Sandbox allowlist doesn't include cwd tracking directory /tmp/claude-{UID}/

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Description U

Claude Code's sandbox mode has conflicting default behavior: the sandbox allowlist permits writes to /tmp/claude/, but the shell session's current working directory tracking writes to /tmp/claude-{UID}/ (e.g., /tmp/claude-501/ for user ID 501). This causes a non-fatal error on every Bash command execution.

Error message:
zsh:1: operation not permitted: /tmp/claude-501/cwd-XXXX

Steps to Reproduce

1. Run Claude Code with default sandbox settings
2. Execute any Bash command
3. Observe the zsh:1: operation not permitted error

Expected Behavior

No permission errors when Claude Code manages its internal shell session state.

Actual Behavior

Every Bash command produces the error:
zsh:1: operation not permitted: /tmp/claude-501/cwd-XXXX

The cwd-XXXX filename changes with each command (e.g., cwd-9ab9, cwd-a591, cwd-8a7f).

Analysis

Two separate temp directories exist:
/tmp/claude/ - in sandbox allowlist (general temp files)
/tmp/claude-501/ - NOT in sandbox allowlist (cwd tracking)

The cwd tracking mechanism uses a user-ID-suffixed directory that isn't included in the sandbox write permissions.

Suggested Fix

Either:

1. Add /tmp/claude-*/ pattern to the sandbox allowlist, or
2. Change cwd tracking to use /tmp/claude/ instead of /tmp/claude-{UID}/

Environment

• OS: macOS (Darwin 25.2.0)
• Shell: zsh
• Claude Code: (current version)
• Sandbox: enabled (default)

Impact

Low - commands execute successfully despite the error, but the error message is confusing and clutters output.

What Should Happen?

Either:

1. Add /tmp/claude-*/ pattern to the sandbox allowlist, or
2. Change cwd tracking to use /tmp/claude/ instead of /tmp/claude-{UID}/

Error Messages/Logs

Steps to Reproduce

Have Claude Code execute a shell command. Happens on every shell interaction where Claude Code tries to persist state

Claude Model

Opus

Is this a regression?

Yes, this worked in a previous version

Last Working Version

_No response_

Claude Code Version

2.1.27

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

_No response_