Sandbox rollout: loose first, strict on evidence
ork's sandbox opinion re-homed from an inert plugin settings.json onto CC's native
sandbox block. Documentation only. Pick a stage to see what it protects against and
what it costs. Issue #3322, rollout #3424.
Stage 0: today
No sandbox. One bypassable regex hook in the Bash lane.
Stage 1: LOOSE, start here
Denylist plus credential denies. No network allowlist, so nothing new is refused.
Stage 2: STRICT
Adds the allowlist. Every unlisted host is denied with no prompt.
Paste into ~/.claude/settings.json
Copy
Full text, the per-line rollback table, and the bare-match key probe against CC 2.1.234 live in
src/skills/configure/references/operator-scope-settings.md.
ork:doctor Check 16 detects the absence of this block and points at that file.
Nothing here is applied automatically: enabling the sandbox is the operator's decision, and the
rollback is deleting one key.