{"version":"2.1.317","anchor":"sandbox-status-gains-policy-origins-field","canonical_anchor":"sandbox-status-gains-policy-origins-field","heading":"New sandbox status report for host apps, including where locking policies come from","tier":"notice","area":"Sandbox","scope":"both","heads_up":false,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.317\/e\/sandbox-status-gains-policy-origins-field","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.317","markdown":"### New sandbox status report for host apps, including where locking policies come from\n\nClaude Code can report its sandbox state to a host app, including support, locks, restrictions and which managed-settings sources apply\n\n**What**\n\nThe sandbox is the protective boundary that limits which files and network addresses commands run by Claude Code can reach. Claude Code now has a function that reports the sandbox's status to a host, meaning an app that embeds Claude Code, such as an editor plugin or a program built on the SDK. The report contains:\n\n- `supported` and `unsupported_reason`: whether the sandbox works here, and why not if it does not.\n\n- `locked`: whether the sandbox settings can be changed.\n\n- `policy_origins`: an optional list of the managed-settings sources that apply. Managed settings are settings an organisation pushes to its users. The codes include `remote`, `plist`, `hklm`, `file`, `parent`, `helper`, `remote_unknown` and `unreadable`.\n\n- `mode`.\n\n- `restrictions`, with lists for files (`fs`) and `network`.\n\n- `dependencies`.\n\n**Why**\n\nA host app can show what the sandbox is doing without guessing. With `policy_origins` it can also tell you where the policy that locks your sandbox settings came from, for example a remote policy, a macOS plist or a Windows registry key.\n\n- Area: Sandbox\n- Names: `policy_origins`\n- Tier: You'll notice\n- Useful: 3\/5\n- Signal: 2\/5\n- Scope: both\n- Heads-up: no"}