{"version":"2.1.299","anchor":"windows-sandbox-filesystem-grant-checks-rewritten","canonical_anchor":"windows-sandbox-filesystem-grant-checks-rewritten","heading":"Sandbox file access grants are checked more strictly, especially on Windows and through linked folders","tier":"notice","area":"Sandbox","scope":"both","heads_up":true,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.299\/e\/windows-sandbox-filesystem-grant-checks-rewritten","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.299","markdown":"### Sandbox file access grants are checked more strictly, especially on Windows and through linked folders\n\nSandbox read and write grants now follow links folder by folder, drop risky entries on Windows, and handle glob patterns and read denies differently\n\n**What**\n\nThe sandbox is a fenced-off area that limits which files and folders the commands Claude runs can reach. Settings such as `allowRead` and `allowWrite` grant extra access. The checks on those grants have been reworked:\n\n- On Windows, a grant that is, or contains, your home folder or a Claude Code configuration folder is withheld. Device paths are refused. Grants from repository settings are still ignored on Windows.\n\n- Links, also called symlinks, are shortcuts that point to another location. Claude Code now follows them one folder at a time along each path, instead of a single check of the whole path.\n\n- The allow and deny write lists are built by shared code. Linked grants and glob patterns, which are paths with wildcards such as `*`, are now tracked. Before, glob patterns were skipped on Linux and WSL with the message 'Skipping glob pattern on Linux\/WSL'.\n\n- A grant whose path is re-pointed after it was approved can be dropped with the reason 'a directory in its spelling now resolves outside that spelling to one that holds or lies inside a denied read path'. Before, these late checks compared only a single root folder.\n\n- `blockReadsOutsideWorkingDirectories` normally keeps reads inside your working folders, with some paths opened back up. That reopening is now turned off when `allowManagedReadPathsOnly` is set, when the working folder's path contains wildcard characters, or on Windows.\n\n**Why**\n\nThis is a security change to how the sandbox enforces read denies and links. Some `allowRead` and `allowWrite` entries, especially on Windows, will now be dropped with a log message. If a command loses access it had before, check the logs for the reason.\n\n- Area: Sandbox\n- Names: `sandbox.filesystem.allowRead`\n- Tier: You'll notice\n- Useful: 3\/5\n- Signal: 2\/5\n- Scope: both\n- Heads-up: yes"}