Compound commands demoted to ask when read-only pipe target lacks explicit allow rule