Claude Code opens network hosts one command at a time

Ask Claude Code to curl one API inside a sandbox and you no longer open the network for the whole session, you open it for that one command. In v2.1.271 the hosts a command needs are reviewed together with the command and opened for it alone, while every other host is refused, according to the release notes on Github.

At a glance

• v2.1.271 adds allowed_domains to Bash, PowerShell and Monitor under auto mode with sandboxing; the hosts a command needs are reviewed with it, and every other host is refused.
• Auto mode changed underneath as well: inline shell commands in skills and slash commands follow default-mode permission rules, and a subagent hands back through a dedicated call the classifier reviews.
• The catch is scope: the per-command host list needs auto mode with sandboxing, and four separate fixes in the same release show the Bash checker had been missing files commands actually read.

If you have not been following: Claude Code asks before it changes files or runs commands, with a handful of safe exceptions like echo and cat. Anthropic's write-up on sandboxing calls the result approval fatigue, where people stop reading what they approve, and says sandboxing cut permission prompts by 84% in internal use. Sandboxing replaces the clicking with two boundaries: which directories Claude may touch, and which servers it may reach.

Bash, PowerShell and Monitor get their own allowed_domains

The new setting is per-command allowed_domains, and it lands in three tools in auto mode with sandboxing: Bash, PowerShell and Monitor. When Claude runs a command, the hosts that command needs are reviewed along with it and opened for that command alone. Everything else stays refused.

Monitor changed in a second way. Its watches always carry a deadline now, at most 30 minutes, and 10 minutes in single-prompt -p runs, and Claude is notified to re-arm the watch. The option that let a watch run with no timeout is replaced by that deadline.

Why does a sandbox need a network boundary at all?

Because file isolation alone leaks. Anthropic's write-up on sandboxing puts it plainly: without network isolation a compromised agent could exfiltrate sensitive files such as SSH keys, and without filesystem isolation it could escape the sandbox and reach the network anyway. The two boundaries work only as a pair.

The runtime behind them, per the same write-up, sits on operating-system primitives, Linux bubblewrap and macOS seatbelt, so directories and hosts are limited without spinning up a container. Per-command allowed_domains narrows the host half of that. Think of a visitor badge that opens one door for one errand, rather than a pass that opens the building all day.

Four Bash permission checks were missing files they should have caught

The permission checker reads a command and works out what it touches. Four fixes sharpen it. It missed the file that fmt, column and similar commands read when that file followed an option the checker did not recognize, and it skipped files a wildcard expands to when the wildcard sat in a pattern or an option value, as in grep -v dir/* file. Shell variable declaration flags could misrepresent the command being run. Commands with two directory changes, a subshell, or a cd plus git chain skipped the prompt under permissions.blockReadsOutsideWorkingDirectories in bypass and auto mode.

Auto mode also moved two decisions. Inline shell commands in a skill or slash command follow default-mode permission rules instead of the classifier, and a command no rule decides runs as a reviewed tool call. A subagent now reports back through a dedicated hand-back call that the safety classifier reviews, instead of its last message being reviewed after the fact.

Fast mode reaches Remote sessions, and a stale org policy stops sticking

Fast mode works in Claude Code Remote sessions on cloud and self-hosted runners, driven by the host's fast-mode setting or by /fast typed in the session, where your organization allows it. Where an organization has fast mode disabled, /fast off turns it off instead of answering "Fast mode unavailable".

Policy handling got three fixes. A cached organization policy was reused after switching accounts, organizations or API keys; tool and command lists did not update when the policy finished loading after startup; and an enterprise managed-mcp.json that cannot be read or parsed keeps exclusive MCP control and warns at startup instead of being ignored.

Smaller pieces: omitClaudeMd in agent frontmatter and in --agents JSON runs custom and plugin subagents without user, project and local CLAUDE.md files, while managed policy files still load; claude plugin install and update accept a sha256 of exactly the command a previous --json run displayed; the /config panel takes the mouse in fullscreen; and a session watches 10 published artifacts at once, up from 5.

Two limits sit in the notes themselves. Per-command allowed_domains applies in auto mode with sandboxing and nowhere else, and the new self-hosted-runner drain-marker-file flag only changes what the runner reports to the server at a SIGTERM drain, telemetry and nothing more. In our view the modelPricing multiplier is the strange addition here: it accepts up to 10 for marked-up internal chargeback rates, which is wide headroom for a number that lands on a team's bill.

Where allowed_domains goes next

The notes stop at auto mode with sandboxing. They do not say whether the same per-command review will reach default mode, or tools beyond Bash, PowerShell and Monitor, and no timeline is given for either. The nearer thing to watch is Monitor: watches expire after 30 minutes, 10 in single-prompt -p runs, and Claude is told to re-arm them, so long jobs are the first place that cap will show.