[BUG] Allow rules reject partial tool-name globs despite accepting full globs on the same server prefix

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

The permission validator rejects partial wildcards in allow rules (e.g. mcp__myserver__list_*) while accepting full wildcards on the same server prefix (e.g. mcp__myserver__*). This is logically inconsistent — a partial glob is strictly more restrictive than a full glob, so if * is safe to allow, list_* should also be safe. The current rule actually decreases security, it encourages wider permissions which is more dangerous.

What Should Happen?

If using any of:

{
    "permissions": {
      "allow": [
        "mcp__my-server__*",
        "mcp__my-server__list_*",
        "mcp__my-server__get_*",
        "mcp__plugin_foo_foo__get_*"
      ]
    }
  }

All four rules are accepted. A partial glob after a literal mcp__<server>__ prefix narrows the scope — it should be valid in allow rules.

Error Messages/Logs

Wildcard tool name "mcp__my-server__list_*" is not supported in allow rules. An allow pattern must name the scope it widens — globs are permitted only in the tool position after a literal mcp____ prefix

Steps to Reproduce

In ~/.claude/settings.json:

{
    "permissions": {
      "allow": [
        "mcp__my-server__*",
        "mcp__my-server__list_*",
        "mcp__my-server__get_*",
        "mcp__plugin_foo_foo__get_*"
      ]
    }
  }

Claude Model

Opus

Is this a regression?

Yes, this worked in a previous version

Last Working Version

2.1.163

Claude Code Version

2.1.168 (Claude Code)

Platform

AWS Bedrock

Operating System

macOS

Terminal/Shell

iTerm2

Additional Information

_No response_