[BUG] Security Issue - Parent folders with whitespaces cause claude code to exit its project directory

Environment

• Platform (select one):
• [x] Anthropic API
• [ ] AWS Bedrock
• [ ] Google Vertex AI
• [ ] Other: <!-- specify -->
• Claude CLI version: 0.2.29
• Operating System: macOS 15.1
• Terminal: VSC mac default

Bug Description

Having a project folder in a path that contains folders with whitespaces leads to serious problems for claude caude. I had the following path: ../Test Area/claude-code and opened the claude-code folder in VSC. Then I launched claude code. After asking it to do some modifications like folder creations and file creations and modifications, it used absolute paths at some point. The absolut paths whitespaces were not escaped correctly. This lead into multiple files and folders created OUTSIDE the project directory. After my session the parent folder looked something like this:

../Test Area/claude-code
../Test/Area/.. (this was created by claude code)

Steps to Reproduce

1. see above

Expected Behavior

Claude never touches files outside the project directory.

Actual Behavior

Claude did touch files outside of the project directory.

Additional Context

My Suggestion: Rather then solving the correct escape mechanism of whitespace characters I would ensure that all cmd commands emmited by claude are checked with a programatic algorithm if itwould modify files outside the scope of the project.

And second: It might be a good idea to invent some kind of docker run setup, that is on by default, allowing claude code only to exist in the docker environment.