permissions.ask is silently skipped for git when the command is prefixed with `cd <other-dir> &&`

Summary

When a Bash command changes into a directory other than the session cwd and then runs git, the permissions.ask patterns are not matched at all — the command executes with no prompt.

The docs state the opposite:

Combining cd with git in one compound command always prompts, regardless of the target directory.

This is git-specific — the same cd prefix with other binaries still prompts. Project/workspace boundaries are irrelevant (it happens with a directory inside the same project too).

Environment

• Claude Code CLI 2.1.219 / VS Code extension 2.1.220
• Windows 11, Git Bash (Git for Windows 2.52)
• defaultMode: "auto"

Repro

1. In settings.json: "permissions": { "ask": ["Bash(git clean -f*)"] }
2. Start a session in directory A. Have a second directory B that is a git repo.
3. Run each command:

| Command | Expected | Actual |
| --- | --- | --- |
| git clean -f -n | prompt | prompt ✅ |
| pwd && git clean -f -n | prompt | prompt ✅ (being compound is not the trigger) |
| cd /path/to/B && git clean -f -n | prompt (per docs) | no prompt, executes ❌ |
| cd /path/to/B && echo hi (with Bash(echo*) in ask) | prompt | prompt ✅ (so it is git-specific) |

Impact

The non-dry-run form cd /path/to/B && git clean -f deleted files with no prompt. Also reproduced with cd /path/to/B && git branch -D <name> against "Bash(git branch -D*)".

permissions.ask is commonly used as the approval gate for destructive git operations, so this silently removes that gate. Cross-directory git is routine in bare + multiple-worktree layouts, where cd <worktree> && git … is a natural thing for the model to emit.

Re-verified on 2.1.219 on 2026-07-28 with a clean A/B: the identical command string prompts when a PreToolUse hook adds its own ask, and runs silently when that hook is removed — so the settings layer is what is being skipped.

Note

git -C /path/to/B clean -f -n also does not prompt, but that is expected — the configured pattern simply doesn't match that string. The bug here is specifically the cd form, where the documentation promises a prompt.

Workaround

A PreToolUse Bash hook does receive the full compound command string, so it can resolve the effective directory itself (cd / pushd / git -C / --work-tree=) and re-issue permissionDecision: "ask". That reconstructs the gate hook-side, but only for projects where such a hook is wired up.