[BUG] sandbox.filesystem.denyWithinAllow not enforced for Edit/Write tools

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Description:

The denyWithinAllow sandbox rule does not prevent the Edit tool from writing to explicitly denied paths.

What Should Happen?

1. Use the Edit tool to modify ~/.claude/settings.json.

Expected: Edit is rejected because the path matches denyWithinAllow.

Actual: Edit succeeds and the file is modified.

Impact: Users who configure denyWithinAllow to protect sensitive config files (e.g., settings.json, settings.local.json) from being modified by the agent have their restriction silently bypassed.

Error Messages/Logs

Steps to Reproduce

1. In ~/.claude/settings.json, configure the sandbox with a denyWithinAllow entry:

"sandbox": {
"enabled": true,
"filesystem": {
"allowWrite": ["."]
}
}

1. The system-level sandbox config includes:

"write": {
"allowOnly": ["/home/user/.claude", "."],
"denyWithinAllow": ["/home/user/.claude/settings.json"]
}

1. Use the Edit tool to modify ~/.claude/settings.json.

Claude Model

Opus

Is this a regression?

Yes, this worked in a previous version

Last Working Version

_No response_

Claude Code Version

1.0.127

Platform

Anthropic API

Operating System

Ubuntu/Debian Linux

Terminal/Shell

Other

Additional Information

_No response_