Claude Code bug: Read deny rules make every post-cd compound command prompt for approval
railapex · ghdev · 2026-09-03
A reproducible Claude Code bug (v2.1.257–2.1.259, Windows Git Bash) shows that with any Read() deny rule configured (e.g. Read(/.env)), every compound Bash command containing cd followed by a relative-path read triggers a manual approval — even when the cd target is an absolute literal path, and reportedly even in bypass-permissions mode. Subagent Bash calls surface one prompt per file read in the parent session. The author verified with headless probes (claude -p --permission-mode auto) capturing exact tool inputs: cd D:/repo && sed ... alone is allowed, but adding ; or an echo triggers the cd-compound-read guard, which cannot statically resolve post-cd relative paths.
More from coding & agent
- Open models below 4-bit struggle at self-iterating 3D asset generation, HF dev finds — mervenoyann · 2026-10-21
- Developer Moves AI Agents to a Dedicated Linux Workstation Using Incus System Containers — kevinkern · 2026-10-21
- Motion Launches a General Video Agent That Edits Footage and Mimics Any Reference Style — mhdfaran · 2026-10-21
- MCP Platform NitroStack Wins Product Hunt Product of the Day, Focuses on Retention — EstablishmentFun4373 · 2026-10-21
- CodeRabbit Ships 5,000 PRs a Week With a Tiny Team, Hires by Strategy-Game Hours — omojumiller · 2026-10-21
- LukeW maps the five UI problems every AI-native company faces with agents — LukeW · 2026-10-21