[BUG] Sandbox issue

[vt-nb]

Preflight Checklist

• I have searched existing issues and this hasn't been reported yet
• This is a single bug report (please file separate reports for different bugs)
• I am using the latest version of Claude Code

What's Wrong?

I'm using Claude Desktop 1.7196.0 (2dbd78) on MacOS with 3 accounts: personal Max account, Team, Claude via Bedrock). All accounts keeps showing annoying sandbox error

This happens even in Developer => Configure third-party inference => Sandbox & workspace: all these directories are listed as allowed workspace folders

What Should Happen?

These sandbox issues do not happened when I used Claude previous versions (and also before using Claude via Bedrock)

Error Messages/Logs

I'm hitting a sandbox-level wall: every write attempt fails in this session, regardless of path. I tested writes to:

/Users/userid/project/ (the project) → blocked
/Users/userid/.claude/plans/ (where plan mode wanted to write) → blocked
$TMPDIR (/tmp/claude-501/) → blocked
/tmp, /private/tmp/claude → blocked

All return Operation not permitted from the kernel sandbox, not a Unix-perm error. The system-prompt sandbox descriptor includes "/" in denyWithinAllow, which looks like the over-reaching deny rule blanket-blocking everything inside the allow list.

I can't implement the change from this session — Write, Edit, and Bash redirections will all fail until the sandbox is reset."

Claude itself finds this: The sandbox descriptor for writes shipped to this session contains:

"write.denyWithinAllow: [
  "/Users/userid/.claude/settings.json",
  "/Users/userid/project/.claude/settings.json",
  "/Users/userid/project/.claude/settings.local.json",
  "/tmp/claude-settings-44136fa355b3678a.json",
  "/Library/Application Support/ClaudeCode/managed-settings.json",
  "/Library/Application Support/ClaudeCode/managed-settings.d",
  "/Users/userid/project/.claude/skills",
  "/"                                      ← this is the killer
]"

I read all three settings.json files via cat (the Read tool is itself blocked for them):
~/.claude/settings.json — no permissions.deny, no Edit(/) rule
<project>/.claude/settings.json — no permissions.deny
<project>/.claude/settings.local.json — no permissions.deny

None of them contain a deny rule that would translate into a / entry in denyWithinAllow. The managed-settings file (/Library/Application Support/ClaudeCode/managed-settings.json) doesn't exist either. So this isn't user-configurable — Claude Code is computing/injecting the / itself.

Steps to Reproduce

Write bash script, push, run git

Claude Model

Opus

Is this a regression?

Yes, this worked in a previous version

Last Working Version

No response

Claude Code Version

2.1.132 (Claude Code)

Platform

Anthropic API

Operating System

macOS 26.5

Terminal/Shell

Terminal.app (macOS)

Additional Information

No response

[github-actions]

Found 3 possible duplicate issues:

1. Sandbox auto-adds config/ to denyWithinAllow, breaking git checkout across refs #56331
2. [BUG] Sandboxing doesnt work with directories named 'config' #58068
3. [BUG] bwrap sandbox completely broken — "Can't create file at .zshrc: Read-only file system" kills ALL Bash tool calls #50781

This issue will be automatically closed as a duplicate in 3 days.

• If your issue is a duplicate, please close it and 👍 the existing issue instead
• To prevent auto-closure, add a comment or 👎 this comment

🤖 Generated with Claude Code

[vt-nb]

This is a horrible bug across platforms (MacOS 26.5 for me, Linux for this case #50781).

Not only ALL BASH calls are prevented, but ALL EDITING/WRITING ON FILES (even in the same projects) are prevented!!! An usual 20min task became 4-5 hours task with a lot of manual run on Terminal sessions.

[vt-nb]

After multiple fixing attempts: "The actual source is the runtime sandbox descriptor the harness itself ships with this session. Quoting from my own system prompt, write-side:

allowOnly: [..., ".", "$TMPDIR", "/Users/userid/project", "/Users/userid/.claude", ...]
denyWithinAllow: [
".../settings.json", ".../settings.local.json",
"/Library/.../managed-settings.json", "/Library/.../managed-settings.d",
".../skills",
"/" ← this entry kills everything
]
That trailing / in denyWithinAllow denies writes under root — which is a superset of every other path in allowOnly. Result: writes are denied everywhere even though the allowOnly list looks generous. Same explanation for Bash redirection failing (the sandbox enforces the same write rules on shell), and for cwd at /tmp/claude-501/cwd-* being unreachable.

Implication: there's nothing for you to edit in any of the four settings files. This is a harness-layer bug in the sandbox descriptor builder, not a config issue. The fix has to come from the Claude Code side — that's the right thing to attach to issue #59455 (with a screenshot of the four empty/clean settings*.json files as evidence that the deny isn't user-configured)."

[vt-nb]

Claude Desktop 1.7196.1 (abcd65) — released 2026-05-16 — resolves the read/write issue in the previous version 1.7196.0 (2dbd78).

⚠️ If you're using 1.7196.0, "Check for updates" will not pull this build. You must download 1.7196.1 manually from https://claude.com

[github-actions]

This issue has been automatically locked since it was closed and has not had any activity for 7 days. If you're experiencing a similar issue, please file a new issue and reference this one if it's relevant.