[BUG] Bash output redirection and cp into the session's own cwd are blocked, while the error message lists that cwd as an allowed working directory

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Version/env: Claude Code CLI 2.1.207, macOS (Darwin 24.6). Context: non-interactive nested session (claude -p "<prompt>") launched with cwd = a git worktree containing its own .claude/settings.json (with permissions.additionalDirectories). Observed identically in two independent sessions on 2026-07-15. No symlinks in any path component.

Behavior: any Bash output redirection (echo x > ./probe.txt) or cp targeting a path inside the session's cwd is blocked with:
Error: Output redirection to '<cwd>/build-ls-test.log' was blocked. For security, Claude Code may only write to files in the allowed working directories for this session: '<cwd>', '<dir2>', ...
— i.e. the error's own allowed-directories list includes the exact directory being written to. Redirects to /tmp were also blocked despite a Read(/tmp/*) grant (expected, but noted for completeness).

Impact: in autonomous/headless pipelines the contradiction is actively misleading — an agent that reads the error concludes its permission environment is broken and misdiagnoses (we watched one confabulate a "harness permission regression" from exactly this message).

What Should Happen?

Expected: either the write is permitted (cwd is an allowed working directory) or the error names the actual reason it's denied.

Error Messages/Logs

Error: Output redirection to '<cwd>/build-ls-test.log' was blocked. For security, Claude Code may only write to files in the allowed working directories for this session: '<cwd>', '<dir2>', ...

Steps to Reproduce

In a directory with a settings.json granting Write(**/*.sh) etc., run claude -p non-interactively and have it attempt: (1) Write foo.py → auto-denied, correct (no matching rule); (2) Write foo.sh → allowed, correct; (3) echo x > probe.txt via Bash → blocked with the self-contradictory message above; (4) cp foo.sh bar.sh → same block.

Claude Model

Opus

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.207

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

iTerm2

Additional Information

_No response_