{"version":"2.1.305","anchor":"permission-read-check-records-grantoutsidesandbox","canonical_anchor":"permission-read-check-records-grantoutsidesandbox","heading":"File read checks now note grants that go beyond the sandbox","tier":"internal","area":"Sandbox","scope":"individual","heads_up":false,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.305\/e\/permission-read-check-records-grantoutsidesandbox","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.305","markdown":"### File read checks now note grants that go beyond the sandbox\n\nThe check for reading files now tracks host permission separately and marks a read that is granted but not allowed by the host\n\n**Unclear.** It is not clear whether this changes which file reads are allowed in practice.\n\n**What**\n\nThe sandbox is a restricted area that limits what commands run by Claude Code can touch. When Claude Code decides whether a file may be read, it now works out whether your computer itself allows the read as a separate value. Before, it reused the value saying whether the file was unreadable.\n\nIt also marks a read that was granted but that the host computer does not allow, as a grant outside the sandbox.\n\n**Why**\n\nThis may fix a case where the sandbox's permission and your computer's permission for a file did not match.\n\n- Area: Sandbox\n- Tier: Under the hood\n- Useful: 1\/5\n- Signal: 2\/5\n- Scope: individual\n- Heads-up: no"}