[BUG] Permission allowlist patterns don't match Bash commands starting with environment variables

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Bash commands that start with environment variable assignments (e.g., CFLAGS="..." cargo check) are never matched by allowlist patterns, even after selecting "Yes, and don't ask again".

What Should Happen?

Permission allowlist patterns should match Bash commands that start with environment variable assignments, the same way they match regular commands. Selecting "Yes, and don't ask again" should persist a pattern that prevents future prompts for similar commands.

Patterns like Bash(CFLAGS=:) or Bash(CFLAGS="-m64..." cargo check:) should match subsequent commands starting with CFLAGS=.

Error Messages/Logs

Steps to Reproduce

Steps to reproduce:

1. Run a command like: CFLAGS="-m64 -fstack-protector" cargo check --manifest-path=foo/Cargo.toml
2. Select option 2: "Yes, and don't ask again for similar commands"
3. Run the same command again
4. It prompts again

Patterns tried that don't work:

• Bash(CFLAGS=:*)
• Bash(CFLAGS=":*)
• Bash(CFLAGS="-m64 -fstack-protector -fPIC -Wno-attributes -I/opt/sgxsdk/include -I../../../rust-sgx-sdk/edl" cargo check:*)
• Even exact match patterns added by option 2 don't match on subsequent runs

Expected behavior: Patterns should match commands starting with env var assignments like they do for regular commands.

Workaround: Wrap the command in a shell script and use that instead.

Environment: macOS, Claude Code CLI

Claude Model

Opus

Is this a regression?

No, this never worked

Last Working Version

_No response_

Claude Code Version

2.0.76

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

_No response_