[BUG] Sandbox: cwd tracking still writes to blocked /tmp/claude-{uid}/ path (regression from #11480)

Title

[BUG] Sandbox: cwd tracking still writes to blocked /tmp/claude-{uid}/ path (regression from #11480)

---

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Every Bash command shows this error before executing:

zsh:1: operation not permitted: /tmp/claude-501/cwd-XXXX

Where 501 is my user ID and XXXX is a random hex string that changes each command. Commands execute successfully after the error, but output is noisy and exit codes are incorrect (exit 1 even on success).

Root cause: The sandbox write policy allows /tmp/claude and /private/tmp/claude, but the runtime creates cwd tracking files in /tmp/claude-{uid}/ (with user ID appended). This path mismatch causes write permission failures.

Sandbox policy (from system prompt):

"write": {
  "allowOnly": [
    "/tmp/claude",
    "/private/tmp/claude",
    ...
  ]
}

Actual runtime path: /tmp/claude-501/cwd-XXXX

This is the same issue as #11480, which was closed on 2025-12-16 but not actually fixed. The last comment on that issue noted it still occurred in v2.0.61, and it persists in v2.1.23.

What Should Happen?

1. Cwd tracking files should be written to a path that matches the sandbox write policy (e.g., /tmp/claude/cwd-{id} instead of /tmp/claude-{id}-cwd)
2. Bash commands should return clean exit codes when the underlying command succeeds
3. No error noise in output for successful commands

Error Messages/Logs

zsh:1: operation not permitted: /tmp/claude-501/cwd-eab4

You are not logged into any GitHub hosts. To log in, run: gh auth login
Not authenticated

Note: The gh auth status command succeeded (shows auth info) but reports exit code 1 due to the cwd error.

Steps to Reproduce

1. Enable sandbox mode in settings ("sandbox": { "enabled": true })
2. Run any Bash command (e.g., ls, git status, gh auth status)
3. Observe the zsh:1: operation not permitted: /tmp/claude-501/cwd-XXXX error before command output
4. Note exit code is 1 even when command succeeds

Claude Model

Opus 4.5

Is this a regression?

Yes - this is the same issue as #11480 which was closed but not fixed

Last Working Version

Unknown - issue has persisted since at least v2.0.37 (original report)

Claude Code Version

2.1.23

Platform

Anthropic API

Operating System

macOS (Darwin 25.2.0)

Terminal/Shell

zsh

Additional Information

Directory structure exists:

/tmp/claude-501/
├── -Users-patrick-projects-my-exo-cluster/
│   ├── <session-uuid>/scratchpad/
│   └── tasks/
└── (other project directories)

Proposed fix (from #11480):
Change cwd tracking path from /tmp/claude-{id}-cwd to either:

• /tmp/claude/cwd-{id} (inside allowed path)
• ${TMPDIR}/cwd-{id} (uses environment variable)

References:

• Original issue: #11480 (closed, auto-locked, not fixed)
• Related: #20396 (multi-user /tmp/claude conflicts)
• Related: #8896 (permission denied after macOS upgrade)