[BUG] File names used by Claude wreak havoc with XFence security

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

My company uses a security tool called WithSecure XFence which implements restricted access control for various file operations. It works fine most of the time with most tools, but Claude Code is problematic for multiple reasons.

• The binary's name is not claude or anything else you can easily guess; the name of the actual binary is simply the version number (as of right now, 2.1.251). You have to know this before you grant access to various paths, and is basically impossible to guess if you don't already know. This also means that rules that you created for an earlier version stop working every time you get an update.
• It writes to files in the user's home directory with a predictable stem, but there is no facility for creating a rule for a filename's prefix. It would be more manageable and (I'm sure also) tractable if the temporary files it creates were under a common directory.

Here is a screen shot of some rules of mine. I selected somewhat older versions because of how erratic they were; the newer ones have better rules as I have learned over time (and also some of them now contain paths that I don't want to share here).

<img width="1512" height="692" alt="Image" src="https://github.com/user-attachments/assets/322bc933-9cca-4f19-b685-c929f98db71e" />

For any other tool, the name in the leftmost column would be something sane and predictable like bash or node or git or etc. You can limit the fallout somewhat by creating a rule for "any binary" with the Team ID of Claude, but this seems rather risky.

What Should Happen?

The binary which runs Claude Code should have a fixed, predictable, and informative name like claude.

The files it writes to for internal purposes should be confined to a few directories which clearly belong to the tool itself.

Error Messages/Logs

Steps to Reproduce

1. Your employer decides to roll out XFence for all Mac workstations, no exceptions.
2. You download and try to use Claude.

Actual behavior: Crazy dialog boxes about blocked writes, multiple per second, and a limited time to respond to them all.

Expected behavior: Once you have a few simple rules in place, these writes are permitted, and no blocking occurs.

Claude Model

Sonnet (default)

Is this a regression?

No, this never worked

Last Working Version

_No response_

Claude Code Version

2.1.251 (Claude Code)

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

Imagine if all tools did this. "30.2 running under 5.3.9(1)-release wants to execute 2.53.0"