Compound commands of individually-allowed safe commands prompt with incorrect safety reason

[GraemeF]

Description

Compound bash commands using && to chain individually-allowed, read-only commands trigger a permission prompt with an incorrect safety reason.

Example

Command: git status && echo "---" && pwd

Permission rules configured in .claude/settings.local.json:

{
  "permissions": {
    "allow": [
      "Bash(git status:*)",
      ...278 other rules...
    ]
  }
}

Prompt shown:

Command contains quoted characters in flag names

Do you want to proceed?
❯ 1. Yes
  2. No

Two problems

1. Compound commands don't match individual allow rules

Each command in the chain (git status, echo "---", pwd) is either explicitly in the allow list or is a harmless read-only command. The compound command should be auto-approved since every component is individually allowed.

This appears to be a consequence of the v2.1.7 fix for "wildcard permission rules matching compound commands containing shell operators", which was a legitimate security fix but has the side effect of blocking entirely safe compound commands where every individual command is already permitted.

2. The stated safety reason is incorrect

The reason "Command contains quoted characters in flag names" does not accurately describe the command. The "---" in echo "---" is a string argument to echo, not a flag name containing quoted characters. The safety classifier appears to be misidentifying this as something like --flag="value".

Expected behaviour

• Compound commands where every individual command matches an existing allow rule should be auto-approved
• When a command does prompt, the stated reason should accurately describe why it was flagged

Environment

• Claude Code version: ~2.1.49+
• OS: macOS (Darwin 25.3.0)
• Permission mode: Custom allow list (278 rules in .claude/settings.local.json)

Related issues

• Bash permission wildcards don't match multiline/heredoc commands #25441 — Bash permission wildcards don't match multiline/heredoc commands
• Permission bypass when commands are chained with && #16180 — Permission bypass when commands are chained with && (the original security fix)
• Bash(command:*) allow rules do not prevent permission prompts for file-modifying commands #20449 — Allow rules not preventing permission prompts for file-modifying commands
• [BUG] settings.local.json allow not working - keeps asking and wanting to add existing items again #6850 — settings.local.json allow not working

[github-actions]

Found 3 possible duplicate issues:

1. Feature: Parse compound Bash commands and match each component against permissions #16561
2. [BUG] Permission system treats command chains as single patterns instead of validating individual commands #20085
3. Add option to disable 'Command contains quoted characters in flag names' warning #27957

This issue will be automatically closed as a duplicate in 3 days.

• If your issue is a duplicate, please close it and 👍 the existing issue instead
• To prevent auto-closure, add a comment or 👎 this comment

🤖 Generated with Claude Code

[GraemeF]

Closing as this is covered by the combination of #16561 (compound commands should be parsed and each component matched individually against allow rules) and #27957 (the 'quoted characters in flag names' warning fires on safe commands and ignores the allow list). Upvoted both.

[github-actions]

This issue has been automatically locked since it was closed and has not had any activity for 7 days. If you're experiencing a similar issue, please file a new issue and reference this one if it's relevant.