- Adds `Bash(*)` to the allow list so routine shell commands run without prompting. - Sets `sandbox.failIfUnavailable=true` so Claude Code aborts rather than silently running unsandboxed when the sandbox cannot initialize. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>