Bash execution issues on macOS — page 2
Issues the maintainers labelled both platform:macos and area:bash.
507 issues · 136 open · 371 resolved (73%) · first seen May 29, 2025
Is this getting better or worse?
This class of problem is holding steady. 159 new reports in the last 90 days vs 207 in the 90 before — -23%. The open backlog peaked at 136 in 2026-10 and sits at 136 today.
Derived by counting each matching issue from its creation date until it closed. First-party
computation over the anthropics/claude-code tracker — the trend is not published
anywhere upstream.
Which builds report this
362 of these reports name the Claude Code build they were running, spanning 157 releases. Heaviest reporters:
- Claude Code v2.1.119
- Claude Code v2.1.170
- Claude Code v2.1.81
- Claude Code v2.1.278
- Claude Code v2.1.71
- Claude Code v2.1.76
- Claude Code v2.1.158
- Claude Code v2.1.74
Report volume, not a defect count: an issue can mention a build without that build having caused the failure. Versions come from the version string in the bug-report template, matched against real published tags.
Do these get fixed?
Median time to close is 33 days across 371 closures. Of the 371 closures with a recorded reason, 20% were closed as completed and 297 as not-planned or duplicate. The most recent completed fix landed in 2026-09.
Workarounds reported by the community
177 of these issues post a workaround someone says worked. The highest-engagement ones:
- [BUG] autoAllowBashIfSandboxed bypassed for commands containing shell expansions and several other constructs
- …t's a significant workflow regression. Partial source-level workarounds: - Quote the variable AND ensure the string has literal content ( works; alone prompts). - No workaround for , brace expansion, ANSI-C strings, here…
Found in the description of #43713 · resolved - [BUG] Bash tool calls emitted as raw <invoke> text instead of executing
- …with the in-context few-shot poisoning hypothesis in 62344) Workaround that helped (not a fix) Switching to mid-session reduced the recurrence, consistent with 64774's finding that 4.7 and Sonnet 4.6 have ~0% failure rat…
Found in the thread of #63870 · still open - macOS: PTY file descriptors leaked across a long Bash-heavy session, exhausting kern.tty.ptmx_max (forkpty / posix_openpt fail with ENXIO system-wide)
- …h PTY (tmux, screen, ssh's local PTY allocation, etc.). The workaround is to quit and relaunch Claude. The 511 PTYs release on process exit and Terminal works again immediately. Environment - macOS: 26.4.1 (build 25E253)…
Found in the description of #57580 · resolved - bypassPermissions mode now prompts on `cd DIR && grep …` when a Read() deny rule is configured (regression in 2.1.259)
- …ws the mode was throughout and auto mode was never entered. Workaround Tell agents not to use prefixes or recursive grep over directories (use explicit file lists or a file-search tool). That removes the prompts but mean…
Found in the description of #91683 · still open - Task runner reports ENOSPC on subprocess output despite disk having free space
- …rsation (new UUID) does NOT durably fix it, contrary to the workaround mentioned here. A new session works for the first command or two (builtins like pass), then the next external process ( , , ) hits ENOSPC — and this…
Found in the thread of #63909 · still open
Excerpts are quoted from the linked issue so you can judge relevance before opening it. Threads that only ask for a workaround, or report that there is none, are excluded. These are community suggestions, not official guidance from Anthropic — read the full thread before applying one.
Matching issues 101–200
Ranked by community engagement (reactions weighted over comments). Listing the top 300 of 507 matches; the statistics above cover all 507.
- [BUG] TypeError "undefined is not an object (evaluating 'H.replace')" replaces Bash tool output
- [BUG] acli (Atlassian's official CLI tool) using OAuth fails in Claude Code but works in macOS Terminal
- Claude.app leaks PTY master fds (/dev/ptmx) — exhausts macOS kern.tty.ptmx_max after long Bash-heavy sessions
- Add `nu` (nushell) as a supported value for `defaultShell`
- [Bug] Agent suggests destructive commands without safety warnings
- Bash tool calls not in allowlist executed without authorization prompt
- Shell snapshot filters _-prefixed functions, breaking dependent exported functions (GVM _encode/_decode)
- Claude Code modified 1,008 user files without permission during 'test' of installed automation
- [BUG] Intermittent "Tool permission stream closed before response received" on Bash tool calls
- Catastrophic data loss — autonomous `rm -rf` destroyed user home subtree despite APFS case-insensitive ambiguity and existing safeguards
- API Error: 500 req_011Ca5jqeWFH9NFeuCYgEf6d
- [Bug] Claude Code corrupts source files with sed command, causing token waste on recovery
- Bash permission heuristic misparses shell command boundaries (escaped semicolons treated as separators)
- [BUG] Bash teardown can SIGKILL an unrelated process after PID reuse
- Worktree-isolated sessions still refuse Bash commands that never run git (2.1.270)
- Desktop app ignores `respondToBashCommands: false` (bundled 2.1.234); terminal CLI honors it
- [Bug] Worktree isolation blocks all Bash commands due to parser abort in bash-command classifier
- [Bug] Bash tool invocations render as text instead of executing intermittently
- [BUG] Sandboxed Bash output corruption during git operations; direct git ref reads remain correct
- PTY leak: Bash tool leaks master PTY file descriptors, exhausting kern.tty.ptmx_max
- [Bug] Multiple shell snapshot processes consuming 100% CPU causing battery drain
- [BUG] Claude Code ran batch API script as background task, signaled completion while processes still running - several hundred USD in charges
- [Bug] Claude ignores user instructions to not read shell profile, exposes secrets
- Bash tool results silently lost — agent waits forever (no timeout fires); correlates with Remote Control sessions
- [Bug] Model generating incorrect bash commands and false success reports
- find/grep shadow functions launch a nested agent instead of bfs/ugrep on 2.1.143 (ARGV0 dispatch broken, silent data corruption)
- [BUG] Running `claude sessions list` via Bash tool triggers recursive process fork bomb, consuming entire usage quota
- [BUG] Bash tool routes all commands to background tasks that never complete
- [Bug] Background task execution not functioning
- Telegram channel plugin MCP connection drops after Bash tool use (macOS Intel)
- [BUG] Cypress commands are not performing properly in the VS Code native UI
- [Bug] Claude Code executed unauthorized rm -rf due to case-insensitive filesystem path resolution
- [Bug] Bash execution fails when VM disk is full
- [Bug] Shell enters broken state when CWD is deleted by rm -rf
- [BUG] Shell snapshot does not honor ZDOTDIR - aliases from redirected config silently absent
- tree-sitter-bash stubbed out in Bun single-file binary — all Bash permission checks use legacy fallback
- [BUG] Interpreting regular expressions as paths for permission checks
- [BUG] Bash tool environment has RUSTUP_TOOLCHAIN=1.80.1 set from unknown source
- Worktree-isolation Bash guard overrides an explicit PreToolUse `permissionDecision: allow`
- Bash diff panel reports another process's file writes as changes made by an unrelated command
- [BUG] blockReadsOutsideWorkingDirectories prompts for allowlisted gh commands: flag values misidentified as runtime-computed paths
- Resource governance for agent-spawned process trees (memory caps, pressure feedback, teardown ordering)
- Bash tool: "wc" via command substitution fails with "command not found" inside a for-loop with 2+ items
- Worktree isolation refuses any command whose path argument has a denylisted basename (`ls docs/source`, `ls internal/eval`)
- Background Bash tasks get lost/duplicated, turning a simple deploy into 10+ hours of retries
- [MODEL] Major Data loss. Agent-constructed test payload with $(...) executed for real due to bash double-quote handling — rm -rf ~ ran against live home directory
- [Bug] agent autonomously changed directory and began to write code unprompted and committed unprompted
- [BUG] Shell grep shim: BRE alternation \| combined with literal ( produces 'rg: regex parse error: unclosed group'
- [BUG] Claude code is hanging on every command.
- Auto-backgrounded/interrupted Bash commands outlive their turn and can destructively race later commands
- [BUG] Bash command containing `python3` execute without permission prompt when no allow rules are configured and sandboxed
- [BUG] PreToolUse hook for Write/Edit can be bypassed by writing files via the Bash tool
- Regression (2.1.149 → 2.1.156): 1Password `op` CLI session broke in Bash tool calls on macOS
- [Bug] Claude hangs on certain bash commands in specific repository
- [Bug] `--help` flag not recognized, causing unintended command execution
- [Bug] ripgrep default color output corrupts text, --color=never workaroundSorr
- Background job (daemon) Bash cwd overridden to ~/.claude, ignoring job's recorded cwd/originCwd
- v2.1.132 (Cursor): parallel agent panels share one shell, sub-agent calls reset cwd mid-run
- Shell snapshot still drops underscore-prefixed zsh helper functions in v2.1.112 (recurrence of #40602)
- Push-to-main rail in auto mode: wildcard allow rules don't override; only exact-match works
- [BUG] rm -rf command executed without asking permission during ambiguous prompting
- Regression: Bash tool permanently broken when CWD is deleted mid-session (was fixed in #21580 / #26136, returned in 2.1.119)
- Claude suggests global `docker network prune -f` as "safe" — wipes networks across unrelated projects
- [Bug] pgrep fork bomb causing session hang with repeated command execution
- auto-mode permission-deny envelope returned without intercepting Bash dispatch (silent-bypass on git push origin main, CLI 2.1.114, Opus 4.7)
- [Bug] Subagents silently terminate long-running background shells on turn end; SendMessage resumption auto-converts to async without warning
- [Bug] Bash pattern matching not applied to sourced commands in settings.json
- [BUG] Undisclosed background command execution burning user credits without consent — Claude Sonnet 4.6
- Bash tool drops `cd` prefix from `command` parameter while text output correctly includes it
- [BUG] Long-running Bash tool (900s timeout) completes but tool_result never delivered — conversation silently rewound via isMeta synthetic message
- Feature request: Use zsh (or login shell) for Bash tool on macOS
- Desktop app ignores settings.json env block and shell profile PATH on macOS
- ! (bash mode) commands produce no output for filesystem commands
- Compound command re-prompts in same session after approval
- [BUG] Claude Code auto-backgrounds Bash commands containing cd + piped chains, causing permanent deadlocks
- [Bug] Shell builtins bypass deny patterns when invoked with absolute paths
- Issue closed - please delete
- [Bug] Agent unsafe shell execution allows destructive commands and session state corruption
- [BUG] Bash permission matcher fails when command arguments contain literal parentheses (e.g. Next.js route groups)
- [Bug] Ralph-loop: Backticks in quoted prompts passed to Bash causing command substitution error
- Bash tool loses HOME and PATH env vars in some sessions
- [BUG] PostToolUse hooks do not fire on failed Bash commands (non-zero exit code)
- [BUG] [CRITICAL] Project Directory Deletion during background task conversion with Sonnet 4.6 1mln context
- [BUG] v2.1.59: "Always allow" suggests overly broad wildcard instead of specific subcommand
- [Desktop] Bash file-change diff (bashEditDiff) is computed but never shown in the Code tab
- Inline-shell rm check (2.1.288) asks on zsh -c scripts that contain no rm
- Bash tool in a worktree-isolated agent refuses commands that never leave the worktree
- Branch switch in a Bash call prints full diffs of every file changed on disk
- Orphaned Bash-tool subprocesses (tsc/vitest) outlive a terminated session and run unsupervised for hours
- [Bug] Agent stuck in infinite loop with backgrounded sleep timers after subagent fan-out completes
- [BUG] bash-input prefill/tab-completion suggests relative-path script without required ./ prefix
- [BUG] Background Bash task's process group is SIGKILLed mid-run when the command spawns a daemonizing CLI (cursor-agent) — and reported as completed (exit code 0)
- [BUG] Project Deleted during Bash tool inconsistencies
- [BUG] Background shell task completes after agent moves on, silently overwrites files with stale content
- [BUG] Bash output redirection and cp into the session's own cwd are blocked, while the error message lists that cwd as an allowed working directory
- macOS: intermittent 2-minute git hangs with core.fsmonitor enabled (multi-worktree/concurrent sessions); timeout SIGTERM orphans index.lock and wedges the session
- [Bug] Intermittent file-read failures and silent cross-reads in workspace mount access layer
- Permission system doesn't match Claude's natural Bash generation patterns (multi-line scripts, variable-assignment prefixes)
- Desktop app leaks PTY masters until system PTY limit (511) is exhausted — Terminal fails with 'forkpty: Device not configured'
- Pty (pseudo-terminal) fd leak exhausts macOS pool until forkpty fails system-wide