[BUG] claude plugin eval refuses Bash-granting cases on WSL2: Docker Desktop's ~/.docker/contexts symlink is not in the pre-flight skip set

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report
• [x] I am using the latest version of Claude Code

What's Wrong?

On WSL2 with Docker Desktop's WSL integration enabled for the distro, claude plugin eval refuses every Bash-granting case before any subject spawns, because Docker Desktop creates ~/.docker/contexts as a symlink into the Windows profile (/mnt/c/Users/<user>/.docker/contexts). Docker Desktop's own distro log records this (syncContextStores ... os.Symlink for contexts). Nothing was placed there by hand.

This is the WSL counterpart of #93368 (macOS, ~/.docker/bin and ~/.docker/cli-plugins). The 2.1.293 changelog relaxed only the macOS ~/.docker/bin case. In the 2.1.295 binary, the pre-flight's skip sets include features.json (the other link Docker Desktop's WSL integration creates) but not contexts; contexts appears only in the list of entry names the refusal message can name. So the WSL layout still trips the check.

Setting DOCKER_CONFIG to a plain directory does not bypass it (the default ~/.docker is always checked, as described in #93368), and deleting the link is unlikely to be durable since Docker Desktop manages it.

What Should Happen?

A stock Docker Desktop WSL integration layout should not block Bash-granting evals: either handle the contexts link the way features.json already is, or inspect only credential-relevant files (config.json, credential helpers), as #93368 asks.

Error Messages/Logs

the Docker (~/.docker, DOCKER_CONFIG) credential store on this machine holds a symbolic link inside it, so the Bash sandbox cannot reliably exclude it — a Bash-granting evaluation cannot run here; keep the store's contents in one plain directory (its root may be a link)

(Observed on every run of a 60-run suite on 2.1.289 under WSL2 with both contexts and features.json linked. On 2.1.295 the refusal strings and skip sets were read from the binary; with features.json now skipped, contexts is the remaining trigger.)

Steps to Reproduce

1. Windows with Docker Desktop (4.9x), WSL2 Ubuntu distro, Settings > Resources > WSL Integration enabled for that distro.
2. In the distro, confirm ls -la ~/.docker shows contexts -> /mnt/c/Users/<user>/.docker/contexts.
3. Install bubblewrap and socat (sudo apt-get install bubblewrap socat) so the sandbox backend is available.
4. Run any plugin eval case that grants Bash, e.g. claude plugin eval <plugin-dir> --case <case> --runs 1 --allow-tools Bash --no-publish --json out.json.
5. The run exits with zero turns and zero cost; each arm's error field holds the refusal above.

Workaround: run Bash-granting evals in a separate WSL distro that does not have Docker Desktop integration enabled.

Claude Model

Not sure / Multiple models

Is this a regression?

I don't know

Claude Code Version

2.1.295 (Claude Code)

Platform

Anthropic API

Operating System

Other Linux (Ubuntu under WSL2 on Windows)

Terminal/Shell

WSL (Windows Subsystem for Linux)

Additional Information

Related: #93368 (open, macOS layout), #94308 (closed, macOS cli-plugins).