Bash execution issues on Linux — page 2
Issues the maintainers labelled both platform:linux and area:bash.
253 issues · 75 open · 178 resolved (70%) · first seen Jan 3, 2026
Is this getting better or worse?
This class of problem is holding steady. 92 new reports in the last 90 days vs 88 in the 90 before — +5%. The open backlog peaked at 75 in 2026-10 and sits at 75 today.
Derived by counting each matching issue from its creation date until it closed. First-party
computation over the anthropics/claude-code tracker — the trend is not published
anywhere upstream.
Which builds report this
202 of these reports name the Claude Code build they were running, spanning 113 releases. Heaviest reporters:
- Claude Code v2.1.233
- Claude Code v2.1.205
- Claude Code v2.1.150
- Claude Code v2.1.288
- Claude Code v2.1.272
- Claude Code v2.1.220
- Claude Code v2.1.259
- Claude Code v2.1.158
Report volume, not a defect count: an issue can mention a build without that build having caused the failure. Versions come from the version string in the bug-report template, matched against real published tags.
Do these get fixed?
Median time to close is 34 days across 178 closures. Of the 178 closures with a recorded reason, 24% were closed as completed and 135 as not-planned or duplicate. The most recent completed fix landed in 2026-10.
Workarounds reported by the community
94 of these issues post a workaround someone says worked. The highest-engagement ones:
- [BUG] Bash comments break permissions
- Workaround: a PreToolUse hook can strip the comment lines before permission matching sees them. The hook reads the command, removes leading lines, and returns the clean command via . Your allowlist then matches correctly…
Found in the thread of #29582 · resolved - Background process termination crashes Claude Code in Docker containers
- …al to kill the process group (e.g., ), it kills itself too. Workaround Manually using to isolate background processes works: However, this loses Claude's background process monitoring and notification features. Suggested…
Found in the description of #16135 · still open - Bash(command:*) allow rules do not prevent permission prompts for file-modifying commands
- …in the desktop app ( , then ), and there's no config or UI workaround. Considering reopening this or filing a new issue — happy to do whichever the maintainers prefer.
Found in the thread of #20449 · resolved - [Bug] Agent spams no-op echo probe commands to flush shell output
- …h a real completion signal — never a burst of no-op echoes. Workaround in use: Added an explicit "never fire no-op probe commands" rule to global CLAUDE.md, but the model should not need this instruction — the default be…
Found in the description of #63887 · still open - [Bug] v2.1.117 regression: parallel Bash tool calls corrupt fd 3 in nested-Docker sandbox; permanent /proc/self/fd/3: Permission denied
- …, or timing. Filing what I've reproduced deterministically. Workaround Possibly related - 2.1.113 introduced the switch from "bundled JS" to "native Claude Code binary" per its release notes. The native binary's sandbox…
Found in the description of #51837 · resolved
Excerpts are quoted from the linked issue so you can judge relevance before opening it. Threads that only ask for a workaround, or report that there is none, are excluded. These are community suggestions, not official guidance from Anthropic — read the full thread before applying one.
Matching issues 101–200
Ranked by community engagement (reactions weighted over comments).
- [BUG] `Bash(git diff)` truncating hunks
- [MODEL] Sonnet 4.5 Generates bash non Claude format wildcard glob patterns into settings.json
- Shell variable expansion broken in piped commands due to HLD tokenizer re-quoting
- [BUG] bash negation fails in bash mode with grep (`if ! grep` does not parse correctly)
- [BUG] Bash tool hangs indefinitely (~25s timeout) when working directory is on NFS mount
- Inline-shell rm check (2.1.288) asks in bypass mode on bash -c $'...' scripts that contain no rm
- Worktree isolation refuses a quoted heredoc whose body has a quote inside braces ("too complex to verify"), 2.1.280
- [BUG] Bash tool creates its session directory via `/proc/self/fd/N/` instead of `mkdirat()` — fails wherever procfs is absent or incomplete (regression in 2.1.263)
- Worktree-isolated sessions: benign read-only command shapes refused as "too complex to verify"; suggested remediation cannot apply to loops
- Sandboxed Bash wedges permanently when the working directory is on a read-only filesystem (no cwd recovery)
- Bundled ugrep shadowing `grep` can exhaust system memory — froze a 16 GB machine twice
- [BUG] bash-input prefill/tab-completion suggests relative-path script without required ./ prefix
- [BUG] Embedded ugrep hangs indefinitely (pegged core) on unanchored bounded-repetition pattern — the same binary's embedded ripgrep finishes in 53 ms
- [BUG] Sandbox kills every Bash call in worktrees at the default `.claude/worktrees/` location (bwrap EROFS creating protected-path mountpoints)
- Bug: la terminal (ghostty) se cierra por completo al aprobarse un comando Bash con comillas muy anidadas (manual o automáticamente)
- Session-env snapshot file breaks when sourced: unquoted LS_COLORS/SSH_CONNECTION/LESSCLOSE spam 'command not found' on every Bash call
- grep shim (embedded ugrep 7.5.0) allocates unbounded memory on double-bounded-repeat BRE patterns — can OOM-kill the host
- [BUG] Bash tool normalizeToolInput silently corrupts commands: unanchored replace strips `cd <cwd> && ` even inside quoted strings
- Claude Code ran rm -rf against $HOME due to env var not persisting between Bash tool calls, deleting Downloads/Documents/Pictures/.config
- [BUG] There is no indication to the user when Claude sets `dangerouslyDisableSandbox: true`
- Main-loop shell cwd silently relocates into a background `isolation: worktree` agent's worktree — git status shows clean, uncommitted changes appear "lost"
- [BUG] --dangerously-skip-permissions ignored when SSH_CONNECTION is set or TERM is empty
- [BUG] Intentional kill of a backgrounded Bash task is reported as "failed" exit 144 with no way to mark cleanup as expected
- Parallel Bash batch: 4/7 calls return "internal error" after 14h silent gap; CLI process never restarted
- [BUG] Agents emit self-matching `pgrep -f` polling patterns that deadlock background tasks
- `!` injection: `&&` chain drops commands after sudo (works fine in fresh shell)
- [BUG] Bash tool returns empty output on RHEL 9 native Linux binary, shell snapshot never written
- Duplicate task-notification responses after TaskOutput consumption
- [Proposal] backgroundMaxElapsedSeconds — watchdog for Bash processes left by run_in_background (16 h silent zombie in auto mode)
- "Unhandled node type: array" emitted during bash tool call display
- [P1][Bug] Failed Bash tool call errors not displayed to user
- [BUG] Bash(cmd *) allowlist silently bypassed for commands interpolating user env vars; uninformative denial
- [BUG] Bash tool sends SIGTERM instead of SIGINT when cancelling commands, corrupting build state
- [Bug] socat presence causes bwrap sandbox to fail silently or error on Ubuntu
- All Bash tool calls execute asynchronously with no opt-out (v2.1.x)
- [Bug] Build output grepping loses full logs, causing redundant rebuilds on failures
- [BUG] Bash tool hangs ~3 minutes on `docker compose up/down` on Linux
- [BUG] Bash commands fail with exit code 1 and no output (empty rg block in shell snapshot)
- [BUG] Shell initialization fails (exit 127) when .bashrc contains extglob pattern inside command substitution in function definition
- [BUG] sed truncates files
- [Bug] Hard crash with unresponsive input handling
- [BUG] Agent cleanup can non-deterministically kill its own tmux session, losing all work
- [BUG] Bash tool timeout error message is printed twice
- Background Bash task SIGTERMed by its own supervising CLI process on Linux — introduced in 2.1.246 (2.1.245 clean)
- [BUG] Shell snapshot should not pull in user aliases by default
- Session spontaneously re-executed hours-old background Bash commands (raw '&') — original order, ~2.3min apart, truncating their logs
- Bundled search helper allocates without bound on a BRE pattern with a literal | and -o (v2.1.233)
- [BUG] Bash tool timeout backgrounds a command instead of cancelling it — contributed to multi-hour VM disk-saturation incidents under concurrent subagent load
- Background Bash runner process (re-exec'd versioned binary) leaks memory after command completes — 100% CPU, OOM-killed at 10.8GB (v2.1.226 & v2.1.233, Linux)
- [Bug] grep shell shim silently skips binary and ignored files, masking search failures from agents
- Bash tool never surfaces stdout; ordinary commands (echo, printf, date, bare pwd) fail with bare Exit code 1
- Bash tool: grep→ugrep shim exits 2 when one operand is missing even though another matched (GNU grep/POSIX -q exits 0)
- [Bug] Bash-tool grep wrapper still silently returns nothing on text files with a stray NUL byte (2.1.220) — #56644 was auto-closed as stale, not fixed
- Bundled ugrep (Bash `grep` shim) balloons to 14–16.6 GB RSS on bounded-repeat -o patterns that GNU grep handles in 3 MB — repeated OOM kills on a production box
- Injected grep wrapper (bundled ugrep) consumes 20+ GB RAM on bounded-repeat regex, hard-freezes machine
- [Bug] Claude accidentally executes rm -rf on a backup directory in auto mode, acknowledging the mistake directly afterwards
- [BUG] Bundled grep/find/rg shims fail with `-G: error while loading shared libraries` when CLAUDE_CODE_EXECPATH is the dynamic loader (native binary launched via ld.so; NixOS)
- Bash tool stdout duplicated N times in tool results (N grows per call); command runs once — capture/render bug, not the shell
- [Bug] Command execution fails when using `!` prefix for external commands
- [BUG] pytest loop led to OOM
- [BUG] Agent ran an unsafe large recursive write to an ntfs3-mounted volume, triggering NTFS corruption and leaving the disk unmountable
- Long-lived daemon caches environment (SHELL) with no drift detection or restart; fish-login users silently get the wrong Bash-tool shell; CLAUDE_CODE_SHELL is undocumented
- Background Bash task: grep→ugrep shim fell back to full multithreaded filesystem scan instead of reading piped stdin, making machine unresponsive
- [Feature Request] Add process timeout and termination for stuck commands
- [Feature Request] Support sudo command execution for system-level operations
- [BUG] Claude CLI will not use "cd", rendering it unable to run commands in a container
- Benign `node -e` regex script false-flagged as "Fork bomb detected"
- Feature request: Bash tool should respect user's configured shell
- Malicious shell command injected into assistant-generated tool_use (command field corrupted with forged result-wrapper tags)
- [BUG] Running claude in a folder with a .git folder without rwx permissions for the current user prevents running bash commands
- [BUG] Background-shell counter under-counts SSH-wrapped Bash invocations (v2.1.144)
- Bash tool summary line undercounts find paths and -o patterns
- Bash tool omits `< /dev/null` when user command has any `<`/`<<` redirect, leaking parent stdin to children
- [BUG] Shell tool is returning no output in arch
- [Bug] Spurious permission denial injected into Bash tool error output
- [BUG] Bash tool starts in $HOME instead of session/project cwd under Termux proot, while Claude Code reports cwd was reset
- [BUG] claude code can't access external projects if running via sandboxed environment
- [BUG] Bash tool completely unusable on AlmaLinux 9 — shell snapshot creation fails with "Unable to read input file: Is a directory", exit 127 on every command
- [BUG] PR_SET_THP_DISABLE=1 is inherited into spawned children, breaking applications that rely on THP (devdax SIGBUS)
- [BUG] Claude Code violated .gitignore/.claudeignore policy by reading .env file using Bash cat command in auto-approve mode
- [BUG] Deduplication for Concurrent Background Bash Tasks since 2.1.112 to 2.1.114
- "Unhandled node type: string" prompt interrupts workflow
- [BUG] "unhandled node type $"
- [BUG] Bash tool with `git push` hangs indefinitely in remote control mode — command never reaches the shell
- [BUG] One-line fix unlocks PowerShell on macOS and Linux: cross-platform support was always there, just never turned on
- [Bug] Bash AST parser warning bypasses sandbox auto-approve mode
- [Bug] Bash tool subprocess execution failure on HPC clusters with cgroups/container restrictions
- [BUG] shell snapshot de 318KB auto-generado consume tokens masivamente
- Shell cd is silently reset when navigating outside allowed directories (--add-dir)
- Background tasks break serial port (device file) read operations
- [BUG] tmpfs user quota causes claude code bash tool to fail
- [Bug] Remote control interferes with bash execution and causes conversation loss
- [Feature Request] Respect user's default shell preference instead of forcing bash
- Bash tool: rejected/cancelled commands still execute (process already started)
- [BUG] Bash tool duplicates stdout in model context when command exits non-zero
- [BUG] Bash tool discards working directory change when command exits with non-zero code
- Nested claude CLI deletes parent session's Bash tool output capture file in /tmp/claude-*
- Bash tool: ZodError in permission system blocks git commands
- [BUG] Bash tool escapes ! inside single-quoted strings, breaking jq != and other commands
- Bash safety check says "This shell -c script runs rm" for `$VAR … -- sh -c '…'` with no rm anywhere (bypass mode)