{"version":"2.1.309","anchor":"sandbox-deny-path-twins-handle-glob-suffixes","canonical_anchor":"sandbox-deny-path-twins-handle-glob-suffixes","heading":"macOS sandbox deny rules with wildcards can follow the real path","tier":"notice","area":"Sandbox","scope":"individual","heads_up":false,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.309\/e\/sandbox-deny-path-twins-handle-glob-suffixes","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.309","markdown":"### macOS sandbox deny rules with wildcards can follow the real path\n\nOn macOS, sandbox deny rules that use wildcards can now also be applied to the real path behind a symlink\n\n**Unclear.** It is not clear when the option that turns this on is set, so it may not apply to every wildcard deny rule.\n\n**What**\n\nThe sandbox is the walled-off area that limits which files Claude Code's commands can reach. A deny rule blocks a path. On macOS, a path can be a symlink (a shortcut) to a real path somewhere else, and Claude Code adds a matching rule for that real path.\n\nThis used to skip any rule containing a wildcard such as `*`, `?` or `[`. Now, when a new option is set and the rule is one you wrote, Claude Code resolves the part of the path before the wildcard and adds the wildcard back on the end.\n\n**Why**\n\nWildcard deny rules can now be enforced on both the shortcut and the real path, closing a way around them.\n\n- Area: Sandbox\n- Tier: You'll notice\n- Useful: 1\/5\n- Signal: 1\/5\n- Scope: individual\n- Heads-up: no"}