Auto mode: read-only Bash compounds starting with `cd DIR` lost static auto-approval in 2.1.258, causing frequent permission prompts

Summary

Since 2.1.258, in auto mode, read-only Bash compounds that start with cd DIR are no longer statically auto-approved. They go through the auto-mode classifier and a large share of them prompt the user. Plain single commands and pipe-only commands are unaffected. On 2.1.252 the same compounds returned in about 0.6s with no prompt.

Explore subagents emit this exact shape (cd DIR + newline + grep …) on nearly every call, so subagent-heavy sessions now stall on unanswered permission prompts.

Environment

• Claude Code 2.1.258 and 2.1.259 (native install, macOS 15, zsh)
• permissions.defaultMode: "auto", one additionalDirectories entry. No allow/deny/ask rules in user or project settings. Organization-managed settings do include Read() deny rules, which is the precondition #91683 identifies for the "a Read() deny rule is configured; only you can approve running it anyway" card.
• Last good version observed: 2.1.252 (2.1.257 was installed but no session ran on it)

Reproduction

In auto mode, have the model run through the Bash tool:

cd /path/to/repo
grep -rn "foo" src | grep -v __pycache__

On 2.1.258/2.1.259 the call takes about 2s and frequently shows a permission prompt.

The equivalent single command returns in about 0.6s with no prompt on the same version:

grep -rn "foo" /path/to/repo/src | grep -v __pycache__

On 2.1.252 both forms return in about 0.6s with no prompt.

Measurements

Gap between the Bash tool_use and its tool_result in session transcripts, read-only commands only (grep, rg, sed -n, cat, ls, find, head, wc, git log/diff/status), main session and subagents combined. About 0.6s is the no-classifier path; the extra ~1.6s is the classifier round trip; anything over 5s on a grep is a human answering a prompt.

| command shape | 2.1.251/252 median (n) | 2.1.258/259 median (n) | share over 5s, old → new |
|---|---|---|---|
| plain single command | 0.57s (330) | 0.64s (38) | 2% → 0% |
| pipe only | 0.57s (340) | 0.66s (44) | 0% → 2% |
| cd DIR + newline + cmd | 0.56s (11) | 2.05s (6) | 0% → 0% |
| cd DIR + newline + pipe | 0.57s (27) | 2.33s (6) | 0% → 17% |
| cd DIR; … \| … echo | 0.74s (21) | 5.80s (6) | 5% → 50% |
| cd DIR && … \| | 0.70s (142) | 2.26s (9) | 3% → 22% |

Share of subagent tool calls that took over 15s: 9.0% on the first full day on 2.1.259, versus 0.4% to 3.8% on every one of the previous ten days. On the previous days every such stall was a test run or find /; on 2.1.259 they include plain grep -n calls at 7s to 48s and one sed -i that waited 928s for approval.

The built-in agents default to the affected shape

• The Bash tool description shipped in these same versions already warns about it: "Working directory persists between calls, but prefer absolute paths — cd in a compound command can trigger a permission prompt." The built-in agents do not follow that guidance.
• Across 228 subagents in my transcripts since 2026-08-23 (109 Explore, 119 general-purpose), 53% of Explore Bash calls (1,245 of 2,353) and 58% of general-purpose Bash calls (2,489 of 4,317) are cd DIR compounds. On 2.1.258+ every one of those takes the classifier path, and the ones that prompt block the subagent until a human answers.
• The shell cwd is reset to the session directory after a call that changes it (the tool result says "Shell cwd was reset to …"), so a standalone cd call is not a workaround either; absolute paths are the only shape that keeps the fast path.

Candidate changelog entries

• 2.1.257: "Fixed a permissions.ask rule being skipped in auto mode when the matching command ran inside a compound command or subshell"
• 2.1.257: "Fixed Bash permission checks auto-approving certain [[ ]] conditionals that zsh parses differently from bash; these commands now prompt for approval"
• 2.1.259: "Fixed Bash Read() deny rules not covering … cd DIR && cat FILE compounds"

Related

#91683, #91776 and #91650 report the same cd DIR && grep … prompt in bypass mode and bisect it to a new bypass-immune safety check. This issue adds the auto-mode view and the latency measurements: on 2.1.258 the compounds already left the static read-only path for the classifier (the +1.6s median), and on 2.1.259 a share of them became human-only prompts.

Expected

A compound whose parts are all read-only (cd plus grep/sed -n/cat/ls/find/git log) keeps the static read-only auto-approval it had on 2.1.252, in the main session and in subagents, regardless of whether the parts are joined by newline, ; or &&.

Workaround (partial)

Add a rule to CLAUDE.md:

Bash commands use absolute paths, never a cd DIR compound.

Plain absolute-path commands still take the read-only fast path on 2.1.258/2.1.259 (0.64s median, no prompts in the sample above).

This covers the main session and general-purpose subagents, which load CLAUDE.md. It does not cover the built-in Explore subagent: Explore does not load CLAUDE.md, and it is a major source of the shape (53% of its Bash calls in the sample above). A rule in the instruction file does not change how it composes commands.

To reach Explore, inject the instruction through a SubagentStart hook as additionalContext, so every subagent type receives it at spawn regardless of what it loads. A PreToolUse hook on Bash that denies the cd DIR + relative-read shape with a rewrite recipe (see #91683) catches whatever still gets through, because the hook deny path returns before the safety check runs.

Both are scaffolding around a regression. The Bash tool description already says "prefer absolute paths — cd in a compound command can trigger a permission prompt"; the fix belongs in the gate (resolve a literal cd operand, as #91776 asks) or in the built-in agents' command composition.