Sandbox file access grants are checked more strictly, especially on Windows and through linked folders

What

The sandbox is a fenced-off area that limits which files and folders the commands Claude runs can reach. Settings such as allowRead and allowWrite grant extra access. The checks on those grants have been reworked:

• On Windows, a grant that is, or contains, your home folder or a Claude Code configuration folder is withheld. Device paths are refused. Grants from repository settings are still ignored on Windows.
• Links, also called symlinks, are shortcuts that point to another location. Claude Code now follows them one folder at a time along each path, instead of a single check of the whole path.
• The allow and deny write lists are built by shared code. Linked grants and glob patterns, which are paths with wildcards such as *, are now tracked. Before, glob patterns were skipped on Linux and WSL with the message 'Skipping glob pattern on Linux/WSL'.
• A grant whose path is re-pointed after it was approved can be dropped with the reason 'a directory in its spelling now resolves outside that spelling to one that holds or lies inside a denied read path'. Before, these late checks compared only a single root folder.
• blockReadsOutsideWorkingDirectories normally keeps reads inside your working folders, with some paths opened back up. That reopening is now turned off when allowManagedReadPathsOnly is set, when the working folder's path contains wildcard characters, or on Windows.

Why

This is a security change to how the sandbox enforces read denies and links. Some allowRead and allowWrite entries, especially on Windows, will now be dropped with a log message. If a command loses access it had before, check the logs for the reason.