gh write commands execute without permission prompt despite Bash not being in allow list

Bug Description

Write-operation Bash commands (specifically gh issue create) executed without showing permission prompts to the user, despite Bash tool not being in the allow or ask lists in settings.local.json.

Expected Behavior

According to Claude Code documentation, only read-only commands (echo, ls, pwd) should execute without prompts in sandbox mode. Write operations like gh issue create should require explicit user confirmation.

Actual Behavior

Commands like gh issue create --title "..." --body "..." executed immediately without any permission prompt appearing to the user.

Configuration at Time of Bug

{
  "permissions": {
    "allow": [
      "WebSearch",
      "WebFetch", 
      "Read(/home/d0021/Automation/**)"
    ],
    "deny": [],
    "ask": []
  }
}

Steps to Reproduce

1. Configure settings.local.json with Bash NOT in allow/ask lists
2. Ask Claude Code to create a GitHub issue using gh issue create
3. Observe: Command executes without permission prompt
4. User sees issue created on GitHub without having confirmed the action

Workaround

Adding "Bash" to the "ask" list forces all Bash commands to prompt:

{
  "permissions": {
    "ask": [
      "Bash",
      "Edit",
      "Write"
    ]
  }
}

After this change, all Bash commands (including gh) correctly prompt for user confirmation.

Impact

This is a security/trust issue - write operations should never execute without explicit user permission, especially when creating external resources (GitHub issues, commits, etc.).

Environment

• OS: Linux 6.14.0-35-generic
• Claude Code: Latest version (as of 2025-11-02)
• Working directory: Git repository