Auto mode: when an allow rule covers only part of a compound Bash command, say which parts weren't covered

Description

In auto mode, an allow rule can cover only part of a compound Bash command. The other parts send the whole call to the classifier, and the denial message doesn't say that one part matched a rule and the others didn't. The model can't tell, from the denial, that running the allowed command on its own would succeed.

Steps to Reproduce

1. Add Bash(cyberlegion *) to permissions.allow and use auto mode.
2. Have the model run a compound command such as:

``sh
cat > /tmp/brief.md <<'EOF'
...
EOF
cd /some/repo && cyberlegion unit spawn --brief-file /tmp/brief.md ...
``

1. cat and cd aren't covered, so the call goes to the classifier, which denies it (here as "[Data Exfiltration]", because of the brief text).

Expected Behavior

The denial says which parts matched an allow rule and which didn't, for example:

cyberlegion unit spawn … matches Bash(cyberlegion *); cat, cd are not covered by any allow rule. Run the allowed command on its own.

The model can then fix the call on the next try: write the file with the Write tool and run cyberlegion … by itself.

Actual Behavior

The denial only gives the classifier's reason. In my session the model wrongly told me the allow rule was missing, and the same call was denied a second time. Run on its own, cyberlegion unit spawn … succeeded immediately.

Why not loosen the matching instead

It is tempting to make Bash(cyberlegion *) also match VAR=x cyberlegion …, export X=… && cyberlegion … or cd dir && cyberlegion …. That would be unsafe: NODE_OPTIONS, PATH, GIT_SSH_COMMAND and the working directory change what the allowed program does. A rule approves one program, not that program in any environment. A clearer denial message keeps the matching strict and still lets the model recover.

Related: #87153 asks for denials to name the deny rule that fired. This is the allow-rule side: a partial match the denial doesn't mention.

Environment

• Claude Code: 2.1.287
• OS: macOS (Darwin 25.6.0), arm64
• Permission mode: auto