`claude plugin eval` refuses every Bash-granting evaluation under Docker Desktop's default `~/.docker` layout; `DOCKER_CONFIG` does not bypass

**Version:** Claude Code 2.1.260 and 2.1.261 (the check is absent from the 2.1.250 binary — the refusal string appears in 2.1.260/2.1.261 and not in 2.1.250). macOS 26.6.2 arm64, Docker Desktop 4.90.0 (Docker CLI 29.7.2), default install, no custom credential helpers.

**What happens.** Any `plugin eval` case that grants the Bash tool is refused before a subject spawns, with:

> the Docker (~/.docker, DOCKER_CONFIG) credential store on this machine holds a symbolic link inside it, so the Bash sandbox cannot reliably exclude it — a Bash-granting evaluation cannot run here; keep the store's contents in one plain directory (its root may be a link)

**Why it fires on a stock machine.** Docker Desktop populates `~/.docker/bin/*` and `~/.docker/cli-plugins/*` as symlinks into `/Applications/Docker.app` (on this machine all 21 symlinks resolve inside `Docker.app`; nothing was hand-placed). A default Docker Desktop install therefore trips the pre-flight even when the credential store itself (`config.json`, `credsStore`) contains no links.

I understand why the check exists — the Bash sandbox needs to exclude the credential store reliably, and a symlink can point outside the excluded tree. The report is that the default Docker Desktop layout makes the check fire for files that are not part of the credential store.

**Override does not help.** Setting `DOCKER_CONFIG=` is refused identically: the credential-store list is built from both `DOCKER_CONFIG` and the `~/.docker` default (`ve("DOCKER_CONFIG", join(homedir(), ".docker"))`), so the default path is always checked.

**Workaround that works.** Replace the symlinks under `~/.docker/bin` and `~/.docker/cli-plugins` with real copies (`cp -L`). After that the pre-flight passes and evals spawn. Docker Desktop may recreate the links on restart.

**Ask.** Either (a) only inspect the credential-store-relevant files (`config.json`, `credHelpers`, the `docker-credential-*` helpers) rather than the whole `~/.docker` tree, (b) honor `DOCKER_CONFIG` as the sole location when set, or (c) treat symlinks that resolve inside `/Applications/Docker.app` as benign.

**Repro.** Fresh macOS with Docker Desktop; `claude --version` 2.1.261; any `plugin eval` case with `--allow-tools Bash` → refusal above, zero turns.

Happy to share redacted trace files or test a build. Thanks for the sandbox work — the check is doing the right thing for the wrong set of files.

Start by reproducing on macOS with Docker Desktop and `claude --version` 2.1.261 using any `plugin eval` case with `--allow-tools Bash`. Search for the refusal string and the Docker config path handling around `DOCKER_CONFIG` and `~/.docker`. Done means Bash-granting evals are not refused for Docker Desktop's default symlinks when the credential-store-relevant files are safe.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.