[BUG] Claude Code creates 17+ empty files (.env, .npmrc, package.json, node_modules) in working directory on every startup

Description

Since updating to ~v2.1.98, Claude Code creates 17+ empty 0-byte files and an empty node_modules/.bin/ directory in the working directory on every startup. This happens via the VSCode/VSCodium extension — the native-binary/claude process creates these files before any user interaction.

Files created (all 0 bytes, all within <1ms)

.env, .env.local, .env.development, .env.development.local,
.env.test, .env.test.local, .env.production, .env.production.local,
.npmrc, .yarnrc, .yarnrc.yml, .gitmodules,
bunfig.toml, package.json, package-lock.json,
pnpm-lock.yaml, yarn.lock, node_modules/.bin/ (empty dir)

Environment

• OS: Fedora 43, SELinux enforcing, hardened desktop
• IDE: VSCodium 1.99.x (RPM, not Flatpak)
• Claude Code: 2.1.98 → 2.1.100 (bug persists across updates)
• Extension: anthropic.claude-code-2.1.100-linux-x64
• Working directory: ~/Downloads (configured in VSCodium)
• Shell: Bash 5.2

Reproduction

1. Install Claude Code extension in VSCode/VSCodium
2. Set working directory to any folder (e.g. ~/Downloads)
3. Start VSCode/VSCodium
4. Observe: 17 empty files + node_modules/.bin/ appear in the working directory

Confirmed with inotifywait:

11:53:07 /home/user/Downloads/.npmrc CREATE
11:53:07 /home/user/Downloads/.yarnrc CREATE
11:53:07 /home/user/Downloads/.yarnrc.yml CREATE
11:53:07 /home/user/Downloads/bunfig.toml CREATE
11:53:07 /home/user/Downloads/package.json CREATE
11:53:07 /home/user/Downloads/.gitmodules CREATE
11:53:07 /home/user/Downloads/package-lock.json CREATE
11:53:07 /home/user/Downloads/yarn.lock CREATE
11:53:07 /home/user/Downloads/pnpm-lock.yaml CREATE
11:53:07 /home/user/Downloads/.env CREATE
... (all 17 files at same second)
11:53:07 /home/user/Downloads/node_modules CREATE,ISDIR

Files are also created in ~ (home root), not just the working directory.

Process responsible

/home/user/.vscode-oss/extensions/anthropic.claude-code-2.1.100-linux-x64/resources/native-binary/claude
  --output-format stream-json --verbose --permission-mode acceptEdits ...

Additional finding: Sandbox regression

Before ~v2.1.98, the sandbox worked fine without socat installed. After updating, the sandbox fails with Sandbox failed to initialize. unless socat is explicitly installed (sudo dnf install socat). The error message gives no hint that socat is missing.

After installing socat, the sandbox also requires a .claude/ directory in the working directory to exist — otherwise bwrap fails with Can't mkdir /path/.claude: Not a directory.

Timeline:

• Before v2.1.98: Sandbox works, no socat needed, no ghost files
• After v2.1.98: Sandbox broken (needs socat), ghost files on every startup

Impact

• Pollutes working directories with JS ecosystem files on a system that has no Node.js/npm installed
• Confuses users who see unexpected files appear
• Can interfere with git repositories (files show as untracked)
• node_modules directory is particularly alarming on a hardened system

Current workaround

# Bash alias to clean up
alias ccclean='rm -rf ~/{.env,.env.*,.npmrc,.yarnrc,.yarnrc.yml,bunfig.toml,package.json,package-lock.json,pnpm-lock.yaml,yarn.lock,.gitmodules,node_modules} ~/Downloads/{.env,.env.*,.npmrc,.yarnrc,.yarnrc.yml,bunfig.toml,package.json,package-lock.json,pnpm-lock.yaml,yarn.lock,.gitmodules,node_modules} 2>/dev/null'

Expected behavior

Claude Code should not create any files in the user's working directory on startup. If these files are needed for internal operation, they should be in ~/.claude/ or a temp directory, not the workspace root.