What probably matters to youSection of the release
What
The Windows install path now creates and trusts the managed sandbox TLS inspection CA, so sandboxed HTTPS works without a manual trust step.
Details
The install path became async and runs a CA trust step when the CA source is "managed".
Failures are reported as partial installs: "The sandbox TLS inspection CA couldn't be trusted for the sandbox user: " or "The sandbox TLS inspection CA couldn't be created: ", both ending "Sandboxed HTTPS won't work — run /sandbox install again to retry.".
Failures are recorded as "trust_ca_failed" and "persistent_ca_failed" under "sandbox_windows_install".
A UAC-cancelled install on an already-provisioned user can now still succeed, and the result message may gain " Restart Claude Code to enable TLS inspection for this session."
Windows only, and the trust step only runs for a managed CA source.
Evidence
sandbox_windows_install
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
