[BUG] sandbox.enabled: false does not disable bwrap when working directory is ~/.claude/

Description

When the working directory is ~/.claude/ (e.g., when ~/.claude is a git repo for version-controlling settings/skills), all Bash commands fail with bwrap errors — even when the sandbox is explicitly disabled via every available method.

Steps to reproduce

1. Have ~/.claude as a git repo (version-controlled settings, skills, hooks)
2. Set sandbox.enabled: false in ~/.claude/settings.json
3. Start Claude Code with ~/.claude as the working directory
4. Run any Bash command

Expected behavior

Bash commands execute without bwrap wrapping when sandbox.enabled: false.

Actual behavior

Every Bash command fails with:

bwrap: Can't create file at /home/<user>/.claude/.github: Read-only file system

The specific path changes as directories are created (first scripts, then .github, etc.) — bwrap tries to set up overlay mount points for denyWithinAllow paths relative to the working directory.

What I've tried (none work)

| Method | Result |
|---|---|
| sandbox.enabled: false in ~/.claude/settings.json | Still uses bwrap |
| sandbox.enabled: false in .claude/settings.local.json | Still uses bwrap |
| /sandbox toggle (shows "Sandbox disabled") | Still uses bwrap |
| dangerouslyDisableSandbox: true on tool calls | Still uses bwrap |

Non-Bash tools (Read, Edit, Glob, Grep) work fine — only Bash is affected.

Root cause hypothesis

bwrap's denyWithinAllow list auto-includes paths like .claude/skills, .claude/hooks, .claude/settings.json relative to the working directory. When the working directory IS ~/.claude/, these resolve to paths inside the config directory itself. bwrap tries to create bind-mount file nodes for each, hitting read-only overlay conflicts.

Additionally, per #19996, the sandbox dependency check may run before config files are read, so sandbox.enabled: false never takes effect.

Environment

• Claude Code: v2.1.101 (latest)
• OS: Linux 6.18.21
• Shell: bash
• Working directory: ~/.claude/ (git repo)

Related issues

• #40133 — bwrap fails with .claude/skills as symlink (same bwrap error pattern)
• #19996 — sandbox config read order (sandbox check before config load)
• #28880 — sandbox.enabled: false ignored on Windows
• #17727 — Linux sandbox broken with bad bwrap calls