{"version":"2.1.304","anchor":"sandbox-bubblewrap-warning-and-denyread-handling-changed","canonical_anchor":"sandbox-bubblewrap-warning-and-denyread-handling-changed","heading":"Sandbox blocks reading credential paths and rewords its old bubblewrap warning","tier":"notice","area":"Sandbox","scope":"individual","heads_up":true,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.304\/e\/sandbox-bubblewrap-warning-and-denyread-handling-changed","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.304","markdown":"### Sandbox blocks reading credential paths and rewords its old bubblewrap warning\n\nThe sandbox now also blocks reading paths taken from credentials, and the warning about an old bubblewrap no longer mentions leftover mount points\n\n**Unclear.** It is not clear whether the oldest bubblewrap version that triggers the warning has actually changed.\n\n**What**\n\nThe sandbox is the restricted space Claude Code runs commands in. On Linux it uses a tool called bubblewrap. Three things changed:\n\n- The list of paths the sandbox may not read now also includes paths that come from credentials.\n\n- The warning shown when bubblewrap is too old is now checked against a different version value. Its text no longer says that a mount point (a folder attachment) left behind by an interrupted sandbox stays on your machine.\n\n- A new cleanup step removes a background connection file when the sandbox shuts down.\n\n**Why**\n\nThese changes tighten what commands inside the sandbox can read and change what you are told about an older bubblewrap.\n\n- Area: Sandbox\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 1\/5\n- Scope: individual\n- Heads-up: yes"}