{"version":"2.1.319","anchor":"sandbox-refuses-claudes-own-commands-without-disabling-the","canonical_anchor":"sandbox-refuses-claudes-own-commands-without-disabling-the","heading":"Bash tool: the sandbox stays on after a failed start, and shell parsing is tightened","tier":"notice","area":"Sandbox","scope":"individual","heads_up":true,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.319\/e\/sandbox-refuses-claudes-own-commands-without-disabling-the","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.319","markdown":"### Bash tool: the sandbox stays on after a failed start, and shell parsing is tightened\n\nClaude Code's own commands are refused instead of turning the sandbox off when it fails to start, and the shell parser handles more syntax\n\n**What**\n\nThe Bash tool runs shell commands for Claude. A sandbox is a walled-off space that limits what those commands can touch.\n\n- When the sandbox fails to start and a new `keepsSandboxOn` setting is true, Claude Code refuses the command and keeps sandboxing on. It says \"This command of Claude Code's own was not run; the sandbox stays on, and the next command tries to start it again.\" Before, a failed start turned sandboxing off for the rest of the session. The Bash tool passes `keepsSandboxOn` to the sandbox setup, the command wrapping and the command runner.\n\n- When Claude Code recovers from exit code 126 (a \"cannot run\" error), it now records how the command text was delivered, as `no_sha256sum` or `text_unconfirmed`. Extra arguments can be added after `getSpawnArgs` when the shell is started.\n\n- The shell reader now recognises `$'...'` strings as an `ansi_c_string` token and skips `$$`. The permission and safety checks can then read these forms correctly instead of misreading them.\n\n- The parser's feature table gains `closingBraceHeld`, and `keepsTheFiles` flags appear alongside it. A new step when permission rules are added to the state was not traced.\n\n- A new scanner reports reasons such as `control_byte`, `open_heredoc` and `comment`. It is used with the server-controlled switch `tengu_moonlit_crayon`, and nothing has been read about that switch.\n\nThe description Claude is given for the Bash tool is unchanged in the capture taken under this release.\n\n**Why**\n\nIf the sandbox fails to start, later commands no longer run without its protection for the rest of the session. Better reading of quoting forms can change which Bash commands are allowed automatically and which are flagged.\n\n- Area: Sandbox\n- Tier: You'll notice\n- Useful: 3\/5\n- Signal: 3\/5\n- Scope: individual\n- Heads-up: yes"}