{"version":"2.1.305","anchor":"windows-sandbox-write-restricted-token-loopback-and-read-e","canonical_anchor":"windows-sandbox-user-profile-read-grant-with-credential-sto","heading":"Windows sandbox reworked: localhost access fixed at install, readable profile, clearer repair messages","tier":"use","area":"Sandbox","scope":"individual","heads_up":true,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.305\/e\/windows-sandbox-write-restricted-token-loopback-and-read-e","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.305","markdown":"### Windows sandbox reworked: localhost access fixed at install, readable profile, clearer repair messages\n\nOn Windows the sandbox now sets localhost access at install, can let commands read your profile except credential stores, and explains how to repair it\n\n**Unclear.** Which settings turn on each of the new sandbox options, and whether every Windows sandbox setup uses them, is not stated.\n\n**What**\n\nThe sandbox is the protected space Claude Code can run shell commands in, limiting which files and network addresses they reach. On Windows its set-up has been reworked.\n\n- Localhost: `sandbox.network.allowLocalBinding` decides whether sandboxed commands may connect to your own machine (127.0.0.1 or ::1). On Windows it is now fixed when the sandbox is installed, not read live from settings. If the setting later differs from the installed one, you see \"sandbox.network.allowLocalBinding asks for local connections\u2026\" and are told to run `\/sandbox install` (or `claude sandbox install`) and restart. A mid-session change leaves the sandbox either off or refusing commands until restart, and one message warns \"Commands run WITHOUT sandboxing until you restart Claude Code\".\n\n- The instructions given to Claude now match: with local binding allowed, commands can reach localhost except some reserved ports; without it, localhost is blocked and Claude explains how to turn it on.\n\n- Profile reads: set-up can now make your user profile readable to sandboxed commands, except credential stores such as SSH and GPG keys, `.aws`, `.claude`, cloud and browser sign-ins and password managers. Skip it with `--skip-profile-grant`, undo it with `srt-win profile forget`. Startup reports whether the profile is readable and warns about stores that could not be closed; a failed grant can fail the install with `profile_grant_failed`.\n\n- The helper `srt-win` now gets `--write-restricted-token`, `--write-root`, `--allow-loopback`, `--deny-read-except` and `--held-by`, plus `proxyPortRange` and `sandboxUser`. `no_proxy` is set when loopback is allowed and `NODE_USE_ENV_PROXY` when a proxy port is in use. Re-install rebuilds the network filters if the loopback choice changed.\n\n- The permissions step changed from `acl stamp` (60-second limit) to `acl grant --persistent` (10-minute limit), and revoking returns a structured result.\n\n- With `sandbox.failIfUnavailable` set, if the sandbox stops being available mid-session, commands are refused, including retries that ask to run without the sandbox.\n\n- The check for weaker sandbox settings now counts `network.allowLocalBinding` on Windows, and `allowNestedUserNamespaces` on platforms other than macOS and Windows.\n\n- The `allowLocalBinding` description now explains its meaning on each operating system.\n\n**Why**\n\nChanging localhost access on Windows now needs a re-install, and the messages say so. Letting sandboxed commands read your profile widens what they can see; files outside the listed credential stores, such as package-manager config that can hold tokens, may become readable.\n\n- Area: Sandbox\n- Tier: Use it now\n- Useful: 4\/5\n- Signal: 3\/5\n- Scope: individual\n- Heads-up: yes"}