Sandbox settings excludedCommands and allowUnixSockets not working

Description

The sandbox settings in settings.json for excludedCommands and network.allowUnixSockets appear to be documented but are not respected by Claude Code.

Environment

• Claude Code version: 2.0.76
• OS: macOS Darwin 25.1.0
• Shell: zsh/fish

Configuration

"sandbox": {
  "excludedCommands": ["ssh", "scp", "rsync"],
  "network": {
    "allowedHosts": [
      "my-server.tailnet.ts.net",
      "100.x.x.x"
    ],
    "allowUnixSockets": [
      "~/.ssh/sockets/*",
      "~/.ssh/agent-socket"
    ]
  }
}

Expected Behavior

1. excludedCommands: ["ssh"] should run SSH commands outside the sandbox
2. allowUnixSockets: ["~/.ssh/sockets/*"] should allow access to SSH ControlMaster sockets

Actual Behavior

Both settings are ignored. SSH commands fail with:

Control socket connect(/Users/user/.ssh/sockets/server-...): Operation not permitted
ssh: Could not resolve hostname my-server.tailnet.ts.net: -65563

The sandbox blocks:

1. DNS resolution (Tailscale MagicDNS not accessible)
2. Unix socket access (~/.ssh/sockets/*)

Workaround

Only dangerouslyDisableSandbox: true works:

// This fails (settings ignored):
Bash({ command: "ssh host echo OK" })

// This works:
Bash({ command: "ssh host echo OK", dangerouslyDisableSandbox: true })

Steps to Reproduce

1. Configure settings.json with sandbox.excludedCommands: ["ssh"]
2. Have SSH configured with ControlMaster (multiplexing)
3. Create SSH master connection outside Claude Code: ssh -MNf host
4. In Claude Code, run: ssh host echo "test"
5. Observe: Command fails despite excludedCommands setting

Additional Context

• Tested on both stable (2.0.67) and latest (2.0.76) - same behavior
• The settings appear in documentation but don't function
• SSH works perfectly when using dangerouslyDisableSandbox: true

Impact

Users relying on Tailscale, custom DNS, or SSH multiplexing cannot use SSH within the sandbox even with explicit configuration to allow it.

🤖 Generated with Claude Code