[FEATURE] Support wildcard in sandbox.excludedCommands setting

Preflight Checklist

• [x] I have searched existing requests and this feature hasn't been requested yet
• [x] This is a single feature request (not multiple features)

Problem Statement

I want Claude Code to be able to build and run the application it develops to test it. If the application is a server of some kind, that does not work well if it gets run in the sandbox, since it cannot reach it to test it. Therefore, I want to exclude the application from sandboxing.

Proposed Solution

I want to be able to specify a wildcard in sandbox.excludedCommands to match all executable files in a directory, e.g. /tmp/claude/*:*.

Alternative Solutions

You can specify the exact path to your compiled application in sandbox.excludedCommands setting, but it is quite inconvenient since I then need to have one entry per application I develop with Claude Code.

Another option would be to use sandbox.network.allowLocalBinding, but that does not work on Linux, and perhaps you don't want to allow that for all commands.

Priority

Medium - Would be very helpful

Feature Category

Configuration and settings

Use Case Example

_No response_

Additional Context

_No response_