Permission system incorrectly parses commas in skill command arguments as separate operations

[nigel-upstart]

Description

When invoking the ralph-loop skill with a prompt containing commas, the permission system incorrectly splits the command arguments on commas and treats each part as a separate "operation" requiring individual approval.

Reproduction Steps

1. Add ralph-loop plugin permissions:

"Bash(/Users/username/.claude/plugins/cache/claude-plugins-official/ralph-loop/*/scripts/setup-ralph-loop.sh*)"
"Bash(~/.claude/plugins/cache/claude-plugins-official/ralph-loop/*/scripts/setup-ralph-loop.sh*)"

2. Run a command with commas in the prompt

Expected Behavior

The entire command should be treated as a single bash invocation with the script path and all arguments passed through as-is.

Actual Behavior

Error message shows the permission system is splitting on commas and treating each segment as a separate operation requiring individual approval.

Impact

This prevents using the ralph-loop skill entirely.

Environment

• Claude Code CLI
• ralph-loop plugin from claude-plugins-official
• Skill command execution with permission system enabled

[nigel-upstart]

Permission Patterns Attempted

We've tried multiple permission patterns to work around this issue, none successful:

Attempted Patterns

1. Wildcard with :* suffix

"Bash(/Users/username/.claude/plugins/cache/claude-plugins-official/ralph-loop/*/scripts/setup-ralph-loop.sh:*)"
"Bash(~/.claude/plugins/cache/claude-plugins-official/ralph-loop/*/scripts/setup-ralph-loop.sh:*)"

Result: Still requires approval, says "multiple operations"

2. Wildcard without colon

"Bash(/Users/username/.claude/plugins/cache/claude-plugins-official/ralph-loop/*/scripts/setup-ralph-loop.sh*)"
"Bash(~/.claude/plugins/cache/claude-plugins-official/ralph-loop/*/scripts/setup-ralph-loop.sh*)"

Result: Still requires approval

3. All scripts in directory

"Bash(/Users/username/.claude/plugins/cache/claude-plugins-official/ralph-loop/*/scripts/*.sh:*)"
"Bash(~/.claude/plugins/cache/claude-plugins-official/ralph-loop/*/scripts/*.sh:*)"

Result: Still requires approval

4. Script path without argument pattern

"Bash(/Users/username/.claude/plugins/cache/claude-plugins-official/ralph-loop/*/scripts/setup-ralph-loop.sh)"
"Bash(~/.claude/plugins/cache/claude-plugins-official/ralph-loop/*/scripts/setup-ralph-loop.sh)"

Result: Currently testing

Root Cause Analysis

The permission system appears to be parsing the arguments passed to the script as if they are multiple bash operations, splitting on:

• Commas (,)
• Periods (.)
• Possibly other punctuation

Even when the prompt is rewritten without commas, the system still reports "multiple operations" and shows each sentence as a separate operation requiring approval.

Additional Observations

• The skill uses \${CLAUDE_PLUGIN_ROOT}/scripts/setup-ralph-loop.sh $ARGUMENTS format
• The skill command template uses ```! syntax for bash execution
• The allowed-tools in the skill definition specifies: "Bash(\${CLAUDE_PLUGIN_ROOT}/scripts/setup-ralph-loop.sh:*)"
• Variable expansion in permission patterns may not be working correctly

Impact

This makes the ralph-loop plugin essentially unusable when the prompt contains any natural language (which always has punctuation). Users are forced to manually approve each invocation, defeating the purpose of permission patterns.

[nigel-upstart]

Update: Pattern with Space Wildcard

Tried adding pattern with space before wildcard:

"Bash(/Users/username/.claude/plugins/cache/claude-plugins-official/ralph-loop/*/scripts/setup-ralph-loop.sh *)"
"Bash(~/.claude/plugins/cache/claude-plugins-official/ralph-loop/*/scripts/setup-ralph-loop.sh *)"

This matches the actual command format which has a space between the script path and arguments:

"/Users/username/.claude/plugins/cache/.../setup-ralph-loop.sh" "Handle PR 132..." --max-iterations 20 --completion-promise "DONE"

Testing now...

[nigel-upstart]

Root Cause Potentially

I believe the issue is with how skill allowed-tools declarations interact with the permission system.

The Skill Definition

The ralph-loop skill declares:

allowed-tools: ["Bash(\${CLAUDE_PLUGIN_ROOT}/scripts/setup-ralph-loop.sh:*)"]

The Problem

The ${CLAUDE_PLUGIN_ROOT} variable doesn't appear to be expanded or matched against user permission patterns. Even when we manually add the expanded path:

"Bash(/Users/username/.claude/plugins/cache/claude-plugins-official/ralph-loop/*/scripts/setup-ralph-loop.sh:*)"

The permission system still requires manual approval.

Expected Behavior

When a skill declares allowed-tools, those tools should either:

1. Be automatically allowed when the skill is invoked (respecting the skill's permission scope), OR
2. The skill's allowed-tools patterns should be used as templates that match user permission patterns with variable expansion

Current Behavior

Skills cannot be used. Manual approval doesn't even get prompted for. Even when permission patterns are added that should match the skill's tool usage, it doesn't work.

Suggested Fix

The permission system should:

1. Expand variables like ${CLAUDE_PLUGIN_ROOT} when matching against user permissions
2. OR automatically allow skill allowed-tools when the skill command is invoked (with appropriate security boundaries)
3. OR provide clear documentation on the correct permission pattern format for plugin skills

Without this, plugin skills that use bash commands are essentially broken for users who want to use permission patterns instead of manual approval.

[nigel-upstart]

Critical Finding: Skills Don't Trigger Approval Prompts

The user is not getting approval prompts at all - the command is immediately denied with an error message.

Expected Behavior

When a Bash command doesn't match any allow rules, Claude Code should:

1. Show an approval prompt
2. Let the user approve/deny interactively

Actual Behavior

When skill bash commands don't match allow rules:

1. No approval prompt is shown
2. Command is immediately denied with error: "This command requires approval"
3. User has no way to approve it

Workaround

Added an explicit ask list to force prompts:

"ask": [
  "Bash(/Users/username/.claude/plugins/cache/claude-plugins-official/ralph-loop/*/scripts/setup-ralph-loop.sh *)"
]

Root Cause

Skills may be bypassing the normal approval prompt flow and going straight to denial when bash commands don't match allow rules. This makes skills unusable unless permission patterns are perfectly configured upfront.

This is a critical UX bug - users should always be able to approve commands interactively, especially for newly installed plugins.