[BUG] bypassPermissions still prompts on compound commands with cd + output redirection (hard-coded guardrail ignores bypass mode and allow rules)

What's Wrong?

In bypassPermissions mode, the hard-coded compound-command guardrail still raises a manual permission prompt for any Bash call that contains a cd together with output redirection (>, 2>&1, or a heredoc). The prompt text in the binary is:

Compound command contains cd with output redirection - manual approval required to prevent path resolution bypass

It fires before permissions.allow (we have a bare Bash allow rule) and is not suppressed by --permission-mode=bypassPermissions --allow-dangerously-skip-permissions. bash -c '…' does not avoid it (the quoted string is inspected). Subagents spawned with Agent inherit the same behaviour, so an orchestrator session running fan-out builders gets prompts from workers whose panels are not even visible.

Bypass mode is documented as "Bypass all permission checks". A user who has accepted the bypass disclaimer has already accepted the cd-path-resolution risk; prompting here defeats the mode's only purpose (unattended multi-session orchestration).

Evidence

Measured over 36 h across 35 concurrent sessions on one machine (all launched by the VS Code extension with --permission-mode=bypassPermissions --allow-dangerously-skip-permissions, verified via ps):

• 26,847 tool calls auto-accepted (permissionDecision.source=config, reasonType=mode)
• 21 prompted (permissionDecision.source=user_temporary) — every one of the 21 contains a cd plus a redirect; ~300 commands with cd $VAR but no redirect were auto-accepted.
• One prompt is fully logged in the extension log: executePermissionRequestHooks called for tool: Bash → [remote-bridge] Sent control_request → user answered 46 s later (permissionDecisionMs=46154).

Reproduction

1. Launch Claude Code in VS Code (extension 2.1.296) with permission mode "Bypass permissions"; settings contain "permissions": {"allow": ["Bash"], "defaultMode": "bypassPermissions"}.
2. Ask it to run:

``bash
W=/path/to/other/worktree; cd $W; bash scripts/some_script.sh > /tmp/out.log 2>&1
`
or
`bash
cd /tmp && python3 - <<'EOF2'
open('/path/to/repo/file.py','w').write('x')
EOF2
``

1. Observe "Allow this bash command?" with Yes/No, despite bypass mode.

Expected

In bypassPermissions mode (disclaimer accepted), no built-in Bash heuristic should raise a prompt. At minimum, the compound-cd guardrail should respect bypassPermissions, or a settings key should let users disable it.

Related

#31523 (open, consolidates the compound-cd messages), #67947 and #76718 (same guardrail, closed as not planned), #34106.

Environment

• Claude Code VS Code extension 2.1.296 (bundled native binary), WSL2 Ubuntu on Windows 11, Max plan
• Also observed on 2.1.280 string-wise; behaviour was first noticed by us on 2026-10-11, the day after the 2.1.296 auto-update