[BUG] Linux: files under a sandbox-reachable directory get enumerated ~one rule per file into the `bash` tool schema, overflowing `/context` "System tools"

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

I suddenly found myself unable to make requests as the context was too large. Running /context showed 829k tokens were taken up by system tools. Issue persisted even after completely uninstalling, removing all .claude folders and files, and reinstalling fresh.
After significant troubleshooting root cause was determined to be a .tox folder had been populated between sessions while running tests. This resulted in ~15k new files which ballooned the context. This was reproducible via script to create dummy files in a reachable folder.

What Should Happen?

Not that - perhaps those folders could be easily ignored, or the same pattern that works in macOS would work in Linux, I didn't seem to be able to reproduce the issue on a mac.

Error Messages/Logs

Steps to Reproduce

1. I'm not sure whether this only applied due to org rules setting sandox to only allow certain folders, but let's say that you do have one for /home/<you>/claude
2. run claude and /context
3. note System Tools and exit
4. use a script to make a dir with 100 subs each containing 100 files. eg

ROOT="${1:-$HOME/claude/cc-context-repro}" 
DIRS="${2:-100}"
FILES_PER_DIR="${3:-100}"             # 100 x 100 = 10,000 empty files
rm -rf "$ROOT"
for d in $(seq -w 1 "$DIRS"); do
  mkdir -p "$ROOT/dir_$d"
  for f in $(seq -w 1 "$FILES_PER_DIR"); do
    : > "$ROOT/dir_$d/file_$f"
  done
done

1. claude and /context

Claude Model

Opus

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.176

Platform

Anthropic API

Operating System

Ubuntu/Debian Linux

Terminal/Shell

Other

Additional Information

Report as generated by Claude after analysis concluded and reproduction confirmed.

Environment

• Claude Code 2.1.176 (npm global install)
• Affected: Linux (Debian 12)
• Verified NOT affected: macOS (same version)

Verified behavior
When files exist under a directory that is in the sandbox's readable allow-set
(a configured "reachable" directory, e.g. via permissions.additionalDirectories
/ synced remote-settings), Linux inflates /context "System tools" in
proportion to the file count. macOS does not.

Linux:

• Real-world: reachable dir held ~15,400 files (mostly a .tox/ tree — tox

builds a full venv per environment). /context "System tools" = 851k
(425% of a 200k window). Removing the tree -> ~22k.

• Controlled: dropping ~10,000 empty files INTO the reachable dir took

"System tools" from 22.3k -> 294.6k (~27 tokens/file at short paths).

macOS (same controlled test — files placed inside the reachable dir):

• "System tools" unchanged (~15.8k baseline). No scaling with file count.

Reproduction (the trigger is location, not --add-dir)

1. Have a directory D that is in the sandbox's readable allow-set

(configured reachable, e.g. permissions.additionalDirectories).

1. Create many files under D:

for d in $(seq -w 1 100); do mkdir -p "D/dir_$d"
for f in $(seq -w 1 100); do : > "D/dir_$d/file_$f"; done; done

1. Start Claude in any cwd (even /tmp) and run /context.

• Linux: "System tools" scales with the file count under D.
• macOS: "System tools" stays at baseline.

IMPORTANT: claude --add-dir <path> does NOT reproduce this if <path> is not
already readable in the sandbox (e.g. a $HOME path that the sandbox denies) —
no files become reachable, so nothing is enumerated. The files must live under
a directory that is actually in the readable allow-set.

Impact
On a 200k-context model this overflows the window and makes sessions unusable;
on 1M it still consumes most of the budget. .tox, node_modules,
__pycache__, .venv regenerate on routine tox / npm install, so it
recurs silently after ordinary dev activity inside a reachable project dir.

Suspected mechanism
The reachable directory appears to be expanded into one sandbox bind/allow rule
per file in the bash tool's input schema — consistent with the linear
tokens/file scaling on Linux and the flat macOS result. The raw tool schema was
not dumped, so the exact mechanism is inferred; the OS contrast and linear
scaling are reproducible.

Ruled out during diagnosis

• Independent of MCP servers, plugins, hooks, agents/commands, permission rules

(27 deny rules), and managed settings.

• Not a large config file (settings 22 B, ~/.claude.json 29 KB); not a file on

disk — generated at startup, reproduces in an empty cwd.

• Not fixed by reinstall. (Note: npm install -g @anthropic-ai/claude-code is a

no-op when already on the latest version; a real reinstall needs
npm uninstall -g + rm -rf of the package dir.)

Workaround
CLAUDE_CODE_SIMPLE=1 claude (or --bare) skips sandbox setup and avoids it.

Suggested fix
On Linux, compile a reachable directory to a single bounded rule (e.g. a
recursive bind) as macOS does, instead of one rule per file; and/or exclude
regenerable trees by default (**/.tox/**, **/.venv/**,
**/node_modules/**, **/__pycache__/**, **/.git/**).