You'll noticeTier: how much it should matter to you
3Useful: my rating, 1 to 5
4Signal: worth watching, 1 to 5
SandboxArea: what it touches
New FeaturesKind: in v2.1.242,
What probably matters to youSection of the release
What
When a call arrives with constraints attached, Bash now refuses to run it unless a fully confining sandbox is available, and refuses outright if the constraints carry extra file read/write deny lists, which cannot yet be enforced locally. Both refusals emit sandbox telemetry and the command never starts.
Details
Only applies when the incoming call actually carries constraints; ordinary local Bash calls are unaffected.
The deny-list refusal is unconditional rather than degrading to an unsandboxed run.
Evidence
This call carries file deny lists that cannot be enforced here yet; the command was not run.
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
