Sandbox: "ask" permission prompts blocked for git commit in Linux devcontainer despite correct excludedCommands config

Bug Report: Sandbox "ask" permission prompts not appearing for git commit commands in Linux devcontainer

Claude Code Version: 2.1.37

Environment:

• OS: Linux (Docker devcontainer)
• Shell: bash
• Context: Running inside VS Code devcontainer with sandbox enabled
• Important: System shows warning "Glob patterns in sandbox permission rules are not fully supported on Linux"

Description:

When running Claude Code with sandbox enabled in a Linux devcontainer environment, commands in the "ask" permissions array are being silently denied without showing the permission prompt dialog. Specifically, Bash(git commit:*) is blocked with "Permission denied" instead of prompting the user for approval.

The system recognizes the command as "unsandboxed" (showing "Bash command (unsandboxed)" message) but still blocks it instead of prompting.

What We Tried (Nothing Worked):

We attempted multiple sandbox configuration changes to make the "ask" prompt appear, but none of them worked :(

1. ❌ Added git to excludedCommands: "excludedCommands": ["git"] - still blocked

• Note: Documentation confirms this IS the correct approach for per-command unsandboxed allowance

1. ❌ Enabled allowUnsandboxedCommands: "allowUnsandboxedCommands": true - still blocked
2. ❌ Configured filesystem write permissions: Added .git to "filesystem": { "write": { "allowOnly": [...]}} - still blocked
3. ❌ Tried glob patterns: .git/, .git/*, .git/** - still blocked (and got warning about glob patterns on Linux)
4. ❌ Ran with skip permissions mode enabled - still blocked
5. ❌ Set allowUnsandboxedCommands: false then back to true - still blocked

Despite all these configuration attempts, the "ask" permission prompt never appeared.

Key Finding:

Documentation confirms that excludedCommands: ["git"] is the correct and intended way to allow git to run unsandboxed while keeping other commands sandboxed. This is working as designed - the system recognizes git as needing unsandboxed execution (shows "Bash command (unsandboxed)"). However, the "ask" permission prompt still fails to appear for commands in the "ask" array.

Linux-Specific Context:

When attempting glob patterns like .git/* or .git/**, the system shows:

Warning: Glob patterns in sandbox permission rules are not fully supported on Linux

This Linux limitation may be related to why the sandbox permissions and "ask" prompts aren't working as expected.

Configuration:

.claude/settings.json (final attempted configuration):

{
  "sandbox": {
    "enabled": true,
    "excludedCommands": ["git"],
    "autoAllowBashIfSandboxed": true,
    "allowUnsandboxedCommands": true,
    "filesystem": {
      "write": {
        "allowOnly": [
          "/tmp/claude-1000",
          ".git"
        ]
      }
    }
  },
  "permissions": {
    "ask": [
      "Bash(git commit:*)"
    ]
  }
}

Expected Behavior:

When Claude attempts to run git commit:

1. System recognizes git is excluded from sandbox (shows "Bash command (unsandboxed)")
2. Permission prompt appears asking user to approve or deny the command
3. User can approve/deny the specific git commit operation

Actual Behavior:

1. ✅ System recognizes git is excluded from sandbox (shows "Bash command (unsandboxed)")
2. ❌ Command is immediately blocked with: Error: Permission to use Bash with command git commit ... has been denied.
3. ❌ No permission prompt appears

This happens even with:

• ✅ git in excludedCommands (correct per-command unsandboxed allowance)
• ✅ allowUnsandboxedCommands: true
• ✅ .git in filesystem write allowOnly
• ✅ Skip permissions mode enabled

Root Cause Hypothesis:

On Linux, when a command in the "ask" array is in excludedCommands and recognized as needing unsandboxed execution, the permission system blocks it instead of prompting. The sandbox evaluation correctly identifies the command as unsandboxed, but the permission prompt mechanism fails before executing.

Steps to Reproduce:

1. Set up Claude Code in a Linux devcontainer environment
2. Enable sandbox in .claude/settings.json
3. Add "git" to excludedCommands array
4. Add "Bash(git commit:*)" to the "ask" array (not "allow")
5. Set allowUnsandboxedCommands: true
6. Attempt to run a git commit command via Claude
7. Observe "Bash command (unsandboxed)" message appears
8. Observe command is blocked without permission prompt

Workaround:

Moving "Bash(git commit:*)" from "ask" to "allow" array works, but defeats the purpose of the "ask" permission level for important git operations.

Additional Context:

Other git commands in the "allow" array work fine with the sandbox:

• "Bash(git add:*)" ✅ works
• "Bash(git status:*)" ✅ works
• "Bash(git log:*)" ✅ works

The issue appears specific to:

• Commands in the "ask" array
• That are in excludedCommands (run unsandboxed)
• Running in a sandbox-enabled Linux devcontainer environment
• May be related to documented Linux glob pattern limitations

Impact:

This prevents users from having granular permission control over destructive git operations while using sandbox mode in Linux devcontainers. Users must choose between:

• Complete allowance (move to "allow" array, no prompts)
• Complete blocking (keep in "ask", never works)

The intended middle ground of "prompt on each use" is not functional.

---

This bug report was created using Claude Code CLI (version 2.1.37)