What
Full Windows Filtering Platform (WFP) integration for the Windows sandbox using the srt-win tool. Enables per-process network isolation via Windows discriminator groups and WFP filters, analogous to the macOS sandbox's network control.
Usage
// In settings.json (windows-specific):
{
"windows": {
"groupName": "my-sandbox-group",
"groupSid": "S-1-...",
"sublayerGuid": "..."
}
}Details
- Requires a one-time installation:
npx sandbox-runtime windows-install(triggers one UAC prompt) - After install, you must log out and back in so the discriminator group SID enters your token
- While the group SID is absent from your token, WFP filter-0 PERMITs all traffic — no connectivity disruption during setup
- Default proxy port range is 60080–60089 (configurable); must match the range passed to
srt-win wfp install --group-sidoverridesgroupNamelookup — use for domain environments where name resolution is unreliableSRT_WIN_PATHenvironment variable overrides thesrt-win.exesearch path- Windows sandbox commands now run via
srt-win execinstead of directly through cmd/PowerShell
Evidence
srt-win integration (search for "srt-win.exe" or "Windows sandbox needs a one-time install") — $38(), YD7(), Oh6() at line ~241773
Strings lifted out of the shipped bundle, so the claim above can be checked against them.