CC Sandbox Schema — what the config keys actually do

Four root causes behind a year of "the sandbox blocks X"

Belief	Reality (verified)
excludedCommands: ["docker"] exempts docker	Entries are patterns — a bare name matches only the arg-less command. Docs' own example: docker *. The bare list exempted zero real invocations.
filesystem.allowWrite on a socket's dir permits connect()	Sockets are network-layer: only network.allowUnixSockets works. Measured EPERM both ways before the right key.
DNS failures need mach-lookup entries (mDNSResponder…)	Sandbox networking is proxy-based; getaddrinfo has no in-sandbox path at all. Proxy-aware tools (curl, gh) resolve at the proxy; ssh needs exclusion.
gh works because it's in excludedCommands	gh worked for an unrelated reason: enableWeakerNetworkIsolation + trustd mach-lookups. One entry "working" by coincidence hid the dead list.

Probe matrix — flip the config

Same session, hot-reloaded — filesystem/network arrays apply on the next command; excludedCommands reload measured laggy (minutes-scale), not absent.

Doctor Check 15 fix

The check read only settings.local.json, but real machine configs live in ~/.claude/settings.json — so it reported "off / unknown" against a machine whose sandbox was on. It now resolves sandbox.enabled across all four scopes (project local → project → user local → user).