{"version":"2.1.259","anchor":"new-per-command-sandbox-filesystem-deny-lists","canonical_anchor":"new-per-command-sandbox-filesystem-deny-lists","heading":"New per-command sandbox filesystem deny lists","tier":"use","area":"Sandbox","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.259\/e\/new-per-command-sandbox-filesystem-deny-lists","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.259","markdown":"### New per-command sandbox filesystem deny lists\n\nShell execution accepts per-command sandboxDenyRead and sandboxDenyWrite path lists on top of the global sandbox config.\n\nShell execution now accepts explicit `sandboxDenyRead` and `sandboxDenyWrite` path lists that get merged into the sandbox's filesystem config for a single command, in addition to the existing global sandbox config.\n\n- Area: Sandbox\n- Names: `sandboxDenyRead`, `sandboxDenyWrite`\n- Tier: Use it now\n- Useful: 5\/5\n- Signal: 3\/5"}