[BUG] In strict sandbox mode, non-literal paths force permission prompts even in Auto mode

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

I keep getting permission prompts because, for example, " │ python3 names a path that is computed at run time, which cannot be checked against the read block (permissions.blockReadsOutsideWorkingDirectories)". This is in auto mode, with strict sandboxing enabled.

What Should Happen?

When in auto mode, these permission prompts should either go through the auto mode classifier, or be automatically denied in auto mode so that Claude can find a different method, such as using literal paths in the command.

If possible, permissions.blockReadsOutsideWorkingDirectories should be enforced at the filesystem level. Then the command can be automatically approved, and if the variable is resolved to a path that is outside of the working directory, the sandboxed filesystem blocks the access.

Error Messages/Logs

Bash command

   │ python3 -c "
   │ import json
   │ data = json.load(open('$TMPDIR/sample_data.json'))
   │ for item in data['items']:
   │     print(item['name'], item['price'], item['qty'])
   │ "
   Read and print JSON items

 │ python3 names a path that is computed at run time, which cannot be checked against the read block (permissions.blockReadsOutsideWorkingDirectories)

 Do you want to proceed?
 ❯ 1. Yes
   2. No

Steps to Reproduce

1. Open Claude Code
2. Type /sandbox, set mode to "1. Sandbox BashTool, with auto-allow", set Overrides to "2. Strict sandbox mode"
3. Confirm that the current mode is "Auto mode" If it isn't, use shift + tab to cycle to Auto Mode.
4. Give Claude Code this prompt:

❯ Run these two Bash commands in order:

1. echo '{"items":[{"name":"widget","price":9.99,"qty":3},{"name":"gadget","price":19.5,"qty":1}]}' > $TMPDIR/sample_data.json
2. python3 -c "

import json
data = json.load(open('$TMPDIR/sample_data.json'))
for item in data['items']:
print(item['name'], item['price'], item['qty'])
"

Report whether command 2 triggers a permission prompt with an error mentioning permissions.blockReadsOutsideWorkingDirectories, even though $TMPDIR is an allowlisted write path.

Claude Model

Sonnet (default)

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.272

Platform

Anthropic API

Operating System

Ubuntu/Debian Linux

Terminal/Shell

Other

Additional Information

Claude thinks the only workaround for this is to make a memory to use literal paths.