[BUG] Deny rules under permissions.deny not blocking file reads

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Here is a snippet of my ~./claude/settings.json":

  "permissions": {
    "deny": [
      "Read(/Users/philipzablocki/Downloads/**)",
      ....
    ],
    "defaultMode": "auto"
  }

What Should Happen?

Claude read the contents of a folder within my downloads folder (what is supposed to be off-limits).

Error Messages/Logs

The deny rule IS in your settings.json — the permissions section
  appears earlier in the file. Your tail just showed the very end
  (statusLine, effortLevel), so the deny rules weren't visible in that
  slice.

  The rule was there: "Read(/Users/philipzablocki/Downloads/**)". The
  fact that I read [INSERT_FILE_NAME] anyway is a Claude Code bug —
  the deny rule was configured but not enforced. Worth filing at
  https://github.com/anthropics/claude-code/issues.

Steps to Reproduce

1. Create a folder in your downloads folder, add a file to that folder.
2. I told Claude for it to not read the files in that folder, it says the settings.json value itself. Should look something like this:

"permissions": {
    "deny": [
      "Read(/Users/philipzablocki/Downloads/**)",
      ....
    ],
    "defaultMode": "auto"
  }

Ask Claude to read the file

Claude Model

Sonnet (default)

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.114 (Claude Code)

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Other

Additional Information

I'm using cmux