[BUG] Permission glob `Read(/path/**)` inconsistently matches files — some reads prompt, others don't

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

I have a global permission rule in ~/.claude/settings.json that allows reading from a specific directory:

"permissions": {
  "allow": [
    "Skill(abc)",
    "Read(/opt/abc/share/claude/abc/**)"
  ]
}

When the abc skill is invoked, it triggers multiple Read calls to files in /opt/abc/share/claude/abc/. The first batch of reads (3 files, including language.md) goes through without prompting. However, a subsequent Read call to another file in the same directory (connector-t4Com.md) prompts for permission:

Read file

  Read(/opt/abc/share/claude/abc/connector-t4Com.md)

 Do you want to proceed?

All files are in the same directory and should match the ** glob pattern equally.

Actual behavior:

Some matching reads are auto-allowed, others prompt for confirmation despite matching the same glob rule.

Environment:

• Claude Code v2.1.69
• macOS (Darwin 25.3.0)
• Working directory: /tmp/xx (outside any project)

What Should Happen?

All Read calls matching the glob pattern should be auto-allowed consistently.

Error Messages/Logs

Steps to Reproduce

1. Configure ~/.claude/settings.json with Read(/opt/abc/share/claude/abc/**) in the allow list
2. Start Claude Code in a directory outside the project (e.g. /tmp/xx)
3. Invoke a skill that reads multiple files from that path in separate tool calls
4. First batch of reads is auto-allowed, subsequent reads to the same directory prompt for permission

Claude Model

Opus

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.69

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

iTerm2

Additional Information

xx@system:/tmp/xx> claude

▐▛███▜▌ Claude Code v2.1.69
▝▜█████▛▘ Opus 4.6 · Claude Team
▘▘ ▝▝ /private/tmp/xx

❯ ich möchte ein abc beispiel programm zum zeigen der funktion von t4com
schreiben. es soll einen sender und einen empfänger in diesem programm
geben, die sich miteinander verbinden und zeigen, das man den wert einer
variablen in einem scope übertragen kann

⏺ Skill(abc)
⎿  Successfully loaded skill · 4 tools allowed

Reading 3 files… (ctrl+o to expand)
⎿ /opt/abc/share/claude/abc/language.md

────────────────────────────────────────────────────────────────────────────────
Read file

Read(/opt/abc/share/claude/abc/connector-t4Com.md)

Do you want to proceed?
❯ 1. Yes

1. Yes, allow reading from abc/ during this session
2. No

Esc to cancel · Tab to amend