[Bug] Permission check incorrectly rejects fully qualified paths in `cmd /c` commands

Bug Description
The permission check appears to incorrectly reject commands that use fully qualified absolute paths when they are executed through cmd /c. For example, Claude Code generated: cd "D:\<workspace>\<project>" && cmd /c ""D:\<workspace>\<project>\gradlew.bat" build" 2>&1 The path to gradlew.bat is fully qualified and clearly resides inside the working directory. There are no relative paths involved. Nevertheless, Claude Code reports: cmd names a path that is computed at run time, which cannot be checked against the read block (permissions.blockReadsOutsideWorkingDirectories) This seems overly conservative and misleading. The permission system should be able to resolve the absolute path passed to cmd /c and verify that it is within the allowed working directory. The error message is especially confusing because it refers to cmd as naming a runtime-computed path, even though the actual target path is explicitly specified as an absolute path in the command. This is particularly problematic on Windows, where invoking .bat files through cmd /c is a normal and legitimate execution pattern.

Environment Info

• Platform: win32
• Terminal: pycharm
• Version: 2.1.270
• Feedback ID: fb6eb062-f53b-439c-9d9a-69c7beff98ec

Errors

[]