Sandbox regression in 2.1.84: external CLI tools crash on macOS SCDynamicStoreCreate

Bug Description

External CLI tools (specifically OpenAI Codex CLI codex exec) that link to macOS SystemConfiguration.framework crash with a panic when executed via the Bash tool in Claude Code 2.1.84. The same command works fine outside the sandbox (via ! prefix) and worked correctly in 2.1.83.

Environment

• Claude Code version: 2.1.84 (regression from 2.1.83)
• OS: macOS Darwin 25.2.0 (Apple Silicon)
• Codex CLI version: 0.104.0
• Sandbox enabled: yes (default settings)

Steps to Reproduce

1. Have codex CLI installed (codex-cli 0.104.0)
2. Run via Bash tool in Claude Code 2.1.84:

``
codex exec -m gpt-5.4 --full-auto "respond with just OK"
``

Expected Behavior

Codex executes and returns the response (as it does in 2.1.83 and when run outside sandbox with ! prefix).

Actual Behavior

WARNING: proceeding, even though we could not update PATH: Operation not permitted (os error 1)

thread 'main' (28127189) panicked at /Users/runner/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/system-configuration-0.6.1/src/dynamic_store.rs:154:1:
Attempted to create a NULL object.

The Rust system-configuration crate (v0.6.1) calls SCDynamicStoreCreate from macOS SystemConfiguration.framework, which returns NULL under the 2.1.84 sandbox, causing a panic. This is used by HTTP clients (e.g., reqwest) for system proxy detection.

Verification

| Method | Result |
|--------|--------|
| Bash tool (sandboxed, 2.1.84) | ❌ Panic |
| ! prefix (unsandboxed, 2.1.84) | ✅ Works |
| Bash tool (sandboxed, 2.1.83) | ✅ Worked (user confirmed) |
| Different working directories (/tmp) | ❌ Same panic |
| env -i, --dangerously-bypass-approvals-and-sandbox | ❌ Same panic |

Impact

Any external CLI tool that uses Rust's system-configuration crate (common in HTTP clients like reqwest, hyper) will crash under the 2.1.84 sandbox. This breaks workflows that rely on calling external AI tools (e.g., cross-model review via Codex) from within Claude Code.

Workaround

Run the command via ! prefix (outside sandbox), but this requires manual user interaction each time.