[BUG] sandbox.filesystem.denyRead does not block reads (file-type patterns and plain folder paths both fail)

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

sandbox.filesystem.denyRead does not block file reads, whether using a wildcard file-type pattern or a plain folder path. Files that should be denied are read successfully.

What Should Happen?

Any file matching a denyRead rule (whether a glob pattern like *.key, or a plain folder path like ~/blocktest) should be blocked from being read, with a permission-denied style error.

Error Messages/Logs

Steps to Reproduce

1. Add a denyRead rule to sandbox.filesystem in settings.json, e.g. "denyRead": ["~/blocktest"]
2. Fully restart Claude Code so settings reload
3. Create a file inside that folder (or matching the pattern)
4. Try to read it with cat
5. Read succeeds (exit code 0) instead of being denied

Claude Model

Sonnet (default)

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.220

Platform

Other

Operating System

Other Linux

Terminal/Shell

WSL (Windows Subsystem for Linux)

Additional Information

_No response_