More read-only commands allowed for the…

More read-only commands allowed for the sandboxed/permission-checked Bash tool

The sandboxed bash read-only allowlist now covers many more text utilities such as tac, rev, comm and numfmt.

You'll noticeTier: how much it should matter to you

1Useful: my rating, 1 to 5

1Signal: worth watching, 1 to 5

SandboxArea: what it touches

ImprovementsKind: in v2.1.257, 01 Sep 26

ImprovementsSection of the release

The read-only command allowlist for the sandboxed/permission-checked Bash tool now includes gawk, mawk, nawk, tac, man, rev, fold, expand, unexpand, fmt, comm, cmp, pr, numfmt, tsort, and egrep/fgrep, all mapped to "read" permission.

See this entry in the whole of v2.1.257 →

The build it came inv2.1.257

1 Sep 2026 · 505 entries, this one is #258.

Use it now45
You'll notice231
Nothing to try yet71
Under the hood158

Either side of it

v2.1.252Older
v2.1.258Newer

Open the release →

Names in this entry

settinggawk
gawk, mawk and nawk now share awk's argument parsing, so their file references are detected in permission checks.
settingmawk
gawk, mawk and nawk now share awk's argument parsing, so their file references are detected in permission checks.
settingnawk
gawk, mawk and nawk now share awk's argument parsing, so their file references are detected in permission checks.
settingtac
Many more text utilities, from tac and rev to comm and numfmt, are now recognized as file-reading commands.
settingrev
Many more text utilities, from tac and rev to comm and numfmt, are now recognized as file-reading commands.
settingfold
Many more text utilities, from tac and rev to comm and numfmt, are now recognized as file-reading commands.
settingcomm
Many more text utilities, from tac and rev to comm and numfmt, are now recognized as file-reading commands.
settingcmp
Many more text utilities, from tac and rev to comm and numfmt, are now recognized as file-reading commands.

Is this right?