{"version":"2.1.242","anchor":"sandbox-requirements-attached-to-a-remote-call-are-enforced-","canonical_anchor":"sandbox-requirements-attached-to-a-remote-call-are-enforced-","heading":"Sandbox requirements attached to a remote call are enforced before Bash spawns","tier":"notice","area":"Sandbox","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.242\/e\/sandbox-requirements-attached-to-a-remote-call-are-enforced-","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.242","markdown":"### Sandbox requirements attached to a remote call are enforced before Bash spawns\n\nCommands arriving with sandbox constraints are refused unless a fully confining sandbox exists.\n\n**What**\n\nWhen a call arrives with constraints attached, Bash now refuses to run it unless a fully confining sandbox is available, and refuses outright if the constraints carry extra file read\/write deny lists, which cannot yet be enforced locally. Both refusals emit sandbox telemetry and the command never starts.\n\n**Details**\n\n- Only applies when the incoming call actually carries constraints; ordinary local Bash calls are unaffected.\n- The deny-list refusal is unconditional rather than degrading to an unsandboxed run.\n\n**Evidence**\n\n`This call carries file deny lists that cannot be enforced here yet; the command was not run.`\n\n- Area: Sandbox\n- Tier: You'll notice\n- Useful: 3\/5\n- Signal: 4\/5"}