{"version":"2.1.20","anchor":"enhanced-sandbox-security","canonical_anchor":"enhanced-sandbox-security","heading":"Enhanced Sandbox Security","tier":null,"area":null,"scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.20\/e\/enhanced-sandbox-security","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.20","markdown":"### Enhanced Sandbox Security\n\n**What**\n\nSignificantly improved Unix domain socket security with ownership verification and stale socket cleanup.\n\n**Details**\n\n- Socket directory ownership check: warns if directory owned by different user\n- Stale socket cleanup: removes sockets for non-running PIDs\n- Better seccomp filter path discovery for global `@anthropic-ai\/sandbox-runtime` installations\n- Added `.npm-global` to seccomp binary search paths\n- Improved error messages with actionable installation instructions\n- Warning when seccomp binaries unavailable: \"[Sandbox Linux] Seccomp binaries not available - unix socket blocking disabled. Install @anthropic-ai\/sandbox-runtime globally for full protection.\"\n\n**Evidence**\n\nSocket ownership check at line 523583 (`\"Socket directory not owned by current user\"`), stale socket cleanup messages, seccomp search paths at line 95936 (`\".npm-global\"`), warning at line 96398"}