cd+git prompts are the git-hooks security control, not an allowlist gap (reframe of the cd-wrapper idea)

Problem

The read-only allowlist (#183 / PR #198) matches bare commands like git status, git log, git diff. But in day-to-day worktree-heavy work the agent habitually wraps them:

cd "C:/Users/tzander/Documents/repos/GrandCentral" && git status

Claude Code splits compound commands and requires every segment to match an allow rule. The leading cd "…" segment is not allowlisted, so the whole compound prompts — even though the actual work (git status) is on the allowlist. The equivalent git -C <path> status form has the same problem: it starts with git -C, not git status, so it doesn't match the prefix either.

Net: we allowlisted the commands, but not the shapes the agent actually emits.

Evidence (transcript analysis, 27 active days)

Residual still-prompting Bash+MCP calls after the allowlist ≈ 271/active day (upper bound). Breakdown:

For comparison the allowlist currently eliminates ~59/day (bare commands). So the cd-wrapper alone is more than double what the allowlist recovers — the single biggest remaining lever, and it's the same safe commands prompting only because of the wrapper.

Options

1. Allow cd (Bash(cd:*)). Safe by construction: compound-splitting means cd path && <x> auto-approves only if <x> is independently allowlisted — cd path && rm -rf y still prompts. cd itself has zero mutation/exfiltration capability. Blocker to verify first: does Claude Code's matcher enforce a token boundary for a 2-char prefix? A raw-prefix match could catch cdrecord/cdparanoia/cdda2wav. Deferred pending that check.
2. Handle git -C <path> — if kept as a habit, the allowlist would need a rule form that matches it (harder; git -C interposes a flag before the subcommand).
3. Steer the agent (soft, standards/CLAUDE.md): prefer the tool's own cwd over cd … && prefixing. Guidance, not enforcement — lower reliability.

Why this matters

The allowlist's measured benefit (~59/day) understates its potential ceiling. Closing the cd-wrapper gap would roughly halve the residual prompt load (~135/day) without adding any mutation surface — the highest-leverage follow-up to #183.

Acceptance criteria

• Verify the matcher's token-boundary behavior for short prefixes (does Bash(cd:*) over-match cdrecord etc.?).
• If safe: add Bash(cd:*) to standards/settings.json and re-measure residual (expect ~135/day recovered).
• Decide on the git -C <path> shape (allowlist rule vs. steer away).
• If steering: add a standards/CLAUDE.md note to avoid cd … && prefixing when the tool's cwd suffices.

Related

• #183 / PR #198 — the allowlist this extends.
• #166 — worktree/context theme; the worktree fragmentation finding (per-directory settings.local.json) is why cd-prefixing is so common here.