Bug: excludedCommands doesn't clear proxy env vars, breaking Go binaries like gh

Summary

Below, is claude code's assessment of the issue. I wanted to run gh in sandbox mode but it failed with:

Get "https://api.github.com/rate_limit": tls: failed to verify certificate: x509: OSStatus -26276

After trying lots of things I could not get it to work and tried adding it to the excludedCommands, but it still fails.

excludedCommands is supposed to fully bypass the sandbox, but the network proxy environment variables (HTTP_PROXY, HTTPS_PROXY, ALL_PROXY, etc.) are still set when excluded commands run. This causes Go binaries like gh to route through the sandbox proxy and fail TLS verification.

Reproduction

1. Enable sandbox with gh excluded:

{
  "sandbox": {
    "enabled": true,
    "autoAllowBashIfSandboxed": true,
    "excludedCommands": ["gh"],
    "network": {
      "allowedDomains": ["github.com", "api.github.com"]
    }
  }
}

1. Run gh api /rate_limit from Claude Code. It fails:

Post "https://api.github.com/rate_limit": tls: failed to verify certificate: x509: OSStatus -26276

1. Checking env vars inside the bash session shows the proxy is still set:

HTTP_PROXY=http://localhost:<port>
HTTPS_PROXY=http://localhost:<port>
ALL_PROXY=socks5h://localhost:<port>

1. Clearing them manually doesn't help either — Seatbelt blocks direct network access, so the proxy is required:

HTTP_PROXY= HTTPS_PROXY= ALL_PROXY= gh api /rate_limit
# error connecting to api.github.com

Root cause

The proxy env vars are injected at the shell session level. excludedCommands may skip the Seatbelt sandbox wrapper, but since the proxy vars are already in the environment, Go's net/http still routes through the proxy. The proxy does TLS interception, and Go's macOS Security.framework verifier rejects the proxy's certificate.

curl and Python work fine because they use their own CA cert bundles, but Go uses the macOS system verifier which fails.

Expected behavior

Excluded commands should bypass the sandbox entirely — no Seatbelt restrictions and no proxy routing. Either:

• Clear proxy env vars for excluded commands, or
• Exempt excluded commands from Seatbelt network restrictions so they can connect directly without the proxy

Environment

• macOS (Darwin 25.3.0)
• Claude Code with sandbox enabled
• gh 2.87.2 (Go binary)