You'll noticeTier: how much it should matter to you
2Useful: my rating, 1 to 5
2Signal: worth watching, 1 to 5
SandboxArea: what it touches
New FeaturesKind: in v2.1.251,
New FeaturesSection of the release
What
Granting a sandboxed session access to a network host now fails if that host, once normalized, spells out as a wildcard pattern. Claude Code logs a warning and declines rather than quietly allowing a much broader match than you asked for.
Details
Runs on every session-level sandbox host grant; no flag turns it off.
Evidence
Refusing a session grant for a host srt would re-spell as
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
