What
The sandbox is the restricted space Claude Code runs commands in, with lists of paths it may not read (denyRead) or write (denyWrite). These lists, both for each command run in the Windows sandbox and for the session as a whole, are now built by a single shared step.
Two things are different:
- Credential paths, the locations of passwords and keys the sandbox protects, are kept in their own list and are no longer added into
denyRead. - When
filesystem.disabledis set, the sandbox grants no file access at all, apart from adding any extra blocked paths passed in.
Why
The way block rules are combined has changed, which can affect exactly which paths end up blocked. If you rely on specific paths being denied, it is worth checking they still are.