What
The sandbox is the walled-off space Claude Code runs commands in, so they can only reach what they are allowed to. Sometimes Claude Code has to install a backup sandbox setup. When that happens:
- The log message names the specific cause. Before, it was a fixed message saying a rebuilt setup could not be put in place.
- Claude Code records how many access grants were dropped and how many masks were reduced.
- A credential mask is a rule that hides a secret inside a file and puts the real value in only when needed. If a moved path may now cover such a mask, Claude Code reduces it to a placeholder for the whole file and does not put the credential in.
Why
The backup setup now handles paths that have moved without passing credentials through by mistake, and its log says why the backup was needed.