Bash execution issues on macOS
Issues the maintainers labelled both platform:macos and area:bash.
507 issues · 136 open · 371 resolved (73%) · first seen May 29, 2025
Is this getting better or worse?
This class of problem is holding steady. 159 new reports in the last 90 days vs 207 in the 90 before — -23%. The open backlog peaked at 136 in 2026-10 and sits at 136 today.
Derived by counting each matching issue from its creation date until it closed. First-party
computation over the anthropics/claude-code tracker — the trend is not published
anywhere upstream.
Which builds report this
362 of these reports name the Claude Code build they were running, spanning 157 releases. Heaviest reporters:
- Claude Code v2.1.119
- Claude Code v2.1.170
- Claude Code v2.1.81
- Claude Code v2.1.278
- Claude Code v2.1.71
- Claude Code v2.1.76
- Claude Code v2.1.158
- Claude Code v2.1.74
Report volume, not a defect count: an issue can mention a build without that build having caused the failure. Versions come from the version string in the bug-report template, matched against real published tags.
Do these get fixed?
Median time to close is 33 days across 371 closures. Of the 371 closures with a recorded reason, 20% were closed as completed and 297 as not-planned or duplicate. The most recent completed fix landed in 2026-09.
Workarounds reported by the community
177 of these issues post a workaround someone says worked. The highest-engagement ones:
- [BUG] autoAllowBashIfSandboxed bypassed for commands containing shell expansions and several other constructs
- …t's a significant workflow regression. Partial source-level workarounds: - Quote the variable AND ensure the string has literal content ( works; alone prompts). - No workaround for , brace expansion, ANSI-C strings, here…
Found in the description of #43713 · resolved - [BUG] Bash tool calls emitted as raw <invoke> text instead of executing
- …with the in-context few-shot poisoning hypothesis in 62344) Workaround that helped (not a fix) Switching to mid-session reduced the recurrence, consistent with 64774's finding that 4.7 and Sonnet 4.6 have ~0% failure rat…
Found in the thread of #63870 · still open - macOS: PTY file descriptors leaked across a long Bash-heavy session, exhausting kern.tty.ptmx_max (forkpty / posix_openpt fail with ENXIO system-wide)
- …h PTY (tmux, screen, ssh's local PTY allocation, etc.). The workaround is to quit and relaunch Claude. The 511 PTYs release on process exit and Terminal works again immediately. Environment - macOS: 26.4.1 (build 25E253)…
Found in the description of #57580 · resolved - bypassPermissions mode now prompts on `cd DIR && grep …` when a Read() deny rule is configured (regression in 2.1.259)
- …ws the mode was throughout and auto mode was never entered. Workaround Tell agents not to use prefixes or recursive grep over directories (use explicit file lists or a file-search tool). That removes the prompts but mean…
Found in the description of #91683 · still open - Task runner reports ENOSPC on subprocess output despite disk having free space
- …rsation (new UUID) does NOT durably fix it, contrary to the workaround mentioned here. A new session works for the first command or two (builtins like pass), then the next external process ( , , ) hits ENOSPC — and this…
Found in the thread of #63909 · still open
Excerpts are quoted from the linked issue so you can judge relevance before opening it. Threads that only ask for a workaround, or report that there is none, are excluded. These are community suggestions, not official guidance from Anthropic — read the full thread before applying one.
Matching issues 1–100
Ranked by community engagement (reactions weighted over comments). Listing the top 300 of 507 matches; the statistics above cover all 507.
- [BUG] autoAllowBashIfSandboxed bypassed for commands containing shell expansions and several other constructs
- [BUG] Bash tool calls emitted as raw <invoke> text instead of executing
- macOS: PTY file descriptors leaked across a long Bash-heavy session, exhausting kern.tty.ptmx_max (forkpty / posix_openpt fail with ENXIO system-wide)
- bypassPermissions mode now prompts on `cd DIR && grep …` when a Read() deny rule is configured (regression in 2.1.259)
- Task runner reports ENOSPC on subprocess output despite disk having free space
- [BUG] Claude always using cd command into current working directory in combination with Git commands, requiring approval for whitelisted commands
- [BUG] Claude Code v2.1.212 asks approval for ALL bash commands in plan mode
- [BUG] Auto mode blocks all Bash actions with endless retries when Opus 4.8 classifier is temporarily unavailable
- [BUG] Auto mode silently disables path-scoped rules: it instructs the agent to edit files through Bash, and Bash edits never trigger rule injection
- [BUG] PreToolUse permissionDecision: "allow" no longer suppresses prompt for Bash with dangerouslyDisableSandbox: true (2.1.116+ regression)
- [BUG] `autoAllowBashIfSandboxed` prompts for commands containing `key=value` arguments
- [BUG] Read(**/.env) deny rule prompts on every rg directory search, though rg skips hidden files by default
- Bash tool aborts with "temp filesystem ... is full (0MB free)" / ENOSPC when disk is NOT full (macOS)
- darwin-x64: false "temp filesystem is full (0MB free) / ENOSPC" — statfs().bsize=0 makes the empty-output explainer always report disk-full
- Add an opt-out for the built-in find→bfs / grep→ugrep shadow functions injected into the Bash tool shell
- Read() deny rule arms an unwhitelistable cd+relative-read prompt in bypassPermissions (2.1.257+), and the predicate ignores the rule's patterns
- [BUG] Bash Commands do not execute, Return No Output
- [BUG] setValueForKeyFakeAssocArray showing up in almost all Bash calls in claude Code
- [BUG] blockReadsOutsideWorkingDirectories blocks reads inside working directory when path is resolved via cd + glob
- Auto mode: read-only Bash compounds starting with `cd DIR` lost static auto-approval in 2.1.258, causing frequent permission prompts
- Desktop app leaks pseudo-terminals (ptys) until the system runs out (forkpty: Device not configured)
- Claude Desktop leaks pty (ptmx) fds -> system-wide pty exhaustion (terminals die with 'forkpty: Device not configured')
- [BUG] Bash tool "avoid cd" instruction causes systematic failure in SSH remote commands
- [BUG] Bogus "ANSI-C quoting" in Bash permission prompt rationale
- [BUG] `Bash` tool executes the user's login shell (e.g. /bin/zsh) and should thus be called "shell" not "bash"; LLM trips over bash-only idioms
- Regression (since 2026-05-29): intermittent "tool call was malformed and could not be parsed" — tool_use block absent on a stop_reason=tool_use turn
- bug: installer places binary in ~/.local/bin but shell snapshot drops it from PATH, causing spurious startup warning
- [BUG]Critical blocker (Max plan) — Claude Code shell bootstrap fails with ENOSPC
- Bash tool falsely reports 'temp filesystem … is full (0MB free)' on any empty-stdout + non-zero-exit command
- Bash tool blocks `sleep` as first command — needs opt-out or configurable threshold
- Unhandled node type: string error appears during git commit/push (cosmetic, non-blocking)
- [BUG] Claude unable to run any bash commands
- [Bug] Spurious ENOSPC errors in task output capture with racing cleanup deletes
- Background processes started by Bash tool are not cleaned up on session exit
- [BUG] Bash tool's heredoc commit format triggers approval prompt on every commit regardless of auto-accept settings
- [BUG] My Mac OS crashes due to claude running `find /` command (reboot multiple times a day)
- [Bug] Background tasks killed without TaskStop when session goes idle
- [BUG] Bash tool incorrectly escapes ! characters — still reproducible as of May 2026
- Claude Code leaks pty handles — exhausts pseudo-terminals on macOS after long session
- [BUG] Sub-agents (Explore, Plan, general-purpose) Bash tool defaults to /root instead of inheriting parent session's working directory
- Worktree-isolation Bash guard refuses every compound command, even with no git usage at all
- [BUG] tree-kill dependency causes pgrep storm / 100% CPU when reaping Bash subprocess trees on macOS
- Bash tool login shell doesn't source /etc/paths or ~/.zprofile
- Any function-hook tool.call on Bash breaks Agent isolation: "worktree" — every Bash call refused with "isolation context for this agent was lost"
- [BUG] ## ESCALATION: Claude Code (Opus 4.8) Bash tool emits false "temp filesystem full / 0MB free" ENOSPC despite ~148 GB free, causing wasted token spend
- [Bug] Anthropic API Error: Model temporarily unavailable blocks auto mode safety checks
- Temp-filesystem preflight false-positives ENOSPC on filesystems with >17.6 TB free (statfs 32-bit truncation)
- Orphaned background shells from prior sessions persist and re-trigger commands in new sessions
- [BUG] Backticks inside heredoc quoted strings trigger false-positive permission prompt
- Command Execution in Incorrect Directory When Running npx nx run-many via Claude Code
- [Bug] Bash tool emits non-zsh-compatible syntax when SHELL=zsh on macOS
- [BUG] Fullscreen TUI: failed Bash tool output is empty when expanded
- Shell snapshot generates empty if-body causing bash syntax error on every command
- Agent refuses to use shell/bash under any circumstance
- Permission "don't ask again" suggests wrong command in piped chains
- [BUG] Claude desktop app leaks pseudo-terminal (pty) master fds, exhausting macOS `kern.tty.ptmx_max` and locking out all terminal apps
- Background Bash command reading other agents' output files can cause runaway disk usage (1.2TB)
- Shell snapshot PATH export contains literal $PATH — system directories lost
- Auto-accept mode runs destructive framework DB commands (e.g. `php artisan migrate:fresh`) without confirmation → data loss
- [Bug] Bash tool executes commands multiple times with duplicate outputs
- [BUG] Opus 4.7 executes destructive `docker rm` without verifying data persistence — user data loss
- Claude ran git clean -fd without permission, destroyed untracked files
- env.PATH in settings.json not applied to Bash tool shell environment
- [BUG] Auto mode tells the model to edit files via Bash, which silently disables checkpointing / `/rewind` (no Restore code on any prompt)
- [Bug] File-change attribution asymmetry between concurrent sessions
- Exported grep/find shell wrappers reference $ZSH_VERSION unguarded → fails under set -u
- Interactive Bash tool hangs after successful execution; tool_result is not written to session/UI
- deniedPaths bypassed by Bash tool — security policy not enforced uniformly across tools
- [BUG] Claude is unaware of case-insensitive filesystems and uses unsafe rm -rf on user data
- [BUG] Shell snapshot captures interactive-only functions, eval-per-function pattern causes O(n) fork overhead (~8s per Bash tool call)
- [BUG] Session working directory becomes permanently unresolvable after using a git worktree (background job), breaking Bash, file tools, and the /cd command
- Permission rules are bypassed by semantically-equivalent command%2 0forms (`git -C`, `cd &&`, env prefixes)
- [BUG] Auto mode ran an unrequested wildcard `rm` in a user directory and deleted user files with no confirmation
- [Bug] v2.1.156+ regression: native Read/Bash return fabricated-but-plausible content, triggering agent confabulation cascades
- Background tasks silently relaunched as duplicates + /tasks lacks elapsed time to triage
- CRITICAL: Claude attempts to delete home directory when cleaning up file named '~'
- Shell snapshot includes unresolvable zsh autoload stubs, breaking system commands (e.g. make, diff)
- Can no longer tell Claude to change its working directory mid-session (regression)
- [Bug] Claude Code injects GITHUB_TOKEN PAT into Bash environment, conflicting with gh CLI OAuth token
- [BUG] Bash tool cannot start: ENOSPC when creating /sessions/.../tmp/claude-XXXX (bootstrap deadlock)
- Bash tool refuses read-only and worktree-local commands as 'too complex to verify' in git worktree isolation
- [Bug] Claude Code executes destructive commands despite explicit user intent to perform action manually
- [Feature Request] Git checkout operations should not appear in Bash Diff Tool output or be disabled by default
- [Bug] Shell glob patterns incorrectly interpreted by zsh causing empty agent returns
- [BUG] Claude Code fails BASH invocations
- [BUG] Bash tool: injected grep/find shell functions terminate the calling shell under bash < 4.0 (macOS system /bin/bash)
- [BUG] PTY leak: Claude desktop app accumulates ~490 /dev/ptmx file descriptors
- [Bug] Bash tool grep silently returns nothing on text files containing stray NUL bytes (bundled ugrep -I skips them)
- Bash tool ignores PATH from all config sources (settings.json env, .zshenv, .zprofile)
- Bash cwd no longer persists between calls (regression, even without CLAUDE_BASH_MAINTAIN_PROJECT_WORKING_DIR)
- Desktop app: parallel Bash tool writes can silently lose files
- Dangerous/bypass mode still prompts for some Bash commands
- [BUG] Shell snapshot generates unquoted PATH on macOS with spaces in home directory
- [Bug] Project context lost when Bash tool changes into nested git repository
- [Bug] Worktree isolation guard false positive: substring match on "git" blocks commands
- Background Bash task completion never resumes in-process subagents — they idle forever while finished work sits on disk
- [BUG] Background Bash tasks (run_in_background) killed by external SIGTERM mid-execution, only after a session runs long
- [Bug] Sub-agent backgrounded processes orphaned/SIGHUP'd on turn-end; no auto-resume on background exit
- Memory-pressure reaper (2.1.193+) silently kills active background tasks — "idle" detection ignores child-process activity, and the kill is indistinguishable from a manual stop
- Bash command with 2>&1 causes ~12min spinner hang with token usage climbing during the stall