Windows sandbox: binShell now accepts object form and custom srt-win path / Claude Code v2.1.208

What

Two improvements to the Windows sandbox configuration.

First, binShell can now be specified as an object {"exe": "...", "args": [...]} instead of only as a string token. This allows passing absolute paths to shells with custom argument arrays. The object form is Windows-only and is rejected on macOS/Linux.

Second, a new windows.srtWin.path setting allows pointing the sandbox at a custom srt-win.exe binary instead of the packaged one.

Details

binShell string form: bare token (cmd, powershell, pwsh) or absolute path to bash.exe/sh.exe/pwsh.exe/powershell.exe
binShell object form: {"exe": "<absolute path>", "args": ["..."]}
Error message updated: now accepts pwsh.exe and powershell.exe in addition to the previous bash.exe/sh.exe
windows.srtWin.path: if set, the file must exist; remove the key to fall back to the packaged binary
CA cert path is now passed to sandbox commands, enabling custom CA trust in Windows sandbox mode

Evidence

binShell object form (search for "binShell object form is Windows-only") and srtWin path (search for "windows.srtWin.path is set to")

Strings lifted out of the shipped bundle, so the claim above can be checked against them.