Sandbox binary paths now re-prompt for consent when changed

Changing sandbox binary paths now re-prompts for approval, like status line and hook commands already did.

You'll notice New Features

JSON All of v2.1.232

You'll noticeTier: how much it should matter to you

3Useful: my rating, 1 to 5

2Signal: worth watching, 1 to 5

PermissionsArea: what it touches

New FeaturesKind: in v2.1.232, 13 Aug 26

New FeaturesSection of the release

What

The three sandbox binary paths in settings, bwrapPath, ripgrep and socatPath, are now treated as dangerous settings. Changing any of them invalidates your earlier approval and prompts again, the same as statusLine, processWrapper and hook commands already did.

Details

The values are read out of the sandbox settings object and folded into the payload whose hash the consent check compares against, recorded as sandbox.bwrapPath and so on.
Effect: a settings file edited by something other than you cannot silently repoint the sandbox helper binaries.

Evidence

bwrapPath

Strings lifted out of the shipped bundle, so the claim above can be checked against them.

Read from

Names in the bundlebwrapPathsocatPath

How sure we are

One source agreesOne thing we can check says the same as this entry.

Anthropic's release notes agreeImproved the managed settings approval dialog: shows endpoint URLs, uses clearer wording for telemetry-only changes, skips routine…

See this entry in the whole of v2.1.232 →

The build it came inv2.1.232

13 Aug 2026 · 405 entries, this one is #109.

Use it now43
You'll notice209
Nothing to try yet41
Under the hood112

Either side of it

v2.1.231Older
v2.1.233Newer

Open the release →

Names in this entry

settingbwrapPath
Changing sandbox binary paths now re-prompts for approval, like status line and hook commands already did.
settingripgrep
Changing sandbox binary paths now re-prompts for approval, like status line and hook commands already did.
settingsocatPath
Changing sandbox binary paths now re-prompts for approval, like status line and hook commands already did.
settingstatusLine
Run your own command to render a status line below the prompt
settingprocessWrapper
Run Claude Code's background processes through a corporate launcher on macOS and Linux
settingsandbox
Isolate Bash commands from your filesystem and network on macOS, Linux, and WSL2
settingsandbox.bwrapPath
Point the sandbox at a bubblewrap binary outside PATH

Anthropic's note

Upstream's own release notes for v2.1.232 name something this entry names, so the two are probably about the same change. Probably: the pairing is made on a shared name rather than on the words around it.

Improved the managed settings approval dialog: shows endpoint URLs, uses clearer wording for telemetry-only changes, skips routine OpenTelemetry options, and requires approval for server-managed sandbox binary overrides (sandbox.bwrapPath, sandbox.socatPath, sandbox.ripgrep)

Is this right?

Other releases about the same thing. Found by shared names or similar wording; neither means one caused the other.

v2.1.286 Project hooks can run in a bubblewrap sandbox on Linux, behind a server switch
Both mention bwrap