Issue Station
Sign In
Tools hereToolbox

claude-code - 💡(How to fix) Fix [BUG] Sandbox blocks git checkout / worktree add on repos tracking .vscode/ — intended?

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…

Error Message

Error Messages/Logs

Code Example

operation not permitted: /Users/xida/monorepo/t/.vscode/x.json

---

{"sandbox": {"enabled": true, "filesystem": {"allowWrite": ["~/monorepo/"]}}}

---

$ printf '{}' > ~/monorepo/t/.vscode/x   # operation not permitted
$ printf '{}' > ~/monorepo/t/.idea/x     # operation not permitted
$ printf '{}' > ~/monorepo/t/foo         # ok
$ printf '{}' > ~/monorepo/t/.git/x      # ok (not blocked)
RAW_BUFFERClick to expand / collapse

Preflight Checklist

  • I have searched existing issues and this hasn't been reported yet
  • This is a single bug report
  • I am using the latest version of Claude Code

What's Wrong?

Trying to git worktree add from a monorepo that tracks .vscode/settings.json. The sandbox denies writing .vscode/settings.json during checkout; the worktree add fails mid-operation, leaving a stale branch + worktree registration that requires git worktree prune + git branch -D to clean up.

The block isn't in any visible settings file — it's hardcoded in the binary. Is this intended? If blocking writes to tracked .vscode/* / .idea/* (common in shared monorepos that standardize format/lint settings) is a deliberate security tradeoff, that's worth documenting + providing an opt-out for. If unintended, explicit sandbox.filesystem.allowWrite entries should win over the hardcoded list so git checkout works on any user-allowlisted repo.

What Should Happen?

git checkout / git worktree add should succeed on any repo under a user-allowlisted allowWrite root, regardless of whether the repo tracks .vscode/*.

Error Messages/Logs

operation not permitted: /Users/xida/monorepo/t/.vscode/x.json

Steps to Reproduce

  1. ~/.claude/settings.json: 
    {"sandbox": {"enabled": true, "filesystem": {"allowWrite": ["~/monorepo/"]}}}
  2. Have a repo under ~/monorepo/ that tracks .vscode/settings.json.
  3. git -C ~/monorepo/main worktree add ../feature-x -b feature-x main → fails mid-checkout; branch + registration created but directory incomplete. Recovery: git worktree prune + git branch -D feature-x.

Narrow repro (sandboxed Bash):

$ printf '{}' > ~/monorepo/t/.vscode/x   # operation not permitted
$ printf '{}' > ~/monorepo/t/.idea/x     # operation not permitted
$ printf '{}' > ~/monorepo/t/foo         # ok
$ printf '{}' > ~/monorepo/t/.git/x      # ok (not blocked)

Claude Model

Not applicable (sandbox behavior, not model-dependent)

Is this a regression?

I don't know

Claude Code Version

2.1.114

Platform

Anthropic API

Operating System

macOS (Darwin 24.6.0)

Terminal/Shell

iTerm2

Additional Information

v2.1.114 binary strings show .vscode, .idea hardcoded near the _SBX module, distinct from the home-dir-mapping dotfile set (.bashrc, .gitconfig, .mcp.json, …) discussed in #29316. Related: #29316, #50505.

extent analysis

TL;DR

The issue can be resolved by explicitly allowing write access to .vscode and .idea directories in the sandbox.filesystem.allowWrite settings.

Guidance

  • The error occurs because the Claude Code binary has a hardcoded block on writing to .vscode and .idea directories, which is not overridden by the allowWrite settings.
  • To verify the issue, try creating a file in the .vscode or .idea directory using the printf command, as shown in the repro steps.
  • To mitigate the issue, add explicit allowWrite entries for the .vscode and .idea directories in the ~/.claude/settings.json file, like this: "allowWrite": ["~/monorepo/", "~/monorepo/.vscode/", "~/monorepo/.idea/"].
  • If the issue persists, try checking the Claude Code version and platform for any known issues or regressions.

Example

{
  "sandbox": {
    "enabled": true,
    "filesystem": {
      "allowWrite": ["~/monorepo/", "~/monorepo/.vscode/", "~/monorepo/.idea/"]
    }
  }
}

Notes

The solution assumes that the allowWrite settings can override the hardcoded block in the Claude Code binary. If this is not the case, further investigation may be needed to determine the root cause of the issue.

Recommendation

Apply the workaround by adding explicit allowWrite entries for the .vscode and .idea directories, as this is a more targeted solution that addresses the specific issue at hand.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#api#integration issue#index setup#retrieval issue#search optimization

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING