[BUG] Permissions: unexpected lack of glob expansion

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Glob wildcard patterns (*) in .claude/settings.json permission rules don't match Bash commands as expected. Commands that should be auto-allowed based on glob patterns are instead prompting for user approval.

What Should Happen?

Permission rules like "Bash(aws ec2 describe-*:*)" should match commands like aws ec2 describe-vpcs, aws ec2 describe-instances, etc.

Error Messages/Logs

Steps to Reproduce

1. Create .claude/settings.json with:

{
  "permissions": {
    "allow": [
      "Bash(aws ec2 describe-*:*)",
      "Bash(aws eks list-*:*)"
    ]
  }
}

1. Ask Claude Code to run aws ec2 describe-vpcs
2. User is prompted for permission

Claude Model

Opus

Is this a regression?

No, this never worked

Last Working Version

_No response_

Claude Code Version

2.1.25 (Claude Code)

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Other

Additional Information

_No response_