Claude Code bug: Read deny rules make every post-cd compound command prompt for approval
railapex · ghdev · 2026-09-03
A reproducible Claude Code bug (v2.1.257–2.1.259, Windows Git Bash) shows that with any Read() deny rule configured (e.g. Read(/.env)), every compound Bash command containing cd followed by a relative-path read triggers a manual approval — even when the cd target is an absolute literal path, and reportedly even in bypass-permissions mode. Subagent Bash calls surface one prompt per file read in the parent session. The author verified with headless probes (claude -p --permission-mode auto) capturing exact tool inputs: cd D:/repo && sed ... alone is allowed, but adding ; or an echo triggers the cd-compound-read guard, which cannot statically resolve post-cd relative paths.
More from coding & agent
- Dev's self-built tracker claims 7.1x speedup with Claude, 2.5 work-years banked — arthurcolle · 2026-10-21
- Librarian Agents: RL-trained agents build file systems, lifting RAG accuracy 44%→77% — simonguozirui · 2026-10-21
- Slack's first employee: living specs as source of truth, AI agents maintain the docs — josh_wills · 2026-10-21
- SpaceX support uses Grok Bot to clear 204 tickets in ~10 minutes — XFreeze · 2026-10-21
- GitHub Copilot's HydraFusion Orchestrates Multiple Models Per Task — WirelessLife · 2026-10-21
- Nous Research's Hermes now launches Cua Spaces for computer-use agents — alexcovo_eth · 2026-10-21