[Bug] Shell builtins bypass deny patterns when invoked with absolute paths

Bug Description
Summary: The source / . builtin bypass is a Claude Code platform limitation, not something fixable via settings.json deny patterns.
The deny rules correctly block Read, Grep, cat, head, cp, ls, file, and Glob — but shell builtins with absolute paths slip through.
Worth filing as a bug.

Here is the deny list changes that apparently did not work.

      214 -      "Bash(. */.env*)",
      215 -      "Bash(. */**/.env*)",
      216 -      "Bash(. /*.env*)",
      217 -      "Bash(. /**.env*)",
      218 -      "Bash(. /**/.env*)",
      206 -      "Bash(source */.env*)",
      207 -      "Bash(source */**/.env*)",
      208 -      "Bash(source /*.env*)",
      209 -      "Bash(source /**.env*)",
      210 -      "Bash(source /**/.env*)",

Environment Info

• Platform: darwin
• Terminal: tmux
• Version: 2.1.87
• Feedback ID: e50a4f0d-b6af-4347-a752-8e4ae76bfdcc

Errors

[{"error":"RangeError: path should be a `path.relative()`d string, but got \"..\"\n    at cG4 (/$bunfs/root/src/entrypoints/cli.js:434:9381)\n    at ki (/$bunfs/root/src/entrypoints/cli.js:434:9554)\n    at _test (/$bunfs/root/src/entrypoints/cli.js:434:10092)\n    at VY (/$bunfs/root/src/entrypoints/cli.js:7433:8246)\n    at oV6 (/$bunfs/root/src/entrypoints/cli.js:726:30761)\n    at eV6 (/$bunfs/root/src/entrypoints/cli.js:726:33023)\n    at AK1 (/$bunfs/root/src/entrypoints/cli.js:1561:1745)\n    at <anonymous> (/$bunfs/root/src/entrypoints/cli.js:1561:2242)\n    at wK1 (/$bunfs/root/src/entrypoints/cli.js:1561:3317)\n    at Eh_ (/$bunfs/root/src/entrypoints/cli.js:1561:5629)","timestamp":"2026-03-29T04:14:28.759Z"},{"error":"MaxFileReadTokenExceededError: File content (12338 tokens) exceeds maximum allowed tokens (10000). Use offset and limit parameters to read specific portions of the file, or search for specific content instead of reading the whole file.\n    at gK9 (/$bunfs/root/src/entrypoints/cli.js:4281:5251)\n    at processTicksAndRejections (native:7:39)","timestamp":"2026-03-29T04:15:50.590Z"},{"error":"AxiosError: Request failed with status code 401\n    at _B (/$bunfs/root/src/entrypoints/cli.js:144:1194)\n    at <anonymous> (/$bunfs/root/src/entrypoints/cli.js:149:12745)\n    at emit (node:events:92:22)\n    at endReadableNT (internal:streams/readable:861:50)\n    at processTicksAndRejections (native:7:39)\n    at request (/$bunfs/root/src/entrypoints/cli.js:151:2467)\n    at processTicksAndRejections (native:7:39)","timestamp":"2026-03-29T15:49:18.067Z"},{"error":"Error: Request was aborted.\n    at makeRequest (/$bunfs/root/src/entrypoints/cli.js:50:3940)\n    at processTicksAndRejections (native:7:39)","timestamp":"2026-03-29T16:18:51.273Z"},{"error":"Error: File does not exist. Note: your current working directory is /Users/jake/Projects/forgectl-root/main.\n    at call (/$bunfs/root/src/entrypoints/cli.js:4290:6593)\n    at processTicksAndRejections (native:7:39)","timestamp":"2026-03-29T16:26:16.042Z"},{"error":"MaxFileReadTokenExceededError: File content (11983 tokens) exceeds maximum allowed tokens (10000). Use offset and limit parameters to read specific portions of the file, or search for specific content instead of reading the whole file.\n    at gK9 (/$bunfs/root/src/entrypoints/cli.js:4281:5251)\n    at processTicksAndRejections (native:7:39)","timestamp":"2026-03-29T18:04:44.636Z"},{"error":"MaxFileReadTokenExceededError: File content (12338 tokens) exceeds maximum allowed tokens (10000). Use offset and limit parameters to read specific portions of the file, or search for specific content instead of reading the whole file.\n    at gK9 (/$bunfs/root/src/entrypoints/cli.js:4281:5251)\n    at processTicksAndRejections (native:7:39)","timestamp":"2026-03-29T18:21:53.540Z"},{"error":"MaxFileReadTokenExceededError: File content (12338 tokens) exceeds maximum allowed tokens (10000). Use offset and limit parameters to read specific portions of the file, or search for specific content instead of reading the whole file.\n    at gK9 (/$bunfs/root/src/entrypoints/cli.js:4281:5251)\n    at processTicksAndRejections (native:7:39)","timestamp":"2026-03-29T18:21:56.197Z"},{"error":"MaxFileReadTokenExceededError: File content (12338 tokens) exceeds maximum allowed tokens (10000). Use offset and limit parameters to read specific portions of the file, or search for specific content instead of reading the whole file.\n    at gK9 (/$bunfs/root/src/entrypoints/cli.js:4281:5251)\n    at processTicksAndRejections (native:7:39)","timestamp":"2026-03-29T19:12:59.159Z"},{"error":"Error: Request was aborted.\n    at makeRequest (/$bunfs/root/src/entrypoints/cli.js:50:3940)\n    at processTicksAndRejections (native:7:39)","timestamp":"2026-03-29T19:55:42.597Z"},{"error":"Error: Request was aborted.\n    at makeRequest (/$bunfs/root/src/entrypoints/cli.js:50:3940)\n    at processTicksAndRejections (native:7:39)","timestamp":"2026-03-29T20:33:19.059Z"},{"error":"Error: Request was aborted.\n    at gv_ (/$bunfs/root/src/entrypoints/cli.js:1365:16708)\n    at next (native:1:11)\n    at Gy9 (/$bunfs/root/src/entrypoints/cli.js:7572:8934)\n    at next (native:1:11)\n    at Ly9 (/$bunfs/root/src/entrypoints/cli.js:7577:10737)\n    at processTicksAndRejections (native:7:39)","timestamp":"2026-03-29T20:35:18.333Z"},{"error…

Note: Content was truncated.