Originally published at https://aicoding-guide.com. This was a security fix week. Claude Code 2.1.309 carries more than ten fixes for routes around the sandbox and the permission checks. Codex 0.164.0 hardened its own sandbox checks and added credential masking.
Codex also shipped features. /presets stores prompts and slash commands in ten slots, and /model and /permissions now take their settings as arguments.
Key point
This week in brief
- Claude Code 2.1.309 concentrates fixes for sandbox and permission-check bypasses
- Codex 0.164.0 adds
/presetsand masks credentials in remote Bash- Claude Code gained theclaude_code.safety_eventOpenTelemetry event
Eight releases this week, 2.1.303 through 2.1.310.
This release is lopsided: it is largely a list of routes that worked when they should not have.
| Route | What was wrong |
|---|---|
| Shell startup files | On macOS and Linux, every sandboxed Bash command ran the shell's startup files outside the sandbox first |
| Symbolic links | macOS denyWrite glob patterns did not apply at a path's real location when the pattern's folder was reached through a symlink |
| MCP config file | Sandboxed commands and auto-accepted edits could modify the config passed with --mcp-config |
| Redirects | The Bash permission check trusted a variable set by a command whose redirect can fail to open |
| Compound commands | A cd that was wrapped or prefixed before a git command did not prompt, as a plaincd does |
| Deny rules | An Edit(path) deny rule did not block a Bash redirect to that path in some commands holding a subshell |
| Worktree isolation | Locale-prefixed commands, and some zsh arithmetic commands, passed the isolation guard |
On Windows, PowerShell permission checks were auto-approving some Set-Location and cd commands that carry extra arguments. 2.1.310 adds another: with Git Bash missing, PreToolUse and PermissionRequest hooks let a tool call through when the hook's command was only quoted strings.
Upgrade if you depend on deny rules or the sandbox
These are "configured but not actually enforced" fixes. If your setup assumes .env cannot be read or writes are confined, move to 2.1.310 and then review the rules themselves. Claude Code permissions in settings.json covers the syntax.
claude_code.safety_event`` sandbox.allowNestedUserNamespaces``CLAUDE_CODE_RETRY_WATCHDOG_USAGE_LIMIT_RECHECK_MS`` CLAUDE_CODE_AUTO_COMPACT_WINDOW=200k silently set a 100K window. The variable now accepts k and M suffixes and warns when a value is out of rangecleanupPeriodDays made background cleanup delete some recent files, such as pasted imagesclaude --worktree removed the worktree and its branch without asking at exit when HEAD was detached or on another branch, which could lose commits
v0.164.0 is a feature release.
| Addition | What it does |
|---|---|
/presets |
Saves reusable prompts and slash commands in ten numbered slots, recalled from a keyboard menu |
/model and/permissions arguments |
Set model, reasoning effort, speed and permissions inline as arguments |
| Image preview | Shows viewed and generated images in the fullscreen transcript on Kitty or Sixel terminals |
| Enterprise MCP auth | Authenticates through Codex account grants or a dedicated sign-in, including OAuth clients that need secrets |
| Credential masking | Masks credentials in remote Bash commands and zsh snapshot sessions, custom provider credentials included |
| Bedrock setup | The Amazon Bedrock setup wizard is now on by default |
On the security side, sandbox checks were hardened for case-variant metadata paths on macOS and for replaceable symlinks used to find executables — the same direction as Claude Code's symlink fixes this week.
Among the fixes, two stand out: a failed compaction no longer leaves a partial summary in history, and Windows HTTPS and WebSocket connections now handle proxy authentication with the signed-in user's Negotiate or NTLM credentials. For the previous release, see Codex CLI v0.163 turns Daybreak back on by default.
v0.65.0 (October 20) had one feature among 27 entries, the otlpHeaders telemetry setting. The change that matters more in practice is that workspace settings in an untrusted folder are now enforced as read-only. See Gemini CLI v0.65 enforces read-only settings in untrusted folders.
200k for CLAUDE_CODE_AUTO_COMPACT_WINDOW, confirm it is the window you meant/presets, inline /model and /permissions arguments, and credential maskingotlpHeaders