{"version":"1.0.125","anchor":"sandbox-command-exemptions","canonical_anchor":"sandbox-command-exemptions","heading":"Sandbox Command Exemptions","tier":null,"area":null,"scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/1.0.125\/e\/sandbox-command-exemptions","release_url":"https:\/\/changelogs.core-directive.com\/v\/1.0.125","markdown":"### Sandbox Command Exemptions\n\n**What:** Configure specific commands to always bypass the sandbox, even when sandbox mode is enabled.\n\n**How to use:** Add an `unsandboxedCommands` array to your sandbox configuration in `.clauderc`:\n\n`{ \"sandbox\": { \"unsandboxedCommands\": [\"git\", \"docker\", \"gcloud\", \"aws\"] } }` **Details:**\n\n- Commands in this list will never run in the sandbox environment\n- Matching uses smart logic: matches both exact command names and commands with arguments (e.g., `\"git\"` matches both `git` and `git push`)\n- Useful for commands that require unrestricted filesystem or socket access\n- Bypasses sandbox restrictions while still enforcing permission checks\n- **Evidence**: `qu2()` at line 383844, schema at line 363385, integration in `Eu2()` at line 383855"}