{"name":"filesystem.disabled","slug":"filesystem-disabled","family":"setting","title":"Settings keys","noun":"settings key","description":"Settings docs now explain that masked credential files survive a relaxed sandbox filesystem policy while denied ones do not.","description_source":"entry","described_by":{"version":"2.1.221","anchor":"sandbox-filesystem-disabled-description-corrected-on-credent"},"presence":{"first_seen":null,"removed_in":null,"in_current_build":false,"newest_mined":"2.1.309","builds":0,"mined_builds":150,"first_cited":null},"aliases":[],"entries":[{"version":"2.1.304","anchor":"sandbox-filesystem-deny-lists-are-merged-through-one-shared","heading":"Sandbox credential paths are now kept apart from other read restrictions","line":"Sandbox block lists are now built in one shared place, and credential paths stay in their own list instead of joining `denyRead`","released_at":"2026-10-19 19:47:15","reason":"found in this entry's text"},{"version":"2.1.296","anchor":"sandbox-option-settings-merge","heading":"The sandbox option now merges with your settings instead of replacing them","line":"Sandbox options passed in now merge with your sandbox settings, deny lists add up, and failIfUnavailable defaults to true","released_at":"2026-10-09 16:58:10","reason":"found in this entry's text"},{"version":"2.1.221","anchor":"sandbox-filesystem-disabled-description-corrected-on-credent","heading":"Sandbox filesystem.disabled description corrected on credential masks","line":"Settings docs now explain that masked credential files survive a relaxed sandbox filesystem policy while denied ones do not.","released_at":"2026-08-03 22:16:25","reason":"named in this entry, found in this entry's text"}],"entries_total":3,"docs":[{"source":"claude-code","path":"managed-settings","title":"Deploy managed settings","documented":false},{"source":"claude-code","path":"sandboxing","title":"Configure the sandboxed Bash tool","documented":false},{"source":"claude-code","path":"server-managed-settings","title":"Configure server-managed settings","documented":false},{"source":"claude-code","path":"settings","title":"Claude Code settings","documented":false},{"source":"claude-code","path":"settings-reference","title":"All settings","documented":false},{"source":"claude-code","path":"whats-new\/2026-w30","title":"Week 30 \u00b7 July 20\u201324, 2026","documented":false}],"docs_total":6,"gates":[],"related":[{"name":"filesystem.allowRead","slug":"filesystem-allowread","description":"On Linux, the sandbox glob warning now also checks `filesystem.denyRead` and `filesystem.allowRead` patterns that start at the root or have no fixed folder"},{"name":"filesystem.denyRead","slug":"filesystem-denyread","description":"Your sandbox `filesystem.denyWrite` paths are now enforced in the sandbox mode used when a proxy port is configured, where they were ignored"},{"name":"filesystem.denyWrite","slug":"filesystem-denywrite","description":"Your sandbox `filesystem.denyWrite` paths are now enforced in the sandbox mode used when a proxy port is configured, where they were ignored"}],"url":"https:\/\/changelogs.core-directive.com\/reference\/setting\/filesystem-disabled","family_url":"https:\/\/changelogs.core-directive.com\/reference\/setting.json"}