PowerShell tool: pwsh.exe fails with "Permission denied" (exit 126) inside sandboxed session, while powershell.exe works fine
Environment: Windows 11, Claude Code CLI, PowerShell tool (targets PowerShell 7 / pwsh)
Issue: Every PowerShell tool call fails immediately with Exit code 1, no stdout/stderr body — even trivial commands like Write-Host "hello".
Isolation: Using the Bash tool to directly exec pwsh.exe (from C:\Program Files\PowerShell\7\) fails with Permission denied (exit 126), reproducible regardless of quoting, working directory, or dangerouslyDisableSandbox: true.
Ruled out:
- File is executable (
rwxr-xr-x), correct ACLs - Valid Authenticode signature
- No Zone.Identifier / blocked-file marker
- Windows Defender not flagging it
Key clue: Legacy powershell.exe (Windows PowerShell 5.1, in System32) runs fine via Bash in the same session — only pwsh.exe (in Program Files, a non-system path) is blocked.
Confirmed pwsh runs fine outside the sandbox in a normal terminal on the same machine — the block is specific to the Claude Code sandboxed session, not the OS install.
Suspected cause: the session's sandbox restricts subprocess execution to system-path binaries and doesn't allow-list pwsh.exe.