What
- A new per-command allowlist map is checked after the global
strictAllowlist/config rules fail, letting a specific command's ownallowed_domainsgrant network access ("Allowed by per-command rule"). A companion UI formatter shows these as "Also lets this command reach, beyond the sandbox allowlist: ..." with long host lists truncated at 160 characters. - The network-permission gate now consults this per-command allowlist (looked up by an origin key) after global config rules but before falling back to strict-allowlist denial, and the strict-allowlist short-circuit was reordered to run earlier. User-denial callbacks can now return an object with a custom
reasonstring instead of just true/false. - The strict network allowlist check (
sandbox.network.strictAllowlist) was consolidated into a single helper that replaces an inline chain, and a related combined check now also factors in theCLAUDE_CODE_EVAL_CONFINEDenvironment variable to decide whether allowed domains should be forced empty.
Why This lets individual commands be granted extra network access beyond the sandbox's global allowlist, gives clearer explanations when network access is denied, and tightens how the strict-allowlist and eval-confinement settings interact.
Names in the bundlesandbox.network.strictAllowlistCLAUDE_CODE_EVAL_CONFINED
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
Confirmed since
Anthropic's documentation has since written up sandbox.network.strictAllowlist, on All settings.
| [`sandbox.network.strictAllowlist`](#sandbox-network-strictallowlist) | Deny hosts outside the [allowlist](/docs/en/sandboxing#network-isolation) instead of prompting | Sandbox settings | User or managed |settings-reference see the edit
One source agreesOne thing we can check says the same as this entry.
Anthropic's documentation agrees
Anthropic's documentation has since written up sandbox.network.strictAllowlist, on All settings.