[DOCS] REPL and Workflow sandbox protections are undocumented
Documentation Type
Missing documentation (feature not documented)
Documentation Location
https://code.claude.com/docs/en/tools-reference
Section/Topic
Built-in tools list and sandbox/security coverage for the Workflow tool and REPL execution path
Current Documentation
The tools reference currently says:
Claude Code has access to a set of built-in tools that help it understand and modify your codebase. The tool names are the exact strings you use in permission rules, subagent tool lists, and hook matchers. To add custom tools, connect an MCP server. To extend Claude with reusable prompt-based workflows, write a skill, which runs through the existing Skill tool rather than adding a new tool entry.
The built-in tools table then lists entries such as Agent, AskUserQuestion, Bash, Edit, Monitor, Skill, WebFetch, and Write, but it does not include a Workflow entry.
The sandboxing page currently says:
The sandbox isolates Bash subprocesses. Other tools operate under different boundaries: Built-in file tools: Read, Edit, and Write use the permission system directly rather than running through the sandbox. Computer use: when Claude opens apps and controls your screen, it runs on your actual desktop rather than in an isolated environment.
The security page currently says:
* Sandboxed bash tool: Sandbox bash commands with filesystem and network isolation, reducing permission prompts while maintaining security. Enable with /sandbox to define boundaries where Claude Code can work autonomously
What's Wrong or Missing?
Changelog v2.1.147 says:
Added theWorkflowtool for deterministic multi-agent orchestration. It is off by default — setCLAUDE_CODE_WORKFLOWS=1to enable Hardened REPL and Workflow tool sandboxes against prototype-pollution and thenable-based escapes
The documentation does not explain this security-relevant feature area anywhere outside the changelog.
A. The Workflow tool is missing from the built-in tools reference
Users cannot discover from the docs that the tool exists, that it is off by default, or that CLAUDE_CODE_WORKFLOWS=1 enables it.
B. The docs do not describe the REPL or Workflow sandbox boundaries
The sandboxing and security pages explain the Bash sandbox, but they do not explain that REPL and Workflow execution also have sandboxes, what those sandboxes protect, or how they relate to the existing Bash sandbox and permission system.
That leaves the v2.1.147 hardening note without enough surrounding documentation for users or security reviewers to understand what changed.
Suggested Improvement
Add a Workflow entry to the tools reference and a short sandbox/security subsection that covers:
- How to enable the tool (
CLAUDE_CODE_WORKFLOWS=1) - Whether it is experimental or off by default
- What the REPL and
Workflowsandboxes protect at a high level - How those sandboxes relate to the documented Bash sandbox and normal permission rules
- A brief v2.1.147 note that these sandboxes were hardened against prototype-pollution and thenable-based escape paths, without needing exploit details
Impact
Medium - Makes feature difficult to understand
Additional Context
Affected Pages:
| Page | Line(s) | Context |
|------|---------|---------|
| https://code.claude.com/docs/en/tools-reference | 9-54 | Built-in tools overview and table omit Workflow entirely |
| https://code.claude.com/docs/en/sandboxing | 341-346 | “What sandboxing does not cover” documents Bash/file/computer-use boundaries only |
| https://code.claude.com/docs/en/security | 23-30 | Built-in protections mention only the sandboxed Bash tool |
| https://code.claude.com/docs/en/changelog | 13-18 | v2.1.147 adds Workflow and notes hardened REPL/Workflow sandboxes |
Total scope: 4 pages affected
3 Comments
It was fixed by removing
from the CHANGELOG.md , pls see the commit https://github.com/anthropics/claude-code/commit/c6b849f27118d97ed57d6067eeb269750b2e647e
Issue #61324 Verification
Title: [DOCS] REPL and Workflow sandbox protections are undocumented
Issue Date: 2026-05-21
Verification Date: 2026-05-22
Status: RESOLVED
---
Issue Summary
This issue reports that the v2.1.147 changelog referenced a
Workflowtool and REPL/Workflowsandbox hardening, but the tools, sandboxing, and security docs did not explain that feature area.---
Verification Results
Claim 1: The current docs still present a public
Workflowtool without documenting it in the tools referenceStatus: RESOLVED
At https://code.claude.com/docs/en/tools-reference, line 11: "To extend Claude with reusable prompt-based workflows, write a skill, which runs through the existing
Skilltool rather than adding a new tool entry."At https://code.claude.com/docs/en/tools-reference, lines 13-54, the built-in tools table lists the current public tool inventory and does not include
Workflow.At https://code.claude.com/docs/en/changelog, lines 46-59, the current
2.1.147release notes include pinned background sessions,/code-review, updater fixes, hook matching fixes, and PowerShell output fixes, but noWorkflowtool announcement orCLAUDE_CODE_WORKFLOWSenablement note.Verdict: The current documentation no longer presents the mismatch described in the issue. The tools reference frames workflows as part of the existing
Skilltool model, and the current v2.1.147 changelog entry no longer advertises a separateWorkflowtool.---
Claim 2: The current docs still claim REPL or
Workflowsandbox hardening without explaining those boundaries elsewhereStatus: RESOLVED
At https://code.claude.com/docs/en/sandboxing, lines 370-375: "The sandbox isolates Bash subprocesses. Other tools operate under different boundaries:" followed by bullets for built-in file tools, computer use, environment variables, and subagents.
At https://code.claude.com/docs/en/security, lines 25-30: "* Sandboxed bash tool: Sandbox bash commands with filesystem and network isolation, reducing permission prompts while maintaining security. Enable with
/sandboxto define boundaries where Claude Code can work autonomously" followed by the other current built-in protections.At https://code.claude.com/docs/en/changelog, lines 46-59, the current
2.1.147release notes do not contain the previously reported REPL/Workflowsandbox hardening note.Verdict: The current docs still document Bash sandboxing, but the current changelog no longer claims separate REPL or
Workflowsandbox hardening that would require follow-on documentation. The specific documentation inconsistency reported in the issue is no longer present.---
Current State
| Claim | Status |
|-------|--------|
| The docs still advertise a public
Workflowtool without documenting it in the tools reference | RESOLVED || The docs still claim REPL/
Workflowsandbox hardening without explaining those boundaries elsewhere | RESOLVED |---
Suggested Fix
N/A - issue has been resolved.
---
References
Skilltool and lists the current built-in tool table without aWorkflowentry.2.1.147release notes, which do not announce aWorkflowtool or REPL/Workflowsandbox hardening.---
Conclusion & Recommendation
Primary Concern: The issue reported a documentation gap caused by changelog references to a
Workflowtool and REPL/Workflowsandbox hardening that were not explained elsewhere in the docs.Resolution Status: RESOLVED
Recommendation: CLOSE
The current docs no longer contain the reported changelog references, so the missing follow-on documentation requested by the issue is no longer required to resolve an active documentation inconsistency.
---
This issue has been automatically locked since it was closed and has not had any activity for 7 days. If you're experiencing a similar issue, please file a new issue and reference this one if it's relevant.