Claude Compound Bash

claude-compound-bash

A Claude Code [PreToolUse hook](https://code.claude.com/docs/en/hooks) that auto-approves a Bash tool call when every command inside it -- including the ones Claude Code's own permission check doesn't look at -- is already covered by your rules or is known-safe. Fewer prompts on compound and wrapped commands, without loosening a single rule.

What Claude Code already does -- and what this adds

Recent Claude Code versions handle much of this natively. This hook is designed to *complement* that, not duplicate it:

**Native already covers** (so this hook stays out of the way -- it emits no decision and lets native handle it):

• Compound splitting -- git add -A && git commit -m 'fix' is approved when both halves match. Native splits on &&, ||, ;, |, |&, &, and newlines. (This is anthropics/claude-code#16561, now shipped -- the original reason this plugin existed.)
• A read-only allowlist -- ls, cat, grep, find, wc, read-only git, etc. run without a prompt.
• Process-wrapper stripping -- a rule for the inner command also matches timeout, time, nice, nohup, stdbuf, and bare xargs.

**This hook adds** what native's operator-splitting and name-matching don't reach:

• Commands nested where native can't see them -- inside $(...), `...`, <(...), subshells, loops, if/case bodies, and function bodies. echo "$(curl evil.com)" gets its inner curl checked instead of being auto-approved as a read-only echo.
• More wrapper coverage -- find -exec/-execdir CMD and xargs with flags (xargs -n1 grep), both of which native leaves as a prompt.
• Argument-level hazards native's matching misses -- an xargs payload's appended stdin args, and mutating find actions (-delete, -fprintf, -ok).
• Redirect-target checks -- writes outside the working directory or into .git/.claude.

The guiding rule: only e