RCA: disallowedTools bug activation in production (Jul 6)

[maruiz93]

Summary

On July 6, 2026 at ~06:57 UTC, a routine renovate bot dependency
update — PR #2998 —
triggered a Docker layer cache bust in the sandbox image build. The
fresh curl | bash install baked a post-enforcement Claude Code
version into the image, activating a latent disallowedTools parsing
bug that had been dormant since April 23. Every Code and Fix agent
run since Jul 6 08:52 UTC is affected.

---

Timeline

Phase 1: Bug introduced (April 20–23)

Date (UTC)	Event	Link
Apr 20	Code agent added with disallowedTools: ["Bash(sed *)"]	agents commit 8f77fa2
Apr 22	Fix agent added with disallowedTools: ["Bash(sed *)"]	agents commit 6dddc82
Apr 23 02:05	Experiment 0021 ran on Claude Code v2.1.118 — concluded disallowedTools was inert	experiment README
Apr 23 23:24	Claude Code v2.1.119 released — --print mode now honors disallowedTools	changelog

v2.1.119 is the enforcement change. Before this version,
disallowedTools in agent frontmatter was silently ignored in
--print / --agent sessions. After, it's enforced — but scoped
patterns like Bash(sed *) are parsed incorrectly, stripping the
entire Bash tool instead of only blocking the scoped command.

Phase 2: Bug latent (April 23 – July 6)

The sandbox image installs Claude Code at build time via
RUN curl -fsSL https://claude.ai/install.sh | bash in the
Containerfile. Docker layer caching preserves the installed version
across rebuilds as long as preceding layers (FROM, apt-get) don't
change.

All sandbox image builds from v0.13.0 (Jun 1) through v0.27.0
(Jul 2) had the curl | bash step CACHED, preserving v2.1.91
(a pre-enforcement version from April 2).

Verified via CI build logs — every build shows #N CACHED for the
Claude Code install step:

Build	Date (UTC)	curl|bash step	Evidence
v0.18.0	Jun 16	CACHED	CI run 27643273597
v0.22.0	Jun 26	CACHED	CI run 28252562787
v0.23.0	Jun 29	CACHED	CI run 28377562293
v0.24.0	Jun 30	CACHED	CI run 28463406378
v0.25.0	Jul 1	CACHED	CI run 28487065193
v0.27.0	Jul 2	CACHED	CI run 28557734475

During this period, 100+ Code/Fix runs executed without issue
(all using v2.1.91 — disallowedTools was not enforced).

Artifact sampling confirms v2.1.91 throughout:

Run date (UTC)	Run ID	Version	Tools	Bash?
Jun 1	—	v2.1.91	23	Yes
Jun 21	—	v2.1.91	23	Yes
Jun 22 06:52	27934955320	v2.1.91	23	Yes
Jun 27 17:37	28296735213	v2.1.91	23	Yes
Jul 1 16:00	28530739183	v2.1.91	23	Yes
Jul 3 13:21	28663308198	v2.1.91	23	Yes
Jul 5 17:00	28748197392	v2.1.91	23	Yes

Phase 3: Cache bust (July 6)

Time (UTC)	Event	Link
06:28	PR #2998 merged to main — renovate bot updating the OpenShell base image digest in images/sandbox/Containerfile	PR #2998
06:28	"Sandbox Images" CI triggered on main push	CI run 28772374321
~06:30	build-base job: RUN curl ... | bash → NOT CACHED — Setting up Claude Code... → installed v2.1.201	Build log line: #11 6.276 Version: 2.1.201
06:41	build-base job completed, fullsend-sandbox:latest pushed	—
06:57	build-code job completed, fullsend-code:latest pushed	—

The changed FROM digest (sha256:11c73b5a... → sha256:aeef1c63...)
invalidated all downstream Docker layers, forcing a fresh Claude Code
install. The build logs show the exact transition:

# Before PR #2998 (e.g., v0.27.0):
#15 [3/10] RUN curl -fsSL https://claude.ai/install.sh | bash
#15 CACHED

# PR #2998 main build:
#11 [3/10] RUN curl -fsSL https://claude.ai/install.sh | bash
#11 1.560 Setting up Claude Code...
#11 6.276   Version: 2.1.201

Phase 4: First affected run (July 6 08:52 UTC)

Time (UTC)	Event	Link
04:05	Last clean Code run — v2.1.91, 23 tools, Bash available	run 28766986920
06:57	New fullsend-code:latest pushed (post-enforcement)	CI run 28772374321
08:52	First affected Code run — v2.1.156, 26 tools, Bash absent	run 28779589895

The transition is sharp. Every Code/Fix run since 08:52 UTC is
affected.

Note on version discrepancy: Build logs show v2.1.201 was
installed, but the runtime init event reports claude_code_version: 2.1.156. Both are post-v2.1.119 (the enforcement change), so the
bug is active regardless. The discrepancy may be due to an
intermediate version resolution mechanism between image build and
sandbox execution.

---

What happens in affected runs

The parsing bug

disallowedTools: ["Bash(sed *)"] is parsed as "this mentions Bash"
and the entire Bash tool is removed from the agent's tool list. The
(sed *) scope is ignored. Instead of 23 tools (including Bash),
the agent starts with 26 tools (different tool composition, no Bash).

The scope leak via subagent delegation

After Bash is removed, the agent adapts by spawning subagents via the
Agent tool. Subagents do NOT inherit the parent's disallowedTools
restriction — they have unrestricted Bash access.

First affected run (Jul 6 08:52) pattern:

1. Parent starts with 26 tools (Bash missing)
2. Line 17: Parent calls Bash → "Error: No such tool available: Bash"
3. Line 30+: Parent spawns 6 subagents via Agent tool
4. Subagents make 25 Bash calls total — completely unrestricted

This makes disallowedTools trivially bypassable. The model
learns after one failed Bash call and exclusively delegates via
subagents for all subsequent Bash work.

Upstream issues filed

Issue	Bug	Status
#78063	disallowedTools not inherited by subagents (scope leak)	Open — filed Jul 2026
#19501	Scoped disallowedTools: Bash(git *) strips entire Bash	Closed (dup of #15348)
#6527	Broad allow swallows narrow deny (composition bug)	Open since Aug 2025

---

Evidence: claude-replay sessions

Interactive HTML replays generated from production JSONL artifacts.
Open in a browser.

1. Last clean run — disallowedTools ignored (v2.1.91)

File: rca-replays/1-last-clean-jul6-0405.html (in project workspace)

• Run: Code agent, Jul 6 04:05 UTC, run 28766986920
• Version: v2.1.91 (pre-enforcement)
• What to look for: The parent session has 23 tools including
  Bash. Agent frontmatter has disallowedTools: ["Bash(sed *)"] but
  the restriction is silently ignored. The agent calls Bash 17 times
  directly — no errors, no subagent delegation.
• Artifact: docs/artifacts/code-jul6-last-clean/ (in project workspace)

2. First affected run — Bash error, pivot to Agent (v2.1.156)

File: rca-replays/2-first-affected-jul6-0852.html (in project workspace)

• Run: Code agent, Jul 6 08:52 UTC, run 28779589895
• Version: v2.1.156 (post-enforcement)
• What to look for: The parent starts with 26 tools (Bash absent).
  At line 17, the parent attempts Bash → gets
  "Error: No such tool available: Bash". From line 30 onward, it
  exclusively uses the Agent tool to spawn subagents.
• Artifact: docs/artifacts/code-jul6-first-affected/ (in project workspace)

---

Root cause chain

disallowedTools: ["Bash(sed *)"] added to Code/Fix agents
    ↓ (Apr 20–22)
v2.1.119 starts enforcing disallowedTools in --print mode
    ↓ (Apr 23)
Bug is latent — sandbox image has v2.1.91 (cached curl|bash)
    ↓ (74 days: Apr 23 → Jul 6)
Renovate bot updates base image digest (PR #2998)
    ↓ (Jul 6 06:28)
Docker cache invalidated → fresh curl|bash → post-enforcement version
    ↓ (Jul 6 06:57)
fullsend-code:latest pushed with new version
    ↓
First Code run pulls new image → Bash stripped → Agent delegation
    ↓ (Jul 6 08:52)
Subagents bypass disallowedTools → restriction is cosmetic

Contributing factors

1. Unpinned Claude Code install. RUN curl | bash installs
   whatever is latest at build time. No version pin, no checksum.
   Behavioral changes in Claude Code land silently on the next cache
   bust.

2. Docker layer caching masked the change for 74 days. The FROM
   digest hadn't changed since the image was first built with v2.1.91.
   All 20+ sandbox image builds between Jun 1 and Jul 2 reused the
   cached Claude Code binary.

3. Scoped pattern parser is broken. disallowedTools: Bash(sed *)
   should block only sed-pattern commands but instead removes Bash
   entirely. Upstream bug, no fix in 11 months — #6527.

4. Subagents don't inherit restrictions. Even if the parser worked
   correctly, subagents bypass disallowedTools entirely. Upstream
   bug, newly filed — #78063.

5. No version monitoring. There's no alert or check comparing the
   Claude Code version across runs. The jump from v2.1.91 to a
   post-enforcement version produced no notification.

6. Experiment 0021
   ran on the last unaffected version. The experiment tested
   disallowedTools on v2.1.118 (Apr 23 02:05 UTC) and concluded it
   was inert. v2.1.119 was released 21 hours later, changing the
   behavior. The experiment's conclusion was invalidated before the
   ink dried.

---

Appendix: image and config references

Reference	Value
Sandbox Containerfile	images/sandbox/Containerfile
Code image Containerfile	images/code/Containerfile
Harness config (code)	.fullsend/harness/code.yaml → base: → scaffold template
Image reference	ghcr.io/fullsend-ai/fullsend-code:latest
Sandbox Images workflow	.github/workflows/sandbox-images.yml
Cache bust PR	#2998 — chore(deps): update openshell
Cache bust CI run	28772374321
Scope leak issue	anthropics/claude-code#78063

[maruiz93]

Remediation

• Remove disallowedTools from agent definitions — agents#171 (open)
• Pin Claude Code version in sandbox Containerfile and track with Renovate — fullsend#5193 (open)