[BUG] claude -p Write permission auto-approval inconsistent within same session — succeeds then fails for same glob rule

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Bug

Write(./**) in .claude/settings.json auto-approves writes to existing files but later denies writes to new files within the same claude -p session.

Environment

• Claude Code version: 2.1.92
• Model: claude-opus-4-6
• OS: macOS (Darwin 25.3.0)
• Permission mode: default
• Git worktree (not main repo)

Impact

This blocks headless agent orchestration — agents can't create new files (like output artifacts) even when permissions explicitly allow it. The workaround is unclear since the
same rule works for updates but not creates.

What Should Happen?

Expected behavior

Write(./**) should auto-approve writes to both existing and new files. The glob pattern matches the path regardless of whether the file exists on disk.

Error Messages/Logs

Evidence from ndjson session log

  Same session (b4457b6f-b8aa-42c9-8cd6-fd410af880ac), same Write(./**) rule:

  ┌──────────┬───────┬───────────────────────────────────────┬───────────────┬───────────┐
  │   Time   │ Tool  │                 File                  │   Existed?    │  Result   │
  ├──────────┼───────┼───────────────────────────────────────┼───────────────┼───────────┤
  │ 13:56:54 │ Write │ games/.../title_screen_state.rs       │ Yes           │ Succeeded │
  ├──────────┼───────┼───────────────────────────────────────┼───────────────┼───────────┤
  │ 13:57:52 │ Write │ games/.../title_screen_enter.rs       │ Yes           │ Succeeded │
  ├──────────┼───────┼───────────────────────────────────────┼───────────────┼───────────┤
  │ 14:00:56 │ Write │ docs/roadmap/.../feature-context.json │ No (new file) │ Denied    │
  ├──────────┼───────┼───────────────────────────────────────┼───────────────┼───────────┤
  │ 14:01:08 │ Write │ (same file, retry)                    │ No            │ Denied    │
  └──────────┴───────┴───────────────────────────────────────┴───────────────┴───────────┘

  All four paths match Write(./**). The only difference is the denied file didn't exist on disk yet.

  The agent then attempted fallbacks:
  - Bash heredoc → blocked by PreToolUse hook ("Contains brace with quote character")
  - python3 -c → blocked ("This command requires approval" — not in allow list)

  Additional testing

  In the same worktree, both of these succeed:
  - Interactive Claude Code session: Write to the same path → auto-approved
  - claude -p "Write test to docs/roadmap/.../test.txt" → auto-approved (but this creates a file that doesn't have an existing-file check conflict)

Steps to Reproduce

Reproduction

1. Create .claude/settings.json in a git worktree:

{
"permissions": {
"allow": [
"Read(./)",
"Edit(./)",
"Write(./)",
"Glob(./)",
"Grep(./**)"
]
}
}

1. Run claude -p with a prompt that writes to multiple files — some existing, some new.
2. Writes to existing files succeed (auto-approved by Write(./**)).
3. Writes to new files (file doesn't exist yet) fail with: "Claude requested permissions to write to [path], but you haven't granted it yet."

Claude Model

Opus

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.92 (Claude Code)

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

_No response_