[FEATURE] Sandbox: per-repo egress by host + port + protocol (TCP/UDP); the only built-in route prompts every time

Problem

Agents in a repo need to reach a specific LAN device over non-HTTP protocols: ssh to 10.0.0.141:22/tcp today, psql and others next.

On Linux (bubblewrap), the Bash sandbox has only loopback. All egress goes through the authenticated HTTP CONNECT proxy (localhost:3128) or the SOCKS5 proxy (localhost:1080). sandbox.network.allowedDomains takes exact hosts only: host:port and CIDR are rejected (sandbox-config.js:12, sandbox-runtime 0.0.67). There is no way to say "this repo may open raw TCP or UDP to host:port".

The only built-in route, sandbox.excludedCommands (run ssh outside the sandbox), prompts the user for approval on every call. That is a no-go for autonomous agents: the user wants every action either always allowed or never allowed, never asked.

Current workaround (a hack we want to delete)

• For ssh: ProxyCommand socat - PROXY:$CLOUDSDK_PROXY_ADDRESS:%h:%p,proxyport=$CLOUDSDK_PROXY_PORT,proxyauth=$CLOUDSDK_PROXY_USERNAME:$CLOUDSDK_PROXY_PASSWORD, applied only when SANDBOX_RUNTIME=1. This copies the runtime's own GIT_SSH_COMMAND pattern and depends on runtime-internal env vars.
• For clients with no proxy hook (psql, redis-cli, Go binaries), a generic local adapter is being built.
• Neither handles UDP.

Request

A declarative setting, e.g.

"sandbox": { "network": { "allow": [ { "host": "10.0.0.141", "port": 22, "protocol": "tcp" } ] } }

honoured inside the sandbox with no prompt, and working for any client, not only HTTP- or SOCKS-aware ones.

Related: #93462 (loopback Postgres), #28018 (localhost). Claude Code 2.1.280, Linux.