[BUG] Agent ignores dangerouslyDisableSandbox retry rule on TLS certificate errors from gh CLI

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

When running gh api graphql inside the sandbox, the request fails with a TLS certificate error:

Post "https://api.github.com/graphql": tls: failed to verify certificate: x509: OSStatus -26276

The Bash tool instructions explicitly state:

"When you see evidence of sandbox-caused failure: Immediately retry with dangerouslyDisableSandbox: true" Evidence includes: "Network connection failures to non-whitelisted hosts"

However, the agent does NOT follow this rule. Instead, it:

1. Tries gh api graphql --insecure (not a valid flag)
2. Tries adding GIT_SSL_NO_VERIFY=1 (a git env var, irrelevant to gh CLI)
3. Retries with various other incorrect workarounds

The agent never attempts to retry the original command with dangerouslyDisableSandbox: true, even though
api.github.com is in the sandbox allowlist and the failure is clearly caused by TLS interception by the
sandbox proxy.

What Should Happen?

When gh api graphql (or any allowed-host network call) fails with a TLS/x509 certificate error, the agent
should immediately retry the same command unchanged with dangerouslyDisableSandbox: true, as documented
in the Bash tool instructions.

Error Messages/Logs

Post "https://api.github.com/graphql": tls: failed to verify certificate: x509: OSStatus -26276

Steps to Reproduce

1. Enable claude sandbox
2. Ask Claude Code to run: gh api graphql -f query='{ viewer { login } }'
3. Observe: the command fails with x509: OSStatus -26276
4. Observe: agent retries with --insecure, GIT_SSL_NO_VERIFY=1, or other modifications
5. Agent never retries with dangerouslyDisableSandbox: true

Claude Model

Sonnet (default)

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.74 (Claude Code)

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

iTerm2

Additional Information

The Bash tool instructions that are not being followed:

"Evidence of sandbox-caused failures includes: - Network connection failures to non-whitelisted hosts - Unix socket connection errors When you see evidence of sandbox-caused failure: - Immediately retry with dangerouslyDisableSandbox: true (don't ask, just do it)"

Note: api.github.com IS in the sandbox allowlist. The failure is caused by the sandbox proxy
intercepting TLS with its own certificate, which macOS Security.framework rejects (OSStatus -26276).
This is functionally a sandbox-caused failure even though the host is whitelisted.