Tip: a plugin eval suite that grants Bash needs bubblewrap and socat on Linux, or WSL2 on Windows
Claude Code Docs·medium signal
Granting `Bash` in any form puts every command under Claude Code's OS-level sandbox, with writes confined to the run workspace, home directory and Claude Code config unreadable, and network limited to domains granted via `--allow-tools "WebFetch(domain:example.com)"`. On a machine with no sandbox backend Claude Code refuses each run rather than running unconfined, so the case errors and usually scores 0. Native Windows has no backend at all.