Claude Code v2.1.221 ·
Sandbox credential masking documents its platform limits
Sandbox credential masking now documents that it falls back to deny on macOS and Windows.
Use it nowTier: how much it should matter to you
4Useful: my rating, 1 to 5
0Signal: worth watching, 1 to 5
SandboxArea: what it touches
ImprovementsKind: in v2.1.221,
What probably matters to youSection of the release
What
The settings schema description for sandbox credential files now explains what mask actually does and where it does not work.
Details
mask shows sandboxed commands a sentinel-substituted copy of the file, either the whole file or only the spans captured by extract.- The proxy swaps the real value back in on egress.
- The description now states outright that the mode degrades to
deny on macOS and Windows.
Evidence
On macOS and Windows mask degrades to deny.
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
See this entry in the whole of v2.1.221 →
