bwrapPath controls the bubblewrap executable used for Linux sandboxing.
socatPath controls the executable used for HTTP/SOCKS bridge processes.
Claude Code validates that configured paths are executable and reports clearer errors if not.
This is useful on systems where these tools are installed outside PATH, or where a managed environment pins exact binary locations.
Evidence
Sandbox schema adds bwrapPath and socatPath settings (search for "Linux only: absolute path to the bwrap" and "Linux only: absolute path to the socat binary")
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
