{"name":"injectHosts","slug":"injecthosts","family":"setting","title":"Settings keys","noun":"settings key","description":"You can mask secrets in credential files so sandboxed commands see placeholders while real values are swapped in on egress.","description_source":"entry","described_by":{"version":"2.1.221","anchor":"sandbox-credentials-files-gains-a-mask-mode-with-regex-extra"},"presence":{"first_seen":null,"removed_in":null,"in_current_build":false,"newest_mined":"2.1.309","builds":0,"mined_builds":150,"first_cited":{"version":"2.1.229","released_at":"2026-08-12 19:28:48","spans":1}},"aliases":[],"entries":[{"version":"2.1.281","anchor":"sandbox-credentials-masks-from-an-eval-confined-foreign-set","heading":"Sandbox credentials: masks from an eval-confined foreign settings tier are downgraded","line":"Credential masks from an eval-confined foreign settings tier are now treated as untrusted and can never grant proxy injection","released_at":"2026-09-23 17:01:17","reason":"found in this entry's text"},{"version":"2.1.268","anchor":"sandbox-schema-additions-mitm-proxy-domain-routing-and-env","heading":"Sandbox schema additions: MITM proxy domain routing and env-var credential masking with JWT decode","line":"Sandbox config gains schemas for routing traffic through a MITM proxy and masking credentials in environment variables, including JWT handling","released_at":"2026-09-10 18:41:11","reason":"found in this entry's text"},{"version":"2.1.229","anchor":"ipv6-addresses-in-sandbox-network-rules-must-be-bracketed","heading":"IPv6 addresses in sandbox network rules must be bracketed","line":"Write IPv6 addresses in sandbox rules in bracketed, canonical form or enforcement gets conservative.","released_at":"2026-08-12 19:28:48","reason":"named in this entry, found in this entry's text"},{"version":"2.1.229","anchor":"two-new-sandbox-diagnostics-for-ipv6-misconfiguration","heading":"Two new sandbox diagnostics for IPv6 misconfiguration","line":"`claude doctor` now flags badly written IPv6 entries in your sandbox network rules.","released_at":"2026-08-12 19:28:48","reason":"named in this entry, found in this entry's text"},{"version":"2.1.224","anchor":"sandbox-aws-credential-pairs-get-precedence-rules-and-scope-","heading":"Sandbox AWS credential pairs get precedence rules and scope warnings","line":"Conflicting AWS credential pairs in the sandbox now resolve predictably and warn about risky setups.","released_at":"2026-08-07 01:36:32","reason":"found in this entry's text"},{"version":"2.1.221","anchor":"sandbox-credentials-files-gains-a-mask-mode-with-regex-extra","heading":"sandbox.credentials.files gains a mask mode with regex extraction","line":"You can mask secrets in credential files so sandboxed commands see placeholders while real values are swapped in on egress.","released_at":"2026-08-03 22:16:25","reason":"found in this entry's text"},{"version":"2.1.221","anchor":"claude-doctor-reports-sandbox-credential-mask-problems","heading":"claude doctor reports sandbox credential-mask problems","line":"claude doctor now lists each sandbox credential-masking problem separately with a specific fix.","released_at":"2026-08-03 22:16:25","reason":"found in this entry's text"}],"entries_total":7,"docs":[{"source":"claude-code","path":"claude-apps-gateway","title":"Claude apps gateway for Amazon Bedrock, Claude Platform on AWS, Google Cloud, and Microsoft Foundry","documented":false},{"source":"claude-code","path":"sandboxing","title":"Configure the sandboxed Bash tool","documented":false},{"source":"claude-code","path":"settings","title":"Claude Code settings","documented":false},{"source":"claude-code","path":"settings-reference","title":"All settings","documented":false}],"docs_total":4,"gates":[],"related":[],"url":"https:\/\/changelogs.core-directive.com\/reference\/setting\/injecthosts","family_url":"https:\/\/changelogs.core-directive.com\/reference\/setting.json"}