Your sandbox rule is keyed to `trap`, not your command

Gemini CLI lets you give individual commands extra room in the tool sandbox: a `[commands.gradlew]` entry in `sandbox.toml` can allow a path or network access for that one tool. Issue #29686 shows that on Linux and macOS those entries never match. Before running anything, the shell tool wraps the command in a subshell that starts with `trap 'jobs -p > …' EXIT`, so it can record background process IDs. The Linux and macOS sandbox managers then take the first command name in that script, skipping only `shopt` and `set`. The first name is always `trap`. No rule exists for `trap`, so your command runs under the default policy, and the same goes for "allow for this session" approvals.

The Gradle repro, failing with a read-only `~/.gradle`, is the reporter’s own; we confirmed the wrapper and the filter in the current source on main. The fix, PR #29726, which also skips `trap`, was still open and unmerged at the time of writing.

When a sandbox rule seems to do nothing, check what command name the sandbox actually sees, not the one you typed.