Why not allow command piping and stderr redirection?

[wviana]

It very common to the model to try to pipe commands eg. seq 10 | grep 5. But as is now it returns to the model a message saying it isn't allowed, than the model have to do some separated calls on those tools.

I'm guessing it's related to some security in mind. But by the other side I know the models are really good on solving problems by unix commands pipelining/chaining, so limiting it may be limiting the model performance on tasks.

I was thinking about, if not allowing it to run chained commands, than we should work on something to parse the chained commands and than spawn the subprocess and connect their input output ourself. This would allow us to get some better approvals, for example, always allow grep even on loops and so on, something that claude interprets as brand new commands to get allowed.

But probably just allowing to chain commands would be the best quick win.

[esengine]

Thanks — agreed, I want to ship the parse-and-spawn route in the next release. Tracking in #232.

Quick summary of why the "just allow chaining" path doesn't work cleanly: the four shells we'd hand the string to disagree.

Operator	bash/zsh	PowerShell 5.1	PowerShell 7+	cmd.exe
|	bytes	objects, not bytes	objects	bytes
&& ||	yes	parse error	yes (v7.0+)	yes
;	yes	yes	yes	no
2>&1	merge	wraps stderr as ErrorRecord on native exes	same	merge

PowerShell 5.1 is still the default on Windows 10/11, so any path that relies on the shell to parse cmd1 && cmd2 breaks for those users. Parsing ourselves and spawning each segment sidesteps the whole zoo.

Plan in #232:

• Phase 1 — |, &&, ||, ; via shell-quote + per-segment spawn. Each segment hits the allowlist independently, which gives the granular-approval behavior you described (git status | grep main passes if both halves are individually allowed).
• Phase 2 — per-segment > file / 2>&1 implemented as stream piping, still no shell.
• Reject the rest with a clear error: <(), $(…), heredocs, glob expansion, background &. Most tools the model uses already glob themselves (grep -r, rg, find).