{"version":"2.1.274","anchor":"sandboxed-dynamic-render-hook-runtime-template-hardens-again","canonical_anchor":"sandboxed-dynamic-render-hook-runtime-template-hardens-again","heading":"Sandboxed dynamic-render-hook runtime template hardens against global tampering","tier":"internal","area":"Elsewhere","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.274\/e\/sandboxed-dynamic-render-hook-runtime-template-hardens-again","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.274","markdown":"### Sandboxed dynamic-render-hook runtime template hardens against global tampering\n\nSandboxed render-hook runtime now locks down global objects before running untrusted code\n\n**What**\n\nWhen Claude Code runs a render hook (custom code that draws part of the interface) in its sandboxed JavaScript runtime, that runtime now captures references to `Object.freeze`, `defineProperty`, `defineProperties`, `keys`, `Array.isArray`, `Map`, `JSON.stringify`, `Error`, and `TypeError` into local constants up front, instead of referencing the global versions directly each time.\n\n**Why**\n\nThis guards against a render hook tampering with these global objects or methods to interfere with how the sandbox itself works, making the sandbox more resilient against misbehaving or malicious render-hook code.\n\n- Area: Elsewhere\n- Tier: Under the hood\n- Useful: 1\/5\n- Signal: 1\/5"}