[BUG] Permission prompts firing for commands that match allow rules (intermittent)

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Environment

OS: macOS 25.5.0
Claude Code: desktop app (version 1.17377.1 (2b3ab4) 2026-06-30T20:11:42.000Z)
Project: Next.js / Node.js app
Description

Commands that exactly match entries in the project's .claude/settings.json allow list intermittently trigger a permission prompt anyway. Re-approving the same command immediately afterward works — confirming the rule isn't missing, just not being applied consistently.

Allow rules in .claude/settings.json:

{
"permissions": {
"allow": [
"Bash(npm test*)",
"Bash(set -a && source .env && set +a && PUUR_TEST_DB=real npm test*)",
"Bash(set -a && source .env && set +a && psql *)",
"Bash(cd && set -a && source .env && set +a && psql )",
"Bash(npm run reseed*)"
]
}
}
Examples of commands that prompted despite matching a rule:

set -a && source .env && set +a && psql "postgres://..." -c "\d quote" — matches Bash(set -a && source .env && set +a && psql *)
set -a && source .env && set +a && psql "postgres://..." -c "SELECT ..." — same rule
set -a && source .env && set +a && psql "postgres://..." -f src/db/migrations/004_add_quote_status_revising.sql — same rule
PUUR_TEST_DB=real npm test — matches Bash(set -a && source .env && set +a && PUUR_TEST_DB=real npm test*)
npm test — matches Bash(npm test*)
Pattern
The prompts are intermittent, not consistent. The identical command will sometimes prompt and sometimes not within the same session. Dismissing the prompt and immediately retrying the same command often succeeds without prompting. This happened across multiple command types and multiple separate allow rules, ruling out a single-rule formatting issue.

Impact
Running an AFK verification pass (applying DB migrations, running tests, reseeding) required repeated manual intervention that the allow rules were explicitly intended to prevent.

What Should Happen?

The prompts should be auto-approved.

Error Messages/Logs

Steps to Reproduce

1. Create a Next.js project with a .claude/settings.json containing these allow rules:

{
"permissions": {
"allow": [
"Bash(npm test*)",
"Bash(set -a && source .env && set +a && psql *)"
]
}
}

1. Open the project in Claude Code (desktop app).
2. Ask Claude to run the test suite. It will issue a command matching Bash(npm test*), e.g.: npm test
3. Observe that a permission prompt appears despite the matching allow rule.
4. Approve the prompt. The command runs successfully.
5. Ask Claude to run the same command again in the same session (e.g. "run the tests again").
6. Observe that the permission prompt may or may not appear this time — the behaviour is intermittent. Sometimes the rule is applied correctly; sometimes it is not, even for the exact same command string within the same session.
7. The same intermittent behaviour occurs for commands matching Bash(set -a && source .env && set +a && psql *), e.g.:

set -a && source .env && set +a && psql "postgres://user:password@localhost:5432/dbname" -c "\d tablename"

Note: No code changes, server restarts, or settings file edits occur between the prompt appearing and not appearing. The allow rule is present and correctly formatted throughout.

Claude Model

Sonnet (default)

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

1.17377.1 (2b3ab4) 2026-06-30T20:11:42.000Z

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

_No response_