{"name":"sandbox.ripgrep","slug":"sandbox-ripgrep","family":"setting","title":"Settings keys","noun":"settings key","description":"Use your own ripgrep binary inside the [sandbox](\/docs\/en\/sandboxing)","description_source":"docs","described_by":{"doc":"claude-code\/settings-reference","title":"All settings"},"presence":{"first_seen":null,"removed_in":null,"in_current_build":false,"newest_mined":"2.1.308","builds":0,"mined_builds":149,"first_cited":{"version":"2.1.257","released_at":"2026-09-01 17:15:33","spans":2}},"aliases":[],"entries":[{"version":"2.1.286","anchor":"cloud-sandbox-refusal-reasons-expanded-seccomp-unavailable","heading":"More sandbox settings now block serving device tools remotely","line":"Claude Code now refuses to serve device tools when seccomp is unavailable or more sandbox-weakening settings are on","released_at":"2026-09-30 17:14:38","reason":"found in this entry's text"},{"version":"2.1.257","anchor":"managed-settings-merge-mode-gains-sandbox-config-exceptions","heading":"Managed settings merge mode gains sandbox config exceptions","line":"Two sandbox config keys are now documented as owned whole by the highest-priority source rather than merged.","released_at":"2026-09-01 17:15:33","reason":"found in this entry's text, named in this entry"},{"version":"2.1.257","anchor":"sandboxed-grepawk-argument-allowlisting","heading":"Sandboxed grep\/awk argument allowlisting","line":"New parsers pull file-path operands out of grep and awk arguments so they can be allowlisted for the sandbox.","released_at":"2026-09-01 17:15:33","reason":"found in this entry's text, named in this entry"},{"version":"2.1.257","anchor":"managedsettings-merge-mode-composition-rules-made-explicit","heading":"managedSettings 'merge' mode composition rules made explicit and expanded","line":"Managed settings merge mode now documents which fields the helper replaces wholesale rather than merging.","released_at":"2026-09-01 17:15:33","reason":"found in this entry's text"},{"version":"2.1.232","anchor":"sandbox-ripgrep-is-ignored-when-set-by-project-settings","heading":"sandbox.ripgrep is ignored when set by project settings","line":"A repo's settings can no longer point sandboxed search at an arbitrary ripgrep binary.","released_at":"2026-08-13 21:30:53","reason":"named in this entry, found in this entry's text"},{"version":"2.1.232","anchor":"sandbox-binary-paths-in-project-settings-are-surfaced-at-the","heading":"Sandbox binary paths in project settings are surfaced at the trust prompt","line":"Sandbox binary paths set by a project now show up in the folder trust prompt before you accept.","released_at":"2026-08-13 21:30:53","reason":"named in this entry, found in this entry's text"}],"entries_total":6,"docs":[{"source":"claude-code","path":"settings-reference","title":"All settings","documented":true},{"source":"claude-code","path":"claude-apps-gateway-config","title":"Claude apps gateway configuration","documented":false},{"source":"claude-code","path":"managed-settings","title":"Deploy managed settings","documented":false},{"source":"claude-code","path":"server-managed-settings","title":"Configure server-managed settings","documented":false}],"docs_total":4,"gates":[],"related":[{"name":"sandbox","slug":"sandbox","description":"[Isolate Bash commands](\/docs\/en\/sandboxing) from your filesystem and network on macOS, Linux, and WSL2"},{"name":"sandbox.allowNestedUserNamespaces","slug":"sandbox-allownestedusernamespaces","description":"Let [sandboxed](\/docs\/en\/sandboxing#chromium-or-rootless-podman-fails-inside-the-sandbox-on-linux) commands create user namespaces on Linux and WSL2"},{"name":"sandbox.bwrapPath","slug":"sandbox-bwrappath","description":"Point the [sandbox](\/docs\/en\/sandboxing) at a bubblewrap binary outside `PATH`"},{"name":"sandbox.credentials","slug":"sandbox-credentials","description":"Hide or mask credential files and variables inside the [sandbox](\/docs\/en\/sandboxing#protect-credentials)"},{"name":"sandbox.credentials.awsPairs","slug":"sandbox-credentials-awspairs","description":"Link custom-named AWS key variables into one credential for [re-signing](\/docs\/en\/sandboxing#re-sign-aws-requests)"},{"name":"sandbox.credentials.files","slug":"sandbox-credentials-files","description":"Block or mask reads of a credential file inside the [sandbox](\/docs\/en\/sandboxing#mask-credential-files)"},{"name":"sandbox.enabled","slug":"sandbox-enabled","description":"Turn on [Bash sandboxing](\/docs\/en\/sandboxing#get-started) on macOS, Linux, and WSL2"},{"name":"sandbox.excludedCommands","slug":"sandbox-excludedcommands","description":"Name commands Claude Code can run outside the [sandbox](\/docs\/en\/sandboxing)"},{"name":"sandbox.failIfUnavailable","slug":"sandbox-failifunavailable","description":"Refuse to start when the [sandbox](\/docs\/en\/sandboxing) can't, instead of running unsandboxed"},{"name":"sandbox.filesystem","slug":"sandbox-filesystem","description":"Control which paths [sandboxed](\/docs\/en\/sandboxing#filesystem-isolation) commands can read and write"}],"url":"https:\/\/changelogs.core-directive.com\/reference\/setting\/sandbox-ripgrep","family_url":"https:\/\/changelogs.core-directive.com\/reference\/setting.json"}