Sandbox denyRead entries scale spawn argv past macOS ARG_MAX (E2BIG)

Claude Code 2.1.220, macOS (Apple Silicon).

When sandbox.filesystem.denyRead carries a realistically long list (~128 entries of ordinary ~80-char absolute paths), every Bash tool call fails at shell spawn:

Could not start /bin/zsh: the command line plus environment exceed the OS exec argument limit (E2BIG)

Measured: ~128 deny-path entries produce ~1023 KB of spawn arguments (about 8 KB per entry) which crosses the macOS 1 MB ARG_MAX. The sandbox is then unusable regardless of the command (echo hi fails identically). The list content is irrelevant; only its length matters.

Reproducer: configure a sandbox with ~130 denyRead paths, run any Bash tool call.

Suggestions worth trying: pass the seatbelt profile via a file (sandbox-exec -f) instead of inline argv, or compact per-path rules (one rule per directory with subpath matching instead of several rule variants per path).

Start by reproducing the failure with about 130 denyRead paths on macOS and any Bash tool call. Trace how the sandbox profile and denyRead entries become spawn arguments, then evaluate the suggested file-based profile or rule compaction approaches. Done means long denyRead lists no longer trigger E2BIG and the command still runs with the intended restrictions.