Under the hoodTier: how much it should matter to you
2Useful: my rating, 1 to 5
2Signal: worth watching, 1 to 5
SandboxArea: what it touches
New FeaturesKind: in v2.1.224,
New FeaturesSection of the release
What
Commands run in the sandbox now pass an identifier through to the sandbox wrapper, where it appears as a command id in the macOS and Linux sandbox configuration, so sandbox activity can be traced back to the command that caused it.
Details
A new sandbox attribution id option is threaded through the bash and PowerShell exec path into both sandbox wrapper entry points.
The macOS sandbox log watcher was reworked to decode its command marker through a caller-supplied resolver, defaulting to identity, instead of a pre-built ignore map.
Evidence
sandboxAttributionId
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
