TAG
#sandbox
Stories connected through a shared idea, actor, technology or theme.
Claude Code 2.1.309 closes multiple sandbox and permission bypassesThe release prevents shell startup files and MCP configuration files from being modified outside intended controls, and fixes permission checks that could be bypassed through symlinks or wrapped directory changes. It also hardens worktree isolation and Windows hook behaviour.→Gemini CLI nightly hardens macOS agent sandbox boundariesThe v0.56.0 nightly 20260822 build isolates Docker and container-runtime sockets and binaries in macOS Seatbelt. The change is a pre-release sandbox fix rather than a stable-channel feature.→Claude Code adds default-model control and cross-session idle notificationsThe release adds ANTHROPIC_DEFAULT_MODEL for new sessions and a one-shot notify_when_idle option for cross-session SendMessage on macOS and Linux. It also tightens macOS sandbox deny rules, improves auto-mode command review, and adds screen-reader support for transcript events in VS Code.→Codex CLI 0.148 adds session forking, MCP hooks and cost visibilityThe release adds Markdown export, session forking with archive and restore, asynchronous hooks that can invoke MCP tools, and estimated thread credit or cost display. It also adds Amazon Bedrock Runtime support and makes sandbox restrictions fail closed for denied or unreadable paths on Linux and Windows.→