[BUG] WebFetch permission bypassed

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

In the latest claude code version, allowing WebFetch for a single domain, e.g. WebFetch(domain:docs.rs) causes Claude Code to bypass the permission prompt for any domain instead of the listed one.

What Should Happen?

Permission prompt should be only bypassed for listed domains, e.g. WebFetch(domain:docs.rs) allows fetching without user approval from docs.rs, but should disallow fetching from any other domain.

Error Messages/Logs

N/A

Steps to Reproduce

1. Allow single domain
2. Ask to fetch from other domain

Claude Model

Other

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.126

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

PowerShell

Additional Information

_No response_