[BUG] Sandboxed git push over SSH fails: local credential proxy requires auth that injected GIT_SSH_COMMAND's nc ProxyCommand can't provide

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report
• [x] I am using the latest version of Claude Code

What's Wrong?

In a sandboxed macOS session (project sandbox.enabled: true, Auto Mode), git push over an SSH remote (git@github.com:org/repo.git) always fails.

Claude Code injects a GIT_SSH_COMMAND into the sandboxed command's environment to route git's SSH connection through a local credential-injection proxy, e.g.:

GIT_SSH_COMMAND=ssh -o ControlMaster=no -o ControlPath=none -o ProxyCommand='nc -X 5 -x localhost:<port> %h %p'

authenticated via http_proxy/https_proxy/all_proxy set to http://<token>:<secret>@localhost:<port>. The local proxy at localhost:<port> rejects the connection:

Received disconnect from UNKNOWN port 65535:1: This proxy requires authentication, and this client did not offer an authentication method, so the connection was refused.

BSD/macOS nc's SOCKS5 client (-X 5) has no username/password auth support, so it can never satisfy the proxy's own auth requirement for this ProxyCommand — the generated GIT_SSH_COMMAND can't work against the proxy Claude Code itself stood up.

Separately, a plain non-git ssh git@github.com in the same session fails differently (Operation not permitted, a direct Seatbelt network deny), confirming two different enforcement paths, and the git-over-SSH one specifically can't complete its proxy's handshake.

Also observed: a project's settings declared sandbox.excludedCommands: ["make", "make *"] to exempt make <target> (including a make target that runs git push) from the sandbox. GIT_SSH_COMMAND/*_proxy were still present on that excluded make invocation, suggesting the exclusion doesn't strip sandbox-injected env vars (or isn't applied at all in this configuration).

What Should Happen?

git push over an SSH remote should succeed inside a sandboxed session — either the generated ProxyCommand should complete its own proxy's required auth (e.g. use a SOCKS client that supports the proxy's auth method, or front it with an HTTP CONNECT-capable command instead of plain nc), or git-over-SSH should bypass this proxy path entirely. Separately, a command matched by sandbox.excludedCommands should not have sandbox-only env vars (GIT_SSH_COMMAND, *_proxy) injected into its environment.

Error Messages/Logs

Received disconnect from UNKNOWN port 65535:1: This proxy requires authentication, and this client did not offer an authentication method, so the connection was refused.
Disconnected from UNKNOWN port 65535
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.

Steps to Reproduce

1. In a repo with an SSH git remote (git@github.com:org/repo.git), enable project-level sandboxing: .claude/settings.json with "sandbox": {"enabled": true}.
2. Start Claude Code in Auto Mode in that repo.
3. Make a commit via the Bash tool, then run git push (directly, or via a Makefile target that wraps it) via the Bash tool.
4. Observe the push fail with the proxy-auth disconnect above.
5. Optionally, to see the injected environment: run env | grep -i proxy and echo "$GIT_SSH_COMMAND" in the same sandboxed session.
6. Optionally, to compare: additionally set sandbox.excludedCommands to the top-level command used in step 3 and confirm the same proxy env vars are still present and the push still fails the same way.

Claude Model

Sonnet (default)

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.289 (Claude Code)

Platform

AWS Bedrock

Operating System

macOS

Terminal/Shell

Non-interactive/CI environment

Additional Information

• Model ID reported by the session: eu.anthropic.claude-sonnet-5 (Bedrock cross-region inference prefix).
• Workaround: prefixing the command with ! (bash-mode prompt) runs it outside the sandbox entirely and succeeds.
• Project sandbox config declaring the (seemingly ineffective) make/make * exclusion: sandbox.enabled: true, sandbox.allowUnsandboxedCommands: false, sandbox.excludedCommands: ["make", "make *"], set in a shared settings file symlinked into the project via .claude/settings.json.
• Possibly related to the sandbox.excludedCommands behavior change in Claude Code 2.1.282 ("ignore project and local settings entries when managed settings or --settings set allowUnsandboxedCommands: false...") — though no managed-settings.json was present on this machine, so that exact trigger condition is unconfirmed.