Local sandbox (bwrap) hangs indefinitely when any unrelated hard-mounted NFS/autofs share is unreachable

Environment

• Claude Code desktop app, Linux
• Debian GNU/Linux 12 (bookworm), kernel 6.1.0-53-amd64
• Sandbox backend: bubblewrap (bwrap) 0.8.0-2+deb12u1
• Working directory: a local ext4 filesystem, unrelated to the affected mounts

Summary
With the desktop app's "local sandbox" setting enabled, the Bash tool hangs indefinitely on every command — including trivial ones like pwd — whenever any hard-mounted NFS share elsewhere on the system is unreachable (e.g. during server maintenance), even though the command and working directory have nothing to do with that share.

Root cause
This host automounts several NFS shares via autofs (plus a couple of direct NFS mounts), many configured with the NFS hard option (confirmed: 36 hard-mounted network filesystems vs. 2 soft on this host). hard mounts retry indefinitely and never return an error if the server doesn't respond.

When the sandbox is enabled, bwrap sets up an isolated root by recursively binding /, which requires walking every mount point under it — including these automounted, unrelated NFS shares. If one of those servers is down (during a maintenance window), the bind-mount walk blocks forever on that one mount, wedging the entire sandbox setup before the user's actual command ever runs.

Disabling the sandbox restores normal behavior instantly, because a plain shell only touches the autofs mounts if something actually references it — confirming the hang is specific to bwrap's full-root bind-mount setup, not the shell or dotfiles.

Steps to reproduce

1. On a Linux host with an autofs-managed, hard-mounted NFS share whose server is temporarily unreachable (e.g. mount shows ...,hard,... for a share under an autofs indirect map).
2. Enable "local sandbox" in the Claude Code desktop app.
3. Run any Bash tool command (even pwd) in a project directory unrelated to the affected mount.

Expected behavior
The sandbox should either (a) not need to touch mount points unrelated to the working directory / project root, or (b) time out gracefully on an unresponsive mount rather than hanging forever, or (c) provide a config option to exclude specific host paths from the sandbox's bind-mount setup.

Actual behavior
The Bash tool hangs indefinitely (tested well past 10 minutes) with no error, timeout, or indication of what it's waiting on. Diagnosed manually via timeout 5 bwrap --ro-bind / / --dev /dev --proc /proc -- echo ok, which itself times out under the same conditions, confirming the hang is in bwrap's mount setup rather than in Claude Code's own logic.

Workaround
Disable "local sandbox" until the affected NFS server is reachable again.

Suggested fix
Scope the sandbox's bind-mounts to what's actually needed (project directory + a minimal set of system paths) rather than recursively binding the entire root filesystem, and/or apply a timeout when walking/binding mount points so one unreachable host-level mount can't wedge the whole sandbox.