What
On Windows, writing excluded-command settings and the check for whether a sandbox is required now both test whether strict sandbox mode is configured, meaning managed policy sets forbidUnsandboxedCommands or settings set allowUnsandboxedCommands to false. The old condition also folded in a runtime toggle for disabling unsandboxed commands, which no longer influences these two decisions.
Details
- A helper that combined the old runtime check with platform checks was deleted.
- Non-Windows platforms are unaffected.
Evidence
isStrictSandboxModeConfigured
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
Names in the bundleforbidUnsandboxedCommandsallowUnsandboxedCommands
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
Confirmed since
Anthropic's documentation has since written up allowUnsandboxedCommands, on Configure the sandboxed Bash tool.
claude --settings '{"sandbox": {"enabled": true, "allowUnsandboxedCommands": false}}'sandboxing see the edit
One source agreesOne thing we can check says the same as this entry.
Anthropic's documentation agrees
Anthropic's documentation has since written up allowUnsandboxedCommands, on Configure the sandboxed Bash tool.