claude-code - 💡(How to fix) Fix [Bug] Permission matcher ignores piped commands, breaking Bash(cmd:*) allowlist rules [1 comments, 2 participants]

[{"error":"Error: Plugin MCP server error - mcp-config-invalid: MCP server github invalid: Missing environment variables: GITHUB_PERSONAL_ACCESS_TOKEN\n at TWH (/$bunfs/root/src/entrypoints/cli.js:2736:30496)\n at processTicksAndRejections (native:7:39)","timestamp":"2026-04-24T03:33:53.938Z"},{"error":"Error: Tool mcp__PAL__listmodels not found\n at Uj7 (/$bunfs/root/src/entrypoints/cli.js:3077:31268)\n at kz (/$bunfs/root/src/entrypoints/cli.js:484:21134)\n at P1 (/$bunfs/root/src/entrypoints/cli.js:484:39900)\n at M9H (/$bunfs/root/src/entrypoints/cli.js:484:50713)\n at rZH (/$bunfs/root/src/entrypoints/cli.js:484:87780)\n at RD6 (/$bunfs/root/src/entrypoints/cli.js:484:86738)\n at iZH (/$bunfs/root/src/entrypoints/cli.js:484:86558)\n at jM_ (/$bunfs/root/src/entrypoints/cli.js:484:82889)\n at aH (/$bunfs/root/src/entrypoints/cli.js:484:6552)\n at LH (/$bunfs/root/src/entrypoints/cli.js:484:5006)\n at async <anonymous> (/$bunfs/root/src/entrypoints/cli.js:18721:2361)","timestamp":"2026-04-24T03:33:55.083Z"},{"error":"Error: Tool mcp__debate__listmodels not found\n at Uj7 (/$bunfs/root/src/entrypoints/cli.js:3077:31268)\n at kz (/$bunfs/root/src/entrypoints/cli.js:484:21134)\n at P1 (/$bunfs/root/src/entrypoints/cli.js:484:39900)\n at M9H (/$bunfs/root/src/entrypoints/cli.js:484:50713)\n at rZH (/$bunfs/root/src/entrypoints/cli.js:484:87780)\n at RD6 (/$bunfs/root/src/entrypoints/cli.js:484:86738)\n at iZH (/$bunfs/root/src/entrypoints/cli.js:484:86558)\n at jM_ (/$bunfs/root/src/entrypoints/cli.js:484:82889)\n at aH (/$bunfs/root/src/entrypoints/cli.js:484:6552)\n at LH (/$bunfs/root/src/entrypoints/cli.js:484:5006)\n at async <anonymous> (/$bunfs/root/src/entrypoints/cli.js:18721:2361)","timestamp":"2026-04-24T03:33:55.084Z"},{"error"…

TL;DR

The permission matcher in Bash commands does not handle piped commands, causing unnecessary permission prompts when a pre-allowlisted command is used in a pipeline.

Guidance

1. Extend Bash matching to pipelines: Modify the permission matcher to handle piped commands, allowing the whole pipeline to auto-approve if all commands are allowlisted or are common safe utilities.
2. Introduce a Bash modifier for pipeline-safe handling: Consider adding a Bash(*:allow-pipes) modifier to enable pipeline-safe handling per rule, giving users explicit control over pipeline handling.
3. Document matcher semantics: Clearly document the current behavior and any changes made to the permission matcher to avoid confusion and unexpected prompts.
4. Verify pipeline handling: Test the modified permission matcher with various pipeline scenarios to ensure it correctly handles allowlisted commands and common safe utilities.
5. Review error logs: Examine the provided error logs to identify any potential issues unrelated to the permission matcher that may be contributing to the problem.

Example

No code snippet is provided as the issue description does not include specific code that needs modification. However, an example of how the Bash(*:allow-pipes) modifier could be used in a settings.local.json file might look like:

{
  "allow": [
    "Bash(python3:*:allow-pipes)",
    "Bash(/abs/path/to/python3:*:allow-pipes)"
  ]
}

This would enable pipeline-safe handling for python3 commands.

Notes

The provided issue description lacks specific details about the implementation of the permission matcher, so the guidance is based on the described behavior and requested changes. The introduction of a new modifier or changes to the matcher's logic may require additional development and testing.

Recommendation

Apply a workaround by explicitly allowlisting common safe utilities like head, tail, grep, etc., until a permanent fix is implemented. This will