[BUG] Path-based rules not applied when file is accessed via a symlinked path

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

When a file is accessed via a symlinked path, Claude does not load path-based rules from .claude/rules/ whose globs match the file — even though the symlink resolves to a file inside the project directory. The rule loads correctly when the same file is referenced by its canonical path. There are no error messages; the rule is silently skipped.

What Should Happen?

Claude should resolve symlinks before matching file paths against rule globs, so that path-based rules apply consistently whether the file is accessed via its canonical path or a symlink that resolves to the same file within the project.

Error Messages/Logs

No error output. The failure is silent — the rule is simply not loaded and the output line `Loaded .claude/rules/<rule>.md` does not appear.

Steps to Reproduce

1. Start Claude Code in a project directory, e.g. ~/dev/myproject
2. Create a path-based rule at .claude/rules/markdown.md with frontmatter glob **/*.md that instructs Claude to prepend a specific marker comment to any markdown file it writes:

```markdown
---
description: Rules for markdown files
paths:

• "**/*.md"

---
When writing or editing any markdown file, always include the following comment at the top of the file as an HTML comment:
<!-- RULE LOADED: markdown.md path-based rule was applied -->
```

1. Create a symlink pointing to the project directory: sudo ln -s ~/dev/myproject /opt/myproject
2. Ask Claude to write to a markdown file using the symlinked path: write a test line to /opt/myproject/test.md
3. Observe: rule is not loaded — the marker comment is absent and Loaded .claude/rules/markdown.md does not appear in the output
4. Ask Claude to write to the same file using the canonical path: write a test line to ~/dev/myproject/test.md
5. Observe: rule is loaded — the marker comment is present and Loaded .claude/rules/markdown.md appears in the output

Key distinction: the file itself is inside the project directory in both cases. Claude Code is started from the canonical project path. The only difference is whether the path argument given to Claude is routed through a symlink.

Example:

Without symlink path (~/dev/symlink/test.md) — rule loads

❯ write a test line to the test file ~/dev/symlink/test.md

⏺ I'll read the file first, then add a test line.
  ⎿  Loaded .claude/rules/markdown.md

⏺ Update(test.md)
  ⎿  Added 3 lines, removed 1 line
     + <!-- This comment confirms that the path-based rule was successfully loaded and applied. -->
     + This is a test line written by Claude Code.
     + This is another test line written by Claude Code.

With symlink path (/opt/symlink/test.md) — rule does not load

❯ write a test line to the test file /opt/symlink/test.md

⏺ Let me read the file first before editing it.
  (no "Loaded .claude/rules/markdown.md" line)

⏺ Update(/opt/symlink/test.md)
  ⎿  Added 1 line
     + This is a third test line written by Claude Code.
     (no marker comment)

Claude Model

Sonnet (default)

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.191

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

iTerm2

Additional Information

Related issues

• #44456 — CLI discards logical symlink path, uses realpath
• #39594 — CLI resolves symlinks in working directory instead of preserving $PWD logical path
• #17732 — FEATURE: Preserve symlink path for CLAUDE.md parent directory lookup

This bug is distinct from the above: those issues involve Claude resolving symlinks too eagerly for the working directory. This bug is the inverse — Claude does not resolve symlinks when matching a file path argument against rule globs, causing rules to be silently skipped.

realpath /opt/myproject/test.md   # -> ~/dev/myproject/test.md ; use that form

PROTECTED="$HOME/dev/myproject/secrets"          # canonical dir to protect
target=$(jq -r '.tool_input.file_path // .tool_input.path // ""')
[ -z "$target" ] && exit 0
real=$(realpath -m -- "$target" 2>/dev/null)     # -m resolves symlinks even if the file doesn't exist yet
case "$real" in
  "$PROTECTED"|"$PROTECTED"/*)
    echo "Blocked: '$target' resolves to protected path '$real'." >&2
    exit 2 ;;                                     # exit 2 blocks the tool call
esac
exit 0