[BUG] settings.json or settings.local.json do NOT suppress permission prompts

Preflight Checklist

• [x] I am using the latest version of Claude Code

What's Wrong?

Summary

On Windows, permissions.additionalDirectories and Read/Write/Edit allow-rules
in settings.local.json do NOT suppress permission prompts for files outside the
working directory, and glob ** does not match recursively. Every read of a
nested file triggers a prompt regardless of configuration.

Environment

• OS: Windows 10
• Claude Code: VS Code extension
• Workspace: working dir F:\JOB\repo1\_claude\project1 contains symlinks to real

projects located OUTSIDE the working dir (e.g. project2 ->
F:\JOB\repo1\project2).

settings.local.json (relevant parts)

"allow": [
"Read(//f/JOB/repo1/project2/)",
"Read(//f/JOB/repo1/project2//*)"
],
"additionalDirectories": [ "f:\\JOB\\repo1\\project2" ]

Steps to reproduce

1. Fully restart VS Code, open a NEW chat (guarantees settings reload).
2. Ask to read F:\JOB\repo1\project2\Docs\05_development\faq\summary-razgovora.md.

Expected

No prompt — the file is covered by both an allow-rule and additionalDirectories.

Actual

"Allow reading from ..." prompt appears every time.

Empirical findings (glob ** is NOT recursive)

Tested against project2/Docs/05_development/faq/summary-razgovora.md (4 levels deep):

• Read(//f/JOB/repo1/project2/**) -> does NOT match (prompt)
• Read(//f/JOB/repo1/project2/**/*) -> does NOT match (prompt)
• Read(//f/JOB/repo1/project2/Docs/05_development/faq/**) -> matches (no prompt)

Conclusion: ** matches exactly ONE path segment (like *), so an allow-rule
cannot cover a directory tree. This contradicts docs
(https://code.claude.com/docs/en/permissions.md) which show //c/**/.env.

Additional issue

additionalDirectories (native f:\... path, exactly the format Claude itself
writes when accepting a prompt) does NOT grant silent access to files outside the
working directory — the prompt still appears. Docs state it should grant file
access without prompting. Possibly related: accessing through a symlink that points
outside the working dir always prompts even when both the link and its target are
in additionalDirectories.

Regression

Worked correctly a few days ago with the same settings.local.json (no config
changes on my side). Broke after a recent auto-update of the VS Code extension.

• Current (broken) version: anthropic.claude-code 2.1.197 (win32-x64)
• Please check permission-matching / additionalDirectories changes in recent

2.1.x releases.