{"version":"1.0.116","anchor":"refactored-sandbox-system","canonical_anchor":"refactored-sandbox-system","heading":"Refactored Sandbox System","tier":null,"area":null,"scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/1.0.116\/e\/refactored-sandbox-system","release_url":"https:\/\/changelogs.core-directive.com\/v\/1.0.116","markdown":"### Refactored Sandbox System\n\n**What:** Complete architectural overhaul of the sandboxing implementation\n\n**Key Changes:**\n\n- Centralized sandbox manager with clean API (`hV` object at line 374998)\n- New configuration model: `allowAllExcept` (blacklist) vs `denyAllExcept` (whitelist)\n- Network deny-lists alongside allow-lists for more granular control\n- macOS sandbox profiles now use deny-by-default security model\n- Recommended defaults for common development tools (npm, cargo, yarn, etc.)\n- Dynamic permission callbacks for interactive network access control\n- **Evidence**: `wBB() at line 374755`, `Zx6() at line 374844`, `DBB() at line 374642`\n\n**Migration Notes:**\n\n- Existing sandbox configurations continue to work\n- New `includeRecommendedDefaults` option automatically allows access to common tools\n- Deny-by-default macOS profiles are more secure but may require configuration updates"}