You'll noticeTier: how much it should matter to you
1Useful: my rating, 1 to 5
1Signal: worth watching, 1 to 5
SandboxArea: what it touches
ImprovementsKind: in v2.1.309,
ImprovementsSection of the release
What
The sandbox is a restricted environment Claude Code can run shell commands in, to limit which files they can change. To block writes to certain paths, called write-deny paths, it places mask files there. Sometimes those files are left behind.
The doctor diagnostic used to list them as "Stale sandbox mask files left by a killed session". It now reads "Sandbox mask files left behind at write-deny paths" and explains that a session leaves one when it is killed, or when it exits while a sandboxed command is still running.
Why
The message now gives the real causes of the leftover files, so you have a better idea of where they came from.
