Source Intelligence
Follow Discord

DisclaimerUnofficial, and not affiliated with Anthropic. Nearly all of this is read straight out of what ships: npm bundles, captured prompts, published docs. Anthropic's own notes go in verbatim, marked as theirs. The rest is my reading, and every entry carries the strings behind it. If one looks wrong, vote it down and say why.

← All of v2.1.219 Home All releases ←olderv2.1.218 v2.1.220newer→
Claude Code v2.1.219

New sandbox setting: network.strictAllowlist

Use it now
Useful4 Signal0
Sandbox Notable

Set strictAllowlist to have the sandbox flat-out deny hosts outside your allowed domains instead of prompting.

sandbox.network.strictAllowlistallowedDomains--settings
What

A strictAllowlist boolean on sandbox network settings makes the sandbox runtime deny hosts outside allowedDomains outright instead of prompting. The runtime check existed before but there was no way to turn it on.

Details
  • Added to the sandbox network settings schema and propagated through settings merging (if (o.strictAllowlist === !0) l.strictAllowlist = !0;), derived from any of user, managed or CLI settings
  • The runtime permission check is if (!r || Hl.network.strictAllowlist); a host matching no rule is denied rather than prompted when this is on
  • Honoured only from user, managed/policy or --settings sources; per its own description project settings (.claude/settings.json and .claude/settings.local.json) are ignored
  • Described as "Enforced for sandboxed commands only"; in-process tools such as WebFetch are not gated by it
  • Absent by default, so behaviour is unchanged unless configured
Usage
{"sandbox":{"network":{"allowedDomains":["api.example.com"],"strictAllowlist":true}}}
Evidence

the sandbox runtime deterministically denies hosts not in allowedDomains instead of prompting, When true, the sandbox runtime deterministically denies hosts not in allowedDomains instead of prompting.

Strings lifted out of the shipped bundle, so the claim above can be checked against them.

Related

Other releases about the same thing. Found by shared names or similar wording; neither means one caused the other.

See this entry in the whole of v2.1.219 →