# What changed in @anthropic-ai/sandbox-runtime

> 173 changes in @anthropic-ai/sandbox-runtime 0.0 from its official release notes, upgrade guides and advisories: 27 breaking, 44 security, 41 new APIs and options. Each one cited. Sources checked 2026-10-18. HTML: https://unstale.sh/npm/@anthropic-ai/sandbox-runtime/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## @anthropic-ai/sandbox-runtime 0.0

### Breaking changes

- Linux VM sockets are refused with EPERM wherever the seccomp filter runs. (0.0.80) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.80)
- Only the literal value true allows a connection; other truthy values deny. The callback may also resolve to { allow: false, reason }. (0.0.80) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.80)
- Credential file entries take precedence over allowRead and allowWrite on every platform; paths at or beneath them are not bound back or granted. (0.0.80) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.80)
- On Linux, denyWrite takes precedence over allowWrite regardless of nesting; writes beneath a denied directory fail as read-only. (0.0.80) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.80)
- Adds normalizedRequestTarget and requestTargetIsAmbiguous callback fields; ambiguous targets are refused with 400 by default. (0.0.80) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.80)
- Requires Node or Bun 1.4 or later; initialization throws on older Bun. CONNECT requests over maxTunnels receive 503. (0.0.80) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.80)
- The supported Node.js engine requirement is now >=22.12.0. (0.0.79) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.79)
- On Linux, dangerous names in subdirectories are write-denied one level below the working directory, and unreadable folders are denied whole. (0.0.79) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.79)
- On Linux, a read deny or credential mask on a symlinked allowRead target takes precedence over the carve-out. (0.0.77) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.77)
- Linux refuses to start when root lacks CAP_SETFCAP. (0.0.77) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.77)
- Default write paths now obey a read deny, and interior path spellings are canonicalised. (0.0.77) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.77)
- Configuration now rejects a deny glob written with a trailing separator. (0.0.77) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.77)
- A / write root on Linux or read root on macOS no longer disables deny rules beneath it. (0.0.77) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.77)
- Allow-listed hostnames are refused if they resolve to loopback, link-local, or configured private ranges. (0.0.76) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.76)
- Linux drops a root caller's capabilities in both sandbox modes. (0.0.76) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.76)
- Non-interactive logon types are denied to the sandbox group. (0.0.74) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.74)
- Automatically loads the persistent MITM CA during initialization. (0.0.67) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.67)
- Changes the install and uninstall timeout default to 120 seconds. (0.0.67) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.67)
- Requires an explicit path; the implicit vendored-executable fallback is removed. Pass VENDORED_SRT_WIN_EXE to use the packaged binary. (0.0.67) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.67)
- The HTTP CONNECT proxy is now advertised in GRPC_PROXY instead of socks5h. (0.0.66) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.66)
- The Linux secure bwrap branch now forces --unshare-user and --cap-drop ALL. (0.0.66) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.66)
- Removes same-user mode, including its exec, WFP, and group behavior. (0.0.64) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.64)
- The TypeScript layer now supports sandbox-user as the only mode. (0.0.63) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.63)
- Windows filesystem access uses disk-is-truth file denial, a parent allow-list, and a hash-ACE seal. (0.0.59) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.59)
- Windows exec fails closed when WFP filters are absent. (0.0.59) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.59)
- Tightens leaf certificate validity to 99 days, anchored at notBefore. (0.0.53) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.53)
- Restricts loopback permits to a fixed port range. (0.0.53) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.53)

### Security

- Warns when the package is installed where a sandboxed command can write it. (0.0.80) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.80)
- On Linux, glob denies now cover descendants on file systems whose directory listings provide no entry types. (0.0.80) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.80)
- Adds opt-in controls to strip response headers, refuse opaque tunnels, and require a Host match. (0.0.80) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.80)
- Processes ending with process.exit() and failed initialize() calls no longer leave library objects, including generated CA keys, in the temp directory. (0.0.80) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.80)
- A path entry containing glob characters is also read as the path it spells, where that path exists, so denies through such folders apply. (0.0.79) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.79)
- Binds a deny path created by another sandbox while the wrapper is looking. (0.0.78) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.78)
- The CLI refuses an unusable control fd or settings file and keeps the fd out of the sandbox. (0.0.77) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.77)
- Linux pins ancestor directories of deny binds to prevent them from being renamed. (0.0.77) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.77)
- Linux keeps a masked file masked when it is a write path or is listed through a symlinked directory. (0.0.77) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.77)
- Forged attribution keys are sanitized, and the Linux monitor receives bubblewrap's write rules. (0.0.77) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.77)
- Unregistered attribution keys are sanitized in every violation producer. (0.0.76) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.76)
- A JVM agent makes Java tools honor the sandbox proxy and credential. (0.0.74) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.74)
- Glob denyRead entries remain denied inside allowRead regions on macOS. (0.0.72) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.72)
- Installation adds write-deny stamps on world-writable system directories. (0.0.72) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.72)
- ACL grant and revoke operations preserve SE_DACL_PROTECTED on Windows. (0.0.72) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.72)
- Decoded proxy commands are sanitized. (0.0.71) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.71)
- Violation lines are sanitized at ingestion. (0.0.71) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.71)
- Query strings are redacted on proxy deny lines. (0.0.70) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.70)
- Persists the MITM CA under the protected state directory using atomic writes and validates its notBefore and notAfter values. (0.0.67) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.67)
- Deny targets that do not yet exist are materialized as placeholders and stamped, closing the create-past-a-deny hole. (0.0.67) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.67)
- Adds claim-level masking inside decoded JWTs, allowing selected claims to be masked. (0.0.66) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.66)
- Adds claim masking for environment variables holding JWTs. (0.0.66) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.66)
- Masked credentials are now substituted in request bodies at the TLS-terminating proxy. (0.0.66) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.66)
- Adds extract for structured masking of environment variable values. (0.0.65) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.65)
- Adds a passive Linux observer for sandbox violations using seccomp USER_NOTIF. (0.0.65) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.65)
- Adds GIT_CONFIG_* injection for safe.directory and Schannel. (0.0.64) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.64)
- Adds environment-based CA trust for TLS termination without using the certificate store. (0.0.64) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.64)
- Windows srt-win performs a behavioral egress-block probe during initialize(). (0.0.63) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.63)
- Windows adds a per-session working-tree grant and full filesystem allow/deny under the sandbox user. (0.0.63) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.63)
- Adds per-exec file-read denial on Windows. (0.0.62) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.62)
- Adds per-exec file-write denial on Windows. (0.0.62) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.62)
- Installation provisions a sandbox user and user-SID WFP as a v2 foundation. (0.0.62) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.62)
- Credential files support mode "mask", which masks the whole file with sentinel content and binds it read-only over the real path. (0.0.61) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.61)
- Windows now wires denyWrite to srt-win ACLs. (0.0.61) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.61)
- Per-host excludeDomains lets tlsTerminate skip MITM for mTLS or pinned hosts. (0.0.61) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.61)
- Environment variables support mode:"mask", which uses a sentinel in the sandbox and injects the real value at the proxy. (0.0.58) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.58)
- The egress allowlist remains enforced when allowLocalBinding is set. (0.0.57) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.57)
- Adds configuration to deny credential files and environment variables inside the sandbox. (0.0.56) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.56)
- Adds deny-all as a network restriction option. (0.0.55) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.55)
- Re-applies denyRead file masks after a denyWrite ancestor bind. (0.0.55) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.55)
- Authenticates the loopback proxy. (0.0.55) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.55)
- Adds strictAllowlist as a network restriction option. (0.0.55) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.55)
- Fixes a header bypass on the TLS-terminating proxy. (0.0.55) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.55)
- Runs commands with a restricted token, job, and hardening stack. (0.0.53) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.53)

### New APIs and options

- On Linux, enables nested user namespaces for the configuration or a single wrap; by default sandboxed commands cannot create their own user or mount namespaces. (0.0.80) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.80)
- Adds askCallbackDenyReason as a member of ISandboxManager. (0.0.80) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.80)
- Can rewrite and observe requests: allows may set or remove headers and provide onResponse, denies may choose a status, and the callback receives request and connection details. (0.0.80) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.80)
- Selects how filterRequest handles a target that names another path after normalization: refuse, preserve its spelling, or normalize it. (0.0.80) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.80)
- TLS termination runs in-process on the tunnel socket; maxTunnels defaults to 256 and handshakeTimeoutMs defaults to 10000. (0.0.80) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.80)
- Adds a new package export named realPathOf. (0.0.80) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.80)
- Adds methods to register and unregister per-command network allow lists of allowed domains. (0.0.80) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.80)
- Adds a standalone HTTP proxy with an external decider process that decides every request; it is also available as a single-file srt-proxy. (0.0.80) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.80)
- A path entry with literal: true is treated as a name regardless of its characters, in any of the four filesystem path lists. (0.0.79) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.79)
- The four filesystem path lists now use FilesystemPathEntry[], defined as string or { path: string; literal: true }, instead of string[]. (0.0.79) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.79)
- writeRootsOf() gives every write root. (0.0.79) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.79)
- Adds commandId for command attribution. (0.0.71) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.71)
- Adds a per-exec commandLabel for attributing violations to a command. (0.0.71) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.71)
- Adds commandText for command attribution. (0.0.71) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.71)
- Adds per-entry deniedDomainReasons for model-facing deny reasons. (0.0.69) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.69)
- Allowed and denied domains can include an optional port suffix. (0.0.68) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.68)
- Adds the asynchronous checkDependenciesAsync API while leaving the synchronous API unchanged. (0.0.67) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.67)
- Adds checkWindowsSandboxStatus and a single-spawn srt-win status --json check. (0.0.67) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.67)
- Exports generateCa for working with the persistent MITM CA. (0.0.67) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.67)
- Adds configuration for safe.directory without write grants, fixing dubious-ownership errors on subdirectory launches. (0.0.67) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.67)
- Adds a typed mapped_drive_cwd error with exit code 16 for network-drive working directories; the broker does not stat UNC literals. (0.0.67) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.67)
- Exports validateCaPair for validating the MITM CA pair. (0.0.67) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.67)
- Exports the packaged Windows executable path for callers that want to use the vendored binary. (0.0.67) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.67)
- Adds typed Windows sandbox error codes and a .subcommand property. (0.0.67) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.67)
- Adds a decode option for encoded credential formats, starting with JWT, including environment variables holding JWTs. (0.0.66) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.66)
- Adds the --quiet option to exec. (0.0.65) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.65)
- Adds lib::run_from_args for invoking the Windows runtime from arguments. (0.0.64) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.64)
- Lets users name the provisioned Windows account. (0.0.64) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.64)
- Adds the Windows configuration schema with an argv[1] sentinel multicall override. (0.0.64) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.64)
- Adds an option to also mask captured values outside regex matches. (0.0.63) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.63)
- Adds extraCaCertPaths to configure site-local CA roots for TLS termination. (0.0.63) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.63)
- Adds an option to control credential file extract behavior when there is no match. (0.0.63) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.63)
- Adds structured extract regex support for masked credential files. (0.0.63) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.63)
- Adds a two-hop runner under the sandbox user. (0.0.62) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.62)
- The TLS-terminating proxy adds gcloud and Nix CA trust environment variables. (0.0.61) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.61)
- Set filesystem.disabled to disable the filesystem policy. (0.0.59) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.59)
- The npm release ships a prebuilt srt-win.exe for each architecture. (0.0.59) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.59)
- Git Bash is now supported as a first-class inner shell for srt-win exec. (0.0.57) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.57)
- Adds an opt-in option to allow Apple Events on macOS. (0.0.53) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.53)
- Adds the group subcommand to srt-win. (0.0.53) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.53)
- Sets up the group and WFP in a single step. (0.0.53) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.53)

### Performance

- Compiles a read rule once and reads brackets in linear time. (0.0.80) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.80)
- On Linux, expanding denyRead and allowRead patterns is about six times faster and uses less memory; rules in one configuration share directory listings. (0.0.79) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.79)
- An unlistable directory is tried once per wrap rather than once per rule, and read lists hold each path once. (0.0.79) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.79)
- On Linux, pattern expansion gives the event loop a turn every 10 ms and stops when the AbortSignal passed to wrapWithSandbox() is aborted. (0.0.79) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.79)
- Linux walks each directory in a read-deny glob once instead of once per name. (0.0.77) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.77)
- The TLS-terminate upstream connection is kept alive per client connection. (0.0.77) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.77)
- The generated macOS sandbox profile is approximately 6–10 times smaller. (0.0.71) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.71)

### Behavior and default changes

- A refused CONNECT response includes the refusal reason in its 403 status phrase. (0.0.80) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.80)
- Warnings now also identify a credentials.files deny whose pattern is skipped. (0.0.80) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.80)
- Unmatched or empty brackets are treated as literal text, while valid character sets remain patterns; Windows drive and share roots also work as glob bases. (0.0.80) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.80)
- On Linux, a wrap uses one configuration and working directory; if updateConfig(), initialize() or chdir() runs during wrapping, it restarts and rereads disk, then finishes without yielding after two restarts. (0.0.79) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.79)
- Linux collapses read-deny globs to directories and mounts denies where paths resolve. (0.0.77) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.77)
- SSH deny reasons are provided in-band. (0.0.71) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.71)
- Proxy denials are recorded in SandboxViolationStore. (0.0.68) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.68)
- A trailing slash marks a deny target as a directory. (0.0.67) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.67)
- Serves an empty CRL for Schannel and other revocation-checking clients. (0.0.64) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.64)
- Windows now wires denyRead to srt-win ACLs. (0.0.61) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.61)
- HTTP and SOCKS proxies can be served on a single port using first-byte sniffing. (0.0.61) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.61)
- Leaf certificates generated by the TLS-terminating proxy include SKI/AKI extensions. (0.0.61) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.61)
- TypeScript owns generateProxyEnvVars, and srt-win exec passes the variables through. (0.0.53) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.53)
- Sets up the group and WFP in a single step. (0.0.53) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.53)
- SandboxManager is wired to the srt-win network sandbox. (0.0.53) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.53)

### Tooling

- Adds the wfp subcommand to srt-win. (0.0.53) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.53)

### Fixes and other changes

- Deep imports globToRegex and denyGlobRegex moved to this file; neither function is a package export. (0.0.80) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.80)
- Git fetch and push now work through the macOS sandbox proxy. (0.0.80) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.80)
- An upstream response larger than its Content-Length no longer causes the entire response to be lost. (0.0.80) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.80)
- A backend-failure 502 is sent in a tunnel only if no response has yet gone back to the client. (0.0.80) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.80)
- Generated certificate serial numbers no longer begin with a zero byte, avoiding rejection by strict parsers. (0.0.80) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.80)
- bubblewrap 0.4 starts again by using one mount per destination. (0.0.79) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.79)
- Binaries built with bun build --compile start again. (0.0.79) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.79)
- The proxy answers 502 Bad Gateway when an upstream responds with an invalid status line or header, rather than throwing and ending the process. (0.0.79) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.79)
- On Linux, a sandboxed command starts only after both in-sandbox relays are listening, preventing its first network call from being refused. (0.0.79) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.79)
- Fixes exit status handling under zsh. (0.0.78) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.78)
- Linux passes over-long bubblewrap profiles through --args so they can be run. (0.0.77) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.77)
- Linux throws a typed error when the bubblewrap profile cannot be run. (0.0.77) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.77)
- Linux removes the deny mount point left on the host by a killed process. (0.0.77) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.77)
- On macOS, a path computed by the library is denied as a literal rather than interpreted as a pattern. (0.0.77) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.77)
- Re-applying a Linux read-deny tmpfs restores read-only behavior, allowing the write deny above it to take precedence. (0.0.77) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.77)
- srt exits after the command when --control-fd is a pipe. (0.0.76) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.76)
- CONNECT clients that abandon a slow permission decision are closed. (0.0.72) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.72)
- The proxy routes and dials the canonical host rather than the client's spelling. (0.0.72) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.72)
- IPv6 literals in allowed and denied domain entries are handled with bracket awareness. (0.0.71) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.71)
- Non-glob path spellings have trailing slashes stripped during normalization. (0.0.71) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.71)
- Clients that cannot be authenticated receive legible refusal messages. (0.0.71) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.71)
- The sandbox now starts when the helper binary is execute-only. (0.0.70) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.70)
- The proxy now honors ignoreViolations. (0.0.70) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.70)
- Skip creating stubs for absent deny paths under a read-only denied directory. (0.0.69) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.69)
- The proxy survives client aborts while preserving abort semantics end-to-end. (0.0.68) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.68)
- Resolves symlinks in deny paths before computing bwrap masks. (0.0.65) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.65)
- The proxy environment overlay no longer includes NO_PROXY on Windows. (0.0.65) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.65)
- Retries password generation when Windows reports NERR_PasswordTooShort, covering any password policy violation. (0.0.64) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.64)
- On schema mismatch, Windows preserves state.db as .bak instead of dropping the table. (0.0.63) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.63)
- Stops corrupting every ! in wrapped commands into \!. (0.0.62) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.62)
- Drops .local from NO_PROXY so *.local traffic routes via the proxy. (0.0.62) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.62)
- Restores the dropped files declaration in getCredentialRestrictions. (0.0.61) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.61)
- Normalizes absolute-form request-targets in the TLS-terminating proxy. (0.0.60) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.60)
- TMPDIR is left untouched when filesystem.disabled is true. (0.0.59) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.59)
- Preserves an explicitly empty allowlist in getNetworkRestrictionConfig. (0.0.55) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.55)
- Re-emits denyRead paths nested under allowRead on macOS. (0.0.55) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.55)
- Prevents denyWrite from unmasking denyRead tmpfs directories. (0.0.55) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.55)
- Disables SSH connection multiplexing in the injected command. (0.0.53) — [release notes](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.53)