Subagent Bash auto-approval regressed between runtime 2.1.121 and 2.1.128 under "Accept edits" mode

Summary

A recent runtime patch tightened how subagent permission inheritance handles broad tool-name allow rules under non-Auto modes. The broad "Bash" allow rule (no parens) in permissions.allow no longer flows to subagents under "Accept edits" mode in runtime 2.1.128. The same setup worked correctly in runtime 2.1.121 hours earlier on the same machine.

Edit and Write tool calls from subagents continue to flow correctly. Only Bash is denied.

Environment

• Claude Code CLI binary on PATH: 2.1.92 (Windows, on disk since Apr 6 — unchanged across both sessions)
• Runtime version (per JSONL transcript metadata):
• Earlier session today: 2.1.121 ✅ subagents called Bash silently
• Current session: 2.1.128 ❌ subagent Bash denied
• Permission mode: Accept edits
• OS: Windows 11 Pro
• Agent invocation: Agent tool with subagent_type: frontend-engineer, isolation: worktree, run_in_background: true

Reproduction

1. Open a Claude Code session in any project
2. Set permission mode to Accept edits
3. Confirm permissions.allow in .claude/settings.local.json includes "Bash" (no parens, broad)
4. Spawn a subagent via the Agent tool — any agent type whose definition lists Bash in its tools: field
5. Have the subagent attempt a Bash call (e.g., git status, flutter test, gh pr create)

Expected: subagent Bash call auto-approves silently per the broad "Bash" allow rule (this was the behavior in 2.1.121).

Actual: subagent returns "Bash tool was denied". The orchestrator session sees no permission prompt surface — the deny appears to happen in the subagent's own permission scope without surfacing to the parent UI.

Smoking gun — runtime version delta

Same machine, same project, same agent definitions, same .claude/settings.local.json (mtime unchanged for 3 days), same CLI binary on disk (mtime unchanged for ~30 days). Only the in-process runtime version differs:

| Source | Runtime version | Subagent Bash |
|---|---|---|
| Earlier session today | 2.1.121 | ✅ Silent end-to-end (git checkout/commit/push, flutter test --coverage, gh pr create across multiple dispatches) |
| Current session | 2.1.128 | ❌ Denied |

The behavior change landed somewhere in 2.1.122 → 2.1.128.

Workaround that works

Adding narrow Bash(...) patterns to permissions.allow restores subagent Bash. Confirmed working:

"Bash(flutter *)",
"Bash(dart *)",
"Bash(git push *)",
"Bash(git commit *)",
"Bash(gh pr *)",
// ... etc.

The broad "Bash" allow rule by itself no longer flows to subagents under "Accept edits" in 2.1.128. Narrow per-command patterns are required.

Possible cause

The Auto Mode docs (https://code.claude.com/docs/en/permission-modes.md#how-the-classifier-evaluates-actions) explicitly state:

"Broad auto-approval rules are dropped on entering auto mode — blanket Bash(*), Bash(python*), and Agent allow rules are stripped. Narrow rules like Bash(npm test) carry over."

It looks like that broad-rule-stripping policy may have been extended from Auto mode to all non-Auto modes for subagents in 2.1.128. If so, this should be documented.

Documentation gap

The "Permission modes" docs do not currently describe subagent permission inheritance under "Accept edits" or default mode — only under Auto mode. The "Subagents" docs likewise don't cover inheritance behavior. Whatever the intended behavior is post-2.1.128, please add an explicit section.

Reproducer note for triage

If you can't reproduce on a freshly-installed CLI, check the runtime version from a subagent's JSONL transcript:

grep -o '"version":"[^"]*"' <subagent-transcript.jsonl> | head -1

The CLI binary version from claude --version may not match the in-process runtime — the runtime appears to auto-update under the static binary.