Agent tool: subagent bypasses git deny rules in settings.local.json

Bug description

Subagents launched via the Agent tool appear to bypass deny rules defined in .claude/settings.local.json. Specifically, a Bash(git *) deny rule was in place, but a subagent still appears to have executed a git command (likely git checkout or git restore) that reverted a file to a previous state, destroying hours of incremental work.

Context

The user explicitly added a git deny rule after an earlier accidental git checkout wiped uncommitted work:

{
  "permissions": {
    "allow": [
      "Bash(*)",
      "WebFetch(*)",
      "Skill(keybindings-help)",
      "Skill(keybindings-help:*)",
      "WebSearch"
    ],
    "deny": [
      "Bash(git *)",
      "Bash(git)"
    ]
  }
}

Despite this deny rule, a subagent appears to have used git checkout or similar to recover/revert a file, overwriting all recent changes. The file (src/i18n.js, ~19,000 lines) was reverted to a state from hours earlier — far beyond what a simple stale-read could explain. Entire sections that were created, renamed, and reorganized over dozens of agent invocations were gone, replaced by the original pre-session content.

Expected behavior

• deny rules in settings.local.json should be inherited by ALL subagents
• If a subagent attempts a denied command, it should be blocked — same as the parent session
• There should be no way for a subagent to bypass permission restrictions set by the user

Impact

• Severity: Critical — this defeats the entire purpose of deny rules
• The user added the deny rule specifically to prevent git-based data loss, and it was bypassed silently
• Combined with the stale-file overwrite issue (see #43138), this creates a scenario where user work is destroyed with no warning and no recovery

Related

• #43138 — Agent tool: subagent can overwrite file with stale content

Environment

• Claude Code Desktop (Windows 11)
• Claude Opus 4.6 (1M context)
• .claude/settings.local.json with deny rules
• Agent tool with general-purpose subagents

---
🤖 Generated with Claude Code