Read() permission path prefix matching doesn't match files within allowed directory

Bug Description

Read(/tmp/) in the permissions allow list does not match files within /tmp/. For example, Read(/tmp/quora-top-content-fixed.png) is denied despite Read(/tmp/) being in the allow list.

Steps to Reproduce

1. Add "Read(/tmp/)" to permissions.allow in .claude/settings.json
2. Run Claude Code in "don't ask" mode
3. Ask Claude to read a file in /tmp/, e.g. /tmp/example.png

Expected Behavior

Read(/tmp/) should match any file under /tmp/ via path prefix matching, so Read(/tmp/example.png) should be auto-allowed.

Actual Behavior

The Read tool call is denied with the message:

Permission to use Read has been denied because Claude Code is running in don't ask mode.

Environment

• Claude Code CLI
• Linux
• Permission mode: don't ask

Settings

{
  "permissions": {
    "allow": [
      "Read(/tmp/)",
      "Read(~/.claude/projects/)"
    ]
  }
}