[BUG] "operation not permitted: /tmp/claude-501/cwd-*" error on macOS in sandbox mode

[monsterhxw]

Preflight Checklist

• I have searched existing issues and this hasn't been reported yet
• This is a single bug report (please file separate reports for different bugs)
• I am using the latest version of Claude Code

What's Wrong?

When executing any Bash command in Claude Code CLI with sandbox mode enabled, a permission error appears before the actual command output:

zsh:1: operation not permitted: /tmp/claude-501/cwd-dd16

The error occurs on every Bash command execution. The underlying commands still work, but the error message is always present.j

What Should Happen?

Commands should execute without permission errors. The temporary directory operations in /tmp/claude-501/ should work seamlessly.

Error Messages/Logs

$ git status
zsh:1: operation not permitted: /tmp/claude-501/cwd-99da

On branch main
Your branch is up to date with 'origin/main'.
...


> The error consistently references `/tmp/claude-501/cwd-*` with varying suffixes (dd16, 99da, 860e, etc.).

Steps to Reproduce

1. Install Claude Code CLI (claude)
2. Enable sandbox mode in ~/.claude/settings.json:

   {
     "sandbox": {
       "autoAllowBashIfSandboxed": true,
       "enabled": true
     }
   }

3. Run claude to start a session
4. Execute any Bash command, for example:
   • Use /commit-commands:commit slash command (See: https://github.com/anthropics/claude-code/tree/main/plugins/commit-commands)
   • Or run git status
5. Observe the error message zsh:1: operation not permitted: /tmp/claude-501/cwd-* appearing before the command output

Claude Model

Opus

Is this a regression?

I don't know

Last Working Version

2.1.21 (Claude Code)

Claude Code Version

2.1.23 (Claude Code)

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Other

Additional Information

• Using Claude Code CLI
• Sandbox mode enabled via ~/.claude/settings.json
• The error appears to be related to Claude Code's internal handling of temporary working directory files in sandbox mode
• The actual commands still execute successfully despite the error
• This may be related to sandbox mode's interaction with /tmp directory operations on macOS
• The issue affects all Bash command executions, not just specific commands

[github-actions]

Found 3 possible duplicate issues:

1. [BUG] Bash tool execution consistently fails with temporary script file error on macOS #2943
2. [Bug] Permission Denied Error on Temporary File Execution #11951
3. [BUG] Sandbox mode breaks zsh heredocs - TMPPREFIX not set to sandbox-allowed path #17989

This issue will be automatically closed as a duplicate in 3 days.

• If your issue is a duplicate, please close it and 👍 the existing issue instead
• To prevent auto-closure, add a comment or 👎 this comment

🤖 Generated with Claude Code

[danielorbach]

This is NOT a duplicate - it's a new regression introduced in v2.1.23.

Root Cause

Version 2.1.23 changed the temp directory from /tmp/claude to /tmp/claude-{UID} for per-user isolation:

"Fixed per-user temp directory isolation to prevent permission conflicts on shared systems"

However, the sandbox allowlist was not updated to match. The sandbox still only allows:

• /tmp/claude
• /private/tmp/claude

But the code now uses /tmp/claude-501 (based on UID), which is not allowed by the sandbox.

The Fix

The sandbox allowlist needs to be updated to allow /tmp/claude-* pattern or dynamically inject the actual temp directory being used.

Workaround

Until fixed, users can:

export CLAUDE_CODE_TMPDIR=/tmp/claude

Why This Isn't a Duplicate

• [BUG] Sandbox mode breaks zsh heredocs - TMPPREFIX not set to sandbox-allowed path #17989: About zsh heredocs and TMPPREFIX (pre-existing issue)
• [BUG] Bash tool execution consistently fails with temporary script file error on macOS #2943: Broader temp script file issues (pre-existing)
• [Bug] Permission Denied Error on Temporary File Execution #11951: General permission denied errors (pre-existing)

This issue is specifically about the 2.1.23 regression where the new per-user isolation feature broke sandbox mode.

[wabi91]

Additional Context: Skill/Command Execution

I'm experiencing the same issue specifically with Custom Slash Commands (the ! backtick pattern in .claude/commands/*.md files).

Specific Error Pattern

zsh:3: operation not permitted: /tmp/claude-501/cwd-XXXX

The cwd-* file is used by Claude Code to persist working directory between Bash calls. When zsh tries to write this file, the
sandbox blocks it.

Why 2>/dev/null Doesn't Help

The zsh error occurs at shell initialization level, before the command even runs. Redirecting stderr in the command itself
doesn't capture this:

# This still shows the zsh error
python3 script.py 2>/dev/null

The error happens in the shell wrapper, not the python process.

Impact

• Custom slash commands using ! pattern always show error messages
• The command output is still returned, but wrapped in "Bash command failed for pattern" error
• User experience is degraded despite commands working correctly

[mikecfisher]

Happening for me as well