Claude Code 2.1.309 closes sandbox and MCP-config gaps and makes ultrareview ask for workspace trust

Released Oct 22, it stops sandboxed Bash from running shell startup files outside the sandbox, blocks sandboxed commands and auto-accepted edits from rewriting the --mcp-config file, and makes bypass-mode rm prompts in Desktop and VS Code deny at once so unattended sessions keep going. claude ultrareview now asks for workspace trust on a terminal and refuses otherwise, so scripts need --trust-workspace.