A sandbox is only useful if it actually keeps the agent inside the fence. Claude Code 2.1.216 tightens several gaps that could let a background task, subagent, or resumed session wander outside its assigned directory. This release introduces a new configuration switch, but the more important work is under the hood: smarter handling of Git worktrees, symlinks, and agent restarts. If you run Claude Code locally or in CI, these changes deserve more than a quick skim of the changelog.
The Filesystem Toggle You Should Not Touch Lightly
Version 2.1.216 adds sandbox.filesystem.disabled. When this is set, Claude Code skips its own filesystem isolation while still enforcing the network sandbox. At first glance this sounds like a way to stop permission errors or speed up file operations. It is not. You should only enable this setting if another layer is already protecting your disk.
That means a disposable container that gets deleted after every run, or a dedicated virtual machine with no access to your home directory or production volumes. If you run Claude Code directly on macOS, Windows, or a bare Linux host, leave filesystem isolation on. The network sandbox is not a substitute for filesystem controls, and the minor friction of sandboxed file access is far cheaper than recovering from an accidental overwrite or a malicious prompt injection that breaks out of the project folder.
Think of the toggle as a compatibility shim, not a performance knob. It exists for environments where the operating system or orchestrator already handles isolation, and Claude’s own sandbox adds unnecessary complexity.
What the Update Actually Fixes
Beyond the new setting, 2.1.216 closes several practical holes that could let an agent reach places it should not.
Worktree isolation. Subagents can no longer redirect Git commands into a parent or sibling directory outside their own worktree. Previously, a subagent running inside your project could aim Git operations at your shared checkout or adjacent repositories. That matters because many developers keep multiple projects under a common parent folder. Now those boundary-crossing commands fail.
Symlink hardening at the .claude path. Workflow definitions and scheduled tasks used to follow symlinks when writing configuration. An attacker who could create a symlink from .claude to, say, your shell profile or SSH directory could potentially get the agent to write outside the project. The update stops this by refusing to follow symlinks at that path.
Safer rewinds. The /rewind command, which lets you roll back recent changes, now skips symlinked and hard-linked paths. Without this guard, a rewind operation could chase a symlink and overwrite a file far away from your repository. Claude now reports those skipped paths explicitly so you know the boundary held.
Resumed agents keep their restrictions. Background sessions that get stopped and later resumed used to fall back to default tool permissions. If you had intentionally restricted an agent so it could read but not write, a restart could silently restore broader access. Now the original restrictions are persisted and restored with the session.
Picking a Security Profile
Claude Code 2.1.216 organizes these controls into three profiles. Choose based on where you run the tool, not based on what feels fastest.
Default. Filesystem and network sandboxing both stay active. This is the right choice for local development on your laptop or workstation. It protects your home directory, system files, and neighboring projects without requiring you to manage containers.
Compatibility. Filesystem isolation is turned off, but the network sandbox remains. Restrict this profile to disposable containers or VMs where the filesystem is already ephemeral or strictly scoped. Do not use it because you are tired of typing passwords to let the agent access a protected folder.
Managed Hard Gate. Both sandbox layers stay on, and the profile expects additional container policies enforced by your orchestrator or security team. This is built for CI pipelines, remote dev environments, and enterprise setups where defense in depth is mandatory.
If you are unsure which one fits, start with Default. You can downgrade the protection later only after you have verified that your runtime environment genuinely isolates the filesystem by itself.
Upgrading Without Breaking Your Workflow
Usichukulie hili kama marekebisho ya kawaida (patch) unayoweka Ijumaa alasiri. Njia ya kuhuisha (upgrade) katika 2.1.216 ni rahisi, lakini matokeo ya usanidi mbaya si rahisi.
Kwanza, huisha hadi 2.1.216 kupitia meneja wako wa kifurushi (package manager) au msaidizi wa usakinishaji (installer) wa kawaida. Kisha chagua moja kati ya wasifu wa kutenganisha (isolation profiles) watatu kabla ya kuanza kazi zozote za wakala (agent tasks). Usichanganye wasifu katika vikao vinavyoendelea bila kuelewa ni upi una kipaumbele.
Kisha, endesha majaribio matano ya mipaka yasiyoharibu (non-destructive boundary tests) yaliyoelezwa hapa chini. Haya ni ukaguzi wa haraka wa skripti unaothibitisha kuwa sandbox inafanya kazi kama wasifu unavyoahidi. Wakati wa majaribio, tengeneza sentinel hashes kwa ajili ya faili zilizo nje ya ghala lako la majaribio la muda (disposable test repository). Sentinel hash ni muhtasari wa kielektroniki (checksum) wa faili au folda nyeti unayotaka kulinda. Baada ya kuendesha majaribio, linganisha hash hizo. Ikiwa kitu chochote kimebadilika, ulinzi wako wa kutenganisha (isolation) unavuja.
Linganisha pia kumbukumbu (logs) zako. Claude Code huandika kukataliwa na matukio ya sandbox kwenye kumbukumbu zake za ndani. Angalia kukataliwa kwa wazi wakati mwenyeji (host) aliyezuiwa anapofikiwa au wakati wakala msaidizi (subagent) anapotoka nje ya worktree yake. Kufeli kwa kimya ni mbaya zaidi kuliko kufeli kwa kelele, hivyo hakikisha kuwa kumbukumbu zinaonyesha vizuizi (guardrails) vikianza kufanya kazi.
Hatimaye, toa mabadiliko haya hatua kwa hatua. Anza na mradi mmoja au tawi lisilo la uzalishaji (non-production branch). Acha toleo jipya lifanye kazi kwa siku moja au mbili kabla ya kulisambaza kwa timu yako nzima au mfumo wako wa CI.
Majaribio Matano ya Mipaka Yanayothibitisha kuwa Sandbox Yako Inafanya Kazi
Daima endesha majaribio haya ndani ya ghala la muda (disposable repository) lililojaa data bandia. Usiyaelekeze kamwe kwenye kodi ya uzalishaji (production code), sifa halisi (real credentials), au miundombinu hai (live infrastructure).
Network boundary. Jaribu kufikia sehemu mbili za mwisho (endpoints): moja uliyoiruhusu waziwazi na nyingine uliyozuia. Ombi rahisi la HTTP dhidi ya huduma ya majaribio ya umma kama httpbin.org inaweza kutumika kama lengo lililoruhusiwa, wakati ombi kwenda kwenye metadata endpoint ya ndani au IP ya ndani linapaswa kushindwa. Ikiwa ombi lililozuiwa litafanikiwa, sandbox yako ya mtandao imesanidiwa vibaya.
Worktree isolation. Kutoka ndani ya subagent, endesha amri ya Git inayolenga folda mama (parent directory). Kwa mfano, jaribu git -C .. status au uweke wakala aeleze faili zilizo nje ya checkout yake. Kwa marekebisho katika 2.1.216, hili lazima lishindwe. Subagent anapaswa kuona worktree yake pekee.
Symlink trap. Tengeneza symlink ndani ya mradi wako inayoelekeza kwenye folda iliyo nje ya ghala, kama vile /tmp/sentinel-target. Kisha jaribu kuhifadhi kazi au mtiririko wa kazi (workflow) chini ya njia ya .claude ambayo ingeandika kupitia kiungo hicho. Baada ya kuhifadhi, kagua folda ya nje. Ikiwa bado ni tupu, uimarishaji wa symlink unafanya kazi.
Rewind skip. Sanidi folda ndani ya ghala lako inayohusisha symlink kwenda kwenye faili ya mfumo au folda nyingine. Endesha /rewind kwenye folda hiyo. Claude anapaswa kuorodhesha njia za symlinked au hard-linked zilizorukwa badala ya kuzifuata. Thibitisha kuwa lengo lililo nje ya ghala halijaguswa.
Session resurrection. Anzisha wakala wa nyuma (background agent) ukiwa na kizuizi kikali, kama vile kuzima zana za kuandika faili. Simamisha au acha kikao, kisha kiendeleze. Jaribu mara moja kumfanya wakala aandike faili. Ikiwa kizuizi bado kipo hai, marekebisho kwa ajili ya mawakala wanaorejelewa (resumed agents) yanafanya kazi. Ikiwa wakala anapata ufikiaji kamili wa zana ghafla tena, bado uko hatarini.
Neno la Mwisho
Claude Code 2.1.216 inakupa uwezo mkubwa zaidi wa kufanya mambo kuliko matoleo yaliyopita, lakini uwezo huo unakuja na agizo la wazi: thibitisha kabla ya kuamini. Kitu cha kubadilisha mfumo wa faili (filesystem toggle) kipya hakipo ili kurahisisha maisha yako kwa gharama ya usalama. Kipo kwa ajili ya wahandisi ambao tayari wamejenga msingi imara chini ya zana hiyo. Maboresho ya kweli katika toleo hili ni vizuizi (guardrails) vya kimya vinavyozuia subagents kuingia kwenye folda mama, vinavyokataa kufuata symlinks wakati wa kuandika usanidi, na vinavyokumbuka sheria hata baada ya kusimama kwa muda mrefu.
Endesha majaribio hayo matano. Kagua sentinel hashes zako. Soma kumbukumbu (logs). Kisha, na pekee yake, acha toleo jipya lifanye kazi halisi.
Chanzo: Claude Code v2.1.216 Release Notes
Jumuiya ya kujifunzia ya hiari: GyaanSetu kwenye Telegram