[Bug] Sandbox blocks uv cache access during pytest execution

[higumachan]

Bug Description When using sandbox and uv together, running pytest fails because it cannot access $HOME/.cache/uv/sdists-v9/.git.

⏺ Bash(uv run pytest -v) ⎿  Error: error: failed to open file $HOME/.cache/uv/sdists-v9/.git: Operation not permitted (os error 1)

 <sandbox_violations>
 uv(9813) deny(1) file-write-data $HOME/.cache/uv/sdists-v9/.git
 </sandbox_violations>

Environment Info

• Platform: darwin
• Terminal: ghostty
• Version: 2.0.26
• Feedback ID: 1c792d06-9b35-4f79-9656-056b857900f1

Errors ⏺ Bash(uv run pytest -v) ⎿  Error: error: failed to open file $HOME/.cache/uv/sdists-v9/.git: Operation not permitted (os error 1)

 <sandbox_violations>
 uv(9813) deny(1) file-write-data $HOME/.cache/uv/sdists-v9/.git
 </sandbox_violations>

[higumachan]

I have already added $HOME/.cache to add-dir.

/add-dir

Permissions:  Allow   Ask   Deny   Workspace   (tab to cycle)
 Claude Code can read files in the workspace, and make edits when auto-accept edits is on.

   -  /Users/<username>/ghq/github.com/higumachan/claude-sandbox-check/pytest_with_uv (Original working directory)
 ❯ 1. /Users/<username>/.cache
   2. Add directory…

[lior-airis]

Something weird happened to me:

1. Added Edit(/Users//.cache/**) to the permissions section
2. It immediately worked and I was able to run "uv run python.." no problem
3. After a while it STOPPED working and i noticed that the Edit() has VANISHED from ~/.claude/settings.json

What's going on? The full edit:

⏺ Update(~/.claude/settings.json)[/+]
⎿  Updated ../../.claude/settings.json with 2 additions and 4 removals
2 "permissions": {
3 "allow": [
4 "WebFetch",
5 - "WebSearch"
5 + "WebSearch",
6 + "Edit(~/.cache/**)"
7 ],
8 "deny": [
9 "Read(~/.aws/**)",
...

I'm on Mac

[github-actions[bot]]

This issue has been inactive for 30 days. If the issue is still occurring, please comment to let us know. Otherwise, this issue will be automatically closed in 30 days for housekeeping purposes.

[lynchifer]

Hey, just adding that we are also running into this configuration limitation for subprocesses. It would be nice to be able to allow .git access (or I suppose .cache) outside the working directory and in sandbox, either explicitly or with ignoreViolations. I verified this is still happening in v2.0.76.

Would be nice to do something like (currently not honored)

"ignoreViolations": {
    "*": ["~/.cache"]
},

[lior-airis]

Same here, please allow Claude code to respect Edit(/path/.git/**) as well