Skills
Claude Code 2.1.221 ships credential masking for sandboxed commands: the agent reads a sentinel, the proxy swaps in the real secret on egress
Released August 4, version 2.1.221 adds `mode: "mask"` for sandbox credential files on Linux and WSL — sandboxed commands read a sentinel copy of the file (either the whole file, or only the spans captured by an `extract` regex) while the sandbox proxy substitutes the real value at egress, so the model never has the live secret in context but the outbound request still authenticates. On macOS, file masking falls back to `deny` rather than silently degrading, which is worth knowing before you assume parity across your machines. This is the practical middle ground between handing an agent your `.env` and blocking it from any authenticated call, and it is configurable today rather than a preview.
↳ Follow the thread