Experimental TLS Termination for Sandbox Runtime [EXPERIMENTAL] / Claude Code v2.1.140

What

The sandbox runtime (SRT) can now terminate TLS in-process, making HTTPS request and response bodies visible to a per-request filter callback.

Usage

// In a programmatic SDK / harness integration:
{
  network: {
    tlsTerminate: {
      caCertPath: "/path/to/ca.crt",  // optional — omit to generate an ephemeral CA
      caKeyPath:  "/path/to/ca.key",
    },
    filterRequest: (request) => {
      // request is a web-standard Request object
      if (request.url.includes("evil.com")) return { action: "deny", reason: "blocked domain" };
      return { action: "allow" };
    }
  }
}

Details

network.tlsTerminate activates in-process CONNECT interception. When a sandboxed child makes an HTTPS request, SRT intercepts the CONNECT tunnel, terminates TLS, and proxies the decrypted traffic through the existing filter pipeline.
If caCertPath/caKeyPath are omitted, SRT generates an ephemeral RSA CA into a temp directory for the lifetime of the session and configures the sandboxed child to trust it. The ephemeral CA is cleaned up on exit.
caCertPath and caKeyPath must be provided together; providing only one throws an error.
The CA key must be RSA (non-RSA keys are rejected with "must be RSA").
network.tlsTerminate and network.mitmProxy are mutually exclusive — enabling both throws "network.tlsTerminate and network.mitmProxy are mutually exclusive".
filterRequest applies to both plain HTTP and, when tlsTerminate is active, to decrypted HTTPS. Denied requests receive a 403 with the reason.
Log prefixes: [mitm-ca] (CA lifecycle), [mitm-leaf] (per-host cert minting), [tls-terminate] (connection errors), [request-filter] (allow/deny decisions).

Evidence

Full TLS intercept stack (search for "[mitm-ca] generated ephemeral CA at" or "tlsTerminate.caCertPath")

Strings lifted out of the shipped bundle, so the claim above can be checked against them.