Bash permission wildcards don't match multiline/heredoc commands

[rwcii]

Bug

Bash(git *) in settings.json permissions does not auto-approve multiline bash commands that start with git, such as compound commands with &&, backslash line continuations, or heredoc $(cat <<'EOF' ...) patterns.

Steps to Reproduce

1. Add "Bash(git *)" to ~/.claude/settings.json permissions allow list
2. Have Claude Code generate a command like:

git add file1.md file2.md && \
git commit -m "$(cat <<'EOF'
commit message here
EOF
)"

3. Claude Code prompts for permission despite the command starting with git

Expected Behavior

Bash(git *) should match any bash command whose text starts with git , regardless of whether the command contains newlines, heredocs, backslash continuations, or && chains.

Actual Behavior

The permission prompt appears every time. Clicking "Yes, and don't ask again" appends the entire verbatim multiline command (including full heredoc content) as a new allow rule in .claude/settings.local.json. These verbatim rules:

• Never match a second time (commit messages are unique)
• Pollute settings.local.json with hundreds of lines of junk
• Create a feedback loop where the file grows unboundedly

Impact

This effectively makes it impossible to auto-approve any non-trivial bash command through the permission system. Users are forced to either:

• Click "Yes" on every single compound command (dozens per session)
• Use --dangerously-skip-permissions to bypass the entire system

The permission system is generating commands that it cannot authorize, which defeats its purpose.

Environment

• Claude Code CLI (latest as of 2026-02-13)
• Linux (Ubuntu 22.04)
• Settings in both ~/.claude/settings.json and .claude/settings.local.json

Suggested Fix

The * wildcard in Bash() permission rules should match against the full command text including newlines, not just the first line. Alternatively, provide a way to allow all invocations of a tool (e.g., Bash with no parentheses to allow all bash commands).

[fluidsonic]

I just spent hours debugging the same issue.

The issue is even worse.
Claude Code is ignoring ask and even deny permissions when a command spans multiple lines.

Example:
"deny": ["Bash(*--no-gpg-sign*)"]

My test session:

❯ run 'echo --no-gpg-sign'

⏺ Bash(echo --no-gpg-sign)
  ⎿  Error: Permission to use Bash with command echo --no-gpg-sign has been denied.

❯ run 'echo --no-gpg-sign "hello<newline>world"'

⏺ Bash(echo --no-gpg-sign "hello
      world")
  ⎿  --no-gpg-sign hello
     world

@claude this should be considered a security issue.

And it seems to be new. It used to work just a few days ago.

EDIT: Claude 2.1.42 (native) on macOS 15.6.1

[mdagost]

Hitting the same issue. In my case I want to allow-list all commands from a given skill so tried allowing Bash(cd /home/.claude/skills/my_skill && *) but this doesn't work if there is a python command with line breaks called by the skill.

[xhiroga]

I'm also hitting this with Bash(psql *) — any SQL command with newlines fails to match. Duplicate of #11932.