Sandbox Command Exemptions

What: Configure specific commands to always bypass the sandbox, even when sandbox mode is enabled.

How to use: Add an unsandboxedCommands array to your sandbox configuration in .clauderc:

{
  "sandbox": {
    "unsandboxedCommands": ["git", "docker", "gcloud", "aws"]
  }
}

Details:

• Commands in this list will never run in the sandbox environment
• Matching uses smart logic: matches both exact command names and commands with arguments (e.g., "git" matches both git and git push)
• Useful for commands that require unrestricted filesystem or socket access
• Bypasses sandbox restrictions while still enforcing permission checks
• Evidence: qu2() at line 383844, schema at line 363385, integration in Eu2() at line 383855