Unclear Whether this behaviour is switched on when the server sends nothing is not known.
The sandbox is a restricted space Claude Code can run commands in, with a list of paths those commands are not allowed to touch. On Windows, that list is only applied when the sandbox starts, so paths blocked later, for example a new worktree (a separate working copy of a git repository), were missed.
Behind a setting controlled from the server, Claude Code now adds those later blocks to each sandboxed command on Windows. If it cannot work out what those blocks are, it refuses to run the command. When the sandbox fails to start, Claude Code also records which blocked paths that are hard links (a second name for the same file) caused the failure.
Paths blocked after the sandbox started can now be enforced on Windows too. The cost is that a sandboxed command can now fail with an error instead of running without those blocks.
Whether this behaviour is switched on when the server sends nothing is not known.