Claude Code 2.1.299 fixes issue where sandbox commands writing to --plugin-dir were loaded and executed outside the sandbox

Claude Code 2.1.299 fixes a sandbox privilege escalation issue: shell commands inside the sandbox could previously write to the --plugin-dir directory, and code in that directory could be reloaded and run by Claude Code outside the sandbox. The same version also fixes an issue on macOS where sandboxed commands could read or write denied paths via symlinks using their real paths, and a problem where the sandbox's allowRead and allowWrite wildcard rules were no longer revalidated after their starting directory was replaced by a symlink. Enforcement of permission rules for user-installed mods, managed hooks, and organization MCP tool names was also strengthened, and an issue where MCP servers were connected before some policy checks completed has been fixed.