[BUG] WebSearch permission allow rule is ignored — every call prompts despite a valid bare-tool-name rule

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Environment: Claude Code via VS Code extension, macOS 25.3.0. (Add your version from /doctor.)

Config — project .claude/settings.json:

{ "permissions": { "allow": ["WebSearch"] } }
.claude/settings.local.json is {}. Neither user-level ~/.claude/settings.json nor managed settings contain any WebSearch entry in allow, ask, or deny.

Expected: per Configure permissions — "Permission rules follow the format Tool or Tool(specifier). To match all uses of a tool, use only the tool name without parentheses" — WebSearch calls should run without prompting.

Actual: every WebSearch call prompts for approval. Four consecutive calls in one session, all prompted.

Control cases in the same session, same settings file:

WebFetch(domain:code.claude.com) — allowed, no prompt. Rules out deferred-tool-loading as a cause (WebSearch and WebFetch were loaded by the same ToolSearch call).
Bash(cat:*) added to the same file mid-session — took effect immediately. Rules out stale settings.
Note: WebSearch does not appear anywhere in the permissions documentation — not in the "match all uses of a tool" table, not in the tool-specific specifier sections. WebFetch has a full section. This suggests WebSearch may not be wired into the permission-rule matcher at all.

What Should Happen?

Expected: per Configure permissions — "Permission rules follow the format Tool or Tool(specifier). To match all uses of a tool, use only the tool name without parentheses" — WebSearch calls should run without prompting.

Error Messages/Logs

Steps to Reproduce

Config — project .claude/settings.json:

{ "permissions": { "allow": ["WebSearch"] } }
.claude/settings.local.json is {}. Neither user-level ~/.claude/settings.json nor managed settings contain any WebSearch entry in allow, ask, or deny.

Claude Model

Opus

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.224

Platform

Other

Operating System

macOS

Terminal/Shell

VS Code integrated terminal

Additional Information

_No response_