[BUG] ermissions.allow entries with dangerouslyDisableSandbox:true still prompt for permission

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

The user is prompted for permission every time, even though the command and sandbox bypass flag match the allow entry exactly.

What Should Happen?

Commands matching a permissions.allow entry that includes dangerouslyDisableSandbox:true should be auto-allowed without prompting.

Error Messages/Logs

Steps to Reproduce

1. Add entries to settings.json like:

{
  "permissions": {
    "allow": [
      "Bash(git *, dangerouslyDisableSandbox:true)",
      "Bash(gh *, dangerouslyDisableSandbox:true)"
    ]
  },
  "sandbox": {
    "autoAllowBashIfSandboxed": true,
    "commandAllowlist": ["git", "gh"]
  }
}

1. In a conversation, run a command like git --version with dangerouslyDisableSandbox: true

1. Claude Code prompts the user for permission despite the command matching a permissions.allow entry

Claude Model

None

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.47

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

• The same commands run fine without dangerouslyDisableSandbox: true (auto-allowed via autoAllowBashIfSandboxed + commandAllowlist)
• The issue is specifically that dangerouslyDisableSandbox:true in the permission entry doesn't suppress the prompt when the sandbox is actually bypassed