Under the hood
Sandboxed render-hook runtime now locks down global objects before running untrusted code
What
When Claude Code runs a render hook (custom code that draws part of the interface) in its sandboxed JavaScript runtime, that runtime now captures references to Object.freeze, defineProperty, defineProperties, keys, Array.isArray, Map, JSON.stringify, Error, and TypeError into local constants up front, instead of referencing the global versions directly each time.
Why
This guards against a render hook tampering with these global objects or methods to interfere with how the sandbox itself works, making the sandbox more resilient against misbehaving or malicious render-hook code.