[BUG] blockReadsOutsideWorkingDirectories prompts for allowlisted gh commands: flag values misidentified as runtime-computed paths

Environment

• Claude Code 2.1.258, macOS (darwin)
• defaultMode: auto
• permissions.blockReadsOutsideWorkingDirectories: true
• permissions.allow includes (among others):
• "Bash(gh pr view *)"
• "Bash(gh api:*)"
• "Bash(grep:)", "Bash(head:)"

Steps to reproduce

1. Set blockReadsOutsideWorkingDirectories: true and add an explicit allow rule for gh, e.g. "Bash(gh pr view *)".
2. Ask Claude to run a gh command whose arguments are a PR number, an --repo slug and a --jq expression, e.g.:

gh pr view XXXX --repo org/repo --json reviews --jq '.reviews[] | "\"\(.submittedAt[0:10]) \(.state) \(.author.login)\""'

Actual result

A permission prompt fires with the message:

gh names a path that is computed at run time, which cannot be checked against the read block (permissions.blockReadsOutsideWorkingDirectories)

The prompt appears even though the command is covered by an explicit user-configured allow rule. The user must confirm every such gh invocation manually.

Expected result

Either of:

• an explicit allow rule (Bash(gh ...) or Bash(gh api:*)) should satisfy the read-block gate for that command, or
• the read-block pre-check should not classify gh flag values (--repo slug, --jq expressions, URLs) as runtime-computed file paths — they are network/URL arguments, not paths under cwd.

Additional notes

• The heuristic is inconsistent: some gh invocations that also carry --repo/--jq pass without a prompt, others trip it. It looks like a token-level heuristic misfiring on certain strings (quotes, brackets, slashes in flag values).
• Related behavior observed in the same session: after the user manually declines a specific command once, an identical command re-prompts on later invocations even when an allow rule matches. If that is by design it would be worth documenting, since combined with the above it produces repeated unavoidable prompts.
• Practical impact: with blockReadsOutsideWorkingDirectories enabled, gh/api-heavy workflows become unusable without answering prompts, which defeats the purpose of a configured allowlist.

Happy to provide more config details if useful.