Sandbox gains three new write protections

What

The sandbox is a fenced-off environment that limits what commands run by Claude Code can write. Its setup now tracks three more protections, each with its own record of whether it was applied:

• Relative-path write-deny twins, which block writes that reach a denied place through a relative path or a symlink (a shortcut to another file or folder). Recorded as builtConfigRelativeWriteDenyTwins.
• A legacy remote folders deny, a write block on .git/remotes and .git/branches. Recorded as builtConfigLegacyRemoteDirsDenied.
• A pin on git info folders. Recorded as builtConfigGitInfoDirsPinned.

On macOS, the setup also loops over a further set of paths and denies those that fall outside the folders you may write to. The sandbox restarts when the feature flags for any of these three protections change. Before, only patternWriteDenyTwins and unlistableWorktreesDeny existed.

Why

Commands inside the sandbox may now be refused writes they could make before, especially into parts of a .git folder or through symlinks.