Windows: PowerShell permission classifier fails 'command line too long' when additionalDirectories list is large

Summary

On Windows, CC's PowerShell permission classifier can crash with pwsh exited with code 1: The command line is too long when permissions.additionalDirectories (or other long settings fields) accumulate enough entries to push the pwsh subprocess invocation past the Windows CreateProcess 32,767-character command-line limit. When this happens, every PowerShell tool call is denied — including allowlisted commands and trivially safe ones like Get-ChildItem . — making the PowerShell(...) allowlist effectively non-functional.

Repro (this install)

• OS: Windows 11 Pro 10.0.26200
• CC: 2.1.126 (VSCodium extension) + standalone CLI binary
• pwsh: 7.6.1 (Microsoft Store install)
• CLAUDE_CODE_USE_POWERSHELL_TOOL=1 set in env + ~/.claude/settings.json
• additionalDirectories: 38 entries (including duplicates — ~/.claude/... Unix-style + C:\Users\...\.claude\... Windows-backslash + c:/Users/... Windows-forward-slash forms — which CC normalizes to the same POSIX path internally per docs but stores as separate string entries)

Symptom (reproduced empirically across 6 probes via claude -p --model haiku --output-format json --allowedTools "PowerShell"):

permission denials: ["pwsh exited with code 1: The command line is too long."]

Symptom appeared on every probe regardless of allowlist content. Pruning additionalDirectories from 38 → 4 entries restored expected behavior.

Expected vs actual

• Expected: allowlisted PowerShell commands auto-approve; non-allowlisted prompt or deny per pattern matching.
• Actual: classifier subprocess fails before any pattern matching runs; all PowerShell calls denied uniformly.

Suggested fix

The permission classifier should not embed the full settings context (especially additionalDirectories, permissions.allow/deny/ask lists, etc.) into the pwsh -Command/-ArgumentList invocation. Pipe via stdin or write to a temp file instead — both bypass the CreateProcess arg-length limit.

Workaround for affected users

Audit additionalDirectories and dedupe / drop redundant entries. CC docs (https://code.claude.com/docs/en/permissions#additional-directories-grant-file-access-not-configuration) confirm directory entries subsume children, and Windows paths normalize to POSIX form internally — most multi-form lists can collapse to a few parent entries.

Related

• Docs: https://code.claude.com/docs/en/permissions#working-directories
• Affected: any Windows install with non-trivial additionalDirectories + PowerShell tool enabled