[BUG] Sandbox issue
Status Fixed / completed
Reported on v2.1.132
Maintainer reply None cached
Activity 5 comments · opened May 15, 2026 · closed May 16, 2026
Preflight Checklist
- [x] I have searched existing issues and this hasn't been reported yet
- [x] This is a single bug report (please file separate reports for different bugs)
- [x] I am using the latest version of Claude Code
What's Wrong?
I'm using Claude Desktop 1.7196.0 (2dbd78) on MacOS with 3 accounts: personal Max account, Team, Claude via Bedrock). All accounts keeps showing annoying sandbox error
This happens even in Developer => Configure third-party inference => Sandbox & workspace: all these directories are listed as allowed workspace folders
What Should Happen?
These sandbox issues do not happened when I used Claude previous versions (and also before using Claude via Bedrock)
Error Messages/Logs
I'm hitting a sandbox-level wall: every write attempt fails in this session, regardless of path. I tested writes to:
/Users/userid/project/ (the project) → blocked
/Users/userid/.claude/plans/ (where plan mode wanted to write) → blocked
$TMPDIR (/tmp/claude-501/) → blocked
/tmp, /private/tmp/claude → blocked
All return Operation not permitted from the kernel sandbox, not a Unix-perm error. The system-prompt sandbox descriptor includes "/" in denyWithinAllow, which looks like the over-reaching deny rule blanket-blocking everything inside the allow list.
I can't implement the change from this session — Write, Edit, and Bash redirections will all fail until the sandbox is reset."
Claude itself finds this: The sandbox descriptor for writes shipped to this session contains:
"write.denyWithinAllow: [
"/Users/userid/.claude/settings.json",
"/Users/userid/project/.claude/settings.json",
"/Users/userid/project/.claude/settings.local.json",
"/tmp/claude-settings-44136fa355b3678a.json",
"/Library/Application Support/ClaudeCode/managed-settings.json",
"/Library/Application Support/ClaudeCode/managed-settings.d",
"/Users/userid/project/.claude/skills",
"/" ← this is the killer
]"
I read all three settings.json files via cat (the Read tool is itself blocked for them):
~/.claude/settings.json — no permissions.deny, no Edit(/) rule
<project>/.claude/settings.json — no permissions.deny
<project>/.claude/settings.local.json — no permissions.deny
None of them contain a deny rule that would translate into a / entry in denyWithinAllow. The managed-settings file (/Library/Application Support/ClaudeCode/managed-settings.json) doesn't exist either. So this isn't user-configurable — Claude Code is computing/injecting the / itself.Steps to Reproduce
Write bash script, push, run git
Claude Model
Opus
Is this a regression?
Yes, this worked in a previous version
Last Working Version
_No response_
Claude Code Version
2.1.132 (Claude Code)
Platform
Anthropic API
Operating System
macOS 26.5
Terminal/Shell
Terminal.app (macOS)
Additional Information
_No response_
5 Comments
Found 3 possible duplicate issues:
This issue will be automatically closed as a duplicate in 3 days.
🤖 Generated with Claude Code
This is a horrible bug across platforms (MacOS 26.5 for me, Linux for this case https://github.com/anthropics/claude-code/issues/50781).
Not only ALL BASH calls are prevented, but ALL EDITING/WRITING ON FILES (even in the same projects) are prevented!!! An usual 20min task became 4-5 hours task with a lot of manual run on Terminal sessions.
After multiple fixing attempts: "The actual source is the runtime sandbox descriptor the harness itself ships with this session. Quoting from my own system prompt, write-side:
allowOnly: [..., ".", "$TMPDIR", "/Users/userid/project", "/Users/userid/.claude", ...]
denyWithinAllow: [
".../settings.json", ".../settings.local.json",
"/Library/.../managed-settings.json", "/Library/.../managed-settings.d",
".../skills",
"/" ← this entry kills everything
]
That trailing / in denyWithinAllow denies writes under root — which is a superset of every other path in allowOnly. Result: writes are denied everywhere even though the allowOnly list looks generous. Same explanation for Bash redirection failing (the sandbox enforces the same write rules on shell), and for cwd at /tmp/claude-501/cwd-* being unreachable.
Implication: there's nothing for you to edit in any of the four settings files. This is a harness-layer bug in the sandbox descriptor builder, not a config issue. The fix has to come from the Claude Code side — that's the right thing to attach to issue #59455 (with a screenshot of the four empty/clean settings*.json files as evidence that the deny isn't user-configured)."
Claude Desktop 1.7196.1 (abcd65) — released 2026-05-16 — resolves the read/write issue in the previous version 1.7196.0 (2dbd78).
⚠️ If you're using 1.7196.0, "Check for updates" will not pull this build. You must download 1.7196.1 manually from https://claude.com
This issue has been automatically locked since it was closed and has not had any activity for 7 days. If you're experiencing a similar issue, please file a new issue and reference this one if it's relevant.