claude plugin eval: every Bash call fails with "bwrap: loopback: Failed RTM_NEWADDR" (ref #14719, #55585)

Preflight Checklist

• [x] I have searched existing issues. This is the error from #14719 and #55585, both closed as not planned by the inactivity bot and now locked, so I am filing a new one as they ask. The new part is where it hits: claude plugin eval.
• [x] This is a single bug report
• [x] I am using the latest version of Claude Code

What's Wrong?

In claude plugin eval runs with --allow-tools Bash, every Bash tool call made by the agent under test fails immediately with:

bwrap: loopback: Failed RTM_NEWADDR: Operation not permitted

This includes trivial commands (echo hi, pwd, node --version). It happened in 6 of 6 runs across two eval cases. Glob, Grep and Read work, so agents fall back to reading files and still produce plausible answers. Graders that check the reply or a tool_used: Bash call still pass, which hides the failure unless you read the trace.

What Should Happen?

Bash should run in eval runs, or the runner should fail the run with a clear sandbox error instead of letting the agent continue without a shell.

Error Messages/Logs

From --keep-temp traces (/tmp/claude-eval-*/out/trace.jsonl):

Bash: node <plugin>/skills/.../check.mjs spec.md
  > Exit code 1 | bwrap: loopback: Failed RTM_NEWADDR: Operation not permitted
Bash: which node; node --version
  > Exit code 1 | bwrap: loopback: Failed RTM_NEWADDR: Operation not permitted
Bash: echo hello
  > Exit code 1 | bwrap: loopback: Failed RTM_NEWADDR: Operation not permitted

Steps to Reproduce

1. In a plugin repo with an evals/ suite, pick any case whose agent uses Bash.
2. Run:

``
claude plugin eval . --trust-plugin --scaffold --allow-tools Bash --ablation none --keep-temp --case '<case>' --json /tmp/out.json
``

1. Open /tmp/claude-eval-*/out/trace.jsonl: every Bash tool_result is the error above.

Environment

• Claude Code 2.1.270 (native install)
• Ubuntu 24.04.5 LTS, kernel 7.0.0-34-generic
• bubblewrap 0.9.0 (/usr/bin/bwrap, not setuid)
• kernel.apparmor_restrict_unprivileged_userns = 1, kernel.unprivileged_userns_clone = 1
• AppArmor profiles present: unprivileged_userns, lxc-usernsexec; no profile for bwrap

What I checked

• On the host, all of these exit 0:
• bwrap --ro-bind / / --unshare-net true
• bwrap --ro-bind / / --unshare-user --unshare-net true
• nested: bwrap --dev-bind / / --unshare-user --unshare-net -- bwrap --dev-bind / / --unshare-user --unshare-net true
• In a normal interactive Claude Code session on the same machine, Bash works, but the process has no PID namespace (NSpid shows a single PID). That looks like the silent sandbox fallback described in #55585. The eval runner does not fall back: it keeps sandboxing each command, and each one fails.

So I cannot reproduce the failure with plain bwrap. It seems specific to the bwrap invocation Claude Code uses, and in the eval runner nothing falls back when it fails.

Related

#14719, #55585