Windows: PowerShell tool pre-check still fails with "The command line is too long" on 2.1.300, so allow rules never apply

What happens

On Windows, PowerShell tool calls ask for permission even when they match an allow rule. Claude Code's pre-check of the command fails before any rule is matched:

pwsh exited with code 1: The command line is too long

With permissions.blockReadsOutsideWorkingDirectories on, a command that cannot be parsed always asks, so no PowerShell allow rule takes effect. Bash tool rules in the same project work as documented: a Bash(...) allow rule for the same command runs it without asking, and read-only commands such as ls run without asking.

Steps to reproduce

1. Windows 11 with PowerShell 7 (pwsh) installed.
2. Project .claude/settings.json with an allow rule PowerShell(node C:/path/to/tool.mjs *), blockReadsOutsideWorkingDirectories: true, and a PreToolUse command hook (exec form, node with the script in args). Two additionalDirectories in settings.local.json.
3. Start Claude Code in that project in Manual mode and have it run node C:/path/to/tool.mjs with the PowerShell tool.

Expected: runs without asking. Actual: asks. The tool run with no arguments, also covered by the rule, asks too. Every PowerShell call tried over two sessions asked.

Environment

• Claude Code 2.1.300, desktop app (Code tab) and CLI
• Windows 11 Pro 10.0.26200
• PowerShell 7
• Model: Opus 5.5
• Permission mode: Manual

Not covered by the 2.1.296 fix

The 2.1.296 changelog fixes "PowerShell commands longer than about 1 KB always asking for permission". The commands here were well under 1 KB, on 2.1.300.

Related

#59454 (closed by the stale bot, which asked for a new issue if still relevant), #57311, #57023, #55671. #55671 ties the failure to a large additionalDirectories list; here there are only two.

Workaround

A deny rule naming the whole PowerShell tool, and Bash allow rules instead.