Bash permission allow rules not honored — "don't ask again" doesn't persist

Bug Description

Bash permission allow rules in settings.local.json and ~/.claude/settings.json are not being applied. Selecting option 2 ("Yes, and don't ask again for: X") writes the rule to the file but does not prevent future prompts — even within the same session, on the very next command.

Reproduction Steps

1. Have Bash(gcloud functions:*) in .claude/settings.local.json under permissions.allow
2. Run a command like: gcloud functions logs read my-function --project=my-project --region=us-central1 --limit=50
3. Get prompted with the 3 options (Yes / Yes, and don't ask again / No)
4. Select option 2: "Yes, and don't ask again for: gcloud functions:*"
5. Claude runs the command successfully
6. Claude immediately runs another gcloud functions logs read ... command in the same turn
7. Gets prompted again despite option 2 just being selected

Configuration

~/.claude/settings.json:

{
  "permissions": {
    "allow": [
      "Bash(gcloud functions:*)"
    ]
  }
}

.claude/settings.local.json (project-level, written by option 2):

{
  "permissions": {
    "allow": [
      "Bash(gcloud functions logs read:*)",
      "Bash(gcloud functions describe:*)",
      "Bash(gcloud functions:*)",
      "Bash(gcloud:*)"
    ]
  }
}

All four rules exist — narrow and broad — and none are honored.

Expected Behavior

• Permission rules in settings.local.json and ~/.claude/settings.json should auto-allow matching Bash commands without prompting
• At minimum, selecting option 2 should persist within the current session

Actual Behavior

• Every gcloud functions logs read command prompts for approval regardless of allow rules
• Option 2 does not persist even within the same session/turn
• This has been happening for months across many sessions

Environment

• macOS (Darwin 25.3.0)
• Claude Code CLI
• Multiple gcloud prefix rules tested: gcloud:*, gcloud functions:*, gcloud functions logs read:*, gcloud functions logs read *