[BUG] Permission parser treats # in multi-line quoted strings as shell comments

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

The Bash permission pattern Bash(python *) fails to auto-allow python -c commands when the code contains a line where # is the first non-whitespace character (i.e., a Python comment). The permission parser interprets these lines as shell comments, breaking the command structure and causing subsequent lines to be evaluated as standalone commands that don't match the python * pattern — triggering an unnecessary permission prompt.

What Should Happen?

# inside a double-quoted string argument should not be treated as a shell comment. The entire python -c "..." should be recognized as a single command matching python *, regardless of whether the Python code contains comment lines.

Error Messages/Logs

Steps to Reproduce

1. Add Bash(python *) to permissions.allow in settings
2. Have Claude run this command:

python -c "
# just a comment
print('hello')
"

Claude Model

Opus

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.148 (Claude Code)

Platform

Anthropic API

Operating System

Other Linux

Terminal/Shell

Other

Additional Information

Systematic testing shows the issue is specifically about # as the first non-whitespace character on a line inside the quoted string:

| Variant | Prompts? |
|---------|----------|
| # at line start | Yes |
| # indented (whitespace before #) | Yes |
| x = 5 # inline (code before #) | No |
| print('#') (# inside a string literal) | No |
| Same multi-line code without any comments | No |

• Reproduced on Claude Code extension (VS Code/Codium) v2.1.109 and v2.1.148
• VSCodium Flatpak, Linux Mint, Linux 6.17.0-23-generic