What
The settings schema (the description of valid settings that editors use for hints and checking) now explains sandbox.excludedCommands. Before, the entry had no description. It now says:
- the entries are command patterns, written like Bash permission rules, that always run outside the sandbox
- it is a convenience, not a security boundary, and excluded commands still go through the permission flow
- patterns from different settings sources are merged together
Why
Editors that read the schema now show this explanation, making clear that excluding a command from the sandbox does not skip permission prompts.
Names in the bundlesandbox.excludedCommands
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
Confirmed since
Anthropic's documentation has since written up sandbox.excludedCommands, on Agent SDK reference - Python.
| `excludedCommands` | `list[str]` | `[]` | Commands that bypass sandbox restrictions, such as `["docker *"]`. These run unsandboxed automatically without model involvement; [`sandbox.excludedCommands`](/docs/en/settings-reference#sandbox-…agent-sdk/python see the edit
Two sources agreeTwo things we can check say the same as this entry.
Anthropic's documentation agrees
Anthropic's documentation has since written up sandbox.excludedCommands, on Agent SDK reference - Python.
Anthropic's release notes agree
Changed sandbox.excludedCommands to ignore project and local settings entries when managed settings or --settings set…