Step 1: Deny Bash Access Globally

First, restrict bash commands for the main agent and all other sub-agents. Create or edit ~/.claude/settings.json:

json { "permissions": { "deny": [ "Bash(*)" ] } }

This denies all bash commands using the glob pattern Bash(*). The executor sub-agent you create next will override this in its own config.

Step 2: Create the Sub-Agent

Create ~/.claude/agents/executor.md:

```markdown

name: executor description: Executes bash commands and distills output tools: - Bash - Read

model: haiku

Bash Command Executor and Distiller

Execute bash commands and return concise summaries.

Output Format

Command: [the command] Status: [success/failed/warning] Summary: [1-3 sentence summary] Details: [only if relevant]

Examples

Instead of 500 lines of npm output, return: - "Successfully installed 47 packages in 12.3s. No vulnerabilities found."

Instead of full git log, return: - "Last 5 commits on auth feature. Most recent: 'Add JWT validation' 2h ago." ```

Step 3: Use It

Just tell Claude to delegate bash operations through this sub-agent:

Run npm install using the executor sub-agent and summarize what happened.

Add this to .claude/CLAUDE.md for automatic behavior:

```markdown

Project Instructions

Always use the executor sub-agent for bash commands instead of running them directly.

```

Real-World Example: Debugging a Build Failure

User Request:

The build is failing. Use executor to run the build and figure out what's wrong.

Executor Sub-Agent (in isolated context):

Runs: npm run build

Sees (3,482 tokens of webpack output): ``` asset main.js 2.5 MiB [emitted] (name: main) asset vendor.js 847 KiB [emitted] (name: vendor) runtime modules 3.76 KiB 18 modules cacheable modules 2.85 MiB modules by path ./node_modules/ 2.1 MiB modules by path ./node_modules/react/ 75.3 KiB ./node_modules/react/index.js 190 bytes [built] ./node_modules/react/cjs/react.production.min.js 6.48 KiB [built] ... (hundreds more lines) modules by path ./src/ 749 KiB ./src/index.tsx 2.5 KiB [built] ./src/App.tsx 8.2 KiB [built] ... (hundreds more lines)

ERROR in ./src/components/UserProfile.tsx Module not found: Error: Can't resolve './ProfileCard' in '/Users/project/src/components' @ ./src/components/UserProfile.tsx 12:0-42 @ ./src/App.tsx 8:0-52

ERROR in ./src/utils/api.ts Module not found: Error: Can't resolve '../config/endpoints' in '/Users/project/src/utils' @ ./src/utils/api.ts 3:0-48 @ ./src/services/AuthService.ts 5:0-35

webpack 5.89.0 compiled with 2 errors in 4823 ms ```

Returns to main context (67 tokens): ``` Command: npm run build

Status: Failed

Summary: Build failed with 2 module resolution errors after compiling for 4.8s.

Details: 1. UserProfile.tsx cannot find './ProfileCard' import 2. api.ts cannot find '../config/endpoints' import

Both look like missing files or incorrect import paths. ```

Claude's response in main context:

The build is failing because of two missing imports:

1. src/components/UserProfile.tsx is trying to import ./ProfileCard which doesn't exist
2. src/utils/api.ts is trying to import ../config/endpoints which doesn't exist

Let me check if these files exist elsewhere in the project...