Sandbox blocks zsh heredoc temp files (TMPPREFIX not set)

[jhaapasa]

Bug Description

The sandbox sets TMPDIR=/tmp/claude/ and allows writes there, but does not set TMPPREFIX. Zsh uses $TMPPREFIX (default: /tmp/zsh) for heredoc temp files — not $TMPDIR. This means any heredoc in a sandboxed zsh command fails with:

(eval):1: can't create temp file for here document: read-only file system

Any command using heredocs (<<EOF, <<-EOF, <<< herestrings) will fail.

Reproduction

Shell: zsh (e.g. WSL2 Ubuntu on Windows 11)

# This fails in sandbox mode:
git commit -m "$(cat <<'EOF'
Multi-line message
EOF
)"

Root Cause

Zsh has a separate variable $TMPPREFIX (documented in zshparam(1)) that controls where heredoc temp files are created. Its default value is /tmp/zsh. The sandbox allows writes to /tmp/claude/ but blocks writes to /tmp/zsh*.

Variable	Value	Sandbox Write?
TMPDIR	/tmp/claude	Allowed
TMPPREFIX	/tmp/zsh (default)	Blocked

Suggested Fix

When the shell is zsh, the sandbox initialization should also set:

export TMPPREFIX=/tmp/claude/zsh

This would make heredocs work transparently, just as setting TMPDIR makes other temp file operations work.

Workarounds

• Use git commit -F /tmp/claude/msg.txt instead of heredocs
• Use multiple -m flags: git commit -m "Subject" -m "Body"
• Use ANSI-C quoting: git commit -m $'Subject\nBody'
• Prefix commands with TMPPREFIX=/tmp/claude/zsh
• Use dangerouslyDisableSandbox: true (defeats the purpose)

Environment

• Claude Code on WSL2 Ubuntu (Windows 11)
• Shell: zsh
• Platform: linux (WSL2)

[github-actions]

Found 3 possible duplicate issues:

1. [BUG] Sandbox mode breaks zsh heredocs - TMPPREFIX not set to sandbox-allowed path #17989
2. [BUG] Git commit with heredoc always fails on first attempt when sandbox is enabled - system prompt fights itself #18713
3. [BUG] git commit fails inside sandbox on macos #17726

This issue will be automatically closed as a duplicate in 3 days.

• If your issue is a duplicate, please close it and 👍 the existing issue instead
• To prevent auto-closure, add a comment or 👎 this comment

🤖 Generated with Claude Code

[github-actions]

This issue has been automatically locked since it was closed and has not had any activity for 7 days. If you're experiencing a similar issue, please file a new issue and reference this one if it's relevant.