[BUG] ask permission rules for Bash don't override blanket Bash in allow

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

When Bash is in the allow list and specific Bash(rm *) patterns are in the ask list, the ask rules are ignored. Claude Code executes rm commands without prompting for confirmation.

Per the https://code.claude.com/docs/en/permissions, rules are evaluated in order: deny → ask → allow, meaning ask rules should take precedence over allow rules. This is not happening.

What Should Happen?

When Bash(rm ) is in the ask list, any Bash command matching rm should prompt the user for confirmation, even if the blanket Bash rule is in allow.

Error Messages/Logs

Steps to Reproduce

1. Set ~/.claude/settings.json to:

  {
    "permissions": {
      "allow": [
        "Bash"
      ],
      "ask": [
        "Bash(rm *)",
        "Bash(rm)",
        "Bash(*| rm *)",
        "Bash(*&& rm *)",
        "Bash(*; rm *)"
      ]
    }
  }

1. Start a new Claude Code session (or restart to clear any cached permissions).
2. Ask Claude to delete a file, e.g. "delete ~/test-file.txt".
3. Expected: Claude Code prompts for confirmation before running rm.
4. Actual: Claude Code runs rm ~/test-file.txt without any prompt.

Claude Model

Opus

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.72

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

Screenshots from claude code UI:
<img width="498" height="270" alt="Image" src="https://github.com/user-attachments/assets/50cba7f4-0ab1-431c-8068-0ba1e25ec97f" />

<img width="559" height="316" alt="Image" src="https://github.com/user-attachments/assets/32144670-c0b4-45d8-9f9b-de9cd870c447" />

<img width="880" height="263" alt="Image" src="https://github.com/user-attachments/assets/f6539c95-9ee5-4af2-8ad3-526ced16dc31" />