Source Intelligence

DisclaimerUnofficial, and not affiliated with Anthropic. Nearly all of this is read straight out of what ships: npm bundles, captured prompts, published docs. Anthropic's own notes go in verbatim, marked as theirs. The rest is my reading, and every entry carries the strings behind it. If one looks wrong, vote it down and say why.

All of v2.1.236 Home All releases olderv2.1.235 v2.1.237newer
Claude Code v2.1.236

macOS sandbox re-applies read and delete denials inside writable folders

You'll notice
Useful4 Signal3
Sandbox

On macOS, granting write access to a folder no longer reopens files you denied inside it.

What

The macOS sandbox profile is now assembled from explicit allow, deny and writable-root lists, and adds a further section that reinstates your denials for any path that happens to sit inside a folder Claude Code is allowed to write in. Granting write access to a directory no longer quietly reopens a file you had denied reads on inside it, and denied paths under a writable root can no longer be deleted or unlinked.

Details
  • Rules that deny a path outright, or allow it only inside an otherwise denied area, are converted into both read denials and delete/unlink denials scoped to the writable roots.
  • Glob patterns in those rules are expanded into regular expressions matching the folder itself and everything beneath it.
  • The parent directory of each glob-based denial is added as its own literal entry, so the containing folder is covered as well as its contents.
  • Paths you explicitly allowed get carve-outs in the generated profile and stay writable.
  • The re-application step is marked in the profile itself with the comment ; File read: keep read-denied paths inside write roots in place, and the delete rules use the sandbox operation named file-write-unlink.
Evidence

; File read: keep read-denied paths inside write roots in place, file-write-unlink

Strings lifted out of the shipped bundle, so the claim above can be checked against them.

Related

Other releases about the same thing. Found by shared names or similar wording; neither means one caused the other.

See this entry in the whole of v2.1.236 →