[BUG] Read(**/) glob in ~/.claude/settings.json permissions.allow does not suppress permission prompts

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Describe the bug

Permission prompts appear for Read tool calls even when the path is covered by a
** glob in ~/.claude/settings.json's permissions.allow.

To reproduce

1. Add the following to ~/.claude/settings.json:

```json
{
"permissions": {
"allow": [
"Read(/Users/andy/Dev/ai-layer/**)"
]
}
}

  2. Start a Claude Code session in any project.
  3. Ask Claude to read a file under /Users/andy/Dev/ai-layer/ — e.g.
  /Users/andy/Dev/ai-layer/vault/workflows/ingest.md.
  4. A permission prompt appears despite the path being covered by the glob.

  ## Expected behaviour

  No permission prompt. The ** pattern should match any file under the specified
  directory tree.

  ## Actual behaviour

  A permission prompt is shown, requiring manual approval.

  ## Environment

  - OS: macOS 25.3.0 (Darwin)
  - Claude Code version: (fill in — run claude --version)
  - Shell: zsh

  ## Notes

  - The entry is in ~/.claude/settings.json (user-level), not a project-level
  .claude/settings.json.
  - There is no project-level settings.json that could override it.
  - The same session correctly uses ~/.claude/settings.json for other settings, so
  the file is being read.
  - The issue appears specific to the Read tool with ** glob patterns — it may be
  that ** is not being expanded recursively for this tool.

### What Should Happen?

see above

### Error Messages/Logs

```shell

Steps to Reproduce

see above

Claude Model

Sonnet (default)

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.178 (Claude Code)

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

_No response_