[FEATURE] Allow-rule wildcard that matches only non-option arguments, so `bash -n FILE` can be allowed in auto mode

Preflight Checklist

• [x] I have searched existing requests and this feature hasn't been requested yet
• [x] This is a single feature request (not multiple features)

Problem Statement

bash -n FILE and python3 -m py_compile FILE do not run the code they read: the first parses a shell script, the second compiles a Python file to bytecode. In auto mode ("defaultMode": "auto", version 2.1.296) no allow rule can cover either one, so both go to the classifier on every call (130 and 40 calls in my last 50 sessions).

Bash(python3 -m py_compile *) is removed when the session starts. The debug log says:

Ignoring dangerous permission Bash(python3 -m py_compile *) from ~/.claude/settings.json (bypasses classifier)

Bash(bash -n *) would not be safe even if it were kept, because a later option cancels the no-execute option. This command prints "executed":

bash -n +n -c 'echo executed'

Proposed Solution

Add a wildcard for allow rules that matches only arguments that are not options: one shell word that does not start with - or +, plus a form for one or more such words.

Writing ARGS for that wildcard, Bash(bash -n ARGS) would match bash -n a.sh b.sh and would not match bash -n +n -c 'echo executed'.

A rule whose only wildcard is of this kind would have to stay in effect in auto mode, as the exact rule Bash(bash --version) does today.

The same wildcard would make Bash(git -C ARG status *) safe, where a * in that position also matches an injected git -c option.

Alternative Solutions

Approve bash -n FILE... and python3 -m py_compile FILE... without the classifier when every argument after that prefix is a word that does not start with - or +, the same way read-only sed and find calls are checked today. That covers these two commands and no other tool.

Priority

Medium - Would be very helpful

Feature Category

Configuration and settings

Use Case Example

A session edits a shell script and a Python file, then checks them with bash -n script.sh and python3 -m py_compile tool.py before running anything. With Bash(bash -n ARGS) and Bash(python3 -m py_compile ARGS) in permissions.allow, both checks are approved by rule, and bash -n +n -c 'echo executed' still goes to the classifier.

Additional Context

In a claude -p session the debug log line above was the only sign that the rule had been dropped: settings.json still listed it, and the command still went to the classifier.