[BUG] Sandbox creates directories in CWD from Bash tool command arguments when command is not found

Description

When the Bash tool runs a command that is not installed (e.g., 7z), the sandbox materializes the command name and its arguments as empty directories in the current working directory. These directories persist after the session ends.

HUMAN EDIT

the previous commands:

     --- Line 5093 ---
     ls ~/Downloads/ | grep -i gpio

     --- Line 5095 ---
     mkdir -p /tmp/gpio_extract
     7z l ~/Downloads/"FILE NAME.rar" 2>&1 | grep -E '\.(pdf|xlsx|xls|csv|txt|doc)'

Maybe it hallucinated an unicode character in place of carriage return or maybe \n\r sequence was not correct for the system?

Reproduction

1. Open Claude Code in a project directory
2. Ensure 7z (p7zip-full) is not installed
3. Have Claude run this via the Bash tool:

``bash
7z l ~/Downloads/somefile.rar 2>&1 | grep -E '\.pdf'
``

1. Observe three new empty directories created in the CWD:

• 7z/ (from the command name)
• l/ (from the first argument)
• ~/ (from the literal ~ — not expanded because the command failed)

Evidence

All three directories share the exact same creation timestamp (same millisecond), matching the Bash tool invocation time:

  File: ./7z
  Birth: 2026-03-10 20:11:29.995472750 -0400

  File: ./~
  Birth: 2026-03-10 20:11:29.995472750 -0400

  File: ./l
  Birth: 2026-03-10 20:11:29.995472750 -0400

The ~/ directory even has nested content from the path argument:

~/Downloads/MT8370 Application Processor GPIO Application Note V1.0.rar/

(created as an empty directory, not a file)

The Bash tool returned empty output with is_error: false — it did not report the command-not-found error or the directory creation.

Expected behavior

• The sandbox should NOT create directories from command arguments
• If a command is not found, the Bash tool should return the "command not found" error
• No filesystem side effects should occur from a failed command

Actual behavior

• Empty directories are silently created in the CWD from each space-separated token of the command line
• The ~ character is not expanded (treated as literal directory name)
• The Bash tool reports success (empty output, no error)
• Directories persist after session ends and show up in git status

Environment

• Claude Code version: 2.1.72
• OS: Linux 6.6.123.2-microsoft-standard-WSL2+ (aarch64)
• Shell: bash
• Sandbox: enabled (default)
• Model: claude-opus-4-6

Related issues

• #17087 — Sandbox creates empty dotfiles in CWD (similar class of bug — sandbox creating unexpected files/dirs — but different root cause; that one is bwrap bind mount paths, this one is command argument materialization)
• #17258, #18548 — Duplicates of #17087