Bash writes to .claude/tmp/ always prompt: no way to scope Bash permission rules by write-target directory

Summary

Projects that use .claude/ as a scratch/config root sometimes adopt a convention like .claude/tmp/ for all agent-generated temporary files (e.g. as project-level guidance in CLAUDE.md, to avoid writing to world-writable system temp dirs). Every Bash command whose output is redirected into that directory requires a fresh interactive approval, because .claude/ is in the hardcoded set of directories treated as sensitive (mentioned in the bypassPermissions docs as still requiring prompts: .git, .config/git, .claude, .vscode, .idea, .husky, .cargo, .devcontainer, .yarn, .mvn), and tmp is not one of the few exempted subpaths under .claude/ (only skills, agents, commands, scheduled_tasks.json, and worktrees appear to be exempted).

Problem

There is no way to permanently allow writes into a specific directory like .claude/tmp/ for arbitrary Bash commands:

• Bash(...) permission rules only match the command string, not the redirect/output target path (confirmed in permissions.md: "You can't match a tool's primary content field this way: command for Bash..."). "Yes, don't ask again" is scoped per command pattern, not per write-target directory, per the permission system table ("Permanently per repository and command").
• permissions.additionalDirectories only affects read access and Edit/Write-tool file-editing permissions (per the "Working directories" section); it doesn't appear to exempt this hardcoded sensitive-directory write check, which the bypassPermissions docs describe as still applying even in that mode.

In practice this means: every distinct Bash command shape that writes into a project's designated scratch directory under .claude/ needs its own one-time approval, with no way to pre-configure (via .claude/settings.json, checked into version control and shared with a team) that the whole directory is safe to write into regardless of which command produced the write.

Requests (either would resolve this)

1. Make the hardcoded sensitive-directory exemption list configurable — e.g. let a project declare that a specific subpath under .claude/ (such as a conventional tmp/ scratch directory) is exempt from the write-sensitivity check, similar to how skills, agents, commands, scheduled_tasks.json, and worktrees are already exempted.
2. Add a way to scope Bash permission rules by output-redirect target, independent of the command itself — e.g. something like Bash(> .claude/tmp/**) that matches any command whose only file-write effect is a redirect into a given path, so a single rule (shareable via .claude/settings.json) could cover the whole class of commands instead of needing individual approval per exact command string.

Version

Observed on Claude Code CLI v2.1.220.