Permission wildcard Bash(prefix:*) does not match chained/redirected commands

Bug Description

Permission wildcard rules like Bash(set:*) and Bash(source:*) in .claude/settings.json do not match commands that start with those prefixes in certain cases.

Environment

• Claude Code version: 2.1.83
• Platform: Windows 11 Pro (Git Bash shell)
• Settings scope: Project .claude/settings.json (validated JSON)

Settings (relevant section)

{
  "permissions": {
    "allow": [
      "Bash(source:*)",
      "Bash(set:*)",
      "Bash(curl:*)",
      "Bash(node:*)"
    ]
  }
}

Reproduction

Case 1: Chained commands with && — prompts despite wildcard

set -a && source .env && set +a && curl -s "https://example.com" -H "Authorization: Bearer $TOKEN" | python -m json.tool | head -120

Expected: Bash(set:*) should match (command starts with set).
Actual: Permission prompt appears.

Case 2: Command with redirect 2>/dev/null — prompts despite wildcard

source .env 2>/dev/null && curl -s "https://example.com" | python -m json.tool

Expected: Bash(source:*) should match.
Actual: Permission prompt appears.

Case 3: Multiline commands — always prompts

source .env && curl -s "https://example.com" | node -e "
const chunks = [];
process.stdin.on('data', c => chunks.push(c));
process.stdin.on('end', () => {
  console.log(JSON.parse(Buffer.concat(chunks).toString()));
});"

Expected: Bash(source:*) should match (first token is source).
Actual: Permission prompt appears. Newlines inside the command seem to break wildcard matching.

Verification

• JSON is valid (verified with node -e "JSON.parse(...)").
• Rules are present in the parsed output.
• Happens in new sessions (not a stale config issue).
• Single-line commands without redirects (e.g., source .env && curl -s ...) work correctly with the wildcard.

Expected Behavior

Bash(prefix:*) should match any command whose first token starts with prefix, regardless of:

1. && chains after the first command
2. Redirects (2>/dev/null) attached to the first command
3. Newlines inside quoted arguments later in the command