Fundamentals and the agent loop8 minFoundation

Running shell commands

The Bash tool runs real commands on your machine, Claude reads the output actually produced to continue its reasoning, and a permission prompt appears before every new command.

The Bash tool runs a real shell command on your machine, not a simulation. Claude Code then reads the standard output and error output of that command to continue its reasoning from what was actually produced, not from what was expected.

A prompt before every new command

Before a new shell command runs, a permission prompt appears on screen. The official documentation describes this behaviour for shell commands as a confirmation requested every time, except for a built in set of read only commands that run directly. Answering with the option that remembers the choice makes that exact command permanently approved, but only for the current repository and for that exact command: it is not a general authorisation that would extend to any future shell command.

The unquoted glob pattern that reactivates the prompt

An already approved command can still retrigger the prompt. When an unquoted glob pattern appears in the arguments of a command with flags capable of writing or executing, for example find, sort, sed or git, the prompt reappears even if the base command is already on the trusted list. The reason is concrete: this pattern could expand, at execution time, into a destructive flag that nobody had approved. This safeguard is not a flaw, it is a protection layered on top of the trusted list itself.

Here is a self contained example, which builds its own file before reading it, rather than inspecting a real project file:

mkdir -p /tmp/demo-bash
echo "erreur : connexion refusée" > /tmp/demo-bash/journal.txt
grep "erreur" /tmp/demo-bash/journal.txt

The last line returns the content found, erreur : connexion refusée. This is exactly what Claude receives back from a call to the Bash tool, the raw output of the command, nothing reconstructed and nothing assumed.

This reading of the actual output before continuing is what drives the agent loop: think, call a tool, observe what it actually returns, start again. The same case by case approval principle appears in reading a file modification diff, where only the type of action changes.

Figure 1

From the proposed command to the resumed reasoning

Claude proposes a command

The Bash tool receives the shell command chosen to answer the current request.

A permission prompt appears

Except for a built in set of read only commands, which run directly without stopping.

You approve or refuse

The option that remembers the choice makes the command permanently approved for that repository and that command.

The command runs

The shell genuinely runs on the machine, with real effects on files and processes.

Claude reads stdout and stderr

The standard output and the error output are read as they are, with nothing reconstructed.

The reasoning continues

The rest of the agent loop relies on what the command actually produced.

The sequence shows the six steps of a call to the Bash tool, from the command Claude proposes through to resuming reasoning on the output actually obtained.

Figure 2

The prompt reappears even on an already approved command

Two commands sent to the Bash tool on a repository where npm test is already approved	Prompt shown the first time	Prompt shown on later runs
npm test, a simple command already approved	Yes	No, it runs directly
find with an unquoted glob pattern in its arguments	Yes	Yes, the prompt reappears every time

The table compares two commands sent to the Bash tool on a repository where a simple command is already approved, depending on whether an unquoted glob pattern appears in the arguments of a command capable of writing.

Calibrate it yourself

A developer asks Claude Code to count the lines in a configuration file. Claude proposes the command wc -l config.yaml. A permission prompt appears on screen, with the option that remembers the approval for that repository and that command.

Write in one sentence what this situation establishes, and in one sentence what it does not establish.

Your answer, before you see the key

What to remember

The Bash tool runs a real shell command on the machine, and Claude reads its standard output and error output to continue its reasoning.
A permission prompt appears before every new command, except for a built in set of read only commands that run directly.
Approving a command with the option that remembers the choice makes it permanent, but only for that repository and that exact command.
An unquoted glob pattern present in the arguments of a command with flags capable of writing, such as find, sort, sed or git, always retriggers a prompt even on a command already on the trusted list.

Do this now

In your own terminal, ask Claude Code to run a harmless command like date or pwd, read the permission prompt that appears before approving, then observe the output Claude reads back before continuing.

Check the source

Every datable claim in this lesson links here to the public text behind it. A source that does not open proves nothing.

Claude Code, permissions, unquoted glob patterns on commands with flags capable of writing consultée le 2026-09-02