Claude Code asks for approval on compound Bash commands (&&, |, ;) even when each part is allowed. How to auto-approve?
Claude Code prompts for approval when a Bash command chains commands with &&, ||, ;, or a pipe, even when each command is already in the allow list such as Bash(git:) and Bash(cd:). The user wants the compound command approved when every segment is allowed, without adding blanket Bash(*) permission.
Originally asked on GitHub: https://github.com/anthropics/claude-code/issues/16561
6 answers
Status: the feature request to match each part of a compound command against allow and deny rules was closed as COMPLETED, but commenters in the thread still report the prompts happening. Users have relied on community hooks as a workaround.
One workaround is the hook at github.com/oryband/claude-code-auto-approve. It splits a compound command into segments with shfmt, walks the AST with jq, and approves only when every segment is in the allow list and none are in the deny list. It falls through to the normal prompt on any parse error. Its author notes that bash, sh, and zsh should not be added to the allow list, because bash -c arguments are not checked on the fast path. A commenter reported that this hook worked for them.
On Windows, where shfmt and jq are not practical, a zero-dependency Node.js hook was shared. It splits on &&, ||, ;, and | while respecting quotes, and checks each segment against Bash(...) allow patterns. It does not check deny patterns, so a compound command could bypass a rule such as Bash(git push --force *). Do not use it if you rely on deny rules.
Security note: a hook that reads only allow patterns can bypass deny rules, so confirm your deny rules still apply before relying on any such hook.
Did this work for you?What a GitHub user tried on GitHub (Didn't work)
Set allow to Bash(git:), Bash(cd:), and Bash(poetry:*), then ran cd /path && git status. Claude Code evaluated the whole string as one unit and prompted for approval.
Source: https://github.com/anthropics/claude-code/issues/16561 (opens external site)
Did this work for you?What @oryband tried on GitHub (Outcome unclear)
Suggested the oryband/claude-code-auto-approve hook, which splits compound commands with shfmt, walks the AST with jq, and approves only when every segment is allowed and none are denied.
Source: https://github.com/anthropics/claude-code/issues/16561#issuecomment-3980848787 (opens external site)
Did this work for you?What @filiptrivan tried on GitHub (Partly worked)
Wrote a zero-dependency Node.js hook for Windows that splits on &&, ||, ;, and | while respecting quotes and checks each segment against Bash(...) allow patterns. It does not check deny patterns.
Source: https://github.com/anthropics/claude-code/issues/16561#issuecomment-3993416428 (opens external site)
Did this work for you?What @dave-foxglove tried on GitHub (Outcome unclear)
Noted that adding exact piped patterns such as Bash(tail *) alongside Bash(cargo test *) for cargo test 2>&1 | tail -10 is impractical because the combinations are effectively unbounded.
Source: https://github.com/anthropics/claude-code/issues/16561#issuecomment-4013835593 (opens external site)
Did this work for you?What @sspaeti tried on GitHub (Worked)
Installed the oryband hook workaround linked from the thread, which the commenter reported worked.
Source: https://github.com/anthropics/claude-code/issues/16561#issuecomment-4038491011 (opens external site)
Did this work for you?