excludedCommands: ["git"] does not fully bypass sandbox — SSH subprocess network access blocked

Bug Description

git push to an SSH remote fails in sandbox mode despite git being listed in excludedCommands. The SSH subprocess chain (git → ssh → TCP connection) is still subject to sandbox network restrictions, causing DNS resolution to fail.

Steps to Reproduce

1. Configure ~/.claude/settings.json with:

``json
{
"sandbox": {
"enabled": true,
"excludedCommands": ["git", "code"],
"network": {
"allowedDomains": ["*"]
}
}
}
``

1. Have a git remote using SSH: ssh://example.host/path/to/repo
2. Run git push via the Bash tool (without dangerouslyDisableSandbox)

Expected Behavior

git push should succeed because git is in excludedCommands, which should exempt the entire process tree from sandboxing.

Actual Behavior

nc: getaddrinfo: nodename nor servname provided, or not known
Connection closed by UNKNOWN port 65535
fatal: Could not read from remote repository.

The error indicates the sandbox is routing the SSH network connection through an nc wrapper that cannot resolve the hostname. There is no ProxyCommand in ~/.ssh/config — the nc invocation originates from the sandbox's own network interception layer.

Retrying the same command with dangerouslyDisableSandbox: true succeeds immediately.

Notes

• The failure is intermittent in the sense that it happens on the first attempt in a session, and the dangerouslyDisableSandbox workaround always works
• allowedDomains: ["*"] is set, so even if the sandbox were applied, the domain should be allowed
• The SSH config (~/.ssh/config) contains no ProxyCommand — only AddKeysToAgent, ForwardAgent, UseKeyChain, and a GitHub-specific IdentityFile

Environment

• Claude Code: 2.1.72
• macOS 15.7.4 (arm64, Apple Silicon)
• Git: /opt/homebrew/bin/git
• Shell: zsh