Claude Code Wildcard Bug and the Safe Fix

James Turner

Brought to you by Jellypod AI, picture this scenario. You think you are being clever setting up custom permissions in Claude Code. You put in an allow rule like Bash git wildcard main, right? Because you just want to let it run git checkout main or git pull main without nagging you every single time.

Lachlan Reed

Yeah, nah, sounds dead simple, mate. I, I, I reckon half the devs out there have written a rule just like that to save two seconds of typing.

James Turner

Right! But here is the massive security loophole in version 2.1.246. If that wildcard sits before the subcommand, you just handed the model an open door to run arbitrary code without any prompt at all.

Lachlan Reed

mate that is proper sketchy. See, the way wildcards work in Claude Code allow rules, it matches raw text string patterns. So if you write git wildcard main, intended for git checkout main, it also blindly matches flags placed before the subcommand! Like, um, git exec path equals slash tmp slash bin main, or git c core dot pager equals cat slash etc slash passwd main.

James Turner

Wait, so because the wildcard is loose before the subcommand, an attacker or a hallucinated command could slip executable flags right into that gap?

Lachlan Reed

Spot on. It just evaluates that the string starts with git, has something in the middle, and ends with main. Boom, auto approved, bypasses all your safety checks. That is why Anthropic just added a big bright startup warning in 2.1.246 whenever it detects a wildcard sitting before a subcommand in your Bash rules.

James Turner

So how do we fix it? What is the right way to re architect these rules?

Lachlan Reed

Super straightforward. You replace those loose prefixed wildcards with explicit subcommand patterns. Instead of git wildcard main, you write Bash git checkout wildcard, or Bash git pull main. Keep the wildcard after the explicit action word so flags cannot hide in front of it. And look, if you hate hand editing dot claude slash settings dot json, you can just pop open slash permissions in the terminal. They added a handy Auto mode tab right inside the interface so you can audit all your classifier rules visually.

James Turner

Lachlan, this whole thing feels like classic early career shell scripting traps. Didn't you once tell me about a wild deployment script blunder back in Newcastle?

Lachlan Reed

Oh mate, do not remind me. I was twenty one, working out of my shed in Newcastle, writing automated deploy scripts for an indie client. I put a lazy rm rf wildcard build path in a hook, thinking it would only ever clear the local dist folder. Turned out a path variable resolved to empty on one bad midnight update, and that bloody wildcard wiped out half the staging root directory! I had to own up to the client at 2 AM. Taught me to never, ever leave loose wildcards anywhere near command execution.

James Turner

Man, tough lesson, but classic. Before we wrap, there are two really nice quality of life tweaks in 2.1.246 too, right?

Lachlan Reed

Yeah! Small but brilliant. End of turn duration lines now append exact completion timestamps, like Sautéed for 23s, done 6:05 PM. Super handy when you drop a long running task in the background and want to know when it finished without digging through terminal logs.

James Turner

And terminal diffs finally stop crashing! If a tool output produces a massive single line like a huge base 64 blob, diff rendering now auto truncates it instead of freezing your whole terminal window.

Lachlan Reed

That alone saves so many forced terminal restarts. Lock down those git wildcards, check your permissions tab, and enjoy the clean logs!