claude-code - 💡(How to fix) Fix [BUG] CRITICAL: Bash permission gate bypassed for compound `rm -rf … && … | … ; echo …` commands in default mode (no allow-list match, no prompt shown, reproduced on 2.1.139)

claude-code2026-05-12 17:21:06

ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

GitHub issue URL

Helpful · Quick feedback

Error Message

Error Messages/Logs

No error was raised. The bug is the absence of a permission prompt or denial — the command executed silently with is_error: false in the JSONL transcript. The JSONL records contain no permissionGranted, permissionMode, permissionDecision, permissionRule, approvalDecision, or permissionPrompt field. Full top-level keys present in the assistant tool_use record:

Root Cause

<p style="font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: pre-wrap; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-line: none; text-decoration-thickness: initial; text-decoration-style: initial; margin-top: 0.1em; margin-bottom: 0.2em; color: rgb(191, 191, 191); font-family: -apple-system, system-ui, "Segoe UI", Roboto, sans-serif; font-size: 13px; font-variant-ligatures: normal; background-color: rgb(18, 19, 20); text-decoration-color: initial;">Test 3 matches the original incident's shape. The bug exists in <strong>both 2.1.136 and 2.1.139</strong> (the latest version installed on this machine).</p><p style="font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: pre-wrap; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-line: none; text-decoration-thickness: initial; text-decoration-style: initial; margin-top: 0.1em; margin-bottom: 0.2em; color: rgb(191, 191, 191); font-family: -apple-system, system-ui, "Segoe UI", Roboto, sans-serif; font-size: 13px; font-variant-ligatures: normal; background-color: rgb(18, 19, 20); text-decoration-color: initial;">The minimal differences between gated Test 2 and bypassed Test 3 are: multi-target <code style="font-family: monospace; color: rgb(140, 140, 140); background-color: rgb(38, 38, 38); padding: 2px 4px; border-radius: 3px; word-break: break-word; font-size: 0.9em;">rm -rf</code>, a pipe <code style="font-family: monospace; color: rgb(140, 140, 140); background-color: rgb(38, 38, 38); padding: 2px 4px; border-radius: 3px; word-break: break-word; font-size: 0.9em;">|</code>, <code style="font-family: monospace; color: rgb(140, 140, 140); background-color: rgb(38, 38, 38); padding: 2px 4px; border-radius: 3px; word-break: break-word; font-size: 0.9em;">grep -E "<regex>"</code> (versus a literal grep argument), and a trailing <code style="font-family: monospace; color: rgb(140, 140, 140); background-color: rgb(38, 38, 38); padding: 2px 4px; border-radius: 3px; word-break: break-word; font-size: 0.9em;">echo "<string>"</code> with a leading space before <code style="font-family: monospace; color: rgb(140, 140, 140); background-color: rgb(38, 38, 38); padding: 2px 4px; border-radius: 3px; word-break: break-word; font-size: 0.9em;">;</code>. Further isolation testing would require additional authorized destructive runs.</p><h2 style="font-style: normal; font-variant-caps: normal; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-line: none; text-decoration-thickness: initial; text-decoration-style: initial; color: rgb(191, 191, 191); font-family: -apple-system, system-ui, "Segoe UI", Roboto, sans-serif; font-variant-ligatures: normal; background-color: rgb(18, 19, 20); text-decoration-color: initial;">Primary hypothesis (compound-command bypass)</h2><p style="font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: pre-wrap; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-line: none; text-decoration-thickness: initial; text-decoration-style: initial; margin-top: 0.1em; margin-bottom: 0.2em; color: rgb(191, 191, 191); font-family: -apple-system, system-ui, "Segoe UI", Roboto, sans-serif; font-size: 13px; font-variant-ligatures: normal; background-color: rgb(18, 19, 20); text-decoration-color: initial;">The Bash permission matcher appears to be approving compound shell expressions when any non-destructive sub-command (e.g. <code style="font-family: monospace; color: rgb(140, 140, 140); background-color: rgb(38, 38, 38); padding: 2px 4px; border-radius: 3px; word-break: break-word; font-size: 0.9em;">grep</code>, <code style="font-family: monospace; color: rgb(140, 140, 140); background-color: rgb(38, 38, 38); padding: 2px 4px; border-radius: 3px; word-break: break-word; font-size: 0.9em;">ls</code>, <code style="font-family: monospace; color: rgb(140, 140, 140); background-color: rgb(38, 38, 38); padding: 2px 4px; border-radius: 3px; word-break: break-word; font-size: 0.9em;">echo</code>) matches an allow-list entry, without separately gating the <code style="font-family: monospace; color: rgb(140, 140, 140); background-color: rgb(38, 38, 38); padding: 2px 4px; border-radius: 3px; word-break: break-word; font-size: 0.9em;">rm -rf</code> segment. The workspace allow-list contains <code style="font-family: monospace; color: rgb(140, 140, 140); background-color: rgb(38, 38, 38); padding: 2px 4px; border-radius: 3px; word-break: break-word; font-size: 0.9em;">Bash(grep:*)</code>, multiple specific <code style="font-family: monospace; color: rgb(140, 140, 140); background-color: rgb(38, 38, 38); padding: 2px 4px; border-radius: 3px; word-break: break-word; font-size: 0.9em;">Bash(grep -E "...")</code> entries, and others — any of which could be causing the whole compound expression to be approved.</p><h2 style="font-style: normal; font-variant-caps: normal; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-line: none; text-decoration-thickness: initial; text-decoration-style: initial; color: rgb(191, 191, 191); font-family: -apple-system, system-ui, "Segoe UI", Roboto, sans-serif; font-variant-ligatures: normal; background-color: rgb(18, 19, 20); text-decoration-color: initial;">Other hypotheses</h2><ol style="font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-line: none; text-decoration-thickness: initial; text-decoration-style: initial; padding-inline-start: 2em; color: rgb(191, 191, 191); font-family: -apple-system, system-ui, "Segoe UI", Roboto, sans-serif; font-size: 13px; font-variant-ligatures: normal; background-color: rgb(18, 19, 20); text-decoration-color: initial;"><li><code style="font-family: monospace; color: rgb(140, 140, 140); background-color: rgb(38, 38, 38); padding: 2px 4px; border-radius: 3px; word-break: break-word; font-size: 0.9em;">skipDangerousModePermissionPrompt: true</code><span> </span>may have broader effect in the VSCode extension code path than its documented "entry confirmation for bypass mode" scope.</li><li>A per-session "always allow" cached from an earlier approval leaking to broader Bash matching.</li><li>The matcher inspecting only the<span> </span><em>last</em><span> </span>segment after<span> </span><code style="font-family: monospace; color: rgb(140, 140, 140); background-color: rgb(38, 38, 38); padding: 2px 4px; border-radius: 3px; word-break: break-word; font-size: 0.9em;">;</code><span> </span>— a trailing<span> </span><code style="font-family: monospace; color: rgb(140, 140, 140); background-color: rgb(38, 38, 38); padding: 2px 4px; border-radius: 3px; word-break: break-word; font-size: 0.9em;">echo "<literal>"</code><span> </span>would always look benign.</li><li>The VSCode extension permission-mode indicator desyncing from actual gate state.</li><li>Plugin-registered hook auto-approving (low likelihood given enabled plugin set).</li></ol><h2 style="font-style: normal; font-variant-caps: normal; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-line: none; text-decoration-thickness: initial; text-decoration-style: initial; color: rgb(191, 191, 191); font-family: -apple-system, system-ui, "Segoe UI", Roboto, sans-serif; font-variant-ligatures: normal; background-color: rgb(18, 19, 20); text-decoration-color: initial;">Impact</h2><p style="font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: pre-wrap; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-line: none; text-decoration-thickness: initial; text-decoration-style: initial; margin-top: 0.1em; margin-bottom: 0.2em; color: rgb(191, 191, 191); font-family: -apple-system, system-ui, "Segoe UI", Roboto, sans-serif; font-size: 13px; font-variant-ligatures: normal; background-color: rgb(18, 19, 20); text-decoration-color: initial;">Severe trust-and-safety regression. In default permission mode a user reasonably trusts that destructive shell commands cannot run without explicit approval. In this incident only regenerable build artifacts were lost, but the same code path could delete source files, dotfiles, uncommitted work, or arbitrary paths. The compound-command pattern is especially concerning because it gives the model a reliable mechanism to escalate any allow-listed command into arbitrary Bash by prefixing <code style="font-family: monospace; color: rgb(140, 140, 140); background-color: rgb(38, 38, 38); padding: 2px 4px; border-radius: 3px; word-break: break-word; font-size: 0.9em;">rm -rf … &&</code> and appending allow-listed segments.</p>

Code Example

In default permission mode, with no `Bash(rm…)` and no wildcard Bash entry in any settings file, the Bash tool gate should:

1. Refuse to execute any command containing a destructive sub-command (`rm`, `rmdir`, `mv` to nonexistent path, redirect-overwrite, `dd`, `truncate`, etc.) without an explicit per-invocation permission prompt — regardless of what other sub-commands appear in the same compound expression.
2. Either evaluate the **most-privileged** segment of any compound shell expression (`&&`, `||`, `;`, `|`, command substitution, process substitution, xargs-style chains) for permission decisions, **or** refuse to evaluate compound commands at all and require the model to issue each sub-command as a separate Bash call (each independently gated).
3. Record every permission decision (granted/denied, matching rule, and which segment of any compound it applied to) in the JSONL transcript so users can audit what happened.
4. Surface a persistent, unambiguous permission-mode indicator in the VSCode extension UI that cannot diverge from the actual gate state.


### Error Messages/Logs

RAW_BUFFERClick to expand / collapse

Preflight Checklist

I have searched existing issues and this hasn't been reported yet
This is a single bug report (please file separate reports for different bugs)
I am using the latest version of Claude Code

What's Wrong?

</p><p style="font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: pre-wrap; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-line: none; text-decoration-thickness: initial; text-decoration-style: initial; margin-top: 0.1em; margin-bottom: 0.2em; color: rgb(191, 191, 191); font-family: -apple-system, system-ui, "Segoe UI", Roboto, sans-serif; font-size: 13px; font-variant-ligatures: normal; background-color: rgb(18, 19, 20); text-decoration-color: initial;">Claude Code's Bash permission gate failed to prompt for a destructive <code style="font-family: monospace; color: rgb(140, 140, 140); background-color: rgb(38, 38, 38); padding: 2px 4px; border-radius: 3px; word-break: break-word; font-size: 0.9em;">rm -rf</code> command in default permission mode. The command was emitted by the model and executed silently with no user-facing approval dialog. After updating to the latest extension version, the bug still reproduces.</p><h2 style="font-style: normal; font-variant-caps: normal; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-line: none; text-decoration-thickness: initial; text-decoration-style: initial; color: rgb(191, 191, 191); font-family: -apple-system, system-ui, "Segoe UI", Roboto, sans-serif; font-variant-ligatures: normal; background-color: rgb(18, 19, 20); text-decoration-color: initial;">Environment</h2><ul style="font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-line: none; text-decoration-thickness: initial; text-decoration-style: initial; padding-inline-start: 2em; color: rgb(191, 191, 191); font-family: -apple-system, system-ui, "Segoe UI", Roboto, sans-serif; font-size: 13px; font-variant-ligatures: normal; background-color: rgb(18, 19, 20); text-decoration-color: initial;"><li><strong>OS:</strong><span> </span>macOS 15.7.5 (Sequoia, Build 24G624) — Darwin kernel 24.6.0</li><li><strong>Architecture:</strong><span> </span>arm64 (Apple Silicon)</li><li><strong>VSCode:</strong><span> </span>1.119.0 (arm64)</li><li><strong>Entrypoint:</strong><span> </span><code style="font-family: monospace; color: rgb(140, 140, 140); background-color: rgb(38, 38, 38); padding: 2px 4px; border-radius: 3px; word-break: break-word; font-size: 0.9em;">claude-vscode</code><span> </span>(VSCode native extension, launched from Extensions panel — not the CLI)</li><li><strong>Extension at original incident:</strong><span> </span>anthropic.claude-code-2.1.136-darwin-arm64</li><li><strong>Extension at confirmed re-repro:</strong><span> </span>anthropic.claude-code-2.1.139-darwin-arm64 (latest installed)</li><li><strong>Claude Code CLI on system:</strong><span> </span>2.1.34 (not used for this incident)</li><li><strong>Model:</strong><span> </span>claude-opus-4-7 (Opus 4.7, 1M context)</li><li><strong>Permission mode:</strong><span> </span>default (user-verified — not bypass, not acceptEdits, not plan)</li><li><strong>Plugins enabled:</strong><span> </span>context7, security-guidance, clangd-lsp (all from claude-plugins-official)</li><li><strong>Managed enterprise policy:</strong><span> </span>none — neither<span> </span><code style="font-family: monospace; color: rgb(140, 140, 140); background-color: rgb(38, 38, 38); padding: 2px 4px; border-radius: 3px; word-break: break-word; font-size: 0.9em;">/Library/Application Support/ClaudeCode/</code><span> </span>nor<span> </span><code style="font-family: monospace; color: rgb(140, 140, 140); background-color: rgb(38, 38, 38); padding: 2px 4px; border-radius: 3px; word-break: break-word; font-size: 0.9em;">/etc/claude-code/</code><span> </span>exist</li></ul><h2 style="font-style: normal; font-variant-caps: normal; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-line: none; text-decoration-thickness: initial; text-decoration-style: initial; color: rgb(191, 191, 191); font-family: -apple-system, system-ui, "Segoe UI", Roboto, sans-serif; font-variant-ligatures: normal; background-color: rgb(18, 19, 20); text-decoration-color: initial;">Relevant settings</h2><p style="font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: pre-wrap; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-line: none; text-decoration-thickness: initial; text-decoration-style: initial; margin-top: 0.1em; margin-bottom: 0.2em; color: rgb(191, 191, 191); font-family: -apple-system, system-ui, "Segoe UI", Roboto, sans-serif; font-size: 13px; font-variant-ligatures: normal; background-color: rgb(18, 19, 20); text-decoration-color: initial;"><code style="font-family: monospace; color: rgb(140, 140, 140); background-color: rgb(38, 38, 38); padding: 2px 4px; border-radius: 3px; word-break: break-word; font-size: 0.9em;">~/.claude/settings.json</code>:</p><div class="codeBlockWrapper_-a7MRw" style="font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-line: none; text-decoration-thickness: initial; text-decoration-style: initial; position: relative; margin: 8px 0px; color: rgb(191, 191, 191); font-family: -apple-system, system-ui, "Segoe UI", Roboto, sans-serif; font-size: 13px; font-variant-ligatures: normal; background-color: rgb(18, 19, 20); text-decoration-color: initial;"><button class="copyButton_CEmTFw copyButton_-a7MRw" title="Copy code" aria-label="Copy code to clipboard" style="color: rgb(191, 191, 191); font-family: -apple-system, system-ui, "Segoe UI", Roboto, sans-serif; font-size: 13px; background: 0% 0% repeat rgb(18, 19, 20); border: 0.833333px solid rgb(42, 43, 44); cursor: pointer; opacity: 0; display: flex; border-radius: 4px; justify-content: center; align-items: center; padding: 4px; transition: opacity 0.15s, background 0.15s; position: absolute; top: 4px; right: 4px;"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 20 20" fill="currentColor" aria-hidden="true" data-slot="icon" class="copyIcon_CEmTFw"><path fill-rule="evenodd" d="M15.988 3.012A2.25 2.25 0 0 1 18 5.25v6.5A2.25 2.25 0 0 1 15.75 14H13.5v-3.379a3 3 0 0 0-.879-2.121l-3.12-3.121a3 3 0 0 0-1.402-.791 2.252 2.252 0 0 1 1.913-1.576A2.25 2.25 0 0 1 12.25 1h1.5a2.25 2.25 0 0 1 2.238 2.012ZM11.5 3.25a.75.75 0 0 1 .75-.75h1.5a.75.75 0 0 1 .75.75v.25h-3v-.25Z" clip-rule="evenodd"></path><path d="M3.5 6A1.5 1.5 0 0 0 2 7.5v9A1.5 1.5 0 0 0 3.5 18h7a1.5 1.5 0 0 0 1.5-1.5v-5.879a1.5 1.5 0 0 0-.44-1.06L8.44 6.439A1.5 1.5 0 0 0 7.378 6H3.5Z"></path></svg></button><pre style="overflow-x: auto; white-space: pre; box-sizing: border-box; border-radius: 4px; max-width: 100%; margin: 0px; padding: 8px;"><code class="language-json" style="font-family: monospace; color: rgb(140, 140, 140); background-color: rgb(38, 38, 38); padding: 0px; border-radius: 3px; word-break: break-word; font-size: 0.9em;">{ "enabledPlugins": { "context7@claude-plugins-official": true, "security-guidance@claude-plugins-official": true, "clangd-lsp@claude-plugins-official": true }, "alwaysThinkingEnabled": true, "skipDangerousModePermissionPrompt": true, "theme": "dark-daltonized" } </code></pre></div><p style="font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: pre-wrap; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-line: none; text-decoration-thickness: initial; text-decoration-style: initial; margin-top: 0.1em; margin-bottom: 0.2em; color: rgb(191, 191, 191); font-family: -apple-system, system-ui, "Segoe UI", Roboto, sans-serif; font-size: 13px; font-variant-ligatures: normal; background-color: rgb(18, 19, 20); text-decoration-color: initial;">Note: <strong>no <code style="font-family: monospace; color: rgb(140, 140, 140); background-color: rgb(38, 38, 38); padding: 2px 4px; border-radius: 3px; word-break: break-word; font-size: 0.9em;">permissions</code> block at user level.</strong></p><p style="font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: pre-wrap; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-line: none; text-decoration-thickness: initial; text-decoration-style: initial; margin-top: 0.1em; margin-bottom: 0.2em; color: rgb(191, 191, 191); font-family: -apple-system, system-ui, "Segoe UI", Roboto, sans-serif; font-size: 13px; font-variant-ligatures: normal; background-color: rgb(18, 19, 20); text-decoration-color: initial;">Settings audited across all four locations (<code style="font-family: monospace; color: rgb(140, 140, 140); background-color: rgb(38, 38, 38); padding: 2px 4px; border-radius: 3px; word-break: break-word; font-size: 0.9em;">~/.claude/settings.json</code>, workspace-root <code style="font-family: monospace; color: rgb(140, 140, 140); background-color: rgb(38, 38, 38); padding: 2px 4px; border-radius: 3px; word-break: break-word; font-size: 0.9em;">.claude/settings.local.json</code>, two subproject <code style="font-family: monospace; color: rgb(140, 140, 140); background-color: rgb(38, 38, 38); padding: 2px 4px; border-radius: 3px; word-break: break-word; font-size: 0.9em;">.claude/settings.local.json</code>). Combined ~160 specific allow-list entries (git, grep, wc, curl, ssh, python, build tools, etc.). <strong>None contain <code style="font-family: monospace; color: rgb(140, 140, 140); background-color: rgb(38, 38, 38); padding: 2px 4px; border-radius: 3px; word-break: break-word; font-size: 0.9em;">Bash(rm…)</code>, <code style="font-family: monospace; color: rgb(140, 140, 140); background-color: rgb(38, 38, 38); padding: 2px 4px; border-radius: 3px; word-break: break-word; font-size: 0.9em;">Bash(*)</code>, or any wildcard Bash entry. No hooks configured.</strong></p><h2 style="font-style: normal; font-variant-caps: normal; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-line: none; text-decoration-thickness: initial; text-decoration-style: initial; color: rgb(191, 191, 191); font-family: -apple-system, system-ui, "Segoe UI", Roboto, sans-serif; font-variant-ligatures: normal; background-color: rgb(18, 19, 20); text-decoration-color: initial;">Smoking gun — JSONL transcript</h2><p style="font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: pre-wrap; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-line: none; text-decoration-thickness: initial; text-decoration-style: initial; margin-top: 0.1em; margin-bottom: 0.2em; color: rgb(191, 191, 191); font-family: -apple-system, system-ui, "Segoe UI", Roboto, sans-serif; font-size: 13px; font-variant-ligatures: normal; background-color: rgb(18, 19, 20); text-decoration-color: initial;">Original incident tool call (T+0):</p><div class="codeBlockWrapper_-a7MRw" style="font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-line: none; text-decoration-thickness: initial; text-decoration-style: initial; position: relative; margin: 8px 0px; color: rgb(191, 191, 191); font-family: -apple-system, system-ui, "Segoe UI", Roboto, sans-serif; font-size: 13px; font-variant-ligatures: normal; background-color: rgb(18, 19, 20); text-decoration-color: initial;"><button class="copyButton_CEmTFw copyButton_-a7MRw" title="Copy code" aria-label="Copy code to clipboard" style="color: rgb(191, 191, 191); font-family: -apple-system, system-ui, "Segoe UI", Roboto, sans-serif; font-size: 13px; background: 0% 0% repeat rgb(18, 19, 20); border: 0.833333px solid rgb(42, 43, 44); cursor: pointer; opacity: 0; display: flex; border-radius: 4px; justify-content: center; align-items: center; padding: 4px; transition: opacity 0.15s, background 0.15s; position: absolute; top: 4px; right: 4px;"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 20 20" fill="currentColor" aria-hidden="true" data-slot="icon" class="copyIcon_CEmTFw"><path fill-rule="evenodd" d="M15.988 3.012A2.25 2.25 0 0 1 18 5.25v6.5A2.25 2.25 0 0 1 15.75 14H13.5v-3.379a3 3 0 0 0-.879-2.121l-3.12-3.121a3 3 0 0 0-1.402-.791 2.252 2.252 0 0 1 1.913-1.576A2.25 2.25 0 0 1 12.25 1h1.5a2.25 2.25 0 0 1 2.238 2.012ZM11.5 3.25a.75.75 0 0 1 .75-.75h1.5a.75.75 0 0 1 .75.75v.25h-3v-.25Z" clip-rule="evenodd"></path><path d="M3.5 6A1.5 1.5 0 0 0 2 7.5v9A1.5 1.5 0 0 0 3.5 18h7a1.5 1.5 0 0 0 1.5-1.5v-5.879a1.5 1.5 0 0 0-.44-1.06L8.44 6.439A1.5 1.5 0 0 0 7.378 6H3.5Z"></path></svg></button><pre style="overflow-x: auto; white-space: pre; box-sizing: border-box; border-radius: 4px; max-width: 100%; margin: 0px; padding: 8px;"><code class="language-json" style="font-family: monospace; color: rgb(140, 140, 140); background-color: rgb(38, 38, 38); padding: 0px; border-radius: 3px; word-break: break-word; font-size: 0.9em;">{ "type": "assistant", "entrypoint": "claude-vscode", "version": "2.1.136", "message": { "model": "claude-opus-4-7", "content": [{ "type": "tool_use", "name": "Bash", "input": { "command": "rm -rf build/ dist/ debug/ && ls -la | grep -E \"build|dist|debug\" 2>&1 ; echo \"---cleaned---\"", "description": "Clean build/dist/debug directories" } }] } } </code></pre></div><p style="font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: pre-wrap; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-line: none; text-decoration-thickness: initial; text-decoration-style: initial; margin-top: 0.1em; margin-bottom: 0.2em; color: rgb(191, 191, 191); font-family: -apple-system, system-ui, "Segoe UI", Roboto, sans-serif; font-size: 13px; font-variant-ligatures: normal; background-color: rgb(18, 19, 20); text-decoration-color: initial;">Tool result (T+92ms):</p><div class="codeBlockWrapper_-a7MRw" style="font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-line: none; text-decoration-thickness: initial; text-decoration-style: initial; position: relative; margin: 8px 0px; color: rgb(191, 191, 191); font-family: -apple-system, system-ui, "Segoe UI", Roboto, sans-serif; font-size: 13px; font-variant-ligatures: normal; background-color: rgb(18, 19, 20); text-decoration-color: initial;"><button class="copyButton_CEmTFw copyButton_-a7MRw" title="Copy code" aria-label="Copy code to clipboard" style="color: rgb(191, 191, 191); font-family: -apple-system, system-ui, "Segoe UI", Roboto, sans-serif; font-size: 13px; background: 0% 0% repeat rgb(18, 19, 20); border: 0.833333px solid rgb(42, 43, 44); cursor: pointer; opacity: 0; display: flex; border-radius: 4px; justify-content: center; align-items: center; padding: 4px; transition: opacity 0.15s, background 0.15s; position: absolute; top: 4px; right: 4px;"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 20 20" fill="currentColor" aria-hidden="true" data-slot="icon" class="copyIcon_CEmTFw"><path fill-rule="evenodd" d="M15.988 3.012A2.25 2.25 0 0 1 18 5.25v6.5A2.25 2.25 0 0 1 15.75 14H13.5v-3.379a3 3 0 0 0-.879-2.121l-3.12-3.121a3 3 0 0 0-1.402-.791 2.252 2.252 0 0 1 1.913-1.576A2.25 2.25 0 0 1 12.25 1h1.5a2.25 2.25 0 0 1 2.238 2.012ZM11.5 3.25a.75.75 0 0 1 .75-.75h1.5a.75.75 0 0 1 .75.75v.25h-3v-.25Z" clip-rule="evenodd"></path><path d="M3.5 6A1.5 1.5 0 0 0 2 7.5v9A1.5 1.5 0 0 0 3.5 18h7a1.5 1.5 0 0 0 1.5-1.5v-5.879a1.5 1.5 0 0 0-.44-1.06L8.44 6.439A1.5 1.5 0 0 0 7.378 6H3.5Z"></path></svg></button><pre style="overflow-x: auto; white-space: pre; box-sizing: border-box; border-radius: 4px; max-width: 100%; margin: 0px; padding: 8px;"><code class="language-json" style="font-family: monospace; color: rgb(140, 140, 140); background-color: rgb(38, 38, 38); padding: 0px; border-radius: 3px; word-break: break-word; font-size: 0.9em;">{ "type": "user", "toolUseResult": { "...": "..." }, "message": { "content": [{ "type": "tool_result", "is_error": false, "content": "<directory listing>" }] } } </code></pre></div><p style="font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: pre-wrap; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-line: none; text-decoration-thickness: initial; text-decoration-style: initial; margin-top: 0.1em; margin-bottom: 0.2em; color: rgb(191, 191, 191); font-family: -apple-system, system-ui, "Segoe UI", Roboto, sans-serif; font-size: 13px; font-variant-ligatures: normal; background-color: rgb(18, 19, 20); text-decoration-color: initial;"><strong>~92 milliseconds between tool-call emission and tool result</strong> — no opportunity for a human-in-the-loop prompt to appear and be clicked. <code style="font-family: monospace; color: rgb(140, 140, 140); background-color: rgb(38, 38, 38); padding: 2px 4px; border-radius: 3px; word-break: break-word; font-size: 0.9em;">is_error: false</code> confirms execution succeeded.</p><p style="font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: pre-wrap; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-line: none; text-decoration-thickness: initial; text-decoration-style: initial; margin-top: 0.1em; margin-bottom: 0.2em; color: rgb(191, 191, 191); font-family: -apple-system, system-ui, "Segoe UI", Roboto, sans-serif; font-size: 13px; font-variant-ligatures: normal; background-color: rgb(18, 19, 20); text-decoration-color: initial;">Neither JSONL record contains any field matching <code style="font-family: monospace; color: rgb(140, 140, 140); background-color: rgb(38, 38, 38); padding: 2px 4px; border-radius: 3px; word-break: break-word; font-size: 0.9em;">perm</code>, <code style="font-family: monospace; color: rgb(140, 140, 140); background-color: rgb(38, 38, 38); padding: 2px 4px; border-radius: 3px; word-break: break-word; font-size: 0.9em;">allow</code>, <code style="font-family: monospace; color: rgb(140, 140, 140); background-color: rgb(38, 38, 38); padding: 2px 4px; border-radius: 3px; word-break: break-word; font-size: 0.9em;">approv</code>, or <code style="font-family: monospace; color: rgb(140, 140, 140); background-color: rgb(38, 38, 38); padding: 2px 4px; border-radius: 3px; word-break: break-word; font-size: 0.9em;">grant</code>. If a permission decision was made, it was not recorded.</p><h2 style="font-style: normal; font-variant-caps: normal; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-line: none; text-decoration-thickness: initial; text-decoration-style: initial; color: rgb(191, 191, 191); font-family: -apple-system, system-ui, "Segoe UI", Roboto, sans-serif; font-variant-ligatures: normal; background-color: rgb(18, 19, 20); text-decoration-color: initial;">Re-reproduced on 2.1.139 with controlled tests</h2><p style="font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: pre-wrap; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-line: none; text-decoration-thickness: initial; text-decoration-style: initial; margin-top: 0.1em; margin-bottom: 0.2em; color: rgb(191, 191, 191); font-family: -apple-system, system-ui, "Segoe UI", Roboto, sans-serif; font-size: 13px; font-variant-ligatures: normal; background-color: rgb(18, 19, 20); text-decoration-color: initial;">After updating the extension to 2.1.139 (latest installed), three controlled tests in default mode in the same workspace:</p> # | Bash command shape | Prompt shown? | Outcome -- | -- | -- | -- 1 | rm <path>; echo $?; ls <dir> | YES | Blocked 2 | rm <path> && grep -c "lit" /etc/hosts 2>&1; echo …; ls <dir> | YES | Blocked 3 | rm -rf <p1> <p2> && ls -la <dir> \| grep -E "<re>" 2>&1 ; echo "<str>" | NO | Silent deletion <p style="font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: pre-wrap; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-line: none; text-decoration-thickness: initial; text-decoration-style: initial; margin-top: 0.1em; margin-bottom: 0.2em; color: rgb(191, 191, 191); font-family: -apple-system, system-ui, "Segoe UI", Roboto, sans-serif; font-size: 13px; font-variant-ligatures: normal; background-color: rgb(18, 19, 20); text-decoration-color: initial;">Test 3 matches the original incident's shape. The bug exists in <strong>both 2.1.136 and 2.1.139</strong> (the latest version installed on this machine).</p><p style="font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: pre-wrap; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-line: none; text-decoration-thickness: initial; text-decoration-style: initial; margin-top: 0.1em; margin-bottom: 0.2em; color: rgb(191, 191, 191); font-family: -apple-system, system-ui, "Segoe UI", Roboto, sans-serif; font-size: 13px; font-variant-ligatures: normal; background-color: rgb(18, 19, 20); text-decoration-color: initial;">The minimal differences between gated Test 2 and bypassed Test 3 are: multi-target <code style="font-family: monospace; color: rgb(140, 140, 140); background-color: rgb(38, 38, 38); padding: 2px 4px; border-radius: 3px; word-break: break-word; font-size: 0.9em;">rm -rf</code>, a pipe <code style="font-family: monospace; color: rgb(140, 140, 140); background-color: rgb(38, 38, 38); padding: 2px 4px; border-radius: 3px; word-break: break-word; font-size: 0.9em;">|</code>, <code style="font-family: monospace; color: rgb(140, 140, 140); background-color: rgb(38, 38, 38); padding: 2px 4px; border-radius: 3px; word-break: break-word; font-size: 0.9em;">grep -E "<regex>"</code> (versus a literal grep argument), and a trailing <code style="font-family: monospace; color: rgb(140, 140, 140); background-color: rgb(38, 38, 38); padding: 2px 4px; border-radius: 3px; word-break: break-word; font-size: 0.9em;">echo "<string>"</code> with a leading space before <code style="font-family: monospace; color: rgb(140, 140, 140); background-color: rgb(38, 38, 38); padding: 2px 4px; border-radius: 3px; word-break: break-word; font-size: 0.9em;">;</code>. Further isolation testing would require additional authorized destructive runs.</p><h2 style="font-style: normal; font-variant-caps: normal; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-line: none; text-decoration-thickness: initial; text-decoration-style: initial; color: rgb(191, 191, 191); font-family: -apple-system, system-ui, "Segoe UI", Roboto, sans-serif; font-variant-ligatures: normal; background-color: rgb(18, 19, 20); text-decoration-color: initial;">Primary hypothesis (compound-command bypass)</h2><p style="font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: pre-wrap; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-line: none; text-decoration-thickness: initial; text-decoration-style: initial; margin-top: 0.1em; margin-bottom: 0.2em; color: rgb(191, 191, 191); font-family: -apple-system, system-ui, "Segoe UI", Roboto, sans-serif; font-size: 13px; font-variant-ligatures: normal; background-color: rgb(18, 19, 20); text-decoration-color: initial;">The Bash permission matcher appears to be approving compound shell expressions when any non-destructive sub-command (e.g. <code style="font-family: monospace; color: rgb(140, 140, 140); background-color: rgb(38, 38, 38); padding: 2px 4px; border-radius: 3px; word-break: break-word; font-size: 0.9em;">grep</code>, <code style="font-family: monospace; color: rgb(140, 140, 140); background-color: rgb(38, 38, 38); padding: 2px 4px; border-radius: 3px; word-break: break-word; font-size: 0.9em;">ls</code>, <code style="font-family: monospace; color: rgb(140, 140, 140); background-color: rgb(38, 38, 38); padding: 2px 4px; border-radius: 3px; word-break: break-word; font-size: 0.9em;">echo</code>) matches an allow-list entry, without separately gating the <code style="font-family: monospace; color: rgb(140, 140, 140); background-color: rgb(38, 38, 38); padding: 2px 4px; border-radius: 3px; word-break: break-word; font-size: 0.9em;">rm -rf</code> segment. The workspace allow-list contains <code style="font-family: monospace; color: rgb(140, 140, 140); background-color: rgb(38, 38, 38); padding: 2px 4px; border-radius: 3px; word-break: break-word; font-size: 0.9em;">Bash(grep:*)</code>, multiple specific <code style="font-family: monospace; color: rgb(140, 140, 140); background-color: rgb(38, 38, 38); padding: 2px 4px; border-radius: 3px; word-break: break-word; font-size: 0.9em;">Bash(grep -E "...")</code> entries, and others — any of which could be causing the whole compound expression to be approved.</p><h2 style="font-style: normal; font-variant-caps: normal; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-line: none; text-decoration-thickness: initial; text-decoration-style: initial; color: rgb(191, 191, 191); font-family: -apple-system, system-ui, "Segoe UI", Roboto, sans-serif; font-variant-ligatures: normal; background-color: rgb(18, 19, 20); text-decoration-color: initial;">Other hypotheses</h2><ol style="font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-line: none; text-decoration-thickness: initial; text-decoration-style: initial; padding-inline-start: 2em; color: rgb(191, 191, 191); font-family: -apple-system, system-ui, "Segoe UI", Roboto, sans-serif; font-size: 13px; font-variant-ligatures: normal; background-color: rgb(18, 19, 20); text-decoration-color: initial;"><li><code style="font-family: monospace; color: rgb(140, 140, 140); background-color: rgb(38, 38, 38); padding: 2px 4px; border-radius: 3px; word-break: break-word; font-size: 0.9em;">skipDangerousModePermissionPrompt: true</code><span> </span>may have broader effect in the VSCode extension code path than its documented "entry confirmation for bypass mode" scope.</li><li>A per-session "always allow" cached from an earlier approval leaking to broader Bash matching.</li><li>The matcher inspecting only the<span> </span><em>last</em><span> </span>segment after<span> </span><code style="font-family: monospace; color: rgb(140, 140, 140); background-color: rgb(38, 38, 38); padding: 2px 4px; border-radius: 3px; word-break: break-word; font-size: 0.9em;">;</code><span> </span>— a trailing<span> </span><code style="font-family: monospace; color: rgb(140, 140, 140); background-color: rgb(38, 38, 38); padding: 2px 4px; border-radius: 3px; word-break: break-word; font-size: 0.9em;">echo "<literal>"</code><span> </span>would always look benign.</li><li>The VSCode extension permission-mode indicator desyncing from actual gate state.</li><li>Plugin-registered hook auto-approving (low likelihood given enabled plugin set).</li></ol><h2 style="font-style: normal; font-variant-caps: normal; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-line: none; text-decoration-thickness: initial; text-decoration-style: initial; color: rgb(191, 191, 191); font-family: -apple-system, system-ui, "Segoe UI", Roboto, sans-serif; font-variant-ligatures: normal; background-color: rgb(18, 19, 20); text-decoration-color: initial;">Impact</h2><p style="font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: pre-wrap; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-line: none; text-decoration-thickness: initial; text-decoration-style: initial; margin-top: 0.1em; margin-bottom: 0.2em; color: rgb(191, 191, 191); font-family: -apple-system, system-ui, "Segoe UI", Roboto, sans-serif; font-size: 13px; font-variant-ligatures: normal; background-color: rgb(18, 19, 20); text-decoration-color: initial;">Severe trust-and-safety regression. In default permission mode a user reasonably trusts that destructive shell commands cannot run without explicit approval. In this incident only regenerable build artifacts were lost, but the same code path could delete source files, dotfiles, uncommitted work, or arbitrary paths. The compound-command pattern is especially concerning because it gives the model a reliable mechanism to escalate any allow-listed command into arbitrary Bash by prefixing <code style="font-family: monospace; color: rgb(140, 140, 140); background-color: rgb(38, 38, 38); padding: 2px 4px; border-radius: 3px; word-break: break-word; font-size: 0.9em;">rm -rf … &&</code> and appending allow-listed segments.</p>

What Should Happen?

In default permission mode, with no `Bash(rm…)` and no wildcard Bash entry in any settings file, the Bash tool gate should:

1. Refuse to execute any command containing a destructive sub-command (`rm`, `rmdir`, `mv` to nonexistent path, redirect-overwrite, `dd`, `truncate`, etc.) without an explicit per-invocation permission prompt — regardless of what other sub-commands appear in the same compound expression.
2. Either evaluate the **most-privileged** segment of any compound shell expression (`&&`, `||`, `;`, `|`, command substitution, process substitution, xargs-style chains) for permission decisions, **or** refuse to evaluate compound commands at all and require the model to issue each sub-command as a separate Bash call (each independently gated).
3. Record every permission decision (granted/denied, matching rule, and which segment of any compound it applied to) in the JSONL transcript so users can audit what happened.
4. Surface a persistent, unambiguous permission-mode indicator in the VSCode extension UI that cannot diverge from the actual gate state.


### Error Messages/Logs

```shell
No error was raised. The bug is the *absence* of a permission prompt or denial — the command executed silently with `is_error: false` in the JSONL transcript. The JSONL records contain no `permissionGranted`, `permissionMode`, `permissionDecision`, `permissionRule`, `approvalDecision`, or `permissionPrompt` field. Full top-level keys present in the assistant tool_use record:

  cwd, entrypoint, gitBranch, isSidechain, message, parentUuid, requestId,
  sessionId, timestamp, type, userType, uuid, version

…and in the corresponding user tool_result record:

  cwd, entrypoint, gitBranch, isSidechain, message, parentUuid, promptId,
  sessionId, sourceToolAssistantUUID, timestamp, toolUseResult, type,
  userType, uuid, version

NO PERMISSION ATTEMPT WAS THERE.

Steps to Reproduce

Launch Claude Code via the VSCode extension (not CLI) in default permission mode.
Open any workspace with a build/ and dist/ directory.
Ensure ~/.claude/settings.json contains "skipDangerousModePermissionPrompt": true and no permissions block.
Ensure workspace .claude/settings.local.json contains Bash(grep:*) but no Bash(rm…) and no wildcard.
Ask the model to do a "fresh build" of the project.
Observe whether a compound Bash invocation of shape rm -rf … && grep … ; echo … runs without a prompt. If hypothesis #1 is correct, the bug should reproduce with any chain of rm -rf X && <any-allow-listed-cmd> in any workspace.

Claude Model

Opus

Is this a regression?

I don't know

Last Working Version

No response

Claude Code Version

2.1.139

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

VS Code integrated terminal

Additional Information

Session transcript (JSONL) is available locally and can be attached on request, redacted to the relevant tool_use / tool_result pairs.
Multiple extension versions are present on this machine (2.1.131, 2.1.136, 2.1.139). The active version at the time of each incident is recorded in the version field of every JSONL record and was confirmed by reading those fields directly.
The model itself flagged the action as destructive in its prose response immediately preceding the tool call ("clean both build/ and dist/") and explicitly proposed the safer make CONF=marine_3 clean as an alternative — but still emitted the compound rm -rf tool call in the same turn without showing it to the user. This suggests the model is aware of the destructiveness but does not consistently route such operations through the permission UI, and that the harness is the last line of defense — which is the one that failed.
Suggested labels: bug, permissions, safety, vscode-extension, Bash-tool.

Vote matrix · Quick signals

Works

Did the solution work? Tap to confirm.

Easy Fix

Was it a quick fix?

Time Saver

Did it save you time?

Blocking

Was it severely blocking?

Common Issue

Are others likely hitting this too?

Flaky / Intermittent

Is it intermittent?

Verified / Reproducible

Can you reproduce it reliably?

#api #GPU setup #container setup #orchestration issue #cache issue

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Data

Security

Network

Code

UI/UX

Text

System

Multimedia

Protocol

API

Engineering

claude-code - 💡(How to fix) Fix [BUG] CRITICAL: Bash permission gate bypassed for compound `rm -rf … && … | … ; echo …` commands in default mode (no allow-list match, no prompt shown, reproduced on 2.1.139)

Recommended Tools

GitHub issue graph ai analysis

Error Message

Error Messages/Logs

Root Cause

Code Example

Preflight Checklist

What's Wrong?

What Should Happen?

Steps to Reproduce

Claude Model

Is this a regression?

Last Working Version

Claude Code Version

Platform

Operating System

Terminal/Shell

Additional Information

Still need to ship something?

TRENDING

claude-code - 💡(How to fix) Fix [BUG] CRITICAL: Bash permission gate bypassed for compound `rm -rf … && … | … ; echo …` commands in default mode (no allow-list match, no prompt shown, reproduced on 2.1.139)

Recommended Tools

GitHub issue graph ai analysis

Error Message

Error Messages/Logs

Root Cause

Code Example

Preflight Checklist

What's Wrong?

What Should Happen?

Steps to Reproduce

Claude Model

Is this a regression?

Last Working Version

Claude Code Version

Platform

Operating System

Terminal/Shell

Additional Information

Still need to ship something?

RELATED_DISCOVERY

TRENDING