{"version":"2.1.193","anchor":"repl-context-poisoning-protection","canonical_anchor":"repl-context-poisoning-protection","heading":"REPL Context Poisoning Protection","tier":null,"area":null,"scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.193\/e\/repl-context-poisoning-protection","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.193","markdown":"### REPL Context Poisoning Protection\n\n**What**\n\nWhen REPL sandbox code renders a global non-configurable (making it impossible to restore to a clean state), Claude Code now detects this, resets the VM context automatically, and shows a clear recovery message.\n\n**Details**\n\n- A new `VMContextPoisonedError` class is thrown when this condition is detected.\n- The REPL context is reset and the user sees: \"REPL context poisoned by non-configurable global; context reset\" with a note that \"global state (variables, registered tools) starts fresh.\"\n- Uses a WeakSet to identify boundary cap errors \u2014 the set is identity-based and not inspectable by attacker code, so a Proxy cannot fake a cap error to escape the walker.\n\n**Evidence**\n\nNew error class (search for `\"REPL sandbox code made the global\"` or `\"VMContextPoisonedError\"`)"}