What
The custom ripgrep command used for sandboxed searching is now read only from trusted settings sources: managed/policy settings, settings passed with --settings, and your user settings. A repository's .claude/settings.json can no longer point ripgrep at an arbitrary binary.
Details
- Resolution walks those sources directly rather than reading the fully merged config.
- The setting's schema description was updated to state the restriction.
Evidence
Only honored from user, managed/policy, or CLI (--settings) settings
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
Names in the bundlesandbox.ripgrep--settings
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
Confirmed since
Anthropic's documentation has since written up sandbox.ripgrep, on All settings.
| Values taken whole | Takes the value whole from the highest source that sets it, without combining entries or fields from lower sources. When the highest source doesn't set it, takes it whole from the next source down | [`sandbox.credent…settings-reference see the edit
Confirmed since
Anthropic's documentation has since written up --settings, on CLI reference.
| `claude agents` | Open [agent view](/docs/en/agent-view) to monitor and dispatch parallel background sessions. Use `--cwd <path>` to show only sessions started under that directory, or `--json` to print active sessions as a JSON array fo…cli-reference see the edit
Two sources agreeTwo things we can check say the same as this entry.
Anthropic's documentation agrees
Anthropic's documentation has since written up --settings, on CLI reference.
Anthropic's release notes agree
Improved the managed settings approval dialog: shows endpoint URLs, uses clearer wording for telemetry-only changes, skips routine…