Permission matching fails for commands using <<< (here-string) syntax

Resolved 💬 6 comments Opened Mar 22, 2026 by oameye Closed Apr 8, 2026

Description

Bash permission allowlist entries like Bash(cut:*), Bash(tr:*), Bash(uniq:*) fail to match when the command uses <<< (here-string) syntax, even though the command prefix is correct.

Steps to reproduce

  1. Add Bash(cut:*) to permissions in settings.json
  2. Run a command without <<<: cut --help — auto-allowed
  3. Run a command with <<<: cut -d' ' -f1 <<< "hello world" — prompts for permission

Expected behavior

Both commands start with cut and should match Bash(cut:*).

Actual behavior

Only commands without <<< are matched. The here-string syntax causes the permission check to fail.

Affected commands

Any command using <<<, confirmed with cut, tr, and uniq. Piping via echo "..." | cut ... works as a workaround (matched by Bash(echo:*)).

View original on GitHub ↗

This issue has 6 comments on GitHub. Read the full discussion on GitHub ↗