Claude Code 2.1.325: sandboxed Bash commands ask for permission by default

What changed

In 2.1.325, sandboxed Bash commands go through the normal permission flow by default. To keep running them without prompts, set sandbox.autoAllowBashIfSandboxed: true; organizations enabling the sandbox through managed settings must set it in their highest-ranking managed source. The release also makes read-only git commands ask first in repositories outside the project or a trusted one, and makes scheduled tasks and /loop ask before running a skill that declares allowed-tools or hooks. The changelog also lists a fix for “a security issue in how zstd-compressed responses are decoded”, without further detail.

Who it affects

Claude Code CLI users and admins who use the Bash sandbox, especially for scheduled or unattended work. Everyone should update for the zstd security fix.

What to do

After updating, set sandbox.autoAllowBashIfSandboxed: true if you want the old no-prompt behaviour. For scheduled tasks that run skills, add Skill(name) to permissions.allow.

Source: https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md#21325