[BUG] Agent/subagent Bash permissions save entire heredoc content into settings.local.json, corrupting the file

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

When using Task/subagent tools (particularly with Opus 4.6), if an agent runs a Bash command
containing a heredoc (e.g., cat > /tmp/file.md << 'EOF' ... EOF), the entire multi-line
heredoc content gets saved as a single Bash permission entry in .claude/settings.local.json.

On the next session start, the settings parser fails because the saved pattern contains :*
in non-trailing positions and is not a valid permission pattern. The error message:

> The : pattern must be at the end. Move : to the end for prefix matching, or use * for
> wildcard matching. Files with errors are skipped entirely, not just the invalid settings.

This effectively corrupts the settings file and blocks session startup until manually fixed.
This has happened multiple times across sessions

What Should Happen?

1. Bash permission patterns saved to settings.local.json should only capture the command

prefix (e.g., Bash(cat:*)) - not the entire command content including heredoc bodies.

1. Multi-line commands should be normalized before saving as permission patterns.
2. At minimum, the settings parser should skip invalid entries gracefully instead of

skipping the entire file.

Error Messages/Logs

The :* pattern must be at the end. Move :* to the end for prefix matching,
  or use * for wildcard matching. Examples: Bash(npm run:*) - prefix matching
  (legacy), Bash(npm run *) - wildcard matching

Steps to Reproduce

1. Start a Claude Code session with Opus 4.6
2. Use the Task tool to spawn a subagent
3. Have the subagent run a Bash command with a heredoc, e.g.:

cat > /tmp/output.md << 'EOF'
# Some markdown content
With multiple lines including code: something:*
EOF

1. Accept/allow the Bash permission when prompted
2. The entire heredoc content is saved as one permission entry in

.claude/settings.local.json

1. Start a new session - settings file fails to parse

Claude Model

Opus

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.41

Platform

Anthropic API

Operating System

Other Linux

Terminal/Shell

VS Code integrated terminal

Additional Information

The corrupted entry in settings.local.json was ~15,000+ characters long - an entire
markdown document with code blocks, tables, and diagrams that was written via
cat > /tmp/file.md << 'EOF' by a subagent. The permission system captured the
full command string verbatim instead of just the command prefix.

This appears to happen specifically when subagents (Task tool) write files using
heredocs via Bash, and the user allows the permission. The full heredoc body
(which can be thousands of lines) becomes part of the permission pattern string.

Suggested fix: Truncate or normalize Bash permission patterns before persisting -
strip everything after the first newline or after a reasonable prefix length.