sandbox.excludedCommands does not bypass network restrictions (SSH blocked for git)

Bug Description

sandbox.excludedCommands does not exempt commands from network sandbox restrictions. Commands listed in excludedCommands are documented as running with "full system access (no isolation)", but the network sandbox still applies, blocking protocols like SSH (port 22) even for excluded commands.

This makes git push over SSH impossible when the sandbox is enabled, even with "git" in excludedCommands.

Reproduction Steps

1. Configure sandbox settings:

{
  "sandbox": {
    "enabled": true,
    "excludedCommands": ["git"],
    "network": {
      "allowedDomains": ["github.com"]
    }
  }
}

1. Run git push via the Bash tool on a repo with an SSH remote
2. Observe the error:

ssh: connect to host github.com port 22: Network is unreachable
fatal: Could not read from remote repository.

1. Running ssh -vT git@github.com directly also fails — confirming the network sandbox applies globally, not per-command:

debug1: Connecting to github.com [140.82.116.3] port 22.
debug1: connect to address 140.82.116.3 port 22: Network is unreachable

1. SSH to github.com works fine outside of Claude Code.

Expected Behavior

Commands in excludedCommands should bypass all sandbox restrictions, including network filtering. git push over SSH should work when "git" is in excludedCommands.

Actual Behavior

excludedCommands appears to only bypass filesystem sandboxing (bubblewrap). The network sandbox (domain/port restrictions) is applied globally to all commands regardless of excludedCommands, blocking SSH (port 22) even when the domain is in allowedDomains.

Possible Solutions

• excludedCommands should also bypass network restrictions for the excluded process and its children
• Alternatively, allowedDomains could support port-aware entries or a protocol allowlist (e.g., allow SSH on port 22 in addition to HTTPS)

Environment

• Claude Code version: 2.1.39
• OS: NixOS, Linux 6.12.68
• Shell: zsh
• Git remote transport: SSH

The sandbox is blocking reads to ~/.ssh/known_hosts and private keys, causing SSH host verification to fail entirely.

Workaround that fixed it for me: Remove `Read(~/.ssh/**)` from the permissions.deny list in settings.json. But this is not ideal as it allows the other tools that can run in sandbox to also read the keys. 

nc: getaddrinfo: nodename nor servname provided, or not known
Connection closed by UNKNOWN port 65535
fatal: Could not read from remote repository.