[BUG] `gcloud` tool cannot be used in sandbox

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

I am running claude with the sandbox enabled:

{
  "permissions": {
    "allow": [
      "Bash(gcloud storage ls *)",
      "Edit(~/.config/gcloud/logs/)"
    ]
  },
  "sandbox": {
    "enabled": true
  }
}

However, the command gcloud storage ls executed by Claude fails with an error:

❯ Please list the contents of this gcloud storage folder: gs://redacted/foo/                                                                                               
                                                                                                                                                     
⏺ Bash(gcloud storage ls gs://redacted/foo/)                                                                                                                               
  ⎿  Error: Exit code 1                                                                                                                                                                                                                             
     ERROR: (gcloud.storage.ls) Invalid value for property [proxy/type]: The proxy type property value [https] is not valid. Possible values: [http, http_no_tunnel, socks4, socks5].                                                               
                      
     ERROR: (gcloud.storage.ls) Invalid value for property [proxy/type]: The proxy type property value [https] is not valid. Possible values: [http, http_no_tunnel, socks4, socks5].                                                               

What Should Happen?

I expect the command to succeed, as it does without the sandbox.

Error Messages/Logs

⎿  Error: Exit code 1                                                                                                                                                                                                                             
     ERROR: (gcloud.storage.ls) Invalid value for property [proxy/type]: The proxy type property value [https] is not valid. Possible values: [http, http_no_tunnel, socks4, socks5].                                                               
                      
     ERROR: (gcloud.storage.ls) Invalid value for property [proxy/type]: The proxy type property value [https] is not valid. Possible values: [http, http_no_tunnel, socks4, socks5].

Steps to Reproduce

1. Create an empty folder with the settings above
2. Ask claude to list the contents of a GCS storage bucket

Claude Model

Sonnet (default)

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.56 (Claude Code)

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

Claude itself seems to point to the CLOUDSDK_PROXY_TYPE as the cluprit when asked to debug:

⏺ The proxy isn't in the config file — it only has core settings. Let me check for environment variables or other sources.
                       
⏺ Bash(env | grep -i proxy)                                                 
  ⎿  NO_PROXY=localhost,127.0.0.1,::1,*.local,.local,169.254.0.0/16,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
     no_proxy=localhost,127.0.0.1,::1,*.local,.local,169.254.0.0/16,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16                                                                                                                                         
     HTTP_PROXY=http://localhost:53282                                                                                                                                                                                                              
     … +16 lines (ctrl+o to expand)                                                                                                                                                                                                                 
                                                                                                                                                                                                                                                    
⏺ There it is. The proxy is configured entirely via environment variables injected by the sandbox, specifically:                                                                                                                                    
                                                                            
  CLOUDSDK_PROXY_TYPE=https                                                                                                                                                                                                                         
  CLOUDSDK_PROXY_ADDRESS=localhost                                                                                                                                                                                                                  
  CLOUDSDK_PROXY_PORT=53282
                                                                                                                                                                                                                                                    
  These CLOUDSDK_* environment variables are gcloud-specific and override the config file. The sandbox also sets the standard HTTP_PROXY/HTTPS_PROXY vars (correctly using http://...) for other tools, but for gcloud it uses the
  CLOUDSDK_PROXY_TYPE=https variable — and as established, https is not a valid value for that field.

  So the fix would be for the Claude Code sandbox to set CLOUDSDK_PROXY_TYPE=http instead of https.