[BUG] Permissions: denied commands ignored with wildcard mistake

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

When I add a permitted command (such as "Bash(git add:*)") to my ./.claude/settings.json, it works. When I add a command without the : (such as "Bash(git commit -m *)"), it nullifies not only the added command, but also the others. It also nullifies commands in the "deny" section (such as "Bash(git add .)").

An ignored deny rule seems bad, even if it's due to a wildcard issue within a separate rule.

No indication is given in the UI that there was an issue understanding the permissions.

Relatedly, the permissions appear to be reloaded if I edit settings without quitting Claude. But that update is blocked when a wildcard issue is present, and no indication is given that there was an issue in that case either.

What Should Happen?

Provide feedback to the user that something is off with the settings by either:

• Issue a warning at startup or when reloading permissions. Maybe even a "modal dialog" like the trust question. Otherwise...
• Print the file and line number of the problem with a message and refuse to start entirely

If those choices raise too many TUI issues, then at least the valid permissions should be honored.

Error Messages/Logs

No error messages.

Steps to Reproduce

1. Create ./.claude/settings.json with:

``
{
"permissions": {
"allow": [
"Bash(git add:*)"
]
}
}
``

1. Start claude and enter the prompt:

> Please run: git add .

Claude should run the command without asking for permission (and it does for me). Whether anything is added or the command exits with errors doesn't really matter.

1. Replace ./.claude/settings.json with:

``
{
"permissions": {
"allow": [
"Bash(git add:*)"
],
"deny": [
"Bash(git add .)"
]
}
}
``

1. Start claude anew and enter the prompt:

> Please run: git add .

Claude should not be permitted to run the command:
> ⎿  Error: Permission to use Bash with command git add . has been denied.

(and so it is for me).

1. Finally, replace ./.claude/settings.json with:

``
{
"permissions": {
"allow": [
"Bash(git add:*)",
"Bash(git commit -m *)"
],
"deny": [
"Bash(git add .)"
]
}
}
``

1. Start claude anew and enter the prompt yet again:

> Please run: git add .

Claude should not be permitted to run the command as before, however, it ignores the "deny" rule and instead prompts me:

╭────────────────────────────────────────────────────────────────────────────────╮
│ Bash command                                                                   │
│                                                                                │
│   git add .                                                                    │
│   Stage all changes to git index                                               │
│                                                                                │
│ Do you want to proceed?                                                        │
│ ❯ 1. Yes                                                                       │
│   2. Yes, and don't ask again for git add commands in                          │
│   /Users/marcel/Projects/orm-jonathan-johnson                                  │
│   3. No, and tell Claude what to do differently (esc)                          │
╰────────────────────────────────────────────────────────────────────────────────╯

Claude Model

Sonnet (default)

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.0.21

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Other

Additional Information

I find the wildcard behavior to be a little under-documented. That makes this bug even more confusing and potentially hazardous.

I found the note about prefix matching here to be illuminating, but the bit about the space before colon appears to be out-of-date or incorrect.