{"version":"2.1.212","anchor":"windows-sandbox-installation","canonical_anchor":"windows-sandbox-installation","heading":"Windows Sandbox Installation","tier":null,"area":null,"scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.212\/e\/windows-sandbox-installation","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.212","markdown":"### Windows Sandbox Installation\n\nWindows sandbox support now includes a full one-time install flow that sets up a dedicated sandbox user and WFP (Windows Filtering Platform) network filters.\n\n**Usage**\n\n`\/sandbox install # install sandbox user and WFP network filters \/sandbox # check current sandbox status` **Details** - Requires administrator privileges for the initial install (an elevation prompt appears). - After install: `Sandbox user and network filters installed` \u2014 confirmed via `\/sandbox`. - If the elevation prompt was missed: re-run `\/sandbox install` and approve within a minute. - WFP filter installation is idempotent; passing `force: true` replaces existing filters if the port range or sandbox user name changed. - New error classes: `SandboxCommandTooLongError` (command too long for the OS argv limit \u2014 write to a file instead), `SandboxPolicyRefusalError` (enterprise policy blocks the command), `SandboxUnavailableForShellError` (shell not sandboxable). - PowerShell commands on Windows are labeled `PowerShell command (unsandboxed)` to clarify they bypass the sandbox. - Feature-gated via `tengu_nankeen_kestrel`. **Evidence** \"Windows sandbox needs a one-time install.\" (search for `\"srt-win install\"` and `\"ClaudeCodeSandbox\"`)\n\n- Flag `tengu_nankeen_kestrel`: Not enough to say (read for one account on one subscription tier against v2.1.212; this account: no value returned, anonymous baseline: no value returned, compiled default: off) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release."}