# character in bash commands incorrectly stripped as comment, breaking permission matching for Nix flake references

Description

When running bash commands containing # (like Nix flake references nix eval .#foo), the # and everything after it is stripped before permission pattern matching occurs. This happens even though # only starts a shell comment when preceded by whitespace.

Reproduction

1. Add Bash(nix eval:*) to .claude/settings.json permissions
2. Run nix eval .#description → prompts for permission
3. Run nix eval --expr "1" → auto-approved (no #)
4. Run nix eval ".#description" → auto-approved (quoted)

Expected Behavior

nix eval .#foo should match Bash(nix eval:*) since .#foo is a single argument where # is not preceded by whitespace, so it's not a shell comment.

Workaround

Quote flake refs: nix eval ".#foo" instead of nix eval .#foo

Additional Issue

Cannot create permission patterns that include quotes like Bash(nix eval ".#:*) because the settings validator requires balanced quotes, making it impossible to match commands that start with a quoted argument.

Environment

• Claude Code CLI
• NixOS (where flake refs with # are extremely common)