[BUG] sandbox: SOCKS5 proxy requires authentication that BSD nc cannot negotiate, breaking SSH git operations

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report
• [x] I am using the latest version of Claude Code

What's Wrong?

When sandbox.enabled: true is set (via managed settings), Claude Code injects GIT_SSH_COMMAND into the shell to route SSH traffic through its SOCKS5 proxy:

GIT_SSH_COMMAND=ssh -o ControlMaster=no -o ControlPath=none -o ProxyCommand='nc -X 5 -x localhost:<PORT> %h %p'

The sandbox's SOCKS5 proxy requires authentication, but BSD netcat (/usr/bin/nc on macOS) only supports unauthenticated SOCKS5. No credentials are provided in the injected GIT_SSH_COMMAND. The authentication negotiation fails and every SSH git operation (git pull, git push, git fetch) fails.

What Should Happen?

SSH git operations should succeed through the sandbox proxy. Either the proxy should not require SOCKS5 authentication, or credentials should be embedded in the injected GIT_SSH_COMMAND.

Error Messages/Logs

nc: authentication method negotiation failed
Connection closed by UNKNOWN port 65535
fatal: Could not read from remote repository.
Please make sure you have the correct access rights and the repository exists.

Steps to Reproduce

1. Enable sandbox via managed settings (sandbox.enabled: true)
2. Open Claude Code
3. Run git pull on any repo with an SSH remote (git@github.com:org/repo.git)
4. Observe the error above

To confirm the injected proxy is the cause:

# Inside a Claude Code bash session:
echo $GIT_SSH_COMMAND
# Shows: ssh ... -o ProxyCommand='nc -X 5 -x localhost:PORT %h %p'

# Workaround that confirms root cause:
env -u GIT_SSH_COMMAND git pull  # succeeds

Claude Model

Not applicable (sandbox/tooling bug)

Is this a regression?

Yes — previously worked, broke with a recent sandbox update

Claude Code Version

2.1.190

Platform

Anthropic API

Operating System

macOS

Terminal

iTerm2

Additional Information

/usr/bin/nc on macOS does support SOCKS5 (-X 5) but only without authentication — there are no flags for SOCKS5 credentials. The proxy is requiring an auth method nc cannot satisfy.

Workaround: export GIT_SSH_COMMAND="" before launching Claude Code bypasses the proxy injection.

if (platform === 'macos') {
  // macOS: use BSD nc SOCKS5 proxy support (-X 5 -x). nc has no SOCKS5
  // auth, so when proxyAuthToken is set, git-over-ssh fails at the SOCKS
  // handshake — use git-over-https (HTTP_PROXY carries the credential).
  envVars.push(
    `GIT_SSH_COMMAND=ssh ${sshMuxOverride} -o ProxyCommand='nc -X 5 -x localhost:${socksProxyPort} %h %p'`,
  )
}

if (platform === 'macos' && !proxyAuthToken) {
  envVars.push(
    `GIT_SSH_COMMAND=ssh ${sshMuxOverride} -o ProxyCommand='nc -X 5 -x localhost:${socksProxyPort} %h %p'`,
  )
}

{
  "hooks": {
    "SessionStart": [
      {
        "matcher": "",
        "hooks": [
          {
            "type": "command",
            "command": "echo 'export GIT_SSH_COMMAND=ssh' >> \"$CLAUDE_ENV_FILE\""
          }
        ]
      }
    ]
  }
}

{
  "hooks": {
    "SessionStart": [
      {
        "matcher": "",
        "hooks": [
          {
            "type": "command",
            "command": "echo 'unset GIT_SSH_COMMAND' >> \"$CLAUDE_ENV_FILE\""
          }
        ]
      }
    ]
  }
}