What
claude doctor now flags unbracketed or non-canonical IPv6 addresses in allow and deny network domain entries, and credential injectHosts entries that can never match their destination because they are bracketed, carry a zone id, or are not canonically compressed. Each says to rewrite the entry as the bare, canonically-compressed address.
Evidence
Sandbox credential injectHosts entries can never match their destination
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
Names in the bundleclaude doctorinjectHosts
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
Confirmed since
Anthropic's documentation has since written up claude doctor, on CLI reference.
| `claude doctor` | Print read-only installation and settings diagnostics from the terminal without starting a session, including install health, settings-file validation errors, and Remote Control eligibility. For the in-session setup che…cli-reference see the edit
One source agreesOne thing we can check says the same as this entry.
Anthropic's documentation agrees
Anthropic's documentation has since written up claude doctor, on CLI reference.