Sandbox leaves behind empty stub files in working directory after bash command completes

Description

Each time Claude runs a sandboxed Bash tool command, it creates empty stub files in the working directory as mount points for its read-only bind mounts. When the command completes and the mount namespace is torn down, the stubs are not cleaned up, leaving them as real files on the filesystem. They show up as untracked files in git status, polluting the working tree.

Steps to reproduce

1. Open Claude Code in any git repository
2. Let Claude run any Bash tool command
3. Run git status — untracked stub files appear in the repo root

Observed behavior

Empty (0-byte), read-only files appear in the project working directory:

Git-internal names (guarded from sandbox writes):
HEAD, hooks, objects, refs, config

Home directory dotfiles (isolated from the real ~):
.bashrc, .bash_profile, .zshrc, .zprofile, .profile, .gitconfig, .gitmodules, .mcp.json, .ripgreprc, .vscode, .idea

Evidence that these are bind mount stubs — /proc/mounts (captured from inside the sandbox) shows:

/dev/sdd /path/to/project/HEAD   ext4  ro,nosuid,nodev,...
/dev/sdd /path/to/project/.bashrc ext4  ro,nosuid,nodev,...
# ... one entry per stub file

Attempting to rm them from inside the sandbox returns Device or resource busy (EBUSY), confirming they are active mount points during command execution.

After the sandbox process exits, the mount namespace is cleaned up but the stub files remain as regular empty files on the host filesystem.

Expected behavior

Stub files created by the sandbox as mount points should be deleted after the bash command completes and the mount namespace is torn down.

Workaround

Delete them manually from a terminal outside Claude's sandbox (they're removable from the host):

rm -f HEAD hooks objects refs config .gitconfig .gitmodules \
  .bashrc .bash_profile .zshrc .zprofile .profile .ripgreprc .mcp.json

Or add them to ~/.gitignore_global. Neither is acceptable long-term since the files reappear on every subsequent bash command.

Environment

• OS: Linux 6.6.87.2-microsoft-standard-WSL2
• Shell: bash