Windows sandbox reworked: localhost access fixed at install, readable profile, clearer repair messages

What

The sandbox is the protected space Claude Code can run shell commands in, limiting which files and network addresses they reach. On Windows its set-up has been reworked.

• Localhost: sandbox.network.allowLocalBinding decides whether sandboxed commands may connect to your own machine (127.0.0.1 or ::1). On Windows it is now fixed when the sandbox is installed, not read live from settings. If the setting later differs from the installed one, you see "sandbox.network.allowLocalBinding asks for local connections…" and are told to run /sandbox install (or claude sandbox install) and restart. A mid-session change leaves the sandbox either off or refusing commands until restart, and one message warns "Commands run WITHOUT sandboxing until you restart Claude Code".
• The instructions given to Claude now match: with local binding allowed, commands can reach localhost except some reserved ports; without it, localhost is blocked and Claude explains how to turn it on.
• Profile reads: set-up can now make your user profile readable to sandboxed commands, except credential stores such as SSH and GPG keys, .aws, .claude, cloud and browser sign-ins and password managers. Skip it with --skip-profile-grant, undo it with srt-win profile forget. Startup reports whether the profile is readable and warns about stores that could not be closed; a failed grant can fail the install with profile_grant_failed.
• The helper srt-win now gets --write-restricted-token, --write-root, --allow-loopback, --deny-read-except and --held-by, plus proxyPortRange and sandboxUser. no_proxy is set when loopback is allowed and NODE_USE_ENV_PROXY when a proxy port is in use. Re-install rebuilds the network filters if the loopback choice changed.
• The permissions step changed from acl stamp (60-second limit) to acl grant --persistent (10-minute limit), and revoking returns a structured result.
• With sandbox.failIfUnavailable set, if the sandbox stops being available mid-session, commands are refused, including retries that ask to run without the sandbox.
• The check for weaker sandbox settings now counts network.allowLocalBinding on Windows, and allowNestedUserNamespaces on platforms other than macOS and Windows.
• The allowLocalBinding description now explains its meaning on each operating system.

Why

Changing localhost access on Windows now needs a re-install, and the messages say so. Letting sandboxed commands read your profile widens what they can see; files outside the listed credential stores, such as package-manager config that can hold tokens, may become readable.