Updated: Restricting Claude Code's sandbox configuration

Changes

The [sandbox in Claude Code](/makandra/626587) by default can access files anywhere in your home directory. This is not ideal, since we usually don't want it to read from our `~/Documents` directory.
This card shows how to restrict its configuration.
## A reasonable default
Put this in your `~/.claude/settings.json`:
```json
{
  "sandbox": {
    "enabled": true,
    "autoAllowBashIfSandboxed": true,
    "allowUnsandboxedCommands": false,
+    "excludedCommands": [
+      "git checkout *", "git checkout",
+      "git cherry-pick *",
+      "git merge *", "git merge",
+      "git pull *", "git pull",
+      "git rebase *", "git rebase",
+      "git reset *",
+      "git restore *",
+      "git revert *",
+      "git stash *", "git stash",
+      "git subtree *",
+      "git switch *"
+    ],
    "network": {
      "allowAllUnixSockets": true
    },
    "filesystem": {
      "denyRead": [
        "~/"
      ],
      "allowRead": [
        ".",
        "~/.rbenv",
        "~/.nvm",
        "~/.claude",
        "~/.cache/node/corepack",
        "~/.cache/ms-playwright",
        "~/.config/glab-cli",
        "~/.config/mise",
        "~/projects/another-project"
      ],
      "allowWrite": [
        "~/.cache/mise",
        "~/.local/share/mise",
        "~/.local/share/pnpm"
      ]
    }
  }
}
```
## Explanation
The above configuration does the following.
* Disables running commands without the sandbox, i.e. [strict sandbox mode](/626587-claude-code-sandbox#section-strict-sandbox-mode).
+* Commands listed at `excludedCommands` can run unsandboxed, even in strict mode.
+  * Agents sometimes need to rebase, merge, or similar. We allow relevant git commands for this to work.
+  * Use this setting wisely.
* Allows socket access, for the database to be reachable (as mentioned in the [base sandbox card](/makandra/626587)).
* Prevents reading with the `Read` tool from your home directory's contents. However, this restriction can be loosened with `allowRead` entries, as seen.
* Allows reading with the `Read` tool from
  * Project directory (`.` resolved from where you start `claude`)
  * Configuration and cache of rbenv, nvm, corepack, and Playwright (the latter is relevant if you're using Vitest)
  * Your Claude Code configuration (helpful to ask Claude Code about its own settings)
  * Any other projects that you want to be reachable, like `authentication-vanilla-example` or another project that you forked from.
* Allows writing to PNPM's store cache. Required for Claude Code to run `pnpm install` itself.
## Merged configurations
Your own configuration files in `~/.claude/settings.json` and your project's `.claude/settings.local.json` will always be merged on top of the default configuration. So you can start with this default, but refine it further per project.