You'll noticeTier: how much it should matter to you
1Useful: my rating, 1 to 5
1Signal: worth watching, 1 to 5
SandboxArea: what it touches
ImprovementsKind: in v2.1.299,
ImprovementsSection of the release
What
The sandbox is the restricted space Claude Code runs commands in. Two things changed around it:
The description of the sandbox setting for credential paths now says it supports the same path forms as a string in filesystem.denyRead.
Text written to the error output stream (stderr, where programs print error messages) through the sandbox may now be dropped when output is under pressure.
Why
Error output from the sandbox is no longer guaranteed to arrive in full, so a missing line there does not always mean nothing was printed.
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
Confirmed sinceAnthropic's documentation has since written up denyRead, on Claude Code changelog.* Fixed sandboxed commands failing to start on Linux when a `sandbox.filesystem.denyRead` glob contains brackets that are not a character class, such as a `[user-id]` route folderchangelogsee the edit
How sure we are
Two sources agreeTwo things we can check say the same as this entry.
Anthropic's documentation agreesAnthropic's documentation has since written up denyRead, on Claude Code changelog.
Anthropic's release notes agreeFixed sandbox denyRead and allowRead globs with braces, parentheses or backslashes in a folder's name being read differently by Claude…
