#### Helper failures
The whole hunk
from line 1663, old and new numbered
/
lines
This page is larger than the 256 KiB this site keeps, so one side of the diff below stops where the stored text does.
from line 1663
16631663
16641664### `sandbox.filesystem`
16651665
1666Control which paths sandboxed commands can read and write. By default they can write to the working directory, any directories you add with `--add-dir`, and the session temp directory, and can read the rest of the filesystem, including credential files. Widen or narrow that with the four path lists, or switch the filesystem layer off with `disabled`. See [Filesystem isolation](/docs/en/sandboxing#filesystem-isolation) for the default boundaries.
1666Control which paths sandboxed commands can read and write. By default they can write to the working directory, the session temp directory, and directories you add with `--add-dir`, `/add-dir`, or `permissions.additionalDirectories`, and can read the rest of the filesystem, including credential files. Widen or narrow that with the four path lists, or switch the filesystem layer off with `disabled`. See [Filesystem isolation](/docs/en/sandboxing#filesystem-isolation) for the default boundaries.
16671667
16681668* **Scope**: [`Any file`](#scopes)
16691669* **Type**: object with `allowWrite`, `denyWrite`, `denyRead`, and `allowRead` arrays, plus the `allowManagedReadPathsOnly` and `disabled` Booleans
from line 1709
17091709
17101710### `sandbox.filesystem.allowWrite`
17111711
1712Add paths where sandboxed commands can write, beyond the working directory, the directories you've added with `--add-dir` or `/add-dir`, and the session temp directory. Use it when a subprocess such as `kubectl` or a build tool needs to write outside the project.
1712Add paths where sandboxed commands can write, beyond the working directory, the session temp directory, and the directories you've added with `--add-dir`, `/add-dir`, or `permissions.additionalDirectories`. Use it when a subprocess such as `kubectl` or a build tool needs to write outside the project.
17131713
17141714* **Scope**: [`Any file`](#scopes)
17151715* **Type**: array of path strings, using the [sandbox path prefixes](#sandbox-path-prefixes)
1716* **Default**: unset, so sandboxed commands can write only to the working directory, any directories you've added with `--add-dir` or `/add-dir`, and the session temp directory
1716* **Default**: unset, so sandboxed commands can write to the working directory, the session temp directory, directories you've added with `--add-dir` or `/add-dir`, and directories in [`permissions.additionalDirectories`](#permissions-additionaldirectories)
17171717
17181718This lets a build write under `/tmp/build` and lets `kubectl` update your kubeconfig:
17191719
from line 3423
34233423
34243424* **Scope**: [`Any file`](#scopes)
34253425* **Type**: Boolean
3426 * `true`: voice dictation is on when you're logged in with a claude.ai account and your organization's policy allows voice, unless `voice.enabled` is set
3427 * `false`: voice dictation is off, unless `voice.enabled` is set
3428* **Default**: unset
3429
3430```js
3426 * `true`: voice dictation is on when you're logged in with a claude.ai account an