You'll noticeTier: how much it should matter to you
1Useful: my rating, 1 to 5
1Signal: worth watching, 1 to 5
SandboxArea: what it touches
ImprovementsKind: in v2.1.284,
ImprovementsSection of the release
What
The sandbox limits which files commands can read or write. Its rules can use glob patterns, which are wildcards such as *. On Linux, Claude Code warns "Glob patterns in sandbox permission rules are not fully supported on Linux". That warning now also checks filesystem.denyRead and filesystem.allowRead. Before, it checked only filesystem.allowWrite and filesystem.denyWrite.
A pattern is flagged when the fixed part before its first wildcard is empty or just /, as in **/.env. The suggested fix says that on Linux, glob patterns in Edit and Read rules will be ignored.
Why
A read rule like **/.env cannot be expanded from a fixed folder on Linux. If you have one, you now get a warning instead of a rule that quietly protects less than you expect.
filesystem.denyReadDeploy managed settingsmodified, high confidence* While `filesystem.denyRead`, `filesystem.denyWrite`, or any entry in either is invalid, Claude Code also withholds both `filesystem.allowRead` and `filesystem.allowWrite` until you fix the deny list.see the edit
filesystem.allowReadDeploy managed settingsmodified, high confidence* While `filesystem.denyRead`, `filesystem.denyWrite`, or any entry in either is invalid, Claude Code also withholds both `filesystem.allowRead` and `filesystem.allowWrite` until you fix the deny list.see the edit
Since it was published
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
Confirmed sinceAnthropic's documentation has since written up filesystem.allowRead, on Configure the sandboxed Bash tool.Claude Code treats `deny` as `error` whenever the read block wouldn't be enforced: when you [disable filesystem isolation](#disable-filesystem-isolation), and when a `filesystem.allowRead` entry re-opens the file's path.sandboxingsee the edit
Confirmed sinceAnthropic's documentation has since written up filesystem.denyRead, on All settings.If a re-opened file holds a secret, such as an `http.extraHeader` token, add its path to [`sandbox.filesystem.denyRead`](#sandbox-filesystem-denyread). A `denyRead` entry that covers a file always takes precedence over this re-open.settings-referencesee the edit
How sure we are
One source agreesOne thing we can check says the same as this entry.
Anthropic's documentation agreesfilesystem.denyRead on Deploy managed settings
