{"version":"2.1.236","anchor":"macos-sandbox-re-applies-read-and-delete-denials-inside-writ","canonical_anchor":"macos-sandbox-re-applies-read-and-delete-denials-inside-writ","heading":"macOS sandbox re-applies read and delete denials inside writable folders","tier":"notice","area":"Sandbox","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.236\/e\/macos-sandbox-re-applies-read-and-delete-denials-inside-writ","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.236","markdown":"### macOS sandbox re-applies read and delete denials inside writable folders\n\nOn macOS, granting write access to a folder no longer reopens files you denied inside it.\n\n**What**\n\nThe macOS sandbox profile is now assembled from explicit allow, deny and writable-root lists, and adds a further section that reinstates your denials for any path that happens to sit inside a folder Claude Code is allowed to write in. Granting write access to a directory no longer quietly reopens a file you had denied reads on inside it, and denied paths under a writable root can no longer be deleted or unlinked.\n\n**Details**\n\n- Rules that deny a path outright, or allow it only inside an otherwise denied area, are converted into both read denials and delete\/unlink denials scoped to the writable roots.\n- Glob patterns in those rules are expanded into regular expressions matching the folder itself and everything beneath it.\n- The parent directory of each glob-based denial is added as its own literal entry, so the containing folder is covered as well as its contents.\n- Paths you explicitly allowed get carve-outs in the generated profile and stay writable.\n- The re-application step is marked in the profile itself with the comment `; File read: keep read-denied paths inside write roots in place`, and the delete rules use the sandbox operation named `file-write-unlink`.\n\n**Evidence**\n\n`; File read: keep read-denied paths inside write roots in place`, `file-write-unlink`\n\n- Area: Sandbox\n- Tier: You'll notice\n- Useful: 4\/5\n- Signal: 3\/5"}