Sandbox hardening: stricter network proxy checks and credential files that stay closed

What

The sandbox is the protected space where Claude Code runs commands with limited access to your files and network. This release tightens it:

• Credential files: denies on credential files are now kept separately (credentialDenies), so a broader allowRead or allowWrite entry no longer reopens them. On Windows, an allow beneath a credential entry is warned about and "not granted". A denyWrite entry makes an overlapping allow read-only.
• Request checks: the network proxy now parses each request's target and answers 400 to ambiguous or malformed ones. It requires a Host header on HTTP/1.1 ("HTTP/1.1 request without a Host header"). With requireHostMatch it answers 421 when the Host header does not match the site named when the encrypted connection was set up (SNI). Some HTTP methods are refused with 405 and "the ${method} method is not forwarded".
• Filter decisions: the request filter now receives SNI and target details, and its answer is validated ("malformed filterRequest decision: ${J}"). It can add a deny header and strip response headers, and setting headers on plaintext requests is denied. A network ask callback that returns anything other than true or false or { allow: false, reason } is treated as a denial, and deny reasons can be passed on to a callback.
• New proxy options: allowPlaintextHeaderSet, stripResponseHeaders, refuseOpaqueTunnels (also on the SOCKS proxy), requireHostMatch, ambiguousRequestTarget (default "refuse", applied only while filterRequest is set), tlsTerminate.maxTunnels (default 256) and handshakeTimeoutMs (default 10000). They are optional, so nothing changes unless a program embedding the sandbox sets them.
• Failures from the far server after a whole answer has arrived are logged instead of reported.
• On Linux, the socat bridge now listens on IPv6 with an IPv4 fallback and backlog=4096.
• bwrap errors about too many arguments now explain that built-in write protection takes most of them.

Why

Credential files stay protected even when a broad allow rule covers their folder, and the proxy can refuse requests that disguise where they are going. If you relied on an allow rule to reach a file under a credential entry, it no longer opens it.