plugin eval (macOS, ≥2.1.251): sandbox denies every Bash write — /private/tmp denyWrite covers the /tmp/e-* sandbox root

Status Fixed / completed

Reported on v2.1.251

Maintainer reply None cached

Activity 0 comments · opened Sep 2, 2026 · closed Sep 10, 2026

Summary

Since Claude Code 2.1.251, claude plugin eval --scaffold --allow-tools Bash on macOS produces a sandbox in which every Bash write fails with Operation not permitted, so every Bash tool call exits non-zero. Write and Edit (un-sandboxed) still work, so only cases that never touch Bash-created files pass. 2.1.250 works.

Cause (from reading the generated policy)

Each trial sandbox is rooted at /tmp/e-XXXXXX. The engine's generated sandbox settings allow writes under <root>/home and <root>/tmp, but the same policy lists /private/tmp under denyWrite. On macOS /tmp is a symlink to /private/tmp, so the parent deny covers the allowed children and wins. The sandbox policy hashes identically from 2.1.251 through 2.1.258; 2.1.250's differs.

A common first symptom: git (the /usr/bin/git xcrun shim) dies before running — git: error: couldn't create cache file '/private/var/folders/…/T/xcrun_db-…' (errno=Operation not permitted), exit 72 — because $TMPDIR is not writable either. Setting TMPDIR, XCRUN_NO_CACHE=1, or CLAUDE_CODE_TMPDIR in the calling environment does not change the root placement.

Repro

claude --version            # 2.1.258 (also 2.1.251–2.1.257)
claude plugin eval <any-plugin-with-a-case> --scaffold --allow-tools Bash
# in the case prompt, have the agent run:  touch ./x && echo ok
# → "touch: ./x: Operation not permitted", exit 1

Same case on 2.1.250: passes.

Expected

Bash writes inside the sandbox's own home/ and tmp/ roots succeed — either by rooting the sandbox outside /private/tmp, or by excluding the sandbox root from the /private/tmp deny.

Impact

Any eval whose task edits a git-tracked file (the agent must branch/commit) is impossible; our release regression suite went from 40/40 passing on 2.1.250 to every edit-a-file case failing in both arms on 2.1.258, with the scores silent about why.

View original on GitHub ↗