[FEATURE] Add sandbox.filesystem.allowRead

[Voxar]

Preflight Checklist

• I have searched existing requests and this feature hasn't been requested yet
• This is a single feature request (not multiple features)

Problem Statement

The sandbox does not have protective enough read defaults so we need to configure that ourselves by setting sandbox.filesystem.denyRead: ["//"]. Now Claude can not read its own configuration dir on startup which means that the sandboxing seems to be working as expected. But we lack any means of giving selective read access to config and project folders.

Proposed Solution

Add sandbox.filesystem.allowRead to add overrides to denyRead

Alternative Solutions

No response

Priority

Critical - Blocking my work

Feature Category

Configuration and settings

Use Case Example

I want to feel confident that Claude does not have unbounded access to my private files. I want to deny all and only allow exactly what it needs.

Additional Context

No response

[Voxar]

Apparently I was wrong about sandbox.filesystem.denyRead. That setting has no effect at all apparently and the error I saw was something else.

[dgmora]

I landed into this issue because my LSP was saying allowRead is not a valid property. However, there's also this other issue that claims that allowRead exists and is in the docs: #35134 https://code.claude.com/docs/en/settings

[github-actions]

Closing for now — inactive for too long. Please open a new issue if this is still relevant.

[github-actions]

This issue has been automatically locked since it was closed and has not had any activity for 7 days. If you're experiencing a similar issue, please file a new issue and reference this one if it's relevant.