excludedCommands does not bypass network sandbox - git DNS blocked

Issue

Git is listed in sandbox.excludedCommands but still gets DNS blocked when trying to push/fetch.

Config (~/.claude/settings.json):

"sandbox": {
  "enabled": true,
  "autoAllowBashIfSandboxed": true,
  "excludedCommands": ["docker", "git", "npm"],
  "network": {
    "allowLocalBinding": true,
    "allowedHosts": ["*"]
  }
}

Expected behavior (per docs):

Commands in excludedCommands should run completely outside the sandbox, including network access.

Actual behavior:

git push
fatal: unable    to access 'https://github.com/...': Could not resolve host: github.com

DNS resolution is blocked even though git is in excludedCommands and allowedHosts is ["\*"].

Workaround:

Only dangerouslyDisableSandbox: true works.

Environment:

• macOS Darwin 25.1.0 (Sequoia)
• Claude Code CLI (latest)

Related: #11481