You'll notice
Bash tool now checks allowed_domains sandbox compatibility earlier, during input validation
What
The Bash tool's check that allowed_domains (a setting that restricts network access to specific domains) only applies to commands running in the sandbox now also runs during input validation, before permission checks happen, in addition to the existing check that runs at permission-check time.
Why
This surfaces the same sandbox-compatibility restriction earlier in the command-handling flow, which can catch invalid allowed_domains usage sooner.
Names in the bundleallowed_domains
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
Confirmed since
Anthropic's documentation has since written up allowed_domains, on Claude Code changelog.
* Added per-command `allowed_domains` to Bash, PowerShell and Monitor in auto mode with sandboxing: the hosts a command needs are reviewed with it and opened for it alone; other hosts are refusedchangelog see the edit
One source agreesOne thing we can check says the same as this entry.
Anthropic's documentation agrees
Anthropic's documentation has since written up allowed_domains, on Claude Code changelog.