[BUG] Sandbox cannot create its own TMPDIR: /tmp/claude allowlisted but /tmp is not writable

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

The sandbox sets TMPDIR=/tmp/claude and includes /tmp/claude in the filesystem write allowlist. However, if /tmp/claude does not already exist, the sandbox prevents creating it because /tmp itself is not in the write allowlist.

This is a chicken-and-egg problem: the sandbox allows writes inside /tmp/claude, but creating /tmp/claude requires a write to /tmp, which the sandbox blocks.

$ mkdir -p /tmp/claude
mkdir: cannot create directory '/tmp/claude': Read-only file system

The "Read-only file system" error is misleading — /tmp is actually writable (drwxrwxrwt root:root), but the sandbox intercepts the write and denies it.

What Should Happen?

The sandbox should ensure /tmp/claude exists before entering sandboxed mode, or /tmp should be included in the write allowlist so the TMPDIR can be bootstrapped.

Steps to Reproduce

1. Ensure /tmp/claude does not exist (e.g. after a reboot or rm -rf /tmp/claude)
2. Start Claude Code
3. In a sandboxed Bash command, run: mkdir -p /tmp/claude
4. Observe: mkdir: cannot create directory '/tmp/claude': Read-only file system
5. $TMPDIR is set to /tmp/claude but the directory is unusable

Claude Model

Opus

Is this a regression?

Unknown

Claude Code Version

Latest

Platform

Anthropic API

Operating System

WSL2 (Linux 6.6.87.2-microsoft-standard-WSL2)

Terminal/Shell

bash

Additional Information

The sandbox filesystem write allowlist includes /tmp/claude and /private/tmp/claude, but not /tmp itself. The sandbox needs to either:

1. Pre-create /tmp/claude (with appropriate permissions) before activating the sandbox, or
2. Temporarily allow writes to /tmp for bootstrapping the TMPDIR directory

This is distinct from the multi-user /tmp/claude permission issues reported in #16914, #20396, and #17034 — this is about the sandbox preventing creation of the directory entirely, even for a single user.