{"version":"2.1.269","anchor":"eval-sandbox-additional-macos-sockettmpdir-directories-den","canonical_anchor":"eval-sandbox-additional-macos-sockettmpdir-directories-den","heading":"Eval sandbox: additional macOS socket\/tmpdir directories denied write access","tier":"internal","area":"Sandbox","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.269\/e\/eval-sandbox-additional-macos-sockettmpdir-directories-den","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.269","markdown":"### Eval sandbox: additional macOS socket\/tmpdir directories denied write access\n\nEval sandbox on macOS blocks writes to more per-user socket and daemon directories\n\n**What**\n\nOn macOS, the internal evaluation sandbox's list of directories that cannot be written to now also covers the real (symlink-resolved) parent directories of per-user socket and daemon paths, including ones named `claude-<uid>`, `cc-daemon-<uid>`, `cc-socks`, and `cc-socks-<uid>`, as well as paths under `CLAUDE_CODE_TMPDIR`.\n\n**Why**\n\nThis closes off more ways a sandboxed eval run could write into shared system locations, keeping test runs better isolated from the host machine.\n\n- Area: Sandbox\n- Tier: Under the hood\n- Useful: 1\/5\n- Signal: 1\/5"}