[BUG] Sandbox network allowlist not enforced after enabling the sandbox mid-session in auto mode (follow-up to #81572, still in 2.1.295)

Summary

If sandbox.enabled is turned on (settings.json hot reload) while a session is already running in auto mode, the filesystem restrictions take effect immediately, but the network allowlist (sandbox.network.allowedDomains) is not enforced: requests to non-allowed hosts go through the sandbox proxy with HTTP 200 until the session is restarted. In default mode the same mid-session switch works (403).

This silently leaves an exfiltration path open while the user believes the sandbox is fully active.

Follow-up to #81572 (same fail-open after in-session sandbox settings changes; closed as stale by the bot). Still reproducible in 2.1.295.

Environment

• Claude Code CLI 2.1.295, macOS 26.6 (Seatbelt sandbox)
• First observed in the Claude desktop app (Code tab), reproduced with the CLI

Settings used

.claude/settings.json in a scratch git repo:

{"sandbox":{"enabled":true,"failIfUnavailable":true,"network":{"allowedDomains":["github.com","*.github.com","*.githubusercontent.com"]}}}

Steps to reproduce

1. Start with .claude/settings.json = {} and run claude -p "<prompt>" --permission-mode auto.
2. In the session: curl -sS -o /dev/null -w '%{http_code}' https://example.com → 200 (expected, no sandbox yet).
3. While the session runs, replace .claude/settings.json with the sandbox settings above.
4. In the same session:

• curl … https://example.com → 200 (expected 403)
• curl … https://www.wikipedia.org → 200 (expected 403)
• touch ~/probe → Operation not permitted (filesystem sandbox is active)

Results matrix (curl https://example.com)

| Sandbox enabled | Permission mode | Result |
|---|---|---|
| at session start | default | 403 ✅ |
| at session start | auto | 403 ✅ |
| mid-session | default | 403 ✅ |
| mid-session | auto | 200 ❌ (reproduced twice) |

Expected

Either the network allowlist applies as soon as the sandbox is active (like the filesystem rules and like default mode), or Claude Code fails closed / warns that a restart is required for sandbox network settings to take effect.