Sandbox gains a write block on the plugin tool staging folder

What

The sandbox is a protected area in which Claude Code runs commands, limiting what they can read and write. Its internal state gained several new pieces:

• pluginToolStagingDenyApplied and builtConfigPluginToolStagingDenied track a write block on the staged mcp_call directory. That directory is a folder where plugin tool calls are staged.
• Claude Code watches for settings changes, and that watching now also reacts when a feature flag changes this write block. A feature flag is a switch Anthropic can turn on or off remotely.
• scrubParentMemo and scrubParentLastKnown appear to cache the results of cleaning up parent folders.
• The permission context now carries readBlockExemptPaths next to blockReadsOutsideWorkingDirectories. The permission context holds the rules for what Claude Code may do, and the new value is taken from added directories.

Why

Where this write block applies, sandboxed commands may no longer be able to write to the plugin tool staging folder. A feature flag controls it, so it may not apply to every user.