> The sandboxed bash tool uses OS-level primitives to enforce both filesystem and network isolation.

As I can't trust Claude Code to use a correct shell, I don't know why I would trust this feature.