Claude Code fixes permission and sandbox boundary errors

Anthropic says Claude Code did not consistently apply deny and ask rules to symlinked directories when a command used the directory's resolved path. On macOS, that distinction affects paths including /etc, /tmp, and /var; on Linux, it includes /bin. Bash commands could also evade a deny rule written with the symlinked spelling of a path.

The release fixes another case involving shell wrappers. A Read or Edit deny rule could fail when an env -C, eval, or similar command that the permission checker could not analyze appeared on the same line.

Anthropic also revised its Bash sandbox documentation. The instructions no longer list paths as confined when filesystem isolation is disabled, and strict mode no longer claims that commands can never run outside the sandbox.

Two credential-handling fixes remove tokens and passwords from plugin, marketplace, and MCP error text. The release also repairs a regression introduced in version 2.1.265 that caused every turn to fail with HTTP 400 on some third-party Anthropic-compatible endpoints configured through ANTHROPIC_BASE_URL.

Why it matters: This is the fourth Claude Code release in five weeks to correct what its permission or sandbox layer enforced, following versions 2.1.221, 2.1.224, and 2.1.251. Teams that rely on deny rules or strict sandbox mode as a containment boundary should audit rules written against symlinked paths and update before assuming those rules hold.