Permission wildcard Bash(command:*) fails when command arguments contain parentheses

Description

The Bash(gcloud logging read:*) permission rule in ~/.claude/settings.json does not match commands where the arguments contain parentheses.

Steps to Reproduce

1. Add permission rule to ~/.claude/settings.json:

{
  "permissions": {
    "allow": [
      "Bash(gcloud logging read:*)"
    ]
  }
}

1. Run a command without parentheses in args — passes without prompting:

gcloud logging read '...' --project=okood-dev --limit=5 --format=json

1. Run a command with parentheses in args — prompts for approval:

gcloud logging read '...' --project=okood-dev --limit=5 --format="value(textPayload,jsonPayload)"

Expected Behavior

The :* wildcard should match any arguments regardless of special characters. The parentheses in --format="value(textPayload,jsonPayload)" should not interfere with the Bash(gcloud logging read:*) permission pattern.

Likely Cause

The permission pattern uses Bash(...) syntax with parentheses as delimiters. Parentheses inside the command arguments are likely being parsed as the closing delimiter of the Bash(...) pattern, causing the match to fail.

Environment

• macOS (Darwin 25.3.0)
• Claude Code CLI
• Model: claude-opus-4-6

🤖 Generated with Claude Code