Under the hoodTier: how much it should matter to you
1Useful: my rating, 1 to 5
3Signal: worth watching, 1 to 5
Plugin EvalArea: what it touches
Internal ChangesKind: in v2.1.251,
Internal ChangesSection of the release
What
Cleaning up a plugin eval sandbox now walks the directory tree recursively, confirming each step is still the same file it expected before changing its permissions to owner-only, so a symlink swapped in mid-cleanup cannot redirect it.
Details
the recursive unlock runs on Linux and WSL, or when the directory is explicitly marked as owned by the harness; it is skipped on Windows
the eval temp area gets its own tmp subdirectory created owner-only
Evidence
await hu(e, 448)
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
