[BUG] CLAUDE_CODE_SHELL environment variable is ignored on Windows

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

The CLAUDE_CODE_SHELL environment variable is documented as overriding automatic shell detection. However, on Windows, setting this variable has no effect. Claude Code continues to use Git Bash regardless of the value set. This is problematic because Git Bash (MSYS2) does not properly inherit Windows security group memberships. Even if a user is in the docker-users group, Docker commands fail with "Access is denied" because the Git Bash process token doesn't include the group membership.

What Should Happen?

Claude Code should use the shell specified in CLAUDE_CODE_SHELL when set. On Windows, this would allow using PowerShell instead of Git Bash, which would properly inherit Windows security group memberships (like docker-users).

Error Messages/Logs

error during connect: in the default daemon configuration on Windows, the docker client must be run with elevated privileges to connect: Get "http://%2F%2F.%2Fpipe%2Fdocker_engine/v1.51/containers/json": open //./pipe/docker_engine: Access is denied.

Steps to Reproduce

1. On Windows, open PowerShell and set: $env:CLAUDE_CODE_SHELL = "powershell.exe"
2. Launch Claude Code: claude
3. 3. In Claude Code, check the shell: echo $0 (returns /usr/bin/bash)
4. 4. Verify env var is set: echo $CLAUDE_CODE_SHELL (returns powershell.exe)
5. 5. Try running docker ps - fails with Access denied even though user is in docker-users group

Claude Model

None

Is this a regression?

No, this never worked

Last Working Version

_No response_

Claude Code Version

2.1.19 (Claude Code)

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

PowerShell

Additional Information

Related issues: #7490, #3461, #1630. The root cause is that Git Bash (MSYS2) creates process tokens that don't include Windows security group memberships. On Windows, Claude Code should default to PowerShell or cmd.exe, or at minimum respect CLAUDE_CODE_SHELL when set.

HUMAN NOTE: I, Alex Bleakley, gave Claude permission to write this bug report. I understand the contents to be accurate, but have not carefully verified this.