[BUG] Read deny rule bypassed by IDE selection context when file path is reported WSL-style (/mnt/c/...) on Windows

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report
• [x] I am using the latest version of Claude Code (2.1.220)

What's Wrong?

A Read(**/.env) deny rule in ~/.claude/settings.json does not block the VS Code extension's selection-context sharing when the IDE reports the file path in WSL style (/mnt/c/...) while the CLI session runs on native Windows (C:\...).

I selected a line inside my project's .env file in VS Code. The selected text (which contained a live API key) was attached to the conversation as context, along with the file path reported as /mnt/c/Users/<user>/<project>/.env. The session's working directory was the same project at C:\Users\<user>\<project>.

The same deny rule works correctly for the Read tool: asking Claude to read the same .env fails with "File is in a directory that is denied by your permission settings." Only the IDE selection channel leaks.

Root cause seems to be path-representation mismatch in deny-rule matching: after adding an additional absolute-path rule Read(//mnt/**/.env), selecting text in the same file no longer reaches Claude (nothing is attached, not even the open-file notice). So the matching engine appears to compare the WSL-style path literally against the patterns instead of normalizing it to the Windows path first — **/.env should have matched either way, but evidently did not for the selection channel.

What Should Happen?

Per the VS Code extension docs (https://code.claude.com/docs/en/vs-code, "The built-in IDE MCP server" section):

To exclude a sensitive file such as .env, add a Read deny rule for its path. A matching deny rule prevents both the selected text and the open-file notice for that file from reaching Claude.

Read(**/.env) should block the selected text and open-file notice regardless of whether the IDE reports the file path as C:\...\.env or /mnt/c/...\.env — they are the same file.

Error Messages/Logs

# Injected selection context (key redacted):
The user selected the lines 4 to 4 from /mnt/c/Users/<user>/<project>/.env:
sk-ant-api03-<REDACTED>

# Read tool on the same file (deny rule working correctly on this channel):
File is in a directory that is denied by your permission settings.

Steps to Reproduce

1. On native Windows, add to ~/.claude/settings.json:

``json
{ "permissions": { "deny": ["Read(**/.env)"] } }
``

1. Start a Claude Code session in a project directory (e.g. C:\Users\<user>\<project>), connected to VS Code with the Claude Code extension, in a setup where the extension reports file paths in WSL style (/mnt/c/...).
2. Open the project's .env in the editor and select any line.
3. Send any message — the selection content and file path are attached to the conversation despite the deny rule.
4. Workaround check: add "Read(//mnt/**/.env)" to the deny list, restart the session, select again — nothing is attached.

Environment

• Claude Code: 2.1.220 (native installer, claude update reports up to date)
• OS: Windows 10 Pro 10.0.19045
• IDE: VS Code with Claude Code extension
• Model: Fable 5