The sandbox, the restricted environment that limits what commands Claude Code runs can touch, now protects more of a git repository's internal folders. Before, it only handled hooks, config, config.worktree, commondir and alternates. Now:
.git/info,.git/objects/infoand.git/objects/info/commit-graphsare pinned so a command cannot swap them for something else- A folder name inside each of those is reserved
- A
[Sandbox]warning is logged when one of those paths is a symbolic link (a pointer to another location), a plain file or unreadable - The folders that hold git remotes and branches are made read-only, behind a new check
- Windows now gets the alternates protection too
Several of these protections only apply on certain platforms or under certain conditions.
Commands run inside the sandbox can write to fewer parts of git's internal files. That makes it harder to tamper with a repository, but some git workflows that write to these places from inside the sandbox may stop working.
tengu_mighty_thimble Not enough to sayNothing here resolved what this flag was doing on this version, so nothing here should be read as on or off.
This account: no value returned · anonymous baseline: no value returned · compiled default in v2.1.317: on
These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release.
Read once, for one account on one subscription tier, against v2.1.317. It isn't a statement about your account. What a flag value here can and cannot tell you