Write out colon subcommands explicitly for Claude Code permissions because test:* doesn’t match test:unit (prefix matching treats them as separate commands), and the fallback test* is too broad (matches testAndDestroyEnvironment).

For example:

{
  "permissions": {
    "allow": [
      "Bash(pnpm test:unit:*)", // Allows pnpm test:unit --arg etc.
      "Bash(pnpm test:e2e:*)",
      "Bash(pnpm test*)"        // ❌ <- will allow testAndDestroyEnvironment
    ]
  }
}

Note: Tested with Claude Code v2.1.3