What
When a Bash command runs inside a sandbox (an isolated environment that restricts what a command can do, such as file or network access) and the sandbox notes that the command tried to do something it blocked, the tool result now includes an extra field: remedy: { kind: "sandbox_violation" }. This only appears when the command actually finished running rather than being interrupted.
Why
This surfaces sandbox restriction problems directly in the tool result instead of leaving them buried in stderr text, making it easier to notice when a command failed because of sandboxing rather than a genuine error in the command itself.
Names in the bundlesandbox_violation
Documented inclaude-code/monitoring-usage