sandbox.excludedCommands does not bypass network restrictions (SSH blocked for git)

Bug Description

sandbox.excludedCommands does not exempt commands from network sandbox restrictions. Commands listed in excludedCommands are documented as running with "full system access (no isolation)", but the network sandbox still applies, blocking protocols like SSH (port 22) even for excluded commands.

This makes git push over SSH impossible when the sandbox is enabled, even with "git" in excludedCommands.

Reproduction Steps

1. Configure sandbox settings:

{
  "sandbox": {
    "enabled": true,
    "excludedCommands": ["git"],
    "network": {
      "allowedDomains": ["github.com"]
    }
  }
}

1. Run git push via the Bash tool on a repo with an SSH remote
2. Observe the error:

ssh: connect to host github.com port 22: Network is unreachable
fatal: Could not read from remote repository.

1. Running ssh -vT git@github.com directly also fails — confirming the network sandbox applies globally, not per-command:

debug1: Connecting to github.com [140.82.116.3] port 22.
debug1: connect to address 140.82.116.3 port 22: Network is unreachable

1. SSH to github.com works fine outside of Claude Code.

Expected Behavior

Commands in excludedCommands should bypass all sandbox restrictions, including network filtering. git push over SSH should work when "git" is in excludedCommands.

Actual Behavior

excludedCommands appears to only bypass filesystem sandboxing (bubblewrap). The network sandbox (domain/port restrictions) is applied globally to all commands regardless of excludedCommands, blocking SSH (port 22) even when the domain is in allowedDomains.

Possible Solutions

• excludedCommands should also bypass network restrictions for the excluded process and its children
• Alternatively, allowedDomains could support port-aware entries or a protocol allowlist (e.g., allow SSH on port 22 in addition to HTTPS)

Environment

• Claude Code version: 2.1.39
• OS: NixOS, Linux 6.12.68
• Shell: zsh
• Git remote transport: SSH