Daily harness signal

Make permission depth executable

August 3, 2026 · JST One evergreen finding Permissions · hooks · path scope
Permission globs that look identical can carry different depth semantics. Make root versus any-depth intent explicit, then test each rule plane against both locations before unattended execution.
01 · Evergreen · source date 2026-07-18

The same glob is not the same boundary

Use when: a Claude Code repository has path-scoped allow, ask, or deny rules, or a hook if condition, and the same directory name appears at the project root and below packages or worktrees. This matters most before headless runs where an unexpected prompt becomes a failure and an overbroad allow becomes silent authority.

Action: require Claude Code 2.1.214 or later, then replace ambiguous intent with explicit pattern shapes. In .claude/settings.json use Edit(src/**) only for the project-root src tree; use Edit(**/src/**) only when every nested src tree is intended. Do not normalize deny or ask rules mechanically: Read(secrets/**) already matches secrets at any depth. Apply the same review to hook if conditions: a single-segment dir/** is root-scoped there, while **/dir/** is any-depth. Record a four-row rule table beside the config: rule type, pattern, root expectation, nested expectation. Keep deny, ask, allow, and hook rows separate even when their text looks similar.

Acceptance check: in a disposable repository create src/root.txt, packages/demo/src/nested.txt, secrets/root.txt, and packages/demo/secrets/nested.txt. Start a clean session from the repository root. With Edit(src/**) as the only edit allow, require the root edit to proceed without approval and the nested edit to prompt or fail. Swap to Edit(**/src/**) and require both edits to proceed. With Read(secrets/**) in deny, require both secret reads to fail. Finally, log the matching hook and assert src/** fires only for the root file while **/src/** fires for both. Any mismatch fails rollout.

Evidence: Anthropic's versioned v2.1.214 release says it repaired the single-segment allow-rule overmatch and changed hook if conditions to root-only. Current official permissions documentation publishes an explicit truth table: Edit(src/**) allow matches root but not nested, while the same single-segment shape in deny or ask matches both. The release and current docs are primary, inspectable, and mutually consistent.

Caveat: the asymmetric behavior is product-specific and intentionally retained for deny and ask rules; copying one pattern across rule types can still widen or narrow authority. Patterns are enforced by Claude Code, not an OS sandbox, and project allow rules require accepted workspace trust. Re-run the fixture after upgrades, on every supported platform, and whenever settings scope or launch directory changes.

Compact source notes

  1. Claude Code v2.1.214 (published 2026-07-18). Official versioned release documenting the allow-rule repair and hook-condition scope change.
  2. Claude Code permissions (retrieved 2026-08-03). Current official rule syntax, depth truth table, precedence, and workspace-trust boundary.
  3. Claude Code hooks guide (retrieved 2026-08-03). Current official hook configuration and executable verification guidance.
  4. Method: anchor lens—versioned release plus current primary documentation; unity lens—one rule matrix makes path authority inspectable across policy planes. The two-location fixture is the falsification check. Confidence: Confirmed for documented Claude Code semantics.