[BUG] "Always Allow" permission never matches compound Bash commands with quoted paths, pipes, and .exe on Windows

Found 3 possible duplicate issues:

1. https://github.com/anthropics/claude-code/issues/27537
2. https://github.com/anthropics/claude-code/issues/16561
3. https://github.com/anthropics/claude-code/issues/25441

This issue will be automatically closed as a duplicate in 3 days.

• If your issue is a duplicate, please close it and 👍 the existing issue instead
• To prevent auto-closure, add a comment or 👎 this comment

🤖 Generated with Claude Code

Thank you for the triage! However, this issue is not a duplicate of the three listed:

vs #27537 (Bash permission pattern fails to match commands with .exe extension):

• #27537 covers a simple .exe command (e.g., mytool.exe /arg). My issue involves a compound command combining a quoted path with spaces, pipe operator (|), output redirection (2>&1), and && chaining — none of which are tested in #27537.

vs #16561 (Feature: Parse compound Bash commands and match each component against permissions):

• #16561 is a feature request for a new parsing behavior. My issue is a bug: the existing "Always Allow" mechanism silently writes to settings.local.json but the entry never matches on subsequent executions — the user is never told the stored rule is ineffective.

vs #25441 (Bash permission wildcards don't match multiline/heredoc commands):

• #25441 is about heredoc/multi-line constructs. My issue is about a single-line compound command using |, &&, and 2>&1 with a quoted path containing spaces.

The distinct failure scenario here is the combination:

"C:/Program Files/LLVM/bin/clang.exe" -std=c11 ... 2>&1 | tail -5 && ./trigex.exe 2>&1

• Quoted executable path with spaces
• Pipe operator and &&
• .exe extension on Windows

Each factor alone may have a related issue; the combination causing silent write-then-fail is the new ground this issue covers.

Hooks bypass all the "Always Allow" pattern matching bugs (quoted paths, pipes, .exe on Windows):

INPUT=$(cat)
COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
[ -z "$COMMAND" ] && exit 0
CLEAN=$(echo "$COMMAND" | sed 's/^\s*//; s/\.exe\b//gi; s/"//g' | tr '\n' ' ')
PARTS=$(echo "$CLEAN" | sed 's/\s*&&\s*/\n/g; s/\s*||\s*/\n/g; s/\s*;\s*/\n/g; s/\s*|\s*/\n/g')
ALL_SAFE=true
while IFS= read -r part; do
    part=$(echo "$part" | sed 's/^\s*//;s/\s*$//')
    [ -z "$part" ] && continue
    BASE=$(echo "$part" | awk '{print $1}' | sed 's|.*/||')  # basename (handles paths)
    case "$BASE" in
        cd|ls|dir|cat|head|tail|grep|find|stat|wc|echo|printf|test) ;;
        git|npm|npx|node|python|python3|pip|make|cargo) ;;
        sort|uniq|cut|tr|awk|sed|jq|tee|xargs) ;;
        mkdir|touch|pwd|which|where|type) ;;
        *) ALL_SAFE=false; break ;;
    esac
done <<< "$PARTS"
if [ "$ALL_SAFE" = true ]; then
    jq -n '{hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"allow",permissionDecisionReason:"Allowed (handles Windows paths/pipes/quotes)"}}'
fi
exit 0

The hook strips .exe extensions, normalizes quotes, and uses basename to handle full paths — so "C:\Program Files\Git\bin\git.exe" status matches the same as git status.

Adding data from a multi-session workflow. We built a PermissionRequest hook that logs every permission prompt to a database.

35 prompts in 2 days for source ../venv/bin/activate && python3 <script> across 3 concurrent sessions:

| Session | Prompts | Period |
|---------|---------|--------|
| Session 1 | 26 | 1 day |
| Session 2 | 8 | 2 days |
| Session 3 | 1 | 1 day |

Both Bash(source:*) and Bash(python3:*) are in the allowlist. The approval does not persist within a session — the same exact command re-prompts multiple times in the same session.

This is the most common compound command in our workflow (every test run, every research script). At 3 concurrent sessions, it's 10-15 unnecessary prompts per day.

Originally filed as #42563 — closing that as a duplicate of this issue.

Adding more reproduction cases from a systematic audit of 4 sessions (~200 allow patterns):

5. Command substitution ($(...))

echo "RESUME_MARKER_260402T$(date +%H%M%S)"

Bash(echo *) is in the allow list.

6. Long SSH with embedded heredoc

/c/Windows/System32/OpenSSH/ssh.exe mkim@100.76.113.12 "mkdir -p ~/.tmux/scripts && cat > ~/.tmux.conf << 'TMUXEOF' ..."

Bash(/c/Windows/System32/OpenSSH/ssh.exe *) is in the allow list. Confirmed in a brand-new session — not mid-session cache.

7. Redirects on otherwise-allowed commands

ls -la ~/.codex/ 2>/dev/null | head -5
git -C "D:/D_Repositories/MHdotfiles" push 2>&1
stat -c '%Y %n' "D:/D_Repositories/..."

All three base commands (ls, git, stat) are in the allow list with * wildcard.

Environment

• Claude Code v2.1.87, Desktop app, Windows 10, acceptEdits mode
• ~200 allow patterns + PreToolUse hook
• Tested across 4 sessions over 3 days

Closing my duplicate #43531 in favor of this issue.

Same here, but on Linux.

I can easily repro this.

Do you want us to debug this? I'm happy to work out a PR if you guys are even open to accepting any.