Under the hood
Eval sandbox on macOS blocks writes to more per-user socket and daemon directories
What
On macOS, the internal evaluation sandbox's list of directories that cannot be written to now also covers the real (symlink-resolved) parent directories of per-user socket and daemon paths, including ones named claude-<uid>, cc-daemon-<uid>, cc-socks, and cc-socks-<uid>, as well as paths under CLAUDE_CODE_TMPDIR.
Why
This closes off more ways a sandboxed eval run could write into shared system locations, keeping test runs better isolated from the host machine.