Permission rules can now flatly deny tools that run code as another denied tool would
When Claude Code checks whether a tool is allowed to run because it "runs code as" another tool would, it previously only checked for a matching "ask" permission rule. It now also checks first for a matching "deny" rule (not counting rules that come from tool-narrowing). If one is found, the action is flatly refused with the message: "Permission to use <tool> has been denied: it runs code as <other tool> does, and a rule denies <other tool>."
Previously, a rule that denied one tool could be bypassed by using a different tool that runs code the same way, since only "ask" rules were checked in that path. Now a deny rule on the underlying capability blocks it outright.