[BUG] sandbox.filesystem.allowWrite does not permit unlink / rm on macOS

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Summary

With sandbox.filesystem.allowWrite including a path, content writes (Edit/Write tools, touch, redirects) succeed on files under that path, but rm on the same path is rejected by the macOS Seatbelt profile with Operation not permitted. It's unclear whether this is intended behavior, a documentation gap, or a bug in the Seatbelt policy.

Environment

• macOS (Darwin 24.6.0)
• Claude Code for VSCode 2.1.117

Questions

1. Is unlink intentionally excluded from allowWrite?
2. If yes, what's the recommended config to permit deletes inside a specific directory without dropping denyWrite: ["/"]?
3. If no, is this a Seatbelt policy bug?

What Should Happen?

Expected

Either:

• allowWrite covers all mutating file ops on the allowed path (including unlink), so rm succeeds; or
• There's a documented separate key (e.g. allowDelete) for permitting deletes, and the docs at sandboxing.md / settings.md explain it.

Error Messages/Logs

## Actual

Neither. `allowWrite` silently excludes `unlink` and no alternative key is documented. Users end up with a sandbox where the agent can create and modify files but cannot clean them up.

Steps to Reproduce

Repro

~/.claude/settings.json:

{
  "sandbox": {
    "enabled": true,
    "allowUnsandboxedCommands": false,
    "failIfUnavailable": true,
    "filesystem": {
      "allowWrite": ["/tmp/claude-501", "/Users/me/code/myrepo"],
      "allowRead": ["/tmp/claude-501", "~/.gitconfig", "/Users/me/code/myrepo"],
      "denyWrite": ["/"],
      "denyRead": ["/"]
    }
  }
}

Inside a Claude Code session with cwd /Users/me/code/myrepo:

• Edit / Write on ./some/file.ts — succeeds
• Bash touch ./some/newfile.ts — succeeds
• Bash rm ./some/file.ts — fails:

``
rm: ./some/file.ts: Operation not permitted
``

Exit code 1; the error comes from the kernel / Seatbelt, not a Claude Code permission prompt.

Claude Model

None

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

Claude Code for VSCode 2.1.117

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

_No response_