Description

claude-flow v2.0.0-alpha.128 generates .claude/settings.json with invalid permission syntax that causes Claude Code to report validation errors. The tool uses * wildcards instead of the required :* prefix matching syntax.

Current Behavior

claude-flow generates permissions like:

"allow": [
  "Bash(npx claude-flow *)",
  "Bash(git diff *)",
  "Bash(git commit *)"
]

Expected Behavior

Should generate Claude Code compatible syntax:

"allow": [
  "Bash(npx claude-flow:*)",
  "Bash(git diff:*)",
  "Bash(git commit:*)"
]

Error Messages

Invalid Settings
 /home/vamsi/svclnk-migration/.claude/settings.json
  └ permissions
    ├ allow
    │ ├ "Bash(npx claude-flow *)": Use ":*" for prefix matching, not just "*".
    │   Change to "Bash(npx claude-flow:*)" for prefix matching.
    │ ├ "Bash(git diff *)": Use ":*" for prefix matching, not just "*".
    │   Change to "Bash(git diff:*)" for prefix matching.

Steps to Reproduce

1. Install claude-flow: npm install -g claude-flow@alpha
2. Initialize claude-flow in a project
3. Check .claude/settings.json permissions section
4. Run Claude Code doctor command to see validation errors

Environment

• claude-flow version: v2.0.0-alpha.128
• Claude Code version: 1.0.128
• OS: Linux

Suggested Fix

Update the settings generator to:

1. Replace all * with :* for prefix matching in allow/deny lists
2. Remove unsupported wildcard patterns in the middle of commands (e.g., "Bash(curl * | bash)")
3. Follow Claude Code's permission syntax documentation

Additional Context

This affects all users trying to use claude-flow with Claude Code, causing permission validation errors that need manual fixing.