Project sandbox.network settings ignored under admin control, including proxy ports

What

The sandbox limits which hosts and ports commands run by Claude can reach, using the sandbox.network settings. Before, project settings, which can be committed to a repository, could supply these network allowances. Now:

• When an admin sandbox mandate (managed settings require the sandbox) or a trusted network deny list applies, sandbox.network allowances from project and local settings are ignored. A log line says "[sandbox] admin sandbox mandate: ignoring sandbox.network."
• Under allowManagedDomainsOnly, only managed settings can replace the filtering proxy (the program that checks where sandboxed traffic goes) through httpProxyPort and socksProxyPort. A project that tries is logged with "a project may not replace the filtering proxy".
• httpProxyPort and socksProxyPort now have descriptions in the settings schema.

Why

A repository's settings can no longer send sandboxed traffic through a proxy of its own or widen network access when an administrator controls the sandbox.