[BUG] In strict sandbox mode, non-literal paths force permission prompts even in Auto mode

### Preflight Checklist

- [x] I have searched [existing issues](https://github.com/anthropics/claude-code/issues?q=is%3Aissue%20state%3Aopen%20label%3Abug) and this hasn't been reported yet
- [x] This is a single bug report (please file separate reports for different bugs)
- [x] I am using the latest version of Claude Code

### What's Wrong?

I keep getting permission prompts because, for example, " │ python3 names a path that is computed at run time, which cannot be checked against the read block (permissions.blockReadsOutsideWorkingDirectories)". This is in auto mode, with strict sandboxing enabled.

### What Should Happen?

When in auto mode, these permission prompts should either go through the auto mode classifier, or be automatically denied in auto mode so that Claude can find a different method, such as using literal paths in the command.

If possible, permissions.blockReadsOutsideWorkingDirectories should be enforced at the filesystem level. Then the command can be automatically approved, and if the variable is resolved to a path that is outside of the working directory, the sandboxed filesystem blocks the access.

### Error Messages/Logs

```shell
Bash command

│ python3 -c "
│ import json
│ data = json.load(open('$TMPDIR/sample_data.json'))
│ for item in data['items']:
│ print(item['name'], item['price'], item['qty'])
│ "
Read and print JSON items

│ python3 names a path that is computed at run time, which cannot be checked against the read block (permissions.blockReadsOutsideWorkingDirectories)

Do you want to proceed?
❯ 1. Yes
2. No
```

### Steps to Reproduce

1. Open Claude Code
2. Type /sandbox, set mode to "1. Sandbox BashTool, with auto-allow", set Overrides to "2. Strict sandbox mode"
3. Confirm that the current mode is "Auto mode" If it isn't, use shift + tab to cycle to Auto Mode.
4. Give Claude Code this prompt:

❯ Run these two Bash commands in order:

1. echo '{"items":[{"name":"widget","price":9.99,"qty":3},{"name":"gadget","price":19.5,"qty":1}]}' > $TMPDIR/sample_data.json
2. python3 -c "
import json
data = json.load(open('$TMPDIR/sample_data.json'))
for item in data['items']:
print(item['name'], item['price'], item['qty'])
"

Report whether command 2 triggers a permission prompt with an error mentioning permissions.blockReadsOutsideWorkingDirectories, even though $TMPDIR is an allowlisted write path.

### Claude Model

Sonnet (default)

### Is this a regression?

I don't know

### Last Working Version

_No response_

### Claude Code Version

2.1.272

### Platform

Anthropic API

### Operating System

Ubuntu/Debian Linux

### Terminal/Shell

Other

### Additional Information

Claude thinks the only workaround for this is to make a memory to use literal paths.

Reproduce the two-command sequence in strict sandbox mode with Auto mode enabled, and inspect the handling of permissions.blockReadsOutsideWorkingDirectories and computed paths. Done means the command no longer causes an avoidable prompt: Auto mode classifies or denies it consistently, or filesystem enforcement safely blocks an out-of-directory read.

Written by the indexing model from the issue text.