{"version":"2.1.315","anchor":"sandbox-adds-plugin-tool-staging-deny-and-parent-scrub-memo","canonical_anchor":"sandbox-adds-plugin-tool-staging-deny-and-parent-scrub-memo","heading":"Sandbox gains a write block on the plugin tool staging folder","tier":"internal","area":"Sandbox","scope":"individual","heads_up":false,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.315\/e\/sandbox-adds-plugin-tool-staging-deny-and-parent-scrub-memo","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.315","markdown":"### Sandbox gains a write block on the plugin tool staging folder\n\nThe sandbox adds a feature-flag-controlled write block on the staged mcp_call folder, plus caching for parent-folder scrubbing\n\n**Unclear.** It is not clear whether sandboxed commands can now no longer write to plugin tool staging folders.\n\n**What**\n\nThe sandbox is a protected area in which Claude Code runs commands, limiting what they can read and write. Its internal state gained several new pieces:\n\n- `pluginToolStagingDenyApplied` and `builtConfigPluginToolStagingDenied` track a write block on the staged `mcp_call` directory. That directory is a folder where plugin tool calls are staged.\n\n- Claude Code watches for settings changes, and that watching now also reacts when a feature flag changes this write block. A feature flag is a switch Anthropic can turn on or off remotely.\n\n- `scrubParentMemo` and `scrubParentLastKnown` appear to cache the results of cleaning up parent folders.\n\n- The permission context now carries `readBlockExemptPaths` next to `blockReadsOutsideWorkingDirectories`. The permission context holds the rules for what Claude Code may do, and the new value is taken from added directories.\n\n**Why**\n\nWhere this write block applies, sandboxed commands may no longer be able to write to the plugin tool staging folder. A feature flag controls it, so it may not apply to every user.\n\n- Area: Sandbox\n- Tier: Under the hood\n- Useful: 2\/5\n- Signal: 3\/5\n- Scope: individual\n- Heads-up: no"}