[BUG] .aiignore glob patterns not enforced on Read and Edit tool calls

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

.aiignore file with glob pattern *cleartext-secret.yaml is not being enforced. Claude was able to both Read and Edit a file named grafana.cleartext-secret.yaml despite the pattern clearly matching.

In gitignore semantics, *plaintext-secret.yaml without a / in the pattern matches at any directory depth

What Should Happen?

Claude must NOT access those files.
This is a security-relevant bug. .aiignore is specifically used to protect sensitive files (secrets, credentials) from being accessed by the AI. If enforcement silently fails, it's a breach of trust and sensitive data can be extracted.

Error Messages/Logs

Steps to Reproduce

Create .aiignore in repo root with content:
*cleartext-secret.yaml

Have a file like path/to/grafana.cleartext-secret.yaml in the repo
Ask Claude to read or edit that file
Claude successfully reads and edits the file — no error or block is returned by the tools

Claude Model

Opus

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.76 (Claude Code)

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

_No response_