繁體中文
公司的工具若必須讀取電腦檔案，卻不能任意往外連網，現在有一道中間門。
打開設定檔——管你所有專案的 ~/.claude/settings.json，或只管這個專案的 .claude/settings.json。
檔案是空的，整段貼上這個開關就好：
{"sandbox": {"filesystem": {"disabled": true}}}
檔案裡已經有設定，例如本來長這樣：
{
"model": "sonnet"
}
就把它變成這樣：
{
"model": "sonnet",
"sandbox": {"filesystem": {"disabled": true}}
}
你其實只動了兩下：
1. 在原本最後一行（"model": "sonnet"）的結尾補一個逗號 ,
2. 把 sandbox 那一行貼在它下面
那個逗號的意思是「還有下一個」，跟寫名單「小明、小華」中間點頓號一樣。
這樣會關掉檔案系統隔離（限制程式可看檔案範圍的防護），但保留網路出口管制。它像辦公室替指定同事打開檔案室，所有外出門仍由警衛把守；不是拆掉整套 sandbox（限制程式活動範圍的保護環境）。
同一段對話談很久，Claude Code 以前會越聊越慢：每多一輪，整理訊息的成本增加得更快，續接時甚至會停好幾秒。這次修掉這種二次方累積，也讓 /context 在對話超過內容視窗（context window，AI 一次能記住的對話容量）時直接警告；/compact 壓縮失敗也會明確顯示錯誤。像桌上文件越堆越高，舊作法每加一張就得從頭翻更多遍；現在能更順地整理，抽屜塞滿時也會亮紅燈，而非假裝沒事。
你剛回答「先等等」或「先解釋」，Claude 不會再把它聽成「繼續做」；AskUserQuestion 的自由填答改為中性提示。自動模式的 OAuth token（授權令牌，證明登入身分的暫時通行證）在工作中過期或輪替，也不會被錯誤分類成 HTTP 401 而拒絕指令。網頁版閒置幾分鐘後不再重問同題、遺失回答；雲端工作階段的容器中途重啟，也會在續接時重跑被打斷的那輪，而非無回應。像客服把你的留言貼上工單，現在不會讀錯、弄丟或叫你再講一次。
改檔後用 @ 提及檔案、在 Vim 連按 c 指令或貼上文字，現在不會悄悄附上一片空白。工作階段恢復時，狀態列（statusline，終端機最底下顯示狀態的一行）不會跑兩次，選擇器失敗也不會卡住；背景工作很久時，閒置提示按兩下 Esc 仍能打開 /rewind 回溯選單。開啟 /memory、/plan、/keybindings 或 Ctrl+G 的圖形編輯器，也不再把滑鼠與焦點控制碼灑進終端機，/memory 不必等編輯器關掉才繼續。像修好的文書桌：夾子不再夾空白紙，抽屜不卡死，旁邊開著筆記本也不會把墨水潑滿桌面。
讓 Claude 在背景跑任務或分出工作樹（worktree，Git 讓同一專案平行開多份副本的功能）時，隔離終於守得住。恢復的背景代理會取回原本的提示詞與工具限制，不會變回預設代理；剛啟動時收到高優先訊息也不會被取消。隔離工作樹的子代理不能再靠 git -C、--git-dir 或環境變數偷偷把 Git 指去共用檢出；工作目錄選錯專案時，也不會掉進別案遺留的工作樹。沒有 Git 倉庫的背景工作樹可刪除，Ctrl+X 連按兩次能刪工作階段，死掉的背景工作者不會讓已刪項目復活。像劇組每人進自己的攝影棚：帶回自己的劇本與道具，也不能把鏡頭接到隔壁棚。
專案裡看似普通的 .claude 捷徑檔，現在不能把 workflow 或排程工作寫到專案外；/rewind 也不會透過符號連結或硬連結去還原、刪除被追蹤檔案，且會告訴你跳過幾個路徑。Windows 讀取網路路徑的唯讀指令會先問權限。Bash 對非 ASCII 字元的分詞改得更接近真正 shell，PowerShell 也會驗證藏有看不見 Unicode 字元的指令；複合 Bash 指令在 && 或否定式裡夾重新導向，權限檢查不再漏掉。這像保全不只看門牌，還會檢查走廊裡的暗門與偽裝字條；通往外面的門，全都先問你。
背景工作階段沒有客戶端連著時，執行 /mcp 或 /install-github-app 不再無聲失敗，而會在代理畫面停一張「需要輸入」通知。MCP（Model Context Protocol，讓 AI 連接外部工具的協定）重新登入時，也不會在新登入成功前先撤銷舊憑證；背景工作階段的重新連線提示會指向能用的指令。Claude-in-Chrome 若 OAuth token 少了必要範圍，重連不再陷入 403 迴圈。最後，claude daemon stop --any 不會因陳舊鎖定檔誤殺無關行程。像接線員先保留舊門禁卡，直到新卡真的能刷，再把需要你回覆的便條貼在看得到的地方；也不會拿過期地址去關掉隔壁公司的機器。
全螢幕對話框不再撐出右側面板，/config 的鍵盤提示與窄於 104 欄終端機的 Ctrl+O 頁尾也不再被截斷。工作階段中改過的 skills 與 commands 不用重開就會出現在斜線選單，外掛 skill 有 name 欄位也會保留外掛前綴。Prometheus metrics（監測系統讀取的數值格式）不再輸出無效的 # UNIT 行；VSCode 的阿拉伯文、希伯來文、波斯文混英文字或程式碼也能用正確順序顯示。/fork 的確認縮成一行並列新名稱、claude attach id 與是否共用檢出；ultrareview 與空 diff 會說明限制、大小、最大檔案或正確 base ref，花費上限被拒也會顯示伺服器理由。像機場的看板不再切掉班機資訊，還會直接告訴你哪個閘門、哪件行李出了問題。
使用者拒絕權限、取消工作，現在在 telemetry（遙測，回傳產品使用狀態的紀錄）裡會被正確分開：跳出權限詢問卻失敗的請求，不再算成你拒絕；你主動中斷則標為使用者中止。PowerShell 裡 git、gh 的參數驗證也更嚴謹。隨附的 dataviz skill（資料視覺化指引）則調整預設圖表色盤順序，並修正四條資料線也建議直接標籤的說法。這像客服報表終於把「櫃台故障」「客人離開」和「客人拒絕」分成不同欄，不會把錯怪到你頭上；儀表板也換了更好辨認的顏色安排。
English
If a company tool must read files on the computer but cannot freely connect to the internet, there is now a middle gate.
Open the settings file—use ~/.claude/settings.json to manage all your projects, or .claude/settings.json to manage only this project.
If the file is empty, paste in this entire switch:
{"sandbox": {"filesystem": {"disabled": true}}}
If the file already has settings, for example:
{
"model": "sonnet"
}
change it to this:
{
"model": "sonnet",
"sandbox": {"filesystem": {"disabled": true}}
}
You only make two changes:
1. Add a comma , to the end of the original last line ("model": "sonnet")
2. Paste the sandbox line below it
The comma means “another item follows,” like the comma between Alice and Bob in a list.
This turns off filesystem isolation (the safeguard that limits which files a program can see) while keeping network egress controls. It is like an office opening the file room for designated colleagues while guards still watch every exit; it does not tear down the entire sandbox (the protected environment that limits a program's range of activity).
A long-running chat used to get slower the longer it went: each new turn made message cleanup grow disproportionately, producing multi-second stalls and slow resumes. That quadratic buildup is fixed. /context now explicitly warns when the conversation exceeds its context window (how much of a conversation the AI can hold at once), and a failed /compact clearly appears as an error. It is like a desk where every added sheet once meant rereading a larger pile from the start; now sorting stays smoother, and an overfilled drawer shows a warning instead of pretending nothing is wrong.
If you answer “wait” or “explain first,” Claude will no longer hear it as “continue”: free-text AskUserQuestion replies now use neutral wording. When an OAuth token (a temporary pass proving your sign-in) expires or rotates mid-session, auto mode will not misclassify it as HTTP 401 and deny commands. The web app also stops asking the same question again after a few idle minutes and losing your answer. If a cloud session’s container restarts mid-turn, that interrupted turn reruns on resume rather than leaving the session unresponsive. Like a support desk, it now reads, keeps, and acts on your message without making you repeat it.
After modifying files, @-mentions, Vim’s repeated c operations, and pasted text no longer silently attach nothing. On resume, the statusline (the line of status at the bottom of your terminal) does not run twice, and a failed resume picker no longer hangs. In long-running work with background tasks, pressing Esc twice at an idle prompt still opens /rewind. Opening a GUI editor from /memory, /plan, /keybindings, or Ctrl+G no longer sprays mouse and focus control junk into the terminal, and /memory no longer waits for that editor to close. Think of a repaired desk: clips hold paper, drawers do not jam, and an open notebook beside it does not spill ink everywhere.
When Claude runs jobs in the background or splits work into a worktree (Git’s way to make parallel copies of one project), the isolation now holds. A resumed background agent gets back its original prompt and tool restrictions rather than reverting to the default agent, and a high-priority message during its startup window no longer cancels it. An isolated subagent cannot redirect Git into the shared checkout through git -C, --git-dir, or environment variables; a mismatched working directory also will not land in another project’s leftover worktree. Non-Git background worktrees can be deleted, Ctrl+X twice deletes a session, and a dead worker cannot resurrect it. Like a film set, each crew keeps its own stage, script, and equipment.
A seemingly ordinary .claude shortcut inside a project can no longer redirect workflow saves or scheduled-task writes outside that project. /rewind also will not restore or delete tracked files through symbolic or hard links, and reports how many paths it skipped. On Windows, read-only commands that access network paths now ask permission. Bash now splits non-ASCII text closer to real shell word boundaries; PowerShell validates commands with invisible Unicode characters; and permission checks no longer miss redirects inside && lists or negations. It is like security checking not only the door label but hidden passages and disguised notes in the hallway — every route outside gets your approval first.
If no client is attached to a background session, /mcp and /install-github-app no longer fail silently; they park a “needs input” request in the agent view. During MCP reauthentication (Model Context Protocol, the protocol that lets AI connect to external tools), working credentials are not revoked until the new sign-in succeeds, and its background reconnect message points to a usable command. Claude-in-Chrome no longer loops on 403 reconnects when an OAuth token lacks a required scope. Finally, claude daemon stop --any will not kill an unrelated process because of a stale legacy lockfile. Like a receptionist, it keeps the old access card until the new one works and leaves your note where you can see it.
Fullscreen dialogs no longer spill past the right panel, and /config keyboard hints plus the Ctrl+O footer on terminals narrower than 104 columns no longer get clipped. Skills and commands changed during a session appear in the slash menu without restart, and plugin skills keep their prefix even with a name field. Prometheus metrics (the numeric format used by monitoring systems) no longer emit invalid # UNIT lines; VSCode renders mixed Arabic, Hebrew, or Persian with English or code in the right order. /fork, ultrareview, empty diffs, and rejected spend-limit changes now give the name, limits, sizes, relevant files, base ref, or server reason you need. Like an airport board, it no longer cuts off the useful part of the message.
Telemetry (records sent back about product use) now separates permission events correctly: a request whose permission prompt failed no longer counts as your rejection, while an interruption you make is reported as a user abort. Validation of git and gh arguments in PowerShell is also stronger. The bundled dataviz skill (guidance for data visualization) reorders its default chart palette and corrects advice that suggested direct labels for four series. Like a support report, it now keeps “counter failed,” “customer left,” and “customer refused” in separate columns instead of blaming you for every one.
原始 CHANGELOG
Original changelog保留網路管制，關掉檔案隔離
Added `sandbox.filesystem.disabled` setting to skip filesystem isolation while keeping network egress control
Original changelog長對話與內容視窗，終於會明說卡在哪
Fixed a slowdown in long sessions where message normalization cost grew quadratically with the number of turns, causing multi-second stalls and slow resumes
`/context` now shows an explicit warning when the conversation exceeds the context window, and a failed `/compact` displays as an error
Original changelog登入失效、提問與網頁續接，不再吞掉你的答案
Fixed auto mode denying commands with "HTTP 401" classifier errors after the OAuth token expired or rotated mid-session
Fixed AskUserQuestion telling Claude to continue even when your answer asked it to wait or explain first — free-text answers now get neutral wording
Fixed Claude Code on the web re-asking the same question and dropping your answer after the session sat idle for a few minutes
Fixed cloud sessions dropping the in-flight message when the session's container restarts mid-turn — the interrupted turn now re-runs on resume instead of leaving the session unresponsive
Original changelog編輯、恢復與終端機操作少了連環小故障
Fixed @-mentions silently attaching nothing after file-modifying hooks, vim dot-repeat of `c`-operators and paste, statusline running twice on resume, and resume-picker hangs on failure
Fixed Esc-Esc at an idle prompt not opening the rewind picker in long-running sessions with background tasks
Fixed mouse and focus garbage in the terminal while a GUI editor from `/memory`, `/plan`, `/keybindings`, or Ctrl+G is open; `/memory` no longer waits for the editor to close
Original changelog背景代理與工作樹不再走錯棚
Fixed resumed background agent sessions reverting to the default agent: the agent's prompt and tool restrictions are now restored
Fixed worktree-isolated subagents redirecting git into the shared checkout via `git -C`, `--git-dir`, or `GIT_DIR`/`GIT_WORK_TREE`
Fixed worktree sessions landing in another project's leftover worktree when the working directory did not match the selected project
Fixed background sessions whose worktree has no git repository being undeletable
Fixed pressing Ctrl+X twice in the agent list failing to delete a session, and deleted sessions reappearing when their background worker had died
Fixed background subagents getting cancelled when a high-priority message arrives during their startup window
Original changelog連結、權限與指令解析，安全邊界補得更緊
Fixed Bash command permission checking for compound statements with redirects inside `&&` lists or negations
Fixed workflow saves and scheduled-task writes following a symlink at `.claude`, which could redirect writes outside the project
Fixed read-only commands on Windows accessing network paths without a permission prompt
Fixed Bash command parsing of non-ASCII characters to match real shell word boundaries
Fixed PowerShell tool permission validation of commands containing invisible Unicode characters
`/rewind` no longer restores or deletes files through symlinks or hard links at tracked paths and reports how many paths it skipped
Original changelog帳號、MCP 與背景需求，重新接得回來
Fixed `claude daemon stop --any` potentially terminating an unrelated process via a stale legacy daemon lockfile
Fixed Claude-in-Chrome 403-looping on reconnect when the session's OAuth token lacks a required scope
Fixed MCP re-authenticate revoking working credentials before the new sign-in succeeds, and the reconnect needs-auth message in background sessions pointing at an unusable command
Background sessions: `/mcp` and `/install-github-app` now park a "needs input" request in the agent view when no client is attached
Original changelog畫面、選單與診斷訊息，更不會讓人猜
Fixed dialogs in fullscreen mode stretching past the right-hand edge of their panel
Fixed the `/config` settings list in fullscreen mode clipping its keyboard-hint footer
Fixed the transcript-mode (Ctrl+O) footer hint wrapping on terminals narrower than 104 columns
Fixed the Prometheus metrics endpoint (`OTEL_METRICS_EXPORTER=prometheus`) emitting invalid `# UNIT` lines
Fixed skills and commands changed during a session not appearing in the slash menu until restart
Fixed plugin skills with a `name` frontmatter field losing their plugin prefix in slash-command autocomplete
Improved the `/fork` confirmation to one line with the new session's name, `claude attach` id, and a note when the copy shares your checkout
Improved the `/ultrareview` diff-too-large error to show configured limits, measured diff size, and largest contributing files
Improved `/code-review ultra` empty-diff message to name the exact base ref and suggest passing an explicit base
Improved the spend limit adjustment prompt to show the server's reason when a spend limit change is rejected
[VSCode] Fixed right-to-left text (Arabic, Hebrew, Persian) rendering in the wrong order when mixed with English or code
Original changelog權限紀錄與圖表建議，少了誤判
Fixed telemetry misreporting permission denials: failed permission-prompt requests no longer count as user rejections, and user interrupts are now reported as user aborts instead of rejections
Improved validation of `git` and `gh` command arguments in the PowerShell tool
Updated the bundled dataviz skill: reordered the default chart palette and fixed guidance that suggested direct labels for four-series charts