Sandbox false positive: newline + # in quoted args to localhost curl

Description

When posting JSON payloads to localhost via curl -d @/tmp/file.json, the sandbox triggers a warning:

"Newline followed by # inside a quoted argument can hide arguments from path validation"

This happens when the JSON content (written to a temp file via the Write tool) contains newlines followed by # characters — common in structured data payloads.

Expected behavior

Writes to /tmp/* and curl commands targeting localhost should not trigger this heuristic. These are local-only, non-destructive operations with no path-injection risk.

Reproduction

1. Write a JSON file to /tmp/payload.json containing a multiline string with a # character
2. Run curl -s -X POST http://localhost:3000/api/endpoint -d @/tmp/payload.json
3. Sandbox prompts for confirmation despite the operation being safe

Environment

• macOS (Darwin 25.5.0)
• Claude Code CLI
• Opus 4.6 model
• Global settings already allow Edit(/tmp/*), Write(/tmp/*), Bash(curl *)

Suggestion

Consider excluding /tmp/* targets and localhost URLs from this heuristic, or at minimum respecting the user's existing permission allowlist for these paths.