Under the hoodTier: how much it should matter to you
1Useful: my rating, 1 to 5
1Signal: worth watching, 1 to 5
SandboxArea: what it touches
Internal ChangesKind: in v2.1.269,
Internal ChangesSection of the release
What
On macOS, the internal evaluation sandbox's list of directories that cannot be written to now also covers the real (symlink-resolved) parent directories of per-user socket and daemon paths, including ones named claude-<uid>, cc-daemon-<uid>, cc-socks, and cc-socks-<uid>, as well as paths under CLAUDE_CODE_TMPDIR.
Why
This closes off more ways a sandboxed eval run could write into shared system locations, keeping test runs better isolated from the host machine.
