"Commands now execute in a secure, sandboxed environment. If you’re on allowlist mode, non-allowlisted commands will automatically run in a sandbox with read/write access to your workspace and no internet access."