You'll notice
Useful2 Signal2
The sandbox verifies the task output path is real directories before locking it down.
What's wrong with this entry?
Anonymous. No account, no email.
What
Before making the sandboxed task output directory read-only, Claude Code now verifies that every directory from your home directory down to it is a plain directory rather than a symlink or other special entry. If the chain does not check out, the read-only rule is skipped and a warning is logged instead of applying a rule to a path that may not be the one intended.
Details
- Always on; there is no flag.
- The warning names the offending path:
[sandbox] task output dir chain is not plain directories; read-only deny skipped: ${Q}.
Evidence
[sandbox] task output dir chain is not plain directories; read-only deny skipped: ${Q}
Strings lifted out of the shipped bundle, so the claim above can be checked against them.