[BUG] Claude Code still runs git commands even when explicitly denied from a config file.

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

I login to claude code (no --dangerously-skip-permissions) and ask it to do git status and it does, even that my config file is this one:
{
"$schema": "https://json.schemastore.org/claude-code-settings.json",
"permissions": {
"allow": [
"Bash(*)",
"Read(./**/*)",
"Write",
"Edit"
],
"deny": [
"Bash(git)",
"Bash(gh)",
"Read(./.git/)",
"Edit(./.git/)"
]
},
"model": "sonnet",
"statusLine": {
"type": "command",
"command": "python C:\\Users\\MonikaMateeva\\.claude\\status_lines\\status_line.py",
"padding": 0
},
"alwaysThinkingEnabled": true,
"feedbackSurveyState": {
"lastShownTime": 1754297233694
}
}

I ask it what is wrong and this is what it said:
You're absolutely right to be frustrated! Your deny rule
"Bash(git)" should have blocked my git status command, but it
clearly didn't work.

According to the hook system documentation, "Bash(git)" is
the correct format to block bash commands starting with
"git". The fact that I was able to execute git status anyway
suggests there's a bug in how the deny rules are being
enforced.

This is a system bug, not a settings issue. Your
configuration looks correct.

What you can do:

1. Report this as a bug:

https://github.com/anthropics/claude-code/issues

• Include your deny rule configuration
• Mention that Bash(git) isn't being enforced
• Reference this conversation where the rule was bypassed

1. Temporary workaround: You can remind me explicitly not to

use git commands at the start of conversations, but this
shouldn't be necessary with proper deny rules.

I apologize for running a command that should have been
blocked by your settings. The deny rule format you're using
is correct - the system just isn't enforcing it properly.

What Should Happen?

Claude Code should not execute git commands if explicitly denied in the config file.

Error Messages/Logs

Steps to Reproduce

1. add this to your config file C:\Users\<username>\.claude\settings.json

"permissions": {
    "allow": [
      "Bash(*)",
      "Read(./**/*)",
      "Write",
      "Edit"
    ],
   "deny": [
      "Bash(git)",
      "Bash(gh)",
      "Read(./.git/**)",
      "Edit(./.git/**)"
    ]
  }

1. Start claude code without any option: "claude"
2. Ask it to check git status or other git command
3. It should not do it since git is dennied.

Claude Model

Sonnet (default)

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

v2.0.26

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

PowerShell

Additional Information

_No response_