Claim 2 — Claude Code dossier

CLAIM 2 / Claude Code

"Claude Code is aware of shell operators, so a rule like Bash(safe-cmd *) won't give it permission to run the command safe-cmd && other-cmd ... A rule must match each subcommand independently"

partial

Observed

Holds as the general design, source-reviewed. Confirmed counterexample at v2.1.51: a Bash(cd:*) prefix rule matched the full compound command cd /path && python3 script.py, allowing arbitrary follow-on commands to execute without prompting (#28784, open at last review).

UPDATE 2026-06-28: the compound-command bypass class is confirmed still active via #66176 (git -C, cd &&, and env-prefix forms).

Evidence

[1][2][3]

Verification

verified 2026-07-16 · by probe-ci · probe probes/claude-code/claim-2/