[BUG] Sandbox blocks access to ~/.claude/shell-snapshots/, preventing all Bash commands from executing

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

When sandbox is enabled, all Bash tool commands fail because the sandbox blocks read access to ~/.claude/shell-snapshots/.

What Should Happen?

This is Claude Code's own internal directory, so the sandbox should grant access to it automatically.

Error Messages/Logs

Every shell command produces:
  zsh:source:1: operation not permitted: /Users/<user>/.claude/shell-snapshots/snapshot-zsh-<id>.sh
  zsh:1: no such file or directory:
  fatal: Unable to read current working directory: Operation not permitted

Steps to Reproduce

1. Enable sandbox in .claude/settings.json:

{
"sandbox": {
"enabled": true,
"autoAllowBashIfSandboxed": true
}
}

1. Run any Bash command (e.g. git status, ls, etc.)
2. Command fails with "operation not permitted" on the shell-snapshots file

Claude Model

Opus

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.50

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

Here's the full thing claude code wrote:

Title: Sandbox blocks access to ~/.claude/shell-snapshots/, preventing all Bash commands from executing

Body:

## Bug

When sandbox is enabled, all Bash tool commands fail because the sandbox blocks read access to ~/.claude/shell-snapshots/. This is Claude Code's own internal directory, so the sandbox should grant access to it automatically.

## Error

Every Bash command produces:

zsh:source:1: operation not permitted: /Users//.claude/shell-snapshots/snapshot-zsh-.sh
zsh:1: no such file or directory:
fatal: Unable to read current working directory: Operation not permitted

## Steps to reproduce

1. Enable sandbox in .claude/settings.json:

``json
{
"sandbox": {
"enabled": true,
"autoAllowBashIfSandboxed": true
}
}
``

1. Run any Bash command (e.g. git status, ls, etc.)
2. Command fails with "operation not permitted" on the shell-snapshots file

## Workarounds attempted (none resolved the issue)

• additionalDirectories with hardcoded project path — no effect
• additionalDirectories with "." or "$PWD" — no effect (variable expansion may not work)
• excludedCommands: ["git"] — no effect, since the shell itself fails before the command runs
• excludedCommands: ["git", "zsh"] — no effect
• Removing broad Read(~/**) and Read(/**) deny rules — no effect

## Expected behavior

The sandbox should automatically grant read access to ~/.claude/ (or at minimum ~/.claude/shell-snapshots/) since these files are required for Claude Code's own shell environment initialization.

## Environment

• Platform: macOS (Darwin 23.2.0)
• Shell: zsh

## Settings file

```json
{
"sandbox": {
"enabled": true,
"autoAllowBashIfSandboxed": true,
"excludedCommands": ["git", "zsh"],
"allowUnsandboxedCommands": false
},
"permissions": {
"deny": [
"Bash(git push:*)",
"Bash(git commit:*)",
"Bash(git reset:*)",
"Bash(git checkout:*)",
"Bash(git merge:*)",
"Bash(git rebase:*)",
"Bash(git branch:*)",
"Bash(git clean:*)",
"Bash(git restore:*)",
"Bash(git stash:*)",
"Bash(git cherry-pick:*)",
"Bash(git revert:*)",
"Bash(git tag:*)",
"Bash(git remote:*)",
"Bash(cd ~*)",
"Bash(cd /*)",
"Bash(cd ..*)",
"Read(../)",
"Read(/.git/)",
"Edit(~/)",
"Edit(/)",
"Edit(../)",
"Edit(/.git/)",
"Edit(.git/**)"
],
"allow": [
"Bash(git log:*)",
"Bash(git status:*)",
"Bash(git diff:*)",
"Bash(git show:*)",
"Bash(git blame:*)",
"Bash(git grep:*)",
"Read(.git/**)"
],
"additionalDirectories": ["/path/to/project"]
}
}