[BUG] No way to whitelist workspace directory in global sandbox settings

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Docs have this example:

{
  "sandbox": {
    "enabled": true,
    "filesystem": {
      "denyRead": ["~/"],
      "allowRead": ["."]
    }
  }
}

This works in a workspace-local .claude/settings.json. The "." is expanded to the workspace directory.

The same settings don't work when added to ~/.claude/settings.json. "." is expanded to ~/.claude instead.

What Should Happen?

Expanding to the workspace directory also for global configuration would be very useful, as this could be used for sensible global sandbox defaults. Not having this (or an alternative) means users have to whitelist specific project paths.

Error Messages/Logs

Steps to Reproduce

See the exact settings JSON above.

1. Use settings inside a workspace (.claude/settings.local.json). Observe that file reads from workspace are allowed. Run /sandbox command and observe that config shows the workspace dir under "Allowed within denied".
2. Remove those settings from your workspace.
3. Use the same settings in ~/.claude/settings.json instead. Observe that file reads from workspace are denied by the sandbox. Run /sandbox command and observe that config shows ~/.claude under "Allowed within denied".

Claude Model

None

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.80

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

_No response_