What
On Windows in strict sandbox mode, a refused command used to give one message regardless of cause. There are now two: the existing one for an exclusion that matched only part of the command, and a new one explaining that an exclusion only exempts a command when a permission prompt could approve running it unsandboxed, and no such prompt is available here.
Details
- Both paths still refuse the command with the
windows_policy_refusaloutcome. - Applies only on Windows, with sandboxing enabled in settings, the platform in the enabled list, and strict sandbox mode configured.
Evidence
exclusions only exempt a command where a permission prompt can approve the unsandboxed run, and none is available here
Strings lifted out of the shipped bundle, so the claim above can be checked against them.