Issue Station
Sign In
Tools hereToolbox

claude-code - 💡(How to fix) Fix [BUG] Permission glob patterns don't match Windows 8.3 short name paths (JOHNSM~1 vs JohnSmith) [1 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
anthropics/claude-code#48118•Fetched 2026-04-15 06:32:40
View on GitHub
Comments
0
Participants
1
Timeline
5
Reactions
0
Author
mpurnell1mpurnell1
Participants
mpurnell1mpurnell1
Timeline (top)
labeled ×4cross-referenced ×1

Error Message

Error Messages/Logs

Code Example

"allow": [
    "Read(//c/Users/JOHNSM~1/AppData/Local/Temp/claude/c--project-dir/**)",
    "Read(C:\Users\JOHNSM~1\AppData\Local\Temp\claude\c--project-dir\**)",
    "Read(//c/Users/*/AppData/Local/Temp/claude/**)",
    "Read(**/AppData/Local/Temp/claude/**)"
]

---

Allow reading from C:\Users\JOHNSM~1\AppData\Local\Temp\claude\c--project-dir\76c0995d-...\tasks\b2nvecpt7.output?

---

Allow grep in C:\Users\JOHNSM~1\AppData\Local\Temp\claude\c--project-dir\76c0995d-...\tasks\b2nvecpt7.output?
RAW_BUFFERClick to expand / collapse

Preflight Checklist

  • I have searched existing issues and this hasn't been reported yet
  • This is a single bug report
  • I am using the latest version of Claude Code

What's Wrong?

On Windows, permission allow patterns fail to match file paths when Windows resolves the username to an 8.3 short name (e.g. JOHNSM~1 instead of JohnSmith). Background tasks and subagents generate paths using the short name form, so allow rules never match for temp directory files.

Controlled test with the same file, same session, same allow rules:

Path formatPrompted?
C:\Users\JohnSmith\AppData\Local\Temp\claude\...No
C:/Users/JohnSmith/AppData/Local/Temp/claude/...No
C:\Users\JOHNSM~1\AppData\Local\Temp\claude\...Yes

The global allow rule Read(//c/Users/JohnSmith/**) catches the long-name paths but not the short-name paths. Adding explicit short-name patterns in multiple formats also fails:

"allow": [
    "Read(//c/Users/JOHNSM~1/AppData/Local/Temp/claude/c--project-dir/**)",
    "Read(C:\Users\JOHNSM~1\AppData\Local\Temp\claude\c--project-dir\**)",
    "Read(//c/Users/*/AppData/Local/Temp/claude/**)",
    "Read(**/AppData/Local/Temp/claude/**)"
]

None of these match a JOHNSM~1 path. The * wildcard and ** prefix patterns also fail to match.

The directory is also listed in additionalDirectories (both short and long name forms) with no effect on prompts.

What Should Happen?

The permission matcher should resolve Windows 8.3 short names to long names (or vice versa) before glob matching, so that JOHNSM~1 paths match patterns containing JohnSmith or *.

Error Messages/Logs

Allow reading from C:\Users\JOHNSM~1\AppData\Local\Temp\claude\c--project-dir\76c0995d-...\tasks\b2nvecpt7.output?
Allow grep in C:\Users\JOHNSM~1\AppData\Local\Temp\claude\c--project-dir\76c0995d-...\tasks\b2nvecpt7.output?

Steps to Reproduce

  1. Use Windows with a username long enough to have an 8.3 short name (6+ chars)
  2. Add global allow: Read(//c/Users/JohnSmith/**)
  3. Find a file in the Claude temp directory: C:\Users\JOHNSM~1\AppData\Local\Temp\claude\...
  4. Ask Claude to read that file using the long-name path: C:\Users\JohnSmith\AppData\Local\Temp\... - no prompt
  5. Ask Claude to read the same file using the short-name path: C:\Users\JOHNSM~1\AppData\Local\Temp\... - prompted

In practice, background tasks and subagents generate the short-name paths, so users are prompted for every task output read despite having allow rules.

Claude Model

Opus

Is this a regression?

I don't know

Claude Code Version

2.1.108 (Claude Code)

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

VS Code integrated terminal

Additional Information

This is related to but distinct from #29574 (WSL path normalization). That issue covers forward-slash vs backslash matching on WSL. This issue is specific to native Windows where the glob matching itself works for long-name paths, but 8.3 short name resolution breaks all pattern matching regardless of format.

The ~ character in the short name may be relevant - it could be interpreted as a glob special character by the pattern matcher, which would explain why even literal JOHNSM~1 patterns and wildcard * patterns fail to match.

extent analysis

TL;DR

The permission matcher should be modified to handle Windows 8.3 short names by resolving them to long names before glob matching.

Guidance

  • The issue is likely caused by the permission matcher interpreting the ~ character in the short name as a glob special character, preventing matches even with literal or wildcard patterns.
  • To verify, test the permission matcher with a custom implementation that resolves short names to long names before matching, using the GetLongPathName Windows API function.
  • Consider adding a preprocessing step to the permission matcher to normalize file paths, replacing short names with their corresponding long names.
  • Investigate using a library or function that handles Windows path normalization, such as path.normalize() or a similar approach, to simplify the implementation.

Example

const path = require('path');
const win32 = require('win32');

// Preprocess file path to resolve short name to long name
function normalizePath(filePath) {
  const longPath = win32.GetLongPathName(filePath);
  return longPath;
}

// Example usage:
const filePath = 'C:\\Users\\JOHNSM~1\\AppData\\Local\\Temp\\claude\\...';
const normalizedPath = normalizePath(filePath);
console.log(normalizedPath); // Output: C:\Users\JohnSmith\AppData\Local\Temp\claude\...

Notes

This solution assumes that the GetLongPathName function is available and functional on the target Windows platform. Additionally, the implementation may need to handle edge cases, such as paths that do not have a corresponding long name.

Recommendation

Apply a workaround by implementing a custom path normalization function, such as the one described above, to resolve short names to long names before passing them to the permission matcher. This approach allows for a targeted fix without requiring significant changes to the underlying permission matching logic.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#api#index setup#retrieval issue#search optimization#API routing

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

claude-code - 💡(How to fix) Fix [BUG] Permission glob patterns don't match Windows 8.3 short name paths (JOHNSM~1 vs JohnSmith) [1 participants]