[BUG] Permission scope falls back to parent directory when project path contains spaces

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

When the project working directory contains spaces in the path (e.g., a Dropbox folder like /Users/me/My Dropbox/Some Folder/Development/my-project), the "always allow" permission prompt scopes to a parent directory without spaces (e.g., /Users/me) instead of the actual project directory.

This makes "always allow" effectively grant permission across the entire home folder, which is far too broad.

What Should Happen?

The permission scope should resolve to the actual project directory regardless of whether the path contains spaces. "Always allow" should scope to the project root, not a parent directory.

Error Messages/Logs

Steps to Reproduce

1. Have a project in a path containing spaces, e.g.: /Users/me/My Dropbox/Some Folder/Development/my-project
2. Launch Claude Code from that directory: cd "/Users/me/My Dropbox/Some Folder/Development/my-project" && claude
3. Perform an action that triggers a permission prompt (e.g., edit a file)
4. Observe the "always allow" option — it scopes to /Users/me rather than the project directory

Claude Model

Opus

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.38 (Claude Code)

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

iTerm2

Additional Information

The issue appears to be in how the permission system resolves the working directory for scope display. It may be truncating at the first space or failing to quote/escape the path when determining the scope boundary.

This is particularly common for users whose projects live in Dropbox folders, which typically contain spaces in the path.

Possibly related: #17176 (OAuth redirect_uri broken by spaces in path) — same root cause (spaces in paths) but different symptom.