[Bug] PERMISSION BYPASS: lsof runs without being in allow list

Claude Code not respecting settings.local.json permissions for lsof command

Bug Description

Claude Code is not respecting ./.claude/settings.local.json for the "lsof" command. I do not have lsof in my "allow" list, yet Claude Code ran the following command without prompting for confirmation:

⏺ Bash(lsof -i :3000)
  ⎿  COMMAND     PID    USER   FD   TYPE             DEVICE SIZE/OFF NODE NAME                                    
     Google    55532 spencer   23u  IPv6 0xf380e30a94c1e2e1      0t0  TCP localhost:63284->localhost:hbci (CLOSED)
     Google    55532 spencer   32u  IPv6 0xac22bc61d8869a2a      0t0  TCP localhost:63282->localhost:hbci (CLOSED)
     … +10 lines (ctrl+o to expand)

Current settings.local.json configuration

{
  "$schema": "https://json.schemastore.org/claude-code-settings.json",
  "enableAllProjectMcpServers": true,
  "permissions": {
    "allow": [
      "Bash(npm run knip:*)",
      "Bash(grep:*)",
      "Bash(npm run lint)",
      "Bash(rg:*)",
      "Bash(npm run type-check:*)",
      "Bash(npm run check:*)",
      "Bash(mkdir:*)",
      "Bash(find:*)",
      "Bash(ls:*)",
      "Bash(psql:*)",
      "Bash(cp:*)",
      "mcp__supabase__get_advisors",
      "WebSearch",
      "mcp__supabase__search_docs",
      "mcp__playwright__browser_type",
      "mcp__playwright__browser_click",
      "mcp__playwright__browser_wait_for",
      "mcp__playwright__browser_take_screenshot",
      "mcp__playwright__browser_press_key",
      "mcp__playwright__browser_evaluate",
      "mcp__playwright__browser_fill_form",
      "mcp__playwright__browser_network_requests",
      "mcp__playwright__browser_console_messages",
      "Bash(git diff:*)",
      "mcp__playwright__browser_snapshot",
      "mcp__chrome-devtools__get_network_requests",
      "Bash(npm run fix:*)"
    ],
    "defaultMode": "plan",
    "deny": [
      "Read(./.env)",
      "Read(./.env.production.local)",
      "Read(./secrets/**)",
      "Read(./config/credentials.json)",
      "Read(./build)"
    ]
  }
}

Potential Cause

The only thing I can think might be causing this is I have "Bash(ls:*)" under "allow" and maybe the wildcard is making that apply to lsof as well. Either way, this appears to be a bug in the permission matching logic.

Additional Issue

The Claude Code documentation (https://docs.anthropic.com/en/docs/claude-code/settings) indicates that you can use "ask" in the settings.local.json file, but the schema (https://json.schemastore.org/claude-code-settings.json) has no such option.

Environment Info

• Platform: darwin
• Terminal: iTerm.app
• Version: 1.0.115
• Feedback ID: ffbaebc7-f4d0-4390-a1e6-3129ac8b6bf0

Error Logs

[
  {
    "error": "SyntaxError: Expected ':' after property name in JSON at position 1086 (line 35 column 5)\n    at JSON.parse (<anonymous>)\n    at file:///opt/homebrew/lib/node_modules/@anthropic-ai/claude-code/cli.js:733:9932\n    at Q (file:///opt/homebrew/lib/node_modules/@anthropic-ai/claude-code/cli.js:713:13288)\n    at HwA (file:///opt/homebrew/lib/node_modules/@anthropic-ai/claude-code/cli.js:784:25070)\n    at D$9 (file:///opt/homebrew/lib/node_modules/@anthropic-ai/claude-code/cli.js:784:26923)\n    at gk (file:///opt/homebrew/lib/node_modules/@anthropic-ai/claude-code/cli.js:784:27307)\n    at E2 (file:///opt/homebrew/lib/node_modules/@anthropic-ai/claude-code/cli.js:784:27239)\n    at file:///opt/homebrew/lib/node_modules/@anthropic-ai/claude-code/cli.js:2373:2457\n    at file:///opt/homebrew/lib/node_modules/@anthropic-ai/claude-code/cli.js:784:23761\n    at Set.forEach (<anonymous>)",
    "timestamp": "2025-09-16T16:31:09.292Z"
  },
  {
    "error": "Error: Invalid settings\n    at K$9 (file:///opt/homebrew/lib/node_modules/@anthropic-ai/claude-code/cli.js:784:24387)\n    at HwA (file:///opt/homebrew/lib/node_modules/@anthropic-ai/claude-code/cli.js:784:25115)\n    at D$9 (file:///opt/homebrew/lib/node_modules/@anthropic-ai/claude-code/cli.js:784:26923)\n    at gk (file:///opt/homebrew/lib/node_modules/@anthropic-ai/claude-code/cli.js:784:27307)\n    at E2 (file:///opt/homebrew/lib/node_modules/@anthropic-ai/claude-code/cli.js:784:27239)\n    at file:///opt/homebrew/lib/node_modules/@anthropic-ai/claude-code/cli.js:2373:2457\n    at file:///opt/homebrew/lib/node_modules/@anthropic-ai/claude-code/cli.js:784:23761\n    at Set.forEach (<anonymous>)\n    at R10.J$9 (file:///opt/homebrew/lib/node_modules/@anthropic-ai/claude-code/cli.js:784:23748)\n    at R10.emit (node:events:508:28)",
    "timestamp": "2025-09-16T16:31:09.300Z"
  }
]

Note: Error logs were truncated in the original report.

Expected Behavior

Claude Code should respect the permissions defined in settings.local.json and should prompt for confirmation before running commands not explicitly listed in the "allow" list.

Actual Behavior

Claude Code executed lsof -i :3000 without prompting, despite lsof not being in the allow list.