You run a simple npm test or an untrusted build script inside a sandbox,
and boom, it silently reads your dot env file and exfiltrates your API keys.
It, it happened to me last month, and honestly it kept me up at night.
But today, brought to you by our sponsor Jellypod AI, Claude Code version two point
one point two hundred twenty one has a proper fix for this called mode mask.
Ah, mate, the classic dot env leak.
So how mode mask works on Linux and WSL is actually really clever.
Instead of giving the sandboxed command your actual secrets file,
Claude Code generates a dummy sentinel copy.
Sandboxed commands read a sentinel copy, either the whole file or just the specific
spans captured by an extract regex you define.
Wait, so if the script only sees dummy sentinel bytes, how do your outbound network
calls actually succeed without throwing auth errors?
Right!
That is the secret proxy magic.
The sandbox network proxy intercepts the outgoing HTTP traffic as it leaves,
detects those sentinel values, and dynamically swaps in the real credentials right
on egress.
The script never touches the real key, but the API endpoint receives the real thing.
Man, that is slick.
But, uh, what happens if you are doing something like offline cryptographic signing
inside the sandbox?
Ah, see, that is the catch!
If your script tries to sign a payload locally using the key file directly,
it reads those dummy sentinel bytes instead of raw private keys,
so the signature fails completely.
And heads up for Mac users, because of macOS sandbox driver limitations,
mode mask falls back to deny mode on Darwin.
Good catch on the crypto edge case!
Beyond masking, this two point one point two hundred twenty one release dropped some
huge quality of life wins.
First up, VS Code Focus View with Control Alt F.
It instantly collapses all those noisy tool outputs and massive stack traces so you
can actually read the conversation history.
Oh, fair dinkum, my editor view was getting ridiculously cluttered!
What else did they pack in there?
They added automatic Git worktrees whenever you spawn sub sessions using slash fork,
so your main branch stays totally untouched while the fork runs.
Plus, the slash status command now clearly breaks down attached foreground tasks
versus unattended background jobs.
That is proper neat.
Go update your CLI, give mode mask a spin, and check out Jellypod AI.
Catch you next time!