Permission prompts on heredoc body lines corrupt settings.local.json with garbage allow entries

Description

When a Bash command contains a heredoc (e.g. gh issue create --body "$(cat <<'EOF' ... EOF)"), the permission system appears to parse individual lines of the heredoc body as separate Bash commands. When the user approves these prompts, the individual lines get written into settings.local.json as allow entries, corrupting the file.

Reproduction

Run a command like:

gh issue create --repo owner/repo --title "Title" --body "$(cat <<'EOF'
## Heading

Some text with a date 2026-03-26 and words like task-name and description.
EOF
)"

After approving the permission prompts, settings.local.json contained:

{
  "permissions": {
    "allow": [
      "Bash(2026-03-26)",
      "Bash(task-name)",
      "Bash(description)"
    ]
  }
}

These are fragments from inside the heredoc body — 2026-03-26, task-name, and description — not actual Bash commands. They were parsed as separate commands and persisted as allow rules when approved.

Expected behavior

Heredoc content should be treated as part of the enclosing command, not parsed as separate Bash commands. The permission prompt should be for the entire gh issue create command, and if approved, only that command pattern should be written to settings.

Actual behavior

Individual heredoc lines are presented as separate Bash permission prompts. Approving them writes nonsensical allow entries to settings.local.json, silently corrupting the user's permission configuration.

Impact

This is a data corruption bug. Users who approve these prompts end up with a polluted allow list that accumulates garbage entries over time. The entries are harmless (they match nothing useful) but degrade the signal-to-noise ratio of the settings file and require manual cleanup.

Related

This may share a root cause with #39263 (matcher fails on compound shell constructs) — both involve the permission system failing to correctly parse multi-line or complex Bash commands.

Environment

• Claude Code on macOS (Darwin 25.3.0)
• Permission mode: Ask