Repository navigation
Permission gap detection doesn't match glob patterns correctly #48
Description
Problem
get_permission_gaps() returns commands that are already covered by glob patterns in settings.json:
Returned gaps:
~/.claude/contrib/repo-stats.sh(18 uses)~/.claude/contrib/parse-session-logs.sh(16 uses)./tests/test-hooks.sh(7 uses)
Existing permissions (should match):
"Bash(~/.claude/contrib/*:*)", // Should match contrib scripts
"Bash(./tests/*.sh:*)" // Should match test scriptsImpact
The API returns stale recommendations that clutter /improve-workflow output. Users have to manually filter out commands already covered by wildcards.
Related
- PR fix: Filter permission gaps against configured subcommand patterns #38 "fix: Filter permission gaps against configured subcommand patterns" - partial fix
- The fix handles simple prefix patterns but not
*glob expansion
Proposed Fix
The pattern matching logic needs to handle * as a true glob:
~/.claude/contrib/*should match~/.claude/contrib/repo-stats.sh./tests/*.shshould match./tests/test-hooks.sh
Consider using Python's fnmatch module for proper glob matching.
Activity
feat: Close drill-down gaps in MCP API (RFC #49)
feat: Close drill-down gaps in MCP API (RFC #49) (#52)
evansenter commentedon Jan 8, 2026
Note: This is a separate issue from #57 (shell builtin false positives). This one is about glob pattern matching - e.g.,
~/.claude/contrib/*should match~/.claude/contrib/repo-stats.shbut doesn't.evansenter commentedon Jan 10, 2026
Closing as fixed. The codebase now uses
fnmatchfor proper glob pattern matching:patterns.py:698:fnmatch.fnmatch(cmd, pattern)matches commands against glob patternspatterns.py:614-667:_parse_settings_permissions()extracts both base commands and glob patternsguide.md:268-271: Documents glob pattern supportPatterns like
Bash(make*)now correctly matchmake,make-test, etc.