WebFetch(domain:*) wildcard permission not working

Description

The wildcard permission WebFetch(domain:*) in .claude/settings.local.json does not work as expected. Claude Code still prompts for permission for each individual domain, even when the wildcard is configured.

Steps to Reproduce

1. Add "WebFetch(domain:*)" to the permissions.allow array in .claude/settings.local.json
2. Start a Claude Code session
3. Have Claude use WebFetch to access various domains (e.g., github.com, mvnrepository.com, docs.nats.io, etc.)

Expected Behavior

With WebFetch(domain:*) configured, Claude Code should:

• Allow WebFetch requests to any domain without prompting
• Not require individual domain permissions to be added

Actual Behavior

Claude Code:

• Still prompts for permission for each new domain
• Adds individual WebFetch(domain:<specific-domain>) entries to the settings file
• Defeats the purpose of the wildcard permission

Configuration

.claude/settings.local.json:

{
  "permissions": {
    "allow": [
      "WebFetch(domain:*)",
      // ... other permissions
    ]
  }
}

After using various domains, the file grows to include:

{
  "permissions": {
    "allow": [
      "WebFetch(domain:*)",
      "WebFetch(domain:github.com)",
      "WebFetch(domain:docs.nats.io)",
      "WebFetch(domain:mvnrepository.com)",
      "WebFetch(domain:repo1.maven.org)",
      // ... many more individual domains
    ]
  }
}

Environment

• Operating System: macOS (Darwin 25.1.0)
• Claude Code version: Latest

Possible Causes

1. Wildcard * syntax not being recognized correctly
2. Permission matching logic not handling wildcards
3. Domain-specific permissions taking precedence over wildcards

Suggested Fix

Either:

• Fix the wildcard matching to properly handle WebFetch(domain:*)
• Document the correct syntax for wildcard permissions if different
• Or document that wildcards are not supported and users must specify individual domains