You'll noticeTier: how much it should matter to you
2Useful: my rating, 1 to 5
2Signal: worth watching, 1 to 5
SandboxArea: what it touches
ImprovementsKind: in v2.1.323,
ImprovementsSection of the release
Unclear It is not clear what the new condition is or when it applies.
What
The sandbox is a fenced-off space where commands run with limited access, and excludedCommands lists commands allowed to run outside it. Claude Code already ignored excludedCommands from untrusted settings files under one condition. It now does so under an extra condition too. When that condition holds:
excludedCommands is taken only from trusted settings levels.
Saved deny lists are treated as possibly incomplete.
The check for running a command outside the sandbox fails.
Why
This can make the sandbox stricter. If commands you listed in excludedCommands start running inside the sandbox, this may be the reason.
