Permission gap detection doesn't match glob patterns correctly

[evansenter]

Problem

get_permission_gaps() returns commands that are already covered by glob patterns in settings.json:

Returned gaps:

• ~/.claude/contrib/repo-stats.sh (18 uses)
• ~/.claude/contrib/parse-session-logs.sh (16 uses)
• ./tests/test-hooks.sh (7 uses)

Existing permissions (should match):

"Bash(~/.claude/contrib/*:*)",  // Should match contrib scripts
"Bash(./tests/*.sh:*)"          // Should match test scripts

Impact

The API returns stale recommendations that clutter /improve-workflow output. Users have to manually filter out commands already covered by wildcards.

Related

• PR fix: Filter permission gaps against configured subcommand patterns #38 "fix: Filter permission gaps against configured subcommand patterns" - partial fix
• The fix handles simple prefix patterns but not * glob expansion

Proposed Fix

The pattern matching logic needs to handle * as a true glob:

• ~/.claude/contrib/* should match ~/.claude/contrib/repo-stats.sh
• ./tests/*.sh should match ./tests/test-hooks.sh

Consider using Python's fnmatch module for proper glob matching.

[evansenter]

Note: This is a separate issue from #57 (shell builtin false positives). This one is about glob pattern matching - e.g., ~/.claude/contrib/* should match ~/.claude/contrib/repo-stats.sh but doesn't.

[evansenter]

Closing as fixed. The codebase now uses fnmatch for proper glob pattern matching:

• patterns.py:698: fnmatch.fnmatch(cmd, pattern) matches commands against glob patterns
• patterns.py:614-667: _parse_settings_permissions() extracts both base commands and glob patterns
• guide.md:268-271: Documents glob pattern support

Patterns like Bash(make*) now correctly match make, make-test, etc.