[Feature Request] Tool allow patterns should support wildcard matching for command arguments

This is a common friction point — Claude Code adds flags like -C that change how the command looks to the permission matcher.

Workaround with a PreToolUse hook:

#!/bin/bash
INPUT=$(cat)
COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty')

# Auto-approve any git read-only command regardless of flags
if echo "$COMMAND" | grep -qE '^\s*git\s+(-C\s+\S+\s+)?(status|log|diff|branch|show|rev-parse)'; then
    jq -n '{
      hookSpecificOutput: {
        hookEventName: "PreToolUse",
        permissionDecision: "allow",
        permissionDecisionReason: "git read-only auto-approved"
      }
    }'
    exit 0
fi

exit 0

This matches git status, git -C /path status, git -C /path log --oneline, etc. The regex handles the optional -C <path> that Claude inserts.

See also #36873 for a related trailing-wildcard matching issue.

Found 3 possible duplicate issues:

1. https://github.com/anthropics/claude-code/issues/27803
2. https://github.com/anthropics/claude-code/issues/26546
3. https://github.com/anthropics/claude-code/issues/13371

This issue will be automatically closed as a duplicate in 3 days.

• If your issue is a duplicate, please close it and 👍 the existing issue instead
• To prevent auto-closure, add a comment or 👎 this comment

🤖 Generated with Claude Code

same as https://github.com/anthropics/claude-code/issues/27803

This issue has been automatically locked since it was closed and has not had any activity for 7 days. If you're experiencing a similar issue, please file a new issue and reference this one if it's relevant.