Under the hoodTier: how much it should matter to you
1Useful: my rating, 1 to 5
1Signal: worth watching, 1 to 5
SandboxArea: what it touches
Internal ChangesKind: in v2.1.317,
Internal ChangesSection of the release
What
The sandbox controls which internet domains commands can reach. When it blocks one, it now records whether a policy caused the block. A block caused by sandbox.network.allowManagedDomainsOnly is marked as a policy block.
Deny rules are also now checked against two names: the host name as first given and the name it resolves to.
Why
Claude Code can now tell policy blocks apart from other blocks. Checking both host names also makes it harder for a request to slip past a deny rule by using a different name.
