What
When sandbox initialization fails, it now clears its recorded state and returns instead of caching a rejected promise, so a later attempt can succeed. A successful init clears the previous failure reason.
Details
- The reset covers both whether the sandbox was started with TLS termination and a new flag recording whether the installed network filter actually enforces the allowlist.
- The settings-change subscription now also re-subscribes to the stream of denied plugin producer directories.
- A new helper answers whether the sandbox is currently usable without re-running the dependency probe.
Evidence
Sandbox configuration updated from settings change
Strings lifted out of the shipped bundle, so the claim above can be checked against them.