{"version":"2.1.221","anchor":"windows-sandbox-install-provisions-a-persistent-tls-inspecti","canonical_anchor":"windows-sandbox-install-provisions-a-persistent-tls-inspecti","heading":"Windows sandbox install provisions a persistent TLS-inspection CA","tier":"use","area":"Sandbox","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.221\/e\/windows-sandbox-install-provisions-a-persistent-tls-inspecti","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.221","markdown":"### Windows sandbox install provisions a persistent TLS-inspection CA\n\nOn Windows, \/sandbox install now sets up the certificate needed for sandboxed HTTPS, reporting partial success on failure.\n\n**What**\n\n`\/sandbox install` on Windows now sets up a certificate authority for sandbox TLS inspection as part of the install, and reports partial success instead of failing outright when that step does not work.\n\n**Details**\n\n- Calls ensurePersistentWindowsCa, which generates or reuses a CA under LOCALAPPDATA\\sandbox-runtime\\ca (ca.json, cert.pem, key.pem) and regenerates it within 30 days of expiry.\n- Trusts the CA for the sandbox account via `srt-win user trust-ca`.\n- Only runs on Windows and only when the sandbox config source is \"managed\".\n- Failures return status \"partial\" with either \"The sandbox TLS inspection CA couldn't be trusted for the sandbox user\" or \"The sandbox TLS inspection CA couldn't be created\", and log sandbox_windows_install\/trust_ca_failed or persistent_ca_failed.\n- Success messages gain a restart suffix when one is needed.\n\n**Evidence**\n\n`Restart Claude Code to enable TLS inspection for this session.`\n\n- Area: Sandbox\n- Names: `\/sandbox install`\n- Tier: Use it now\n- Useful: 4\/5\n- Signal: 0\/5"}