Windows Sandbox Network Filtering (WFP / srt-win) / Claude Code v2.1.169

What

Full Windows Filtering Platform (WFP) integration for the Windows sandbox using the srt-win tool. Enables per-process network isolation via Windows discriminator groups and WFP filters, analogous to the macOS sandbox's network control.

Usage

// In settings.json (windows-specific):
{
  "windows": {
    "groupName": "my-sandbox-group",
    "groupSid": "S-1-...",
    "sublayerGuid": "..."
  }
}

Details

Requires a one-time installation: npx sandbox-runtime windows-install (triggers one UAC prompt)
After install, you must log out and back in so the discriminator group SID enters your token
While the group SID is absent from your token, WFP filter-0 PERMITs all traffic — no connectivity disruption during setup
Default proxy port range is 60080–60089 (configurable); must match the range passed to srt-win wfp install
--group-sid overrides groupName lookup — use for domain environments where name resolution is unreliable
SRT_WIN_PATH environment variable overrides the srt-win.exe search path
Windows sandbox commands now run via srt-win exec instead of directly through cmd/PowerShell

Evidence

srt-win integration (search for "srt-win.exe" or "Windows sandbox needs a one-time install") — $38(), YD7(), Oh6() at line ~241773

Strings lifted out of the shipped bundle, so the claim above can be checked against them.