Unclear Only the description text changed here, so it is not shown whether the SSH enforcement itself works in this version.
What
The description of the setting for read-only folders has been rewritten. It used to say that Bash and SSH do not enforce read-only. It now says that over SSH (a connection to another computer), read-only is enforced by Claude Code's permission rules and, where the sandbox runs, for shell commands too. The sandbox is the walled-off environment Claude Code can run shell commands in.
The description lists cases where this does not apply:
- Windows hosts
- Hosts with their own managed settings, unless
parentSettingsBehavioris set tomerge - MCP servers (outside programs that give Claude Code extra tools)
- Hooks (commands Claude Code runs automatically at set points)
- Commands listed in
sandbox.excludedCommands
The description also notes that earlier hosts ignore the mode.
Why
If you rely on read-only folders over SSH, the listed exceptions are where files can still be changed.
sandbox.excludedCommands
Code in Claude Desktop on 3P modified, high confidence
Shell commands that run unsandboxed can reach hosts outside `coworkEgressAllowedHosts` and change files outside `allowedWorkspaceFolders`. Where the sandbox runs, a command that matches [`sandbox.excludedCommands`](https://code.claude.com/…see the edit
sandbox.excludedCommands
SSH remote sessions in Claude Desktop on 3P modified, high confidence
* **Shell commands that Claude runs**: Claude Code's sandbox keeps them from writing under the path on a host where it runs, which on Linux needs Claude Code's [sandbox dependencies](https://code.claude.com/docs/en/sandboxing). The sandbox…see the edit
Something disagreesSomething we can check disagrees with this entry, or the writer said they could not settle it.
The writer flagged doubt
Only the description text changed here, so it is not shown whether the SSH enforcement itself works in this version.
Anthropic's documentation agrees
sandbox.excludedCommands on Code in Claude Desktop on 3P