[Bug] Deny rule with `*/**` pattern incorrectly blocks files at anchor depth

Bug Description
Edit deny rule "<dir>//*" also blocks files directly in <dir> Environment: Claude Code 2.1.280, Linux (WSL2), auto mode, sandbox enabled. User settings only (no project/local settings). Rule: Layout: ~/References/<checkout>/... subdirectories plus top-level files ~/References/refs.sh and ~/References/references.lock. Expected: per the permissions docs, "" matches within one path segment and a //- or ~/-anchored pattern matches only at its anchored depth, so /** needs at least one directory level. The rule should block ~/References/secretspec/x but allow ~/References/refs.sh. Actual: the Edit/Write tool refuses both: ~/References/refs.sh -> refused ~/References/references.lock -> refused ~/References/secretspec/.perm-probe -> refused (expected) Error: "File is in a directory that is denied by your permission settings." Isolation (same session, settings hot-reloaded between steps): - Removing the deny rule: top-level edits succeed. - Restoring it: top-level edits refused again. - Removing ~/References from additionalDirectories: no change. - The same rule shape for a second folder (//home/<user>/R//*) refused ~/R/top.txt the same way. Each rule only affects its own folder's top-level files. Repro: 1. mkdir -p ~/R/sub && echo test > ~/R/top.txt 2. Add "Edit(//home/<user>/R//*)" to permissions.deny. 3. Ask Claude to use the Edit tool on ~/R/top.txt -> refused (unexpected). Editing ~/R/sub/anything is refused as well (expected).

Environment Info

• Platform: linux
• Terminal: wsl-NixOS
• Version: 2.1.280
• Feedback ID: ea1047d1-ebed-4505-a459-26cf5057381b

Errors

[]