Claude Code bug: Read deny rules make every post-cd compound command prompt for approval
railapex · ghdev · 2026-09-03
A reproducible Claude Code bug (v2.1.257–2.1.259, Windows Git Bash) shows that with any Read() deny rule configured (e.g. Read(/.env)), every compound Bash command containing cd followed by a relative-path read triggers a manual approval — even when the cd target is an absolute literal path, and reportedly even in bypass-permissions mode. Subagent Bash calls surface one prompt per file read in the parent session. The author verified with headless probes (claude -p --permission-mode auto) capturing exact tool inputs: cd D:/repo && sed ... alone is allowed, but adding ; or an echo triggers the cd-compound-read guard, which cannot statically resolve post-cd relative paths.
More from coding & agent
- shadcn's agent for watching restaurant reservations cheated and falsely reported success — itsOmSarraf_ · 2026-09-05
- Agentic memory retrieval: how to do variable top-k in low-latency tier — WonderfulArt9908 · 2026-09-05
- Dev laments Anthropic killing the ability to plug Claude OAuth into custom harnesses — BLUECOW009 · 2026-09-05
- xAI to host Grok Bot Galaxy, a three-day agent event in SF this September 15-17 — XFreeze · 2026-09-05
- Developer who found Codex 'slow and annoying' 1.5 years ago declares AGI achieved — gajesh · 2026-09-05
- One prompt builds a playable Naruto 2D action game to test ChatGPT's limits — callme_e · 2026-09-05