{"version":"2.1.300","anchor":"read-only-folder-setting-text-now-says-ssh-enforcement-exist","canonical_anchor":"read-only-folder-setting-text-now-says-ssh-enforcement-exist","heading":"Read-only folder setting now describes enforcement over SSH","tier":"notice","area":"Sandbox","scope":"both","heads_up":false,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.300\/e\/read-only-folder-setting-text-now-says-ssh-enforcement-exist","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.300","markdown":"### Read-only folder setting now describes enforcement over SSH\n\nThe read-only folders setting's description no longer says SSH ignores it, and now lists where read-only is enforced and where it is not\n\n**Unclear.** Only the description text changed here, so it is not shown whether the SSH enforcement itself works in this version.\n\n**What**\n\nThe description of the setting for read-only folders has been rewritten. It used to say that Bash and SSH do not enforce read-only. It now says that over SSH (a connection to another computer), read-only is enforced by Claude Code's permission rules and, where the sandbox runs, for shell commands too. The sandbox is the walled-off environment Claude Code can run shell commands in.\n\nThe description lists cases where this does not apply:\n\n- Windows hosts\n\n- Hosts with their own managed settings, unless `parentSettingsBehavior` is set to `merge`\n\n- MCP servers (outside programs that give Claude Code extra tools)\n\n- Hooks (commands Claude Code runs automatically at set points)\n\n- Commands listed in `sandbox.excludedCommands`\n\nThe description also notes that earlier hosts ignore the mode.\n\n**Why**\n\nIf you rely on read-only folders over SSH, the listed exceptions are where files can still be changed.\n\n- Area: Sandbox\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 1\/5\n- Scope: both\n- Heads-up: no"}