[BUG] Allowed write commands (e.g. mkdir) still prompt for permission

Summary

Bash commands in the allow list work for read-only and network commands, but still prompt for filesystem write commands. This creates an inconsistent and counterintuitive security model.

Minimal Reproduction

Repo with repro: https://github.com/jameshfisher/claude-code-permissions-bug

1. Clone the repo
2. Run claude in the directory
3. Ask Claude to run ls -la → No prompt ✅
4. Ask Claude to run curl -s -I https://example.com → No prompt ✅
5. Ask Claude to run mkdir -p /tmp/test → Prompts for permission ❌

Settings

.claude/settings.json:

{
  "permissions": {
    "allow": [
      "Bash(mkdir:*)",
      "Bash(ls:*)",
      "Bash(curl:*)"
    ]
  }
}

Actual Behavior

| Command | Type | Allow Rule | Result |
|---------|------|------------|--------|
| ls -la | Filesystem read | Bash(ls:*) | ✅ No prompt |
| curl -s -I https://example.com | Network | Bash(curl:*) | ✅ No prompt |
| mkdir -p /tmp/test | Filesystem write | Bash(mkdir:*) | ❌ Prompts |

Things That Don't Help

• "sandbox": { "enabled": false } - still prompts
• Restarting Claude Code after settings change - still prompts
• The pattern appears correctly in /permissions UI - still prompts

Security Model Inconsistency

This is counterintuitive:

• curl can exfiltrate data, download malware, make arbitrary HTTP requests → allowed
• mkdir creates an empty directory → blocked

Not a Settings Override Issue

Verified no settings are overriding:

~/.claude/settings.json          → empty allow/deny lists
~/.claude/settings.local.json    → doesn't exist
~/.claude/managed-settings.json  → doesn't exist
.claude/settings.local.json      → doesn't exist

Related Issues

These are similar but not the same bug:

• #13340 - piped commands, not single commands
• #5140 - user-level settings not applied (project-level works for them)
• #15421 - closed as dupe of #13340

Environment

• macOS (Darwin 24.6.0)
• Claude Code 2.1.3
• Node.js v22