Filesystem Sandboxing for macOS

What: Fine-grained filesystem access controls using macOS sandbox-exec, allowing you to restrict which files and directories bash commands can read or write.

How to use: Configure in .claude/settings.json:

{
  "sandbox": {
    "filesystem": {
      "read": {
        "allow": ["~/projects/*", "~/data"],
        "deny": ["/etc/passwd"]
      },
      "write": {
        "allow": ["~/projects/output/*"],
        "deny": ["~/projects/output/protected"]
      }
    }
  }
}

Details:

• Complements existing network sandboxing (v1.0.113 only had network restrictions)
• Read allow-list mode denies all reads except specified paths
• Write deny-list blocks specific paths while allowing essential system paths
• Automatically allows stdout/stderr, temp directories, and Claude config paths
• Supports path expansion (~, ./, ../) and wildcards (/* suffix only)
• Path validation prevents shell metacharacters (&&, ||, ;, backticks, $)
• Evidence: QBB() at line 374281, y41() at line 353864