[BUG] Approval patterns with environment variables don't match

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Description

Approval patterns containing environment variable assignments (like CUDA_VISIBLE_DEVICES="") don't match commands, even when the pattern appears correct in settings.json.

Actual Behavior

Manual approval is required every time, even though:

• The pattern is in ~/.claude/settings.json
• The command exactly matches the pattern prefix
• No pipes or other complications are involved

Possible Causes

1. The "" (empty string) in the env var assignment may not be parsed correctly
2. The = character may need escaping
3. Environment variable prefixes may not be supported in patterns at all

Questions for Maintainers

1. Are environment variable prefixes supported in approval patterns?
2. If so, what's the correct syntax?
3. If not, could this be added or documented?
4. Could you publish documentation on the pattern matching syntax? (e.g., what wildcards are supported, how special characters are handled, etc.)

What Should Happen?

The command should execute without prompting since it matches Bash(CUDA_VISIBLE_DEVICES="" python -m pytest:*).

Error Messages/Logs

Steps to Reproduce

Steps to Reproduce

1. ~/.claude/settings.json contains:

``json
{
"permissions": {
"allow": [
"Bash(CUDA_VISIBLE_DEVICES=\"\" python -m pytest:*)"
]
}
}
``

1. Run Claude Code and have it execute:

``bash
CUDA_VISIBLE_DEVICES="" python -m pytest tests/ -x --tb=short
``

1. Result: Claude prompts for approval despite the pattern being in the allow list. Telling it to add the command to the approval list will not prevent it from asking for approval the next time.

Claude Model

Opus

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.0.76

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

WSL (Windows Subsystem for Linux)

Additional Information

_No response_