Bash(git push *) in a Claude Code subagent's disallowedTools took away all of Bash in 10 of 10 launches, not just git push

On Claude Code 2.1.289, a subagent whose disallowedTools said Bash(git push *) started without the Bash tool in 10 of 10 launches, so git status and echo failed along with the push, just as the docs warn. The documented alternative, a Bash(git push *) deny rule in settings, kept Bash and stopped git push origin main 3 of 3 times, but when the subagent was only handed the repository path it typed git -C <path> push origin main instead, and all 3 of those pushes reached the remote. A custom subagent that may run shell commands but must never push is an easy thing to want, and the line that comes to mind first is disallowedTools: Bash(git push *). It reads like "everything except pushing", and it uses the same Tool(specifier) syntax as a permission rule. Claude Code's subagent page says plainly that it does not work that way. We wanted to see what the subagent actually receives when you write it, whether a harmless command still runs, what stops the push, and whether the fix the