{"version":"2.1.285","anchor":"sandbox-network-settings-projectlocal-ignored-under-admin","canonical_anchor":"sandbox-network-settings-projectlocal-ignored-under-admin","heading":"Project sandbox.network settings ignored under admin control, including proxy ports","tier":"notice","area":"Sandbox","url":"https:\/\/changelogs.core-directive.com\/v\/2.1.285\/e\/sandbox-network-settings-projectlocal-ignored-under-admin","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.285","markdown":"### Project sandbox.network settings ignored under admin control, including proxy ports\n\nUnder an admin sandbox mandate, sandbox.network entries from project and local settings are ignored, and only managed settings may replace the proxy\n\n**What**\n\nThe sandbox limits which hosts and ports commands run by Claude can reach, using the `sandbox.network` settings. Before, project settings, which can be committed to a repository, could supply these network allowances. Now:\n\n- When an admin sandbox mandate (managed settings require the sandbox) or a trusted network deny list applies, `sandbox.network` allowances from project and local settings are ignored. A log line says \"[sandbox] admin sandbox mandate: ignoring sandbox.network.\"\n\n- Under `allowManagedDomainsOnly`, only managed settings can replace the filtering proxy (the program that checks where sandboxed traffic goes) through `httpProxyPort` and `socksProxyPort`. A project that tries is logged with \"a project may not replace the filtering proxy\".\n\n- `httpProxyPort` and `socksProxyPort` now have descriptions in the settings schema.\n\n**Why**\n\nA repository's settings can no longer send sandboxed traffic through a proxy of its own or widen network access when an administrator controls the sandbox.\n\n- Area: Sandbox\n- Names: `sandbox.network`\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 1\/5"}