{"name":"sandbox.excludedCommands","slug":"sandbox-excludedcommands","family":"setting","title":"Settings keys","noun":"settings key","description":"Name commands Claude Code can run outside the [sandbox](\/docs\/en\/sandboxing)","description_source":"docs","described_by":{"doc":"claude-code\/settings-reference","title":"All settings"},"presence":{"first_seen":null,"removed_in":null,"in_current_build":false,"newest_mined":"2.1.308","builds":0,"mined_builds":149,"first_cited":{"version":"2.1.277","released_at":"2026-09-18 16:22:26","spans":2}},"aliases":[],"entries":[{"version":"2.1.300","anchor":"read-only-folder-setting-text-now-says-ssh-enforcement-exist","heading":"Read-only folder setting now describes enforcement over SSH","line":"The read-only folders setting's description no longer says SSH ignores it, and now lists where read-only is enforced and where it is not","released_at":"2026-10-14 14:27:26","reason":"found in this entry's text"},{"version":"2.1.282","anchor":"sandbox-project-settings-excludedcommands-are-ignored-whe","heading":"Repositories can no longer exempt commands from a sandbox an admin has locked down","line":"When running commands outside the sandbox is forbidden, `sandbox.excludedCommands` entries in a project's own settings files are ignored","released_at":"2026-09-24 15:56:22","reason":"found in this entry's text, named in this entry"},{"version":"2.1.282","anchor":"sandboxexcludedcommands-setting-now-documented-in-the-schem","heading":"Settings schema now describes sandbox.excludedCommands","line":"The settings schema now explains that sandbox.excludedCommands is a convenience, not a security boundary, and that its patterns merge across sources","released_at":"2026-09-24 15:56:22","reason":"found in this entry's text, named in this entry"},{"version":"2.1.282","anchor":"sandbox-exclude-command-refused-when-unsandboxed-commands","heading":"Excluding a command from the sandbox can now be refused under a strict setup","line":"When commands outside the sandbox are forbidden, excluding a command is saved to user settings or refused, not saved to local settings","released_at":"2026-09-24 15:56:22","reason":"found in this entry's text, named in this entry"},{"version":"2.1.277","anchor":"new-sandbox-escape-detection-heuristics-for-sandboxexclude","heading":"New sandbox-escape detection heuristics for sandbox.excludedCommands","line":"New heuristics detect commands trying to escape the sandbox via the excludedCommands allowlist","released_at":"2026-09-18 16:22:26","reason":"found in this entry's text, named in this entry"},{"version":"2.1.234","anchor":"sandbox-exclusion-list-stops-being-an-escape-hatch-once-unsa","heading":"Sandbox exclusion list stops being an escape hatch once unsandboxed commands are disabled","line":"Your sandbox exclusion list stops working as a bypass once unsandboxed commands are disabled.","released_at":"2026-08-17 18:19:13","reason":"named in this entry, found in this entry's text"},{"version":"2.0.24","anchor":"auto-allow-bash-commands-in-sandbox-mode","heading":"Auto-Allow Bash Commands in Sandbox Mode","line":null,"released_at":"2025-10-20 18:36:49","reason":"found in this entry's text"}],"entries_total":7,"docs":[{"source":"claude-code","path":"settings-reference","title":"All settings","documented":true},{"source":"claude-code","path":"agent-sdk\/python","title":"Agent SDK reference - Python","documented":false},{"source":"claude-code","path":"changelog","title":"Claude Code changelog","documented":false},{"source":"claude-code","path":"sandboxing","title":"Configure the sandboxed Bash tool","documented":false},{"source":"claude-docs","path":"government\/security\/security-and-data-handling","title":"Security and data handling","documented":false},{"source":"claude-docs","path":"third-party\/claude-desktop\/code","title":"Code in Claude Desktop on 3P","documented":false},{"source":"claude-docs","path":"third-party\/claude-desktop\/ssh-remote-sessions","title":"SSH remote sessions in Claude Desktop on 3P","documented":false}],"docs_total":7,"gates":[],"related":[{"name":"sandbox","slug":"sandbox","description":"[Isolate Bash commands](\/docs\/en\/sandboxing) from your filesystem and network on macOS, Linux, and WSL2"},{"name":"sandbox.allowNestedUserNamespaces","slug":"sandbox-allownestedusernamespaces","description":"Let [sandboxed](\/docs\/en\/sandboxing#chromium-or-rootless-podman-fails-inside-the-sandbox-on-linux) commands create user namespaces on Linux and WSL2"},{"name":"sandbox.bwrapPath","slug":"sandbox-bwrappath","description":"Point the [sandbox](\/docs\/en\/sandboxing) at a bubblewrap binary outside `PATH`"},{"name":"sandbox.credentials","slug":"sandbox-credentials","description":"Hide or mask credential files and variables inside the [sandbox](\/docs\/en\/sandboxing#protect-credentials)"},{"name":"sandbox.credentials.awsPairs","slug":"sandbox-credentials-awspairs","description":"Link custom-named AWS key variables into one credential for [re-signing](\/docs\/en\/sandboxing#re-sign-aws-requests)"},{"name":"sandbox.credentials.files","slug":"sandbox-credentials-files","description":"Block or mask reads of a credential file inside the [sandbox](\/docs\/en\/sandboxing#mask-credential-files)"},{"name":"sandbox.enabled","slug":"sandbox-enabled","description":"Turn on [Bash sandboxing](\/docs\/en\/sandboxing#get-started) on macOS, Linux, and WSL2"},{"name":"sandbox.failIfUnavailable","slug":"sandbox-failifunavailable","description":"Refuse to start when the [sandbox](\/docs\/en\/sandboxing) can't, instead of running unsandboxed"},{"name":"sandbox.filesystem","slug":"sandbox-filesystem","description":"Control which paths [sandboxed](\/docs\/en\/sandboxing#filesystem-isolation) commands can read and write"},{"name":"sandbox.filesystem.allowRead","slug":"sandbox-filesystem-allowread","description":"Re-open reading inside a region [`denyRead`](#sandbox-filesystem-denyread) blocks"}],"url":"https:\/\/changelogs.core-directive.com\/reference\/setting\/sandbox-excludedcommands","family_url":"https:\/\/changelogs.core-directive.com\/reference\/setting.json"}