Atomic Write Staging Dir Tamper Detection / Claude Code v2.1.198

Internal write atomicity now includes inode-level identity checks on sandbox staging directories, rejecting writes if the directory was replaced or moved after being established by a sandboxed command.

Details

When a sandboxed command first opens a staging directory (qIs), the directory's dev (device number) and ino (inode number) are recorded in an in-process map alongside a held open file descriptor (using O_RDONLY | O_DIRECTORY | O_NOFOLLOW to prevent symlink traversal)
Before each subsequent atomic write, FDt() re-opens the directory with the same flags, calls fstatSync, and compares the live dev/ino pair against the recorded values; a mismatch (directory removed and recreated, or replaced by a symlink) triggers _Ie(), which throws StagingDirTamperedError and emits a sandbox_exec / atomic_write_staging_dir_tampered telemetry event
A separate path (zIs) checks the parent of the staging dir: if the parent resolves to a symlink (ELOOP) or non-directory (ENOTDIR), a SymlinkWriteRefusedError is thrown with "Refusing to stage atomic write under non-directory parent: <path>"
If the staging dir itself becomes ENOENT/ENOTDIR/ELOOP between establishment and write-time, the write falls back to a sibling path in the same directory rather than silently using a potentially hostile target
StagingDirTamperedError is included in the harness's set of named sentinel error types reported to telemetry

Evidence

Error class (search for "StagingDirTamperedError"); inode comparison (r.dev !== t.dev || r.ino !== t.ino); throw site _Ie() (search for "Refusing to stage atomic write under non-directory parent")

Strings lifted out of the shipped bundle, so the claim above can be checked against them.