Tool call serialized into settings.local.json instead of being executed

Description

When asked to create a GitHub issue, Claude incorrectly wrote the entire gh issue create bash command into /Users/jmhunter/Projects/.claude/settings.local.json as a permission entry instead of executing it.

The command was added to the permissions.allow array, resulting in a malformed JSON entry with escaped quotes and newlines.

Steps to Reproduce

1. User asked Claude to create a bug report
2. Claude should have executed: gh issue create --repo anthropics/claude-code --title "..." --body "..."
3. Instead, the entire command (including heredoc body) was written as a string into settings.local.json line 29

Expected Behavior

The gh issue create command should have been executed via the Bash tool.

Actual Behavior

The command was serialized into the permissions configuration file as:

"Bash(gh issue create --repo anthropics/claude-code --title \"Background dev servers...\" --body \"$\\(cat <<''EOF''...EOF\\)\")"

This resulted in:

• Malformed settings file (though still valid JSON)
• The issue was apparently created anyway (user confirmed)
• User had to manually clean up the settings file

Environment

• Claude Code version: 2.0.76
• OS: macOS (Darwin 25.2.0)
• Date: 2026-01-03
• Settings file: /Users/jmhunter/Projects/.claude/settings.local.json

Evidence

The serialized command included a 50+ line issue body with heredoc syntax, escaped quotes, and newlines - clearly intended to be executed, not stored as a permission pattern.

Root Cause Hypothesis

Possible causes:

1. Claude confused permission granting with command execution
2. User approved a permission prompt that should have been an execution confirmation
3. Tool routing bug where Bash commands got written to settings instead of executed
4. The command was too complex (heredoc, special chars) and triggered incorrect handling

Impact

• Corrupts user configuration files
• Confusing user experience (command appears to work but leaves artifacts)
• Requires manual cleanup
• Could affect other complex bash commands with heredocs or special characters

Suggested Fixes

1. Ensure Bash tool calls are never serialized into configuration files
2. Add validation to settings.local.json writes to reject entries that look like full commands
3. Investigate if this relates to permission prompting flow
4. Review how complex bash commands (heredocs, multi-line) are handled in the permission system