Add commands to both permissions.allow and sandbox.excludedCommands to run them outside Claude Code’s sandbox by default, because allow grants permission to run at all and excludedCommands runs them unsandboxed.
{
"permissions": {
"allow": [
"Bash(pnpm test:unit:*)",
"Bash(pnpm test:e2e:*)"
]
},
"sandbox": {
"excludedCommands": [
"pnpm test:unit:*", // Same commands, different purpose
"pnpm test:e2e:*"
]
}
}Note: Tested with Claude Code v2.1.3