Bash permission heuristic misparses shell command boundaries (escaped semicolons treated as separators)

Bug

The Bash permission heuristic incorrectly parses the escaped semicolon (\;) in find -exec as a shell command separator, causing it to treat the remainder of the command (the 2 in 2>/dev/null) as a separate command.

Reproduction

Run this command in Claude Code:

find /Users/MyUser/some/directory -name "*.js" -exec grep -l "generateSitemaps" {} \; 2>/dev/null | head -5

The permission prompt appears, but says:

Yes, and don't ask again for: 2

This confirms the heuristic split the command at \; and classified 2 (from 2>/dev/null) as a standalone command.

Expected Behavior

\; is the standard find -exec terminator — it's not a shell command separator. The heuristic should recognize this extremely common pattern and not split the command at this point.

Impact

Immediate: False positive

This is a read-only, safe command being flagged unnecessarily.

Deeper concern: Heuristic quality signal

The fact that find -exec {} \; — one of the most common shell patterns in existence — triggers a false positive suggests the semicolon-detection heuristic lacks basic test coverage for escaped/quoted semicolons. If the heuristic doesn't handle this well-known case, it likely has gaps in more nuanced cases too.

Security UX: Warning fatigue

This contributes to the broader problem of permission prompt fatigue. Research on Windows UAC and browser security dialogs has consistently shown that excessive false-positive prompts train users to click "Allow" reflexively, reducing the effectiveness of legitimate warnings. Each false positive erodes trust in the security system.

Related issues with similar false-positive patterns:

• #28183 (compound commands of individually-allowed commands)
• #30892 (echo "---" flagged as quoted flag characters)
• #27957 (request to disable quoted-characters-in-flag-names warning)
• #16449 (quoted hyphen-prefixed values misidentified as flags)

Environment

• macOS
• Claude Code (latest at time of filing)