[BUG] /sandbox fills entire context window (~150k+ tokens) with tool definitions when plugins/agents are loaded

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Enabling /sandbox causes the system prompt to balloon well beyond the usable context window, even with a minimal permissions.deny list.

Environment:

• Claude Code v2.1.62 (native ELF binary)
• WSL2 (Ubuntu), kernel 6.6.87.2-microsoft-standard-WSL2
• ENABLE_TOOL_SEARCH set to "true" (most aggressive deferred loading)

With /sandbox off, context usage is ~40k/200k (20%):

• System tools: 17.4k tokens
• Custom agents: 2.3k (35 plugin agents)
• Skills: 2.7k (40+ skills)
• Memory files: 12.9k

Enabling /sandbox causes the session to become unusable — system tool definitions expand to fill the remaining ~160k tokens.

The permissions config is small (32 allow, 5 deny) — this is not a deny-list explosion as in #27757. The bloat appears to be triggered by sandbox interacting with the large number of plugin-provided tool definitions.

What Should Happen?

/sandbox should add minimal overhead (bubblewrap policy metadata), not multiply existing tool definitions. Context overhead should scale O(1) with sandbox enable, not O(n) with tool count.

Error Messages/Logs

Context exhausted after enabling /sandbox — no error message, session simply becomes unusable.

Steps to Reproduce

1. Install multiple plugins providing agents/skills (~35 agents, ~40 skills)
2. Have ENABLE_TOOL_SEARCH: "true" in settings.json env
3. Run claude in a project with CLAUDE.md + rules files (~13k tokens of memory)
4. Run /context — observe ~40k/200k usage (20%)
5. Run /sandbox to enable sandbox mode
6. Send any message — context is exhausted

Claude Model

Opus

Is this a regression?

I don't know

Last Working Version

Claude Code Version

2.1.62

Platform

Anthropic API

Operating System

Other Linux

Terminal/Shell

WSL (Windows Subsystem for Linux)

Additional Information

Related: #27757 (same symptom — sandbox explodes system prompt — but triggered by large deny list rather than plugin count). Likely the same underlying combinatorial expansion bug applied to a different input vector.

/context output before enabling sandbox:

System tools: 17.4k tokens (8.7%)
Custom agents: 2.3k tokens (1.2%)
Memory files: 12.9k tokens (6.4%)
Skills: 2.7k tokens (1.4%)
Total: ~40k/200k (20%)