Windows sandbox setup grants more permissions, prepares git identity and explains failures better

What

The sandbox is a fenced-off area where Claude Code runs commands so they can only reach what they are allowed to. /sandbox is the command that turns sandbox mode on. On Windows, setting up this sandbox now does more work:

• Program-permission step: installing through /sandbox now runs a step that sets program permissions before the step that trusts the sandbox's certificate (the CA used for TLS inspection, which lets the sandbox look inside secure web traffic). The result of that step is added to the failure message, such as "The sandbox TLS inspection CA couldn't be trusted for the sandbox user".
• Git identity: each session gets its own generated global gitconfig file (git's settings file) holding your git user.name and user.email, so git commands run in the sandbox can make commits. The file is locked down with icacls (/inheritance:r, /grant:r). If it cannot be prepared, a warning says sandboxed git will not see your global user.name and user.email, so a commit may fail unless the repository sets them.
• Parent folders: Claude Code adds access entries (ACL entries, Windows' per-folder permission lists) for the sandbox group on the folders above your project. Without them, the logs say, sandboxed PowerShell commands may start in the drive's root and Node may fail with EPERM. Setting the environment variable CLAUDE_CODE_SANDBOX_LEAVE_PARENT_FOLDERS_ALONE turns these parent-folder grants off.
• Claude executable: the sandbox group gets read and execute rights on the claude executable through icacls.
• Refusal to start: the sandbox will not start when the working folder is your home folder, a folder that contains your home folder, or the config folder.
• Other additions: deny entries specific to Bun (the runtime Claude Code is built on), and a new error when the block of environment variables is too long.

Why

These steps change permissions on real folders on your Windows machine, not just inside the sandbox, so it helps to know they happen and that CLAUDE_CODE_SANDBOX_LEAVE_PARENT_FOLDERS_ALONE exists to stop the parent-folder part. Commits from inside the sandbox should no longer fail just because git has no identity, a failed install says more about what went wrong, and starting a sandboxed session from your home folder is now refused.