bypassPermissions mode not working in VS Code extension

Found 3 possible duplicate issues:

1. https://github.com/anthropics/claude-code/issues/15921
2. https://github.com/anthropics/claude-code/issues/2933
3. https://github.com/anthropics/claude-code/issues/18191

This issue will be automatically closed as a duplicate in 3 days.

• If your issue is a duplicate, please close it and 👍 the existing issue instead
• To prevent auto-closure, add a comment or 👎 this comment

🤖 Generated with Claude Code

Still getting this with Claude Code 2.1.50 and VSCode extension 2.1.49. Can be partially mitigated by having this is Claude global settings:

{
  "permissions": {
    "allow": [
      "Bash(*)",
      "Edit(*)",
      "Write(*)",
      "Read(*)",
      "Glob(*)",
      "Grep(*)"
    ]
  },
  ...
}

plz solve this

issue was reproduced on
VS Code: 1.110.1
claude code for VS Code: 2.1.79
OS: Linux

after upgrade

issue was reproduced on VS Code: 1.110.1 claude code for VS Code: 2.1.79 OS: Linux after upgrade

IDE-VSCODE-CC-01-v1: Workaround — bypassPermissions in VSCode Extension

Linked rule: [IDE-VSCODE-CC-01-v1](IDE-VSCODE-CC-01-v1.md) Upstream: anthropics/claude-code#20536

---

Environment

| Component | Version |
|---|---|
| OS | Ubuntu 25.10, Linux 6.17.0-19-generic x86_64 |
| VSCode | 1.112.0 (x64) |
| Claude Code Extension | anthropic.claude-code@2.1.79 |
| Mode | VSCode native chat panel (NOT CLI in terminal) |

---

Problem

defaultMode: "bypassPermissions" alone was ignored by the extension. Granular per-command entries like Bash(curl:*) worked, but broad wildcards like Read(*) did not. MCP tool calls always prompted.

---

Workaround: Belt-and-Suspenders Config

The key insight: both defaultMode: "bypassPermissions" AND explicit tool wildcards are needed together. Neither alone is sufficient.

Step 1 — ~/.claude/settings.json (global)

{
  "permissions": {
    "allow": [
      "Bash(*)",
      "Read(*)",
      "Edit(*)",
      "Write(*)",
      "Glob(*)",
      "Grep(*)",
      "WebFetch(*)",
      "WebSearch(*)",
      "Agent(*)",
      "NotebookEdit(*)",
      "Skill(*)"
    ],
    "defaultMode": "bypassPermissions"
  }
}

Step 2 — .claude/settings.local.json (project-level, same permissions block)

{
  "permissions": {
    "allow": [
      "Bash(*)",
      "Read(*)",
      "Edit(*)",
      "Write(*)",
      "Glob(*)",
      "Grep(*)",
      "WebFetch(*)",
      "WebSearch(*)",
      "Agent(*)",
      "NotebookEdit(*)",
      "Skill(*)"
    ],
    "defaultMode": "bypassPermissions"
  }
}

Step 3 — VSCode User Settings (~/.config/Code/User/settings.json)

{
  "claudeCode.allowDangerouslySkipPermissions": true,
  "claudeCode.initialPermissionMode": "bypassPermissions"
}

Step 4 — Restart VSCode completely (not just reload window)

---

Verification

After applying, tested 10 tools across all categories — zero permission prompts:

| Tool | Auto-approved? |
|---|---|
| Bash(echo ...) | Yes |
| Bash(podman compose ps) | Yes |
| Read(file) | Yes |
| Edit(file) | Yes |
| Glob(*.md) | Yes |
| Grep(pattern) | Yes |
| MCP tool calls (5 different servers) | Yes |

---

Extension Logs

Log location: ~/.config/Code/logs/{session}/window1/exthost/Anthropic.claude-code/Claude VSCode.log

Permission evaluation (working — not blocked)

2026-03-20T20:01:45.045Z [DEBUG] bashToolHasPermission: tree-sitter unavailable, using legacy shell-quote path

Settings loading — 3 locations checked, 2 missing is normal

2026-03-20T19:56:42.542Z [DEBUG] Broken symlink or missing file encountered for settings.json at path: /project/.claude/settings.json
2026-03-20T19:56:42.544Z [DEBUG] Broken symlink or missing file encountered for settings.json at path: /etc/claude-code/managed-settings.json

The extension reads settings from:

1. ~/.claude/settings.json — global (read successfully)
2. .claude/settings.local.json — project-level (read successfully)
3. /etc/claude-code/managed-settings.json — enterprise (missing, expected)

Note: .claude/settings.json (without .local) at project level logs as "Broken symlink" — the extension only looks for settings.local.json at project scope.

---

Notes

• MCP tool wildcards also work with the mcp__servername__* pattern in the allow list.
• Previously only defaultMode: "acceptEdits" was set with per-command Bash entries — switching to "bypassPermissions" + full wildcard list fixed it.
• The tree-sitter unavailable log line is cosmetic — permission check falls back to shell-quote parser and works fine.

---

Verified 2026-03-20 | Workaround for upstream bug #20536

The key finding (both defaultMode AND explicit wildcards needed together) isn't documented anywhere upstream, so that comment adds real value.

Note that issues reproduces easily when we mention 'plan' in prompt, e.g. asking the agent to prepare a plan,
it goes into planning mode and doesn't return to Bypass Permissions one without operator intervention.
I understand this is as designed.
However if I don't apply above workaround on latest version just stops my IDE from expected workflow with the Permissions Bypass.

Personal lesson learned & a recommendation for Claude Code users - disable automatic update for Claude Code. We cannot be sure about it's quality unless we certify it in our own environments.

To creators of Claude Code:
thank you for this amazing tool & good blessings ❤️ 🌞 🌻 🍀 .
Please, consider this as a procedural enhancement - introduce code certification with evidence collection so that community knows what the tool can do - treat it as a functional certification guardrail.

This stuff appeared to me on vs code 1.124 (and anothe previous version) on the 9th of June.
Today 2.1.175 affected
Yesterday 2.1.173 affeted
Probably last workign was 2.1.170

Talking about VSCode Extension installed and autoupodate via VS Code