[BUG] Write/Edit EBADF/ENOENT on Windows CFA paths still present (re-filing #53761, unfixed)

Re-filing of #53761 (auto-closed for inactivity, not fixed). Bug is still present on Claude Code 2.1.220.

Summary

The Write and Edit tools fail with EBADF or ENOENT when targeting files inside Windows Controlled Folder Access (CFA) protected directories. The Claude Code harness Node binary is not on the CFA allowlist, so the OS kernel rejects its file operations — but the error surfaces as cryptic libuv errors instead of a clear CFA diagnostic.

Environment

• Claude Code 2.1.220 (VSCode extension, Windows 11 with Controlled Folder Access enabled)
• CFA-protected paths: Desktop, Documents, and any user-added folders

Reproduction

1. Enable Controlled Folder Access in Windows Security
2. Open Claude Code in a project whose working directory is under a CFA-protected path (or whose files reference one)
3. Ask Claude to write or edit a file in the protected directory

Result:

• Edit fails with EBADF (bad file descriptor) — libuv's open-on-FD syscall path rejected
• Write fails with ENOENT (no such file or directory) — libuv's write-on-FD syscall path rejected

Both are the same root cause (CFA kernel rejection) surfacing through different libuv code paths.

Key diagnostic (from original filing)

A probe matrix across 5 operators on the same Windows 11 host confirmed that only the Claude Code harness Node binary is blocked. Bash, PowerShell, and Python all succeed on the same paths because they are on the CFA allowlist. The issue is specifically that the Node.js binary used by Claude Code is not CFA-allowlisted.

Workaround

Use Bash tool with heredoc writes, or PowerShell Set-Content, or write to a non-protected temp directory and copy. All work because they use allowlisted executables.

Previous issue

• #53761 — our original filing with full probe matrix, cross-operator reproducibility table, and libuv analysis. Auto-closed for inactivity 2026-05-30, then auto-locked 2026-07-31.

Suggested fixes (from original filing)

1. Tool-layer catch: detect CFA-class errors and surface a clear message ("file is in a Controlled Folder Access protected directory — add the Claude Code Node binary to the CFA allowlist or use Bash as a workaround")
2. Tool description: document the CFA limitation in Write/Edit tool descriptions
3. Installer-time: offer to add the Claude Code Node binary to the CFA allowlist during installation