{"version":"2.1.317","anchor":"sandbox-pins-git-infocommit-graph-dirs-and-denies-remotesb","canonical_anchor":"sandbox-pins-git-infocommit-graph-dirs-and-denies-remotesb","heading":"Sandbox protects more git folders and can make remotes and branches read-only","tier":"notice","area":"Sandbox","scope":"individual","heads_up":true,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.317\/e\/sandbox-pins-git-infocommit-graph-dirs-and-denies-remotesb","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.317","markdown":"### Sandbox protects more git folders and can make remotes and branches read-only\n\nThe sandbox now guards more folders inside .git against replacement and can make the git remotes and branches folders read-only\n\n**What**\n\nThe sandbox, the restricted environment that limits what commands Claude Code runs can touch, now protects more of a git repository's internal folders. Before, it only handled hooks, config, config.worktree, commondir and alternates. Now:\n\n- `.git\/info`, `.git\/objects\/info` and `.git\/objects\/info\/commit-graphs` are pinned so a command cannot swap them for something else\n\n- A folder name inside each of those is reserved\n\n- A `[Sandbox]` warning is logged when one of those paths is a symbolic link (a pointer to another location), a plain file or unreadable\n\n- The folders that hold git remotes and branches are made read-only, behind a new check\n\n- Windows now gets the alternates protection too\n\nSeveral of these protections only apply on certain platforms or under certain conditions.\n\n**Why**\n\nCommands run inside the sandbox can write to fewer parts of git's internal files. That makes it harder to tamper with a repository, but some git workflows that write to these places from inside the sandbox may stop working.\n\n- Flag `tengu_mighty_thimble`: Not enough to say (read for one account on one subscription tier against v2.1.317; this account: no value returned, anonymous baseline: no value returned, compiled default: on) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release.\n- Area: Sandbox\n- Tier: You'll notice\n- Useful: 3\/5\n- Signal: 3\/5\n- Scope: individual\n- Heads-up: yes"}