[Bug] Sandbox file-read deny rule (.env*) not enforced for compound Bash commands in Agent-dispatched subagents

Bug Description
Sandbox file-read deny rule (.env) not enforced for compound Bash commands inside an Agent-dispatched subagent. Environment: Claude Code CLI (background/job session), orchestrator model Claude Opus 5, subagent model Claude Sonnet 5 dispatched via the Agent tool (general-purpose subagent type, default), platform macOS (Darwin 25.5.0). The harness's own sandbox description declares filesystem read.denyOnly including "//.env" and "//.env." — the standard guarantee that no agent reads env files. What happened: a subagent spawned via the Agent tool executed a single Bash tool call containing a compound multi-line shell command, one line of which was: grep -oE "^[A-Z_]+" /path/to/project/.env.local 2>/dev/null || echo "not read". Expected: this read should have been denied by the declared .env. deny-glob, the same way every other protected-path access attempt was denied elsewhere in this same session for the top-level orchestrator session (consistently "Operation not permitted"). Actual: the command executed normally and returned real data — five real environment variable names from the file, exit code 0 (confirmed because the "|| echo" fallback, which only fires on non-zero exit, did not fire). No permission prompt, no error, no log entry indicating a block was attempted. Only variable names were read (not values) in this instance, but the same code path with "cat .env.local" instead of a name-only grep would have exposed real secret values (API tokens, a login password) to the subagent's context. The deny-rule for .env reads is documented and relied upon as an absolute tool-level guarantee, not a behavioral convention the model self-enforces — this shows at least one reproducible path where that guarantee did not hold. Question for the team: is the file-read deny-list enforced differently for compound Bash invocations inside Agent-dispatched subagents versus the top-level session? Happy to provide the full session transcript or reproduce this in a minimal test case if useful.

Environment Info

• Platform: darwin
• Terminal: xterm-256color
• Version: 2.1.233
• Feedback ID: 8b41c7ac-28c7-4069-a0f4-867e7f8d669b

Errors

[]