You'll noticeTier: how much it should matter to you
2Useful: my rating, 1 to 5
1Signal: worth watching, 1 to 5
Bash SafetyArea: what it touches
ImprovementsKind: in v2.1.311,
ImprovementsSection of the release
Unclear It is not clear whether the new checks are switched on by default.
What
Claude Code checks shell commands before running them. The sandbox is a restricted environment that limits which files and folders commands can reach. Both are tighter:
The command analysis now carries zshNullCommandHeld, rubyAttachedPattern and forNameDo. Before, only quotedBackslashKept was passed. Each is read through a safety-flag helper, and their defaults were not resolved.
NULLCMD and READNULLCMD join the list of dangerous environment variables.
The zsh builtin list now takes in a separate set in place of the removed zformat, zparseopts, zstyle, zregexparse, getln and vared entries.
The Ruby attached pattern is passed to the rscript and php checks.
A javaHook entry is added to a fixed-binary table.
On Windows, the sandbox tags paths that may be read as a folder name. It refuses grants whose resolved path leads to the home folder or a Claude config folder, and explains why. Before, it only refused a path that is or contains the home folder.
Symlinks (entries that point to another path) that are relinked late are checked again against the same rules.
On macOS, the sandbox denies .git/**/config.lock in case-insensitive spellings. This is tracked by a new nestedGitConfigLockDenyApplied state and can be turned off remotely through a kill switch.
Why
Shell commands that use these zsh, Ruby or PHP constructs may now ask for permission or be blocked. The sandbox is also harder to escape through symlinks, home-folder grants or tampering with git's config.lock file.
How sure we are
Something disagreesSomething we can check disagrees with this entry, or the writer said they could not settle it.
The writer flagged doubtIt is not clear whether the new checks are switched on by default.
