[BUG] --allowedTools does not override ask permissions in settings.json during -p mode

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Summary
When running claude -p with --allowedTools specifying a Bash pattern, commands matching that pattern are still blocked if the project's .claude/settings.local.json has the same pattern under permissions.ask. The --allowedTools flag should promote ask -> allow for the session, but instead the ask rule takes precedence, and since -p mode has no interactive approval, the tool call is denied.

Motivation
This prevents a common autonomous workflow pattern: keeping a tool in ask for interactive safety (e.g., confirming before running database migrations) while allowing it in autonomous -p sessions via --allowedTools where the operator has explicitly authorised it.

There is currently no way to express "ask me when interactive, allow when -p", --allowedTools should be that mechanism.

What Should Happen?

--allowedTools patterns passed via CLI should promote matching ask rules to allow for that session. This preserves interactive safety (settings file keeps ask) while enabling autonomous execution when the operator explicitly opts in via CLI flags.

Error Messages/Logs

Steps to Reproduce

Reproduction

Create/update settings.local json.
Create update the tool call in question, sanitized in my examples from the actual call

.claude/settings.local.json:

{
  "permissions": {
    "ask": [
      "Bash(./scripts/my-script.sh new:*)"
    ]
  }
}

CLI invocation:

claude -p "Run ./scripts/my-script.sh new my-arg" \
  --allowedTools "Bash(./scripts/my-script.sh *)" \
  --model sonnet

Expected: The command runs without prompting, --allowedTools should override the ask permission for this session.

Actual: The command is denied with "This command requires approval". The model retries the same tool call multiple times, running in a loop with --max-turns, each time denied, eventually giving up.

Claude Model

Sonnet (default)

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.85

Platform

Other

Operating System

macOS

Terminal/Shell

iTerm2

Additional Information

Claude Code version: 2.1.85
macOS 26.3.1 (Apple Silicon)
The model also tried invoking as bash ./scripts/my-script..sh new ... (prefixed with bash), which didn't match the --allowedTools glob pattern Bash(./scripts/my-script..sh *) either.

Related closed issues: #1520 (auto-closed, different root cause unclear), #12232 (closed, --allowedTools + bypassPermissions interaction)