[BUG] Auto mode: ask rules matching shell operators (`Bash(* >*)`, `Bash(* | tee*)`) never fire; text-matching ask rules do

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

In auto permission mode, permissions.ask rules whose pattern hinges on a redirect operator or pipe segment (Bash(* >*), Bash(* | tee*)) never match: mat
ching commands run silently, write their output files, and neither prompt nor produce a classifier block. Ask rules matching command text (Bash(*sed*-i*)) f
ire normally in the same auto session, and all patterns work correctly in default mode. Result: any allowlisted or classifier-approved read-only command plus
> writes files silently in auto mode, bypassing ask guards intended as a human checkpoint.

autoMode.classifyAllShell: true (fresh session) does not change the behavior.

What Should Happen?

Per permission-modes.md, "Explicit ask rules still force a prompt" in auto mode; per auto-mode-config.md, ask rules are "evaluated before the classifier and a
lways force a permission prompt, even in auto mode ... The classifier cannot auto-approve a matching action." The redirect/tee guards should prompt in auto mo
de exactly as they do in default mode.

Error Messages/Logs

None; the commands execute silently, which is the bug.

Steps to Reproduce

Settings (~/.claude/settings.json):

{
  "permissions": {
    "allow": ["Bash(jq *)"],
    "ask": ["Bash(* >*)", "Bash(* | tee*)", "Bash(*sed*-i*)"]
  }
}

1. Default mode: run jq . f.json > out.json — prompts (ask beats allow, as documented).
2. Switch to auto mode: same command — runs silently, file writtblock.
3. Auto mode: awk 'NR==1 {print}' README.md > out.json (no allow rule matches awk) — also silent, ruling out allow-precedence as the cause.
4. Auto mode: sed -i 's/x/x/' f.json — prompts, so text-matchi
5. Auto mode: jq . f.json | tee out.json — silent.
6. Add autoMode.classifyAllShell: true, restart, repeat 2/3/5 ll silent.

Hypothesis: auto-mode permission evaluation strips redirections ule matching, so patterns containing > or | tee cannot match
any evaluated segment; default mode matches the raw command text.

Claude Model

Other

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.226

Platform

Anthropic API

Operating System

Other Linux

Terminal/Shell

Other

Additional Information

Related: #42797 (auto mode ignores permissions.ask), #51689 (duplicate of it), #21833 (allow overrides ask carve-outs), #37106 (patterns cannot match redirect
suffixes). This report isolates the operator-vs-text pattern diatching ask rules DO fire in auto mode; operator-matching ones ne
ver do, in both the allow-overlap and no-allow cases.