Summary

The release prevents shell startup files and MCP configuration files from being modified outside intended controls, and fixes permission checks that could be bypassed through symlinks or wrapped directory changes. It also hardens worktree isolation and Windows hook behaviour.

Why it matters

Coding agents execute commands with access to source trees and developer credentials, so sandbox correctness is a core supply-chain and workstation-security concern.

Sources