[BUG] cp can escape deny permissions

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Claude Code's permission system shows inconsistent behavior when a directory is restricted. Read operations via ls are correctly denied, but cp from the same directory is allowed. I have a deny rule that prevents reading from a directory. It at one point cp the files out of the directory to read them.

• ls -la secret/ → Permission denied
• cp secret/secretfile.cpp ./destination/ → Allowed and succeeds

What Should Happen?

If ls on a directory is denied (via Claude deny rules), operations like cp that read from that directory should also be denied.

Error Messages/Logs

Steps to Reproduce

1. Have a directory that Claude Code denies access to (e.g., secret/)
2. Ask Claude to list the directory contents
3. Observe that ls -la secret/ is denied
4. Ask Claude to copy a file from that directory
5. Observe that cp secret/secretfile.cpp ./destination/ succeeds

Claude Model

Opus

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.2

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

_No response_