[BUG]Bash(cmd *) trailing wildcard does not match command invoked without arguments

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Version: 2.1.80
Reference: https://code.claude.com/docs/en/permissions

Description

A permission rule containing a mid-pattern wildcard followed by a command and a trailing * fails to match when that command is invoked with no arguments. The rule Bash(ssh * uptime *) matches ssh host uptime -s but does not match ssh host uptime, requiring a second duplicate entry without the trailing wildcard to cover the no-argument form.

What Should Happen?

Expected Behaviour

Bash(ssh * uptime *) should match both ssh host uptime -s and ssh host uptime. A trailing * should cover zero-or-more trailing characters, consistent with the documented "space or end-of-string" semantics.

Error Messages/Logs

Steps to Reproduce

Reproduction

{ "permissions": { "allow": ["Bash(ssh * uptime *)"] } }

| Command | Expected | Actual |
|---|---|---|
| ssh ubuntu@server uptime -s | allowed | allowed |
| ssh ubuntu@server uptime | allowed | prompts for approval |

Root Cause

The official documentation states that a space before * enforces a word boundary, requiring the prefix to be followed by "a space or end-of-string." In mid-pattern rules the trailing * does not satisfy the end-of-string case, so bare invocations without arguments fall through to the permission prompt.

Workaround

Two entries are required to achieve full coverage:

"Bash(ssh * uptime *)",
"Bash(ssh * uptime)"

This applies to any mid-pattern rule of the form Bash(prefix * command *) where the final command may be called without arguments, for example mount, w, env, getenforce, daemon-reload.

Claude Model

None

Is this a regression?

No

Claude Code Version

2.1.80

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

_No response_