Seatbelt

Claude Code's Sandbox Ran Your Shell Config Outside It

On Wednesday 22 October Claude Code 2.1.309 fixed sandboxed Bash commands running the shell's startup files outside the sandbox before each command. On 2.1.308 every sandboxed command started as an unsandboxed /bin/zsh -c that sourced ~/.zshenv with full access in the project directory, so a .env a sandboxed command wrote was executed with full access on the next Bash call; verified on macOS with an instrumented ZDOTDIR, canary file in the home directory on 2.1.308, denied on 2.1.309 and 2.1.310. The same release stopped sandboxed commands editing the file passed with --mcp-config (appendable on 2.1.308, operation not permitted on 2.1.310). Monday's 2.1.305 added sandbox.allowNestedUserNamespaces, which the docs say turns off a security boundary, and Thursday's 2.1.310 fixed Windows PreToolUse and PermissionRequest hooks letting calls through when Git Bash is missing. The per-session shell snapshot still runs your login shell outside the sandbox at a session's first Bash command, with the project as its working directory, so a leftover .env still runs there on 2.1.310.