[BUG] Bash-tool sandbox cannot reach port 5432 on an AAAA-only (IPv6) Supabase host; port 443 on a sibling host works fine

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Body:

Summary

From within a Claude Code session's Bash/PowerShell sandbox, TCP connections
to port 5432 on an IPv6-only Supabase database host time out with no
response, while port 443 on a related host (same project, no "db." prefix)
connects normally from the same sandbox.

Environment

• Platform: Windows 11 Pro, Claude Code CLI (Bash tool + PowerShell tool)
• Target host: db.bbvlvimogurniznocodi.supabase.co
• Target host resolves via AAAA only: 2406:da18:167b:f901:d841:2601:f538:a6f1

(confirmed via PowerShell Resolve-DnsName)

What works

• DNS resolution for the target host succeeds and returns a stable IPv6

address.

• The same project's REST API host WITHOUT the "db." prefix

(bbvlvimogurniznocodi.supabase.co) responds successfully on port 443
from the same sandbox.

What fails

• TCP connections to db.bbvlvimogurniznocodi.supabase.co:5432 time out

(no SYN-ACK, no RST — silent) from the same sandbox, confirmed via two
independent methods, repeated across multiple runs and across a fresh
session:

• Bash tool: cat < /dev/null > /dev/tcp/db.bbvlvimogurniznocodi.supabase.co/5432
• PowerShell: Test-NetConnection -ComputerName db.bbvlvimogurniznocodi.supabase.co -Port 5432

Both consistently report failure (Test-NetConnection: TcpTestSucceeded=False).

Not tested (flagging as open questions, not claims)

• Port 6543 (Supabase's pooler port) on the same host
• Port 443 on the db. host itself (only the sibling non-db. host was tested

on 443)

• Whether this reproduces in a remote-isolated subagent environment
• Supabase's own status page

Question

Is egress from Claude Code's Bash-tool sandbox restricted on port 5432 (or
non-443 ports generally) to IPv6-only destinations? Or is this specific to
this host/route? Any pointer to what differs in the network path for this
port vs. 443 would help narrow it down.

What Should Happen?

Bash-tool sandbox should be able to establish a TCP connection to port 5432 on db.bbvlvimogurniznocodi.supabase.co, the same way it can reach port 443 on the sibling host (bbvlvimogurniznocodi.supabase.co) without a "db." prefix.

Error Messages/Logs

PowerShell: Test-NetConnection -ComputerName db.bbvlvimogurniznocodi.supabase.co -Port 5432
Result: TcpTestSucceeded: False

Steps to Reproduce

1. From a Bash-tool session, run:

cat < /dev/null > /dev/tcp/db.bbvlvimogurniznocodi.supabase.co/5432

1. Observe: command hangs / times out with no response (no SYN-ACK, no RST).
2. For comparison, run the same test against the sibling host without "db." prefix on port 443:

cat < /dev/null > /dev/tcp/bbvlvimogurniznocodi.supabase.co/443

1. Observe: this connects successfully, confirming general egress works and DNS resolves correctly — the failure is specific to the db. host on port 5432.

Claude Model

None

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

opus5

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

Terminal.app (macOS)

Additional Information

_No response_