Unclear It is not clear what turns on mask mode or what this changes for someone using the sandbox.
What
The sandbox is a fenced-off environment that limits what commands Claude Code runs can touch. When it is set to mask credential files, such as files holding passwords or keys, the locations it blocks reading from are now flagged as masked. A separate list of trusted blocked locations has also been added.
Why
This changes how the sandbox handles credential files.
Something disagreesSomething we can check disagrees with this entry, or the writer said they could not settle it.
The writer flagged doubt
It is not clear what turns on mask mode or what this changes for someone using the sandbox.