[Bug] Permission pattern matching fails when `:*` suffix follows another `*` wildcard

Bug Description
The docs at https://code.claude.com/docs/en/permissions state: ▎ "The : suffix is an equivalent way to write a trailing wildcard, so Bash(ls:) matches the same commands as Bash(ls )." Empirically, this equivalence breaks when the pattern contains another earlier in the string. The : form silently fails to match; replacing : with (no space) or (with space) makes it match. Repro (Claude Code 2.1.132, Linux): mkdir -p /tmp/perm-test && cd /tmp/perm-test # Helper that runs claude with one rule and dontAsk mode. test_rule() { claude --setting-sources project \ --settings "{\"permissions\":{\"allow\":[\"$1\"]}}" \ --permission-mode dontAsk -p \ "Use the Bash tool to run exactly: $2. Then print MATCHED or NO_MATCH." } test_rule 'Bash(git -C show:)' 'git -C /tmp show HEAD' # NO_MATCH (bug) test_rule 'Bash(git -C show)' 'git -C /tmp show HEAD' # MATCHED test_rule 'Bash(git -C show )' 'git -C /tmp show HEAD' # MATCHED test_rule 'Bash(git -C /tmp show:)' 'git -C /tmp show HEAD' # MATCHED (no mid-pattern ) Expected: Bash(git -C show:) matches per the documented : ≡ equivalence. Actual: It doesn't, while the otherwise-equivalent and forms do. Impact: Anyone writing rules of the shape Bash(<cmd> <subcmd>:) (a common pattern, e.g. git -C <subcmd>: for cross-repo work) silently gets prompted for every invocation. The bug is hard to diagnose because the documented behavior says it should work.

Environment Info

• Platform: linux
• Terminal: tmux
• Version: 2.1.132
• Feedback ID: 72014e2a-cb7a-4226-974f-38a8971c7996

Errors

[]