[BUG] Bash allow rules fail to match when empty string argument precedes a dash-flag

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

When a Bash command contains an empty string argument ('' or "") followed by a dash-prefixed flag (-x or --flag), the permission check always prompts — even when the command matches an allow rule. The blanket "Bash" allow works, but pattern-based rules like Bash(cli/scan *) do not.

Pattern

The permission prompt triggers specifically when an empty string is followed by a dash-prefixed argument (-x or --x). Reversing the order (flag before empty string) or removing the dashes avoids the prompt.

Expected Behavior

Commands matching the allow pattern should not prompt regardless of empty string arguments.

Workaround

Using the blanket "Bash" (no pattern) in the allow list bypasses the issue.

Environment

• macOS (Darwin 24.6.0)
• Claude Code CLI

What Should Happen?

Should be no prompt

Error Messages/Logs

Steps to Reproduce

Reproduction

Allow rules in .claude/settings.json:

{
  "permissions": {
    "allow": [
      "Bash(cli/scan:*)",
      "Bash(cli/scan*)",
      "Bash(cli/scan *)"
    ]
  }
}

Prompts (unexpected)

cli/scan resend '' --headers    # empty string + --flag
cli/scan resend '' --body       # empty string + --flag
cli/scan resend '' --randomarg  # empty string + --flag
cli/scan resend '' -h           # empty string + -flag
cli/scan resend 2 '' --headers  # empty string + --flag (different position)
cli/scan resend 2 'a' '' --headers  # same, deeper in args

No prompt (works correctly)

cli/scan ''                     # empty string, no flag after it
cli/scan '' resend              # empty string, no dash-flag after it
cli/scan resend ''              # empty string at end, no flag after
cli/scan resend '' randomarg    # empty string + arg without dashes
cli/scan resend --headers ''    # flag BEFORE empty string
cli/scan resend 2 'a' 'b' --headers  # no empty string at all

Claude Model

None

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.39 (Claude Code)

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

iTerm2

Additional Information

_No response_