sandbox.excludedCommands not honored — adb/fastboot still run inside the sandbox namespace

Summary

sandbox.excludedCommands in settings.json is documented to run listed commands outside the sandbox, but the harness still executes them inside the sandboxed user/pid/net namespace. This makes adb and fastboot unusable for any USB-attached Android device, because the sandbox does not bind-mount /dev/bus/usb — even though excludedCommands is configured for them.

Configuration

~/.claude/settings.json:

"sandbox": {
  "enabled": true,
  ...
  "excludedCommands": ["adb", "fastboot"]
}

Expected

adb and fastboot invoked via the Bash tool should execute outside the sandbox — same namespaces as the user's terminal — and therefore see /dev/bus/usb and any connected USB devices.

Actual

They run inside the sandbox. adb devices returns an empty device list. The Android device is visible to lsusb (which reads sysfs, which is exposed) but not to adb (which needs /dev/bus/usb, which is not).

Reproduction

1. Connect any Android device over USB. Confirm in a normal terminal: adb devices shows the serial.
2. In Claude Code with the default sandbox enabled and excludedCommands: ["adb", "fastboot"] set, run via the Bash tool:

• adb devices → List of devices attached (empty)
• ls /dev/bus/usb → No such file or directory
• lsusb → device IS listed (e.g. Google Inc. Nexus/Pixel Device)
• readlink /proc/self/ns/{pid,net,user} → non-default namespace IDs (e.g. 4026533xxx), confirming sandbox is active for this command

1. Re-run the same adb devices with dangerouslyDisableSandbox: true → device serial appears, /dev/bus/usb is populated.

Impact

Any workflow that needs a real Android device — APK deploy, logcat capture, on-device test runs — is blocked unless every adb/fastboot invocation explicitly bypasses the sandbox, which prompts the user each time. The whole point of excludedCommands is to avoid this.

Environment

• Linux 6.17.0-20-generic, x86_64
• Claude Code CLI
• adb 1.0.41 (platform-tools 36.0.0)

Suggested fix

Honor sandbox.excludedCommands for top-level Bash invocations: when the resolved command (after parsing cmd args...) matches a name in the list, run it in the host namespaces rather than the sandbox.