[BUG] 2.1.283: sandbox.excludedCommands never unsandboxes aws calls with --profile or --endpoint-url (Linux)

Environment

• Claude Code 2.1.283
• Linux (bubblewrap sandbox), zsh
• sandbox.excludedCommands: ["aws *", ...], sandbox.allowUnsandboxedCommands: false
• sandbox.filesystem.denyRead: ["~/"], so ~/.aws is only reachable from unsandboxed commands

What happens

An aws call is taken out of the sandbox by the aws * entry, unless it has --profile or --endpoint-url. With either flag the call stays sandboxed, whatever excludedCommands contains.

Classification checked with the Bash tool's allowed_domains parameter (rejected for commands that won't run sandboxed) and by running the commands:

| Command | Runs |
|---|---|
| aws configure list-profiles | unsandboxed |
| aws sts get-caller-identity --region eu-west-1 | unsandboxed |
| aws configure list-profiles --output json / --query '[0]' / --no-cli-pager | unsandboxed |
| aws configure list-profiles --profile myprofile | sandboxed |
| aws configure list-profiles --profile=myprofile | sandboxed |
| aws --profile myprofile configure list-profiles | sandboxed |
| aws configure get region --profile myprofile | sandboxed → aws: [ERROR]: The config profile (myprofile) could not be found |
| aws configure list-profiles --endpoint-url https://example.com | sandboxed |

Adding "aws * --profile *" and "aws --profile *" to excludedCommands (and restarting) doesn't change the result.

Expected

Either aws * covers these calls like any other aws invocation, or the documentation lists --profile / --endpoint-url among the shapes that always stay sandboxed (settings-reference, sandbox.excludedCommands).

Impact

There is no way to choose an AWS profile per command in a strict-sandbox session: --profile stays sandboxed, and an env prefix (AWS_PROFILE=x aws ...) is sandboxed too. The failure looks like a missing profile rather than a sandbox restriction, so agents and users go looking in the wrong place.

Possibly the same family as #95455 (git -C, -c, --git-dir dropping single commands out of the exclusion).