Enhanced Sandbox Security Policy

What: A new configuration option allowUnsandboxedCommands that provides policy-level control over the dangerouslyDisableSandbox parameter.

How to use:

// In your settings
{
  "sandbox": {
    "allowUnsandboxedCommands": false  // Enforce sandbox-only mode
  }
}

Details:

• Default: true (maintains backward compatibility)
• When set to false: All commands run in sandbox mode regardless of the dangerouslyDisableSandbox parameter
• Enforcement: The security check at Q9A() at line 249229 validates both the parameter AND the policy setting
• User communication: Claude receives different system prompt instructions based on this setting (lines 208919-208942)
• Evidence: Configuration schema at line 473000, getter function XP8() at line 208521