Sandbox sets TMPDIR to non-existent directory, causing child processes to hang

Description

When running in sandbox mode, Claude Code sets TMPDIR=/tmp/claude and adds /tmp/claude to the filesystem write allowlist — but never actually creates the directory. Since /tmp itself is read-only within the sandbox, the directory cannot be created from inside the sandbox either.

This causes any tool that spawns child processes relying on os.tmpdir() (Node.js) or $TMPDIR for temp files, IPC, or worker communication to silently hang.

Steps to reproduce

1. Start Claude Code in sandbox mode (fresh session or after reboot, so /tmp/claude doesn't exist)
2. Run any command that uses worker threads/child processes needing temp files — e.g., npm run test in a project using vitest

Observed behavior

• TMPDIR is set to /tmp/claude and inherited by child processes
• /tmp/claude does not exist as a directory
• mkdir -p /tmp/claude fails from within the sandbox with Read-only file system (because /tmp is not writable, only /tmp/claude is in the allowlist)
• Child processes (e.g., vitest worker threads) attempt to write IPC/temp files to the non-existent directory and block indefinitely
• Commands hang with no error message

Expected behavior

The sandbox should create the TMPDIR directory on startup before any commands are executed, since it cannot be created from within the sandbox.

Workaround

Manually create the directory with sandbox disabled:

mkdir -p /tmp/claude

This persists until reboot (since /tmp is typically tmpfs).

Environment

• Platform: Linux (Ubuntu, kernel 6.8.0-106-generic)
• Note: The sandbox also creates and uses /tmp/claude-1000/ which does exist — the inconsistency suggests /tmp/claude creation was simply missed