[BUG] Permission settings unclear/inconsistent - security issues

Environment

• Platform (select one):
• [x] Anthropic API
• Claude CLI version: 1.0.64
• Operating System: macOS 15.5
• Terminal: Warp

Bug Description

The permission settings don't behave as expected. Several bash commands can be executed although denied through settings.

Steps to Reproduce

1. Put these permission in ~/.claude/settings.json

    "deny": [
      "Read(.env)",
      "Edit(.env)",
      "Write(.env)",
      "MultiEdit(.env)",
      "Bash(*:.env)"
    ]

1. Instruct claude to cat your .env file.
2. it will be able to do so

Expected Behavior

Permission denied

Actual Behavior

Permission not denied

Additional Context

I tried different syntax for \.env, .env\, .env - while the rules for Read, Edit, Write, etc seem to work, Bash seems to be just ignored.