[BUG] Bash() permission rules with nested parentheses are rejected

Description

Permission rules in settings.json that contain nested parentheses inside Bash(...) are rejected. This makes it impossible to allowlist commands like node -e "..." that contain parentheses in their arguments.

Steps to reproduce

Add the following entry to the permissions.allow array in .claude/settings.json:

"Bash(node -e \"import('node:crypto').then(m => console.log(m.randomUUID()))\")"

Expected behavior

The rule is accepted and the command is allowed.

Actual behavior

A settings warning is shown (also visible via /doctor):

Invalid permission rule "Bash(node -e "import('node:crypto').then(m => console.log(m.randomUUID()))")" was skipped: Empty parentheses. Either specify a pattern or use just "Bash" without parentheses.

The rule is dropped, so the permission is never granted.

Environment

• Claude Code version: 2.1.173
• Settings file: .claude/settings.json