What probably matters to youSection of the release
What
/sandbox install on Windows now sets up a certificate authority for sandbox TLS inspection as part of the install, and reports partial success instead of failing outright when that step does not work.
Details
Calls ensurePersistentWindowsCa, which generates or reuses a CA under LOCALAPPDATA\sandbox-runtime\ca (ca.json, cert.pem, key.pem) and regenerates it within 30 days of expiry.
Trusts the CA for the sandbox account via srt-win user trust-ca.
Only runs on Windows and only when the sandbox config source is "managed".
Failures return status "partial" with either "The sandbox TLS inspection CA couldn't be trusted for the sandbox user" or "The sandbox TLS inspection CA couldn't be created", and log sandbox_windows_install/trust_ca_failed or persistent_ca_failed.
Success messages gain a restart suffix when one is needed.
Evidence
Restart Claude Code to enable TLS inspection for this session.
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
