{"version":"2.1.268","anchor":"bash-permission-check-gets-a-fallback-deny-check-based-on-cd","canonical_anchor":"bash-permission-check-gets-a-fallback-deny-check-based-on-cd","heading":"Bash permission check gets a fallback deny check based on cd\/read paths when full AST parsing fails","tier":"notice","area":"Bash Permissions","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.268\/e\/bash-permission-check-gets-a-fallback-deny-check-based-on-cd","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.268","markdown":"### Bash permission check gets a fallback deny check based on cd\/read paths when full AST parsing fails\n\nBash permission checks get a fallback path-based deny check when full command parsing fails\n\n**What**\n\nWhen Claude Code can't fully parse the structure of a bash command to check permissions, it now runs a secondary check that scans the raw command text for `cd` directory changes and file reads, comparing any resulting paths against configured Read\/Edit deny rules. This only runs when deny rules are actually configured. If this fallback check itself fails, the failure is logged as \"semantics-path deny check failed\" and Claude Code falls back to asking the user.\n\n**Why**\n\nThis closes a gap where a command that couldn't be fully parsed might have bypassed deny rules entirely; now it gets a best-effort check instead of skipping straight to asking or allowing.\n\n- Area: Bash Permissions\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 2\/5"}