[BUG] Bash permissions in settings.json not enforced - requires custom hook workaround

Found 3 possible duplicate issues:

1. https://github.com/anthropics/claude-code/issues/18160
2. https://github.com/anthropics/claude-code/issues/17321
3. https://github.com/anthropics/claude-code/issues/13340

This issue will be automatically closed as a duplicate in 3 days.

• If your issue is a duplicate, please close it and 👍 the existing issue instead
• To prevent auto-closure, add a comment or 👎 this comment

🤖 Generated with Claude Code

Update: Same Issue Affects Edit and Write Tools

This bug isn't limited to Bash commands — Edit and Write tool permissions are also not enforced.

Reproduction

1. Add Edit/Write permissions to settings.json:

{
  "permissions": {
    "allow": [
      "Edit(/Users/me/code/**)",
      "Write(/Users/me/code/**)",
      "Edit(/tmp/**)"
    ]
  }
}

1. Ask Claude to edit a file in ~/code/
2. Expected: Edit proceeds without prompt
3. Actual: Permission prompt still appears

Workaround: PreToolUse Hook for Edit/Write

I extended the hook approach to cover file operations:

#!/usr/bin/env python3
"""PreToolUse hook that auto-approves Edit and Write for allowed paths."""
import json
import sys
import os
from pathlib import Path

SETTINGS_FILE = Path.home() / ".claude" / "settings.json"

def load_path_patterns():
    edit_patterns = []
    write_patterns = []

    if SETTINGS_FILE.exists():
        with open(SETTINGS_FILE, 'r') as f:
            settings = json.load(f)
            permissions = settings.get("permissions", {})

            for rule in permissions.get("allow", []):
                if rule.startswith("Edit(") and rule.endswith(")"):
                    edit_patterns.append(rule[5:-1])
                elif rule.startswith("Write(") and rule.endswith(")"):
                    write_patterns.append(rule[6:-1])

    return edit_patterns, write_patterns

def path_matches_pattern(file_path: str, pattern: str) -> bool:
    file_path = os.path.normpath(file_path)
    if "**" in pattern:
        base_path = pattern.replace("**", "").rstrip("/")
        return file_path.startswith(base_path)
    return False

def main():
    try:
        input_data = json.load(sys.stdin)
    except json.JSONDecodeError:
        sys.exit(0)

    tool_name = input_data.get("tool_name", "")
    tool_input = input_data.get("tool_input", {})
    edit_patterns, write_patterns = load_path_patterns()

    patterns = []
    if tool_name == "Edit":
        patterns = edit_patterns
    elif tool_name == "Write":
        patterns = write_patterns
    else:
        sys.exit(0)

    file_path = tool_input.get("file_path", "")
    for pattern in patterns:
        if path_matches_pattern(file_path, pattern):
            print(json.dumps({
                "hookSpecificOutput": {
                    "hookEventName": "PreToolUse",
                    "permissionDecision": "allow",
                    "permissionDecisionReason": f"Path matches: {pattern}"
                }
            }))
            break

    sys.exit(0)

if __name__ == "__main__":
    main()

Hook Configuration

Add to settings.json:

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Edit",
        "hooks": [{
          "type": "command",
          "command": "/path/to/auto-approve-file-ops.py",
          "timeout": 5000
        }]
      },
      {
        "matcher": "Write",
        "hooks": [{
          "type": "command",
          "command": "/path/to/auto-approve-file-ops.py",
          "timeout": 5000
        }]
      }
    ]
  }
}

Summary

The permission system appears to be completely broken for all tool types:

• Bash: Reported in original issue
• Edit: Confirmed broken
• Write: Confirmed broken

The documented permissions.allow patterns are not being checked by the core permission system, forcing users to implement their own enforcement via hooks.

🦗 🦗 🦗

The current state of permissions and how they are repeatedly requested is insanely bad and needs to be fixed ASAP. It has major impact on productivity. Further, when multiple agents are executing, the responsivity of permissions prompts shown is virtually close to none and the TUI becomes unusable.

@lucasmccomb

Using fnmatch enables you to place wildcards () anywhere in your patterns (e.g., mkdir _output_*), allowing you to match commands with variable middle sections.
Additionally, the permissionDecisionReason returned in hookSpecificOutput perfectly supports these patterns, clearly identifying which wildcard rule authorized the action.

for example in settings.json:
`"permissions": {
"allow": [
// Matches any mkdir command have _output_
"Bash(mkdir -p _output_)",

// Matches any .log file within any "logs" directory at any depth
"Read(/logs/.log)",

// Matches any python script in the src directory of any project user
"Edit(/Users//project/src/.py)"
]
}`

update in auto-approve-*.py:
`
import fnmatch
def path_matches_pattern(file_path: str, pattern: str) -> bool:
file_path = os.path.normpath(file_path)

# Support wildcard matching (glob pattern)
if '*' in pattern and fnmatch.fnmatch(file_path, pattern):
return True

if "" in pattern:
base_path = pattern.replace("", "").rstrip("/")
return file_path.startswith(base_path)
return False
`

thank you @Sendarg! I will look into adding this.

I just posted https://github.com/anthropics/claude-code/issues/24832 and am curious if this is the same issue or just similar. Is permissions.bash.blocked the same feature as permissions.deny? My config format is different but also not enforced.

Had a similar issue on "Claude Version: 2.1.22 (Claude Code)" where the agent committed and pushed, even though he should not have.
Claude used for that

git add scripts/run_test_builder.sh && git commit -m "$(cat <<'EOF'
test_builder: clear pycache before run to pick up source changes
EOF
)" && git push

This should not been possible due to my settings (at least from a user point of view, I understand why it was possible)

```json {
{
"permissions": {
"deny": [
"Bash(git commit )", "Bash(git push )"
]
}
}

You've identified the right solution. Here's a complete hook that replaces the broken permissions.allow/deny system:

INPUT=$(cat)
COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
[ -z "$COMMAND" ] && exit 0
CLEAN=$(echo "$COMMAND" | tr '\n' ' ')
if echo "$CLEAN" | grep -qiE '(rm\s+-rf\s+/|DROP\s+TABLE|curl.*\|\s*bash|format\s+c:)'; then
    echo "BLOCKED by deny rule" >&2
    exit 2
fi
PARTS=$(echo "$CLEAN" | sed 's/#.*$//' | sed 's/\s*&&\s*/\n/g; s/\s*||\s*/\n/g; s/\s*;\s*/\n/g; s/\s*|\s*/\n/g')
ALL_SAFE=true
while IFS= read -r part; do
    part=$(echo "$part" | sed 's/^\s*//;s/\s*$//')
    [ -z "$part" ] && continue
    BASE=$(echo "$part" | awk '{print $1}')
    case "$BASE" in
        cd|ls|cat|head|tail|grep|rg|find|stat|wc|du|tree|file|which|realpath) ;;
        echo|printf|true|false|test|export|set|env|date|sleep) ;;
        sort|uniq|cut|tr|awk|sed|jq|yq|tee|xargs) ;;
        git) ;; # All git ops allowed — adjust as needed
        mkdir|touch|pwd|pushd|popd) ;;
        npm|npx|node|yarn|python|python3|pip|pytest|make|cargo) ;;
        *) ALL_SAFE=false; break ;;
    esac
done <<< "$PARTS"
if [ "$ALL_SAFE" = true ]; then
    jq -n '{hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"allow",permissionDecisionReason:"Allowed by hook-based permission system"}}'
fi
exit 0

// ~/.claude/settings.json
{
  "hooks": {
    "PreToolUse": [{
      "matcher": "Bash",
      "hooks": [{ "type": "command", "command": "bash ~/.claude/hooks/reliable-permissions.sh" }]
    }]
  }
}

The hook receives the raw command via JSON, splits compound commands itself, and checks each component. It doesn't depend on the pattern matcher that has the known bugs (wildcard matching, escape handling, heredoc parsing, compound command splitting).
Deny rules are also enforced reliably — the hook checks them first and exit 2 blocks the command regardless.

thank you for the workaround, this is golden!!! I had to ask claude to rewrite it into node tho since I had no python installed but it worked 🤣

I haven't had an issue with this anymore. Closing.