[BUG] Update(src/[:id]/bla.ts) always triggers permission dialog because or [:param] in path

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Square brackets [ ] in file paths are glob special characters (character class syntax). When Claude Code checks if src/api/backoffice/events/[:event_id]/publish/createSnapshot.test.ts matches the permission pattern Edit(src/**), the [:event_id] in the file path is likely interpreted as a glob character class, causing the match to fail → permission dialog triggered.

Given a file path with `[:id]` and all permissions allowed in settings
When tool used against this file 
Then tool triggers permission dialog

What Should Happen?

Given a file path with `[:id]` and all permissions allowed in settings
When tool used against this file 
Then tool usage allowed

Error Messages/Logs

Steps to Reproduce

1. Create a project with a file whose path contains square brackets: src/api/[:id]/index.ts
2. In .claude/settings.json, add permission "Edit(src/**)" (or "Read(src/**)"
3. Ask Claude Code to read or edit that file
4. Actual: permission dialog appears
5. Expected: tool executes without dialog (path matches src/**)

Claude Model

None

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.80 (Claude Code)

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

Automated Reproduction

#!/usr/bin/env bash
# Reproduction script for Claude Code permission bug with square brackets in file paths
# Issue: glob-based permission matching treats [] in file paths as character classes
#
# Usage:
#   chmod +x reproduce-bracket-bug.sh
#   ./reproduce-bracket-bug.sh
#   cd repro-bracket-bug
#   claude
#   > Read src/api/[:id]/index.ts    # <-- triggers permission dialog (bug)
#   > Read src/api/normal/index.ts   # <-- auto-allowed (control)

set -euo pipefail

REPRO_DIR="$(pwd)/repro-bracket-bug"

rm -rf "$REPRO_DIR"
mkdir -p "$REPRO_DIR"
cd "$REPRO_DIR"

# 1. Init a minimal project
git init
echo "node_modules" > .gitignore

# 2. Create files — one with brackets, one without (control)
mkdir -p "src/api/[:id]"
mkdir -p "src/api/normal"

cat > "src/api/[:id]/index.ts" <<'EOF'
export function getById(id: string) {
  return { id };
}
EOF

cat > "src/api/normal/index.ts" <<'EOF'
export function getAll() {
  return [];
}
EOF

# 3. Configure permissions to allow Read and Edit on src/**
mkdir -p .claude
cat > .claude/settings.json <<'JSON'
{
  "permissions": {
    "allow": [
      "Read(src/**)",
      "Edit(src/**)"
    ]
  }
}
JSON

git add -A
git commit -m "init: repro for bracket permission bug"

cat <<'INSTRUCTIONS'

=== Reproduction ready ===

Directory: repro-bracket-bug/

Steps:
  1. cd repro-bracket-bug
  2. claude

  3. Ask Claude to read the CONTROL file (no brackets):
     > Read src/api/normal/index.ts
     Expected: reads without permission dialog ✅

  4. Ask Claude to read the BRACKET file:
     > Read src/api/[:id]/index.ts
     Expected: reads without permission dialog (matches src/**)
     Actual:   permission dialog appears ❌

  5. Ask Claude to edit the BRACKET file:
     > Add a comment to src/api/[:id]/index.ts
     Expected: edits without permission dialog (matches src/**)
     Actual:   permission dialog appears ❌

Both files are under src/**, so both should be auto-allowed.
The only difference is square brackets in the path.

INSTRUCTIONS

chmod +x ./bug.sh