[BUG] `sandbox.filesystem.allowWrite` setting has no effect on macOS Seatbelt sandbox

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [ ] I am using the latest version of Claude Code

What's Wrong?

The sandbox.filesystem.allowWrite configuration in both project-level (.claude/settings.local.json) and user-level (~/.claude/settings.json) settings does not actually grant write access to the specified directories. The macOS Seatbelt sandbox continues to block writes regardless of the configuration.

This affects any tool that needs to write outside the project directory and explicitly allowed paths — notably cargo install, cargo update, and any command that writes to ~/.cargo/.

What Should Happen?

Directories listed in sandbox.filesystem.allowWrite should be added to the Seatbelt sandbox profile's write allowlist, permitting sandboxed commands to write to those paths without needing dangerouslyDisableSandbox: true.

Error Messages/Logs

warning: failed to write cache, path: /Users/<user>/.cargo/registry/index/index.crates.io-1949cf8c6b5b557f/.cache/sh/a3/sha3, error: Operation not permitted (os error 1)

  cargo install --list also fails with:

  error: failed to open: /Users/<user>/.cargo/.crates.toml

  Caused by:
    Operation not permitted (os error 1)

Steps to Reproduce

1. Enable the sandbox in project or user settings:

{
  "sandbox": {
    "enabled": true,
    "autoAllowBashIfSandboxed": true,
    "filesystem": {
      "allowWrite": [
        "/Users/<user>/.cargo"
      ]
    }
  }
}

1. Restart Claude Code to pick up the config change.
2. Run any command that writes to ~/.cargo/, e.g. cargo update --dry-run or cargo install --list.
3. Observe Operation not permitted (os error 1) — the sandbox blocks the write despite the config.

Tested with:

• The absolute path (/Users/<user>/.cargo) in both project-level .claude/settings.local.json and user-level ~/.claude/settings.json
• The tilde path (~/.cargo) in project-level settings
• Restarting Claude Code after each change

None of these had any effect. The only workaround is dangerouslyDisableSandbox: true.

Claude Model

Opus

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.39 (Claude Code)

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

_No response_