[BUG] `Bash(git commit *)` deny rule not enforced when git is called with `-C <path>` flag

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Summary

A deny rule for Bash(git commit *) in settings.json was bypassed when
git commit was invoked with the -C <path> flag.

Environment

• Claude Code version: 2.1.94
• OS: macOS 25.5.0 (Darwin)
• Settings file: ~/.claude/settings.json

settings.json

{
"permissions": {
"deny": ["Bash(git commit *)"]
}
}

Command that bypassed the rule

git -C /path/to/repo commit -m "..."

Expected behavior

The deny rule Bash(git commit *) should block any git commit invocation
regardless of preceding flags such as -C <path>.

Actual behavior

The commit executed successfully without triggering a permission prompt or denial.

Root cause hypothesis

The pattern matcher for Bash(git commit *) likely checks whether the command
string starts with git commit, but git -C <path> commit places -C <path>
between git and commit, causing the pattern match to fail silently.

Impact

Users who set deny rules to prevent accidental commits may have those rules
silently bypassed whenever Claude Code uses git -C to operate on a non-CWD
repository. This is a security/safety regression for any workflow that relies
on commit restrictions.

What Should Happen?

Bash(git commit *) deny rule should match any shell command where git commit
appears as the effective subcommand, regardless of flags inserted between git
and commit (e.g. -C <path>, --no-pager, etc.).

The pattern matching should normalize or parse the git invocation rather than
doing a naive prefix match on the raw command string.

Error Messages/Logs

Steps to Reproduce

1. Add the following to ~/.claude/settings.json:

```json
{
"permissions": {
"deny": ["Bash(git commit *)"]
}
}

1. Open a project that is NOT the current working directory (i.e. a subdirectory or separate path).
2. Ask Claude Code to commit changes to that project.
3. Observe that Claude Code runs git -C /path/to/repo commit -m "..." and the commit succeeds without any permission prompt or denial.

Claude Model

Sonnet (default)

Is this a regression?

No, this never worked

Last Working Version

_No response_

Claude Code Version

2.1.94

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

VS Code integrated terminal

Additional Information

_No response_