Bash execution issues on Linux — page 3
Issues the maintainers labelled both platform:linux and area:bash.
253 issues · 75 open · 178 resolved (70%) · first seen Jan 3, 2026
Is this getting better or worse?
This class of problem is holding steady. 92 new reports in the last 90 days vs 88 in the 90 before — +5%. The open backlog peaked at 75 in 2026-10 and sits at 75 today.
Derived by counting each matching issue from its creation date until it closed. First-party
computation over the anthropics/claude-code tracker — the trend is not published
anywhere upstream.
Which builds report this
202 of these reports name the Claude Code build they were running, spanning 113 releases. Heaviest reporters:
- Claude Code v2.1.233
- Claude Code v2.1.205
- Claude Code v2.1.150
- Claude Code v2.1.288
- Claude Code v2.1.272
- Claude Code v2.1.220
- Claude Code v2.1.259
- Claude Code v2.1.158
Report volume, not a defect count: an issue can mention a build without that build having caused the failure. Versions come from the version string in the bug-report template, matched against real published tags.
Do these get fixed?
Median time to close is 34 days across 178 closures. Of the 178 closures with a recorded reason, 24% were closed as completed and 135 as not-planned or duplicate. The most recent completed fix landed in 2026-10.
Workarounds reported by the community
94 of these issues post a workaround someone says worked. The highest-engagement ones:
- [BUG] Bash comments break permissions
- Workaround: a PreToolUse hook can strip the comment lines before permission matching sees them. The hook reads the command, removes leading lines, and returns the clean command via . Your allowlist then matches correctly…
Found in the thread of #29582 · resolved - Background process termination crashes Claude Code in Docker containers
- …al to kill the process group (e.g., ), it kills itself too. Workaround Manually using to isolate background processes works: However, this loses Claude's background process monitoring and notification features. Suggested…
Found in the description of #16135 · still open - Bash(command:*) allow rules do not prevent permission prompts for file-modifying commands
- …in the desktop app ( , then ), and there's no config or UI workaround. Considering reopening this or filing a new issue — happy to do whichever the maintainers prefer.
Found in the thread of #20449 · resolved - [Bug] Agent spams no-op echo probe commands to flush shell output
- …h a real completion signal — never a burst of no-op echoes. Workaround in use: Added an explicit "never fire no-op probe commands" rule to global CLAUDE.md, but the model should not need this instruction — the default be…
Found in the description of #63887 · still open - [Bug] v2.1.117 regression: parallel Bash tool calls corrupt fd 3 in nested-Docker sandbox; permanent /proc/self/fd/3: Permission denied
- …, or timing. Filing what I've reproduced deterministically. Workaround Possibly related - 2.1.113 introduced the switch from "bundled JS" to "native Claude Code binary" per its release notes. The native binary's sandbox…
Found in the description of #51837 · resolved
Excerpts are quoted from the linked issue so you can judge relevance before opening it. Threads that only ask for a workaround, or report that there is none, are excluded. These are community suggestions, not official guidance from Anthropic — read the full thread before applying one.
Matching issues 201–253
Ranked by community engagement (reactions weighted over comments).
- [BUG] Manual mode does not review model-generated file content written through Bash
- Worktree isolation in a background session blocks subagents' Bash commands, even for other repos
- Commands that hit the Bash timeout keep running in the background unbounded; agents re-run them and processes pile up until the host runs out of memory
- [BUG] Bash tool children inherit the TUI's real pty; ssh passphrase prompt breaks fullscreen mouse tracking and wedges the session across resumes (regression in 2.1.281)
- Dangerous-rm approval dialog displays a target resolved against the session cwd, not the cd target
- [Bug] pkill -f process matching kills unintended user processes on occupied ports
- Session dies permanently with `400 ... unexpected end of data` after a Bash result containing NUL bytes
- run_in_background reports a self-backgrounding command as completed instantly, orphaning the process
- [MODEL] Opus 5 executed rm -rf "$HOME" during test cleanup(57,235 files and 11,315 directories deleted), causing extensive data loss
- [Bug] Claude Code hangs on long-running command execution causing excessive delays
- [BUG] "tell Claude what to do next" instructions don't reach Claude if a bash command is approved but fails
- [Bug] Bash tool dumps entire files instead of reading specified ranges
- [Bug] Auto mode classifier generates unsafe `awk` commands with large unintended replacement radius
- [BUG] Bash tool refused in nested user namespace since 2.1.220: apply-seccomp: write /proc/self/uid_map: Operation not permitted
- [BUG] run_in_background tasks intermittently killed ~17-20s after start, seconds after the arming turn ends (terminal CLI, Linux — not idle-timeout timing)
- Bash tool shell runs with `expand_aliases` enabled — shell aliases can silently rewrite commands after PreToolUse hook approval
- [Bug] Auto-mode classifier judges command form, not effect: dry-runs blocked while allowlisted equivalents with larger blast radius pass; denials stack into the 5-consecutive lockout
- [Bug] Claude Code prompts for sudo commands without password input support in terminal
- [Bug] Claude Code re-activates virtual environment on every bash prompt
- [Bug] Unnecessary directory changes trigger security analyzer false positives
- grep -Z/--null is silently ignored by the bundled grep, breaking "grep -Z | xargs -0" pipelines
- [Bug] Linux sandbox fails: apply-seccomp setgroups "Permission denied" on Ubuntu 26.04
- Bash tool `grep` (bundled ugrep) silently misses `^` alternatives: `(a|b|^)x` and `(^|[^0-9])x` match nothing that GNU grep matches
- [Bug] Bash tool call interrupted by safety classifier on benign df command
- Remote Control sessions get the background-command time limit meant for unattended sessions
- Auto mode: model dropped a git stash after restoring only one file from it, twice in one session
- Filed in error
- [Bug] Spurious SSH "Enter PIN for ECDSA-SK key" prompt interrupts input field
- [BUG] Background sub-agent reported "completed" while its own background Bash task is still running
- Bash tool grep shim (ugrep) misses matches for -E '(^|[^0-9])N' that GNU grep finds
- [BUG] gitOperation reports PR "created" when a command merely mentions "gh pr create"
- [Opus 5] Reniced ~44 of the user's desktop processes via an unverified PID list
- [Bug] CLI hangs when cp/mv commands are aliased to interactive prompts
- [BUG] Bash tool inlines CLAUDE_ENV_FILE into a single `bash -c` argument, so a hook env file over ~128 KiB makes every Bash call fail with E2BIG and permanently breaks the session
- [BUG] Bash tool produces no output when KSH_OPTION_PRINT is set in ~/.zshrc
- Worktree isolation: a subagent spawned before EnterWorktree has every Bash call refused afterward
- [BUG] Agent ran `timeout 5 <electron-app> --version` as a sanity check, orphaned Electron child processes froze the desktop (hard reboot required)
- [Bug] Session cleanup deletes concurrent session task output, causing Bash commands to fail with exit code 1
- [Bug] Tool execution timeout too short in check_all.sh (10 min limit)
- [BUG] Bash tool (Linux): after `exec` in a command, the CLI is the parent of the program, so killing that parent PID stops the session (pkill is guarded, kill is not)
- [BUG] Claude Code hangs when running `nmcli`
- [BUG] Bash permission walker: "Unhandled node type" forces prompts on pipes/semicolons nested inside $(...) command substitution
- [Bug] Claude Code generates Python code with incorrect leading whitespace in inline scripts
- Subagent composed permitted operations to bypass a permission block, causing SSH self-lockout on a remote host
- Bash tool: ~/.claude is bind-mounted read-only with no way to opt out, so hook state and config-manager writes always fail with EROFS
- [BUG] Remote Control session: background Bash tasks killed ~5-7 min after launch while CLI host in tmux stays alive
- Worktree isolation verifies complexity, not targets: a simple Bash command writing an absolute path outside the worktree passes unchecked
- Worktree-isolated background sessions: command shape verifier refuses safe read-only commands at scale (0/100 protective in sampled refusals)
- [BUG] `Messages sent during a Bash tool call are silently destroyed when the call returns is_error: true`
- Auto-mode classifier false-positives on codex exec and cross-tool state files
- [BUG] On a genuinely full disk, the Bash ENOSPC notice names the session tmpdir instead of the filesystem, and no command can then run to diagnose it
- Bash-tool grep shadow (2.1.245): present string returns exit 1 — measured repro, embedded ugrep 7.8.4, session-scoped workaround
- [BUG] Completion notifications unreliable for foreground commands auto-backgrounded at the 10-minute cap (inside subagents)