Claude Code now sends sandboxed Bash through normal permission checks, and no-prompt runs need an explicit switch
Claude Code's changelog says sandboxed Bash commands now follow the normal permission flow by default instead of running without prompts; keeping prompt-free execution requires setting sandbox.autoAllowBashIfSandboxed. The same batch makes read-only git commands ask first in repositories that are not the project's or trusted, and unpacks plugin MCP bundles under the plugins directory so read-only plugin folders load. These changes concern the permission boundary for an agent running commands and loading plugins locally, not model capability.