{"version":"2.1.299","anchor":"sandbox-prompt-gains-windows-localhost-and-profile-access-gu","canonical_anchor":"sandbox-prompt-gains-windows-localhost-and-profile-access-gu","heading":"Claude Code gives Windows-specific advice when sandboxed commands fail","tier":"notice","area":"Sandbox","scope":"individual","heads_up":false,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.299\/e\/sandbox-prompt-gains-windows-localhost-and-profile-access-gu","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.299","markdown":"### Claude Code gives Windows-specific advice when sandboxed commands fail\n\nOn Windows, the sandbox instructions now cover localhost limits, profile folder reads, certificate issues and placeholder files\n\n**What**\n\nThe sandbox is a protected space where Claude Code runs commands with limited access to your system. The instructions Claude Code gives the model about the sandbox now include Windows sections:\n\n- Sandboxed commands cannot connect to localhost (127.0.0.1 or ::1), even to their own port, and no setting allows it\n\n- Reads from your profile folder are limited, and `sandbox.filesystem.allowRead` is the way to allow specific paths\n\n- Notes on Maven and .NET, pip certificate errors, and the 0-byte placeholder files the sandbox creates, such as `.mcp.json` and `.claude\/settings.json`\n\nThe suggested fixes, running `\/sandbox exclude` or prefixing a command with `!`, are now offered only when they apply, for example not when your settings are locked by an organisation policy.\n\nWhen Windows refuses to start Claude Code as the sandbox account with an access-denied error, Claude Code now tells the model to retry once and resets its permission to restart itself in the sandbox.\n\n**Why**\n\nOn Windows, the model can now explain more accurately why a sandboxed command failed and suggest a fix that actually works in your setup.\n\n- Area: Sandbox\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 2\/5\n- Scope: individual\n- Heads-up: no"}