[BUG] can't run trunk with sandbox mode enabled

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Title: macOS sandbox blocks setpriority() on child processes, breaking trunk and similar daemon-based tools

Body:

Summary

On macOS, the Claude Code sandbox profile allows process-info* only with (target same-sandbox). This blocks any tool that calls setpriority() on child processes that were not exec'd inside the sandbox, which breaks trunk and likely other
daemon-based linters/formatters.

Root cause

The hardcoded macOS SBPL profile contains:
(allow process-info* (target same-sandbox))

Trunk's architecture is: CLI → gRPC daemon (spawned on first run, persists across calls) → worker processes (eslint, prettier, etc.). The daemon calls setpriority() on its worker processes. Since the workers may not satisfy (target
same-sandbox), this syscall is denied with "Operation not permitted", and all linters fail.

Error

trunk: setpriority() failed: Operation not permitted

Workaround

Pass dangerouslyDisableSandbox: true on every trunk Bash call. This works but defeats the purpose of sandboxing.

Requested fix

Add a settings.json option — e.g.:

{
"sandbox": {
"process": {
"allowSetpriority": true
}
}
}

…that would loosen the process-info* rule to allow setpriority() on non-sandboxed child processes. This would let trunk (and similar tools like bazel, cargo, sbt) work within the sandbox without a full bypass.

Environment

• macOS 15.x (Darwin 25.x)
• Claude Code CLI
• trunk v1.x

What Should Happen?

Running trunk check (or any tool that uses setpriority() on child processes) inside the Claude Code sandbox should succeed without requiring dangerouslyDisableSandbox: true. The sandbox should provide a settings.json option to allow
▎ process-info* without the (target same-sandbox) restriction, so daemon-based tools can nicely coexist with sandboxing rather than requiring a full bypass.

Error Messages/Logs

setpriority() failed: Operation not permitted                                                                                                                                                                                                   
                                                                                                                                                                                                                                                  
  And if you ran trunk with verbose output, you'd also see the earlier connection error before the sandbox settings were tuned:                                                                                                                   
                                                                                                                                                                                                                                                  
  failed to connect to all addresses; ipv4:127.0.0.1:0 Operation not permitted                                                                                                                                                                    
                                                                                                                                                                                                                                                  
  The setpriority() one is the core issue — that's the one that persists even after the network settings are fixed.

Steps to Reproduce

1. Install trunk in a repo (trunk init)
2. Open Claude Code in that repo (sandbox enabled, default settings)
3. Ask Claude to run trunk check <some-file>
4. Claude runs trunk check via the Bash tool (sandboxed)

Result: trunk fails with setpriority() failed: Operation not permitted

Note: Running trunk check directly in a terminal outside Claude Code succeeds. The failure is specific to the Claude Code sandbox environment.

Claude Model

None

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.118 (Claude Code)

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

_No response_