[BUG] Edit() deny rules with relative glob patterns don't apply to --add-dir working directories

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

A deny rule in user settings using a relative glob, e.g. "Edit(**/*.Designer.cs)", is only enforced inside the primary working directory. The same file pattern in an additional working directory (added via --add-dir or additionalDirectories) is not matched, and the edit goes through.

This is a silent failure mode: the user believes a class of files is protected everywhere, and it is protected in the repo they're looking at — so the gap is only discovered after a protected file has already been modified in the other repo.

What Should Happen?

**/*.Designer.cs reads as "any .Designer.cs anywhere". A deny rule should apply to every directory the session can write to, not just the primary one — or, if scoping to the primary root is intentional, the mismatch should be surfaced (e.g. a warning when a session starts with additional directories and relative-path permission rules).

Error Messages/Logs

# Denied (primary working directory) — correct:
Edit /home/me/repos/PrimaryRepo/.../Global.Designer.cs
<tool_use_error>File is in a directory that is denied by your permission settings.</tool_use_error>

# Allowed (additional working directory) — the bug:
Edit /home/me/repos/SecondRepo/.../Global.Designer.cs
The file ... has been updated successfully.

Steps to Reproduce

1. Add to ~/.claude/settings.json:

{ "permissions": { "deny": ["Edit(**/*.Designer.cs)"] } }

1. Create two repos, each with a matching file:

``
mkdir -p /tmp/primary/sub /tmp/secondary/sub
echo "original" > /tmp/primary/sub/Foo.Designer.cs
echo "original" > /tmp/secondary/sub/Foo.Designer.cs
``

1. cd /tmp/primary && claude --add-dir /tmp/secondary
2. Ask Claude to edit /tmp/primary/sub/Foo.Designer.cs → denied (correct)
3. Ask Claude to edit /tmp/secondary/sub/Foo.Designer.cs → succeeds (bug)

Note: these repro steps were generated by Claude and have not been tested. The confirmed repro steps use two sibling directories in ~/repos, with the primary having a project-level settings.json with the other allowed through permissions:additionalDirectories.

Claude Model

Opus

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.241 (Claude Code)

Platform

Anthropic API

Operating System

Other Linux

Terminal/Shell

WSL (Windows Subsystem for Linux)

Additional Information

_No response_