Problem

When Claude Code detects potentially risky command syntax, it prompts the user for approval rather than auto-denying. For example:

 Bash command

   echo "foo $(whoami)"
   Compound command with command substitution

 Command contains $() command substitution

The user is then asked whether to proceed.

CC would easily re-write this without command substitution, given the chance. Currently, though, CC does not have the chance until the user intervenes to approve.

As an option the command should be auto-denied, and Claude should reformulate (e.g., run the commands as separate Bash calls).

Current workaround

PreToolUse hooks with exit 2 can auto-block specific patterns. But this requires the user to reimplement detection that CC already has built in.

Proposed solution

A setting (in settings.json or .claude/settings.json) to change the behavior of CC's built-in safety warnings from "prompt" to "deny". Something like:

{
  "bashSafetyMode": "strict"
}

Or more granularly, per warning type:

{
  "bashSafety": {
    "commandSeparators": "deny",
    "ambiguousSyntax": "deny"
  }
}

When set to "deny", CC would:

1. Auto-reject the command (same as a PreToolUse hook returning exit 2)
2. Receive the denial reason as an error message
3. Reformulate the command to avoid the flagged pattern

The goal of this pattern is to avoid ask fatigue when a re-write by CC would pass easily.

Why this matters

• The prompt creates a false choice: the user either approves something CC flagged as risky, or manually denies it every time. Auto-deny removes the friction and the risk of accidental approval.
• CC already has the detection logic — this is purely about exposing the behavior as configurable.