[BUG] Non-interactive mode able to use tools including Bash and WebSearch without permissions

Environment

• Platform (select one):
• [ ] Anthropic API
• [ ] AWS Bedrock
• [ ] Google Vertex AI
• [x] Other: Anthropic Subscription
• Claude CLI version: 1.0.29
• Operating System: macOS 15.5, Fedora 42, Ubuntu docker container
• Terminal: ghostty, vscode integrated terminal

Bug Description

When run non-interactively (-p) claude code is able to use tools like Bash and WebSearch even through they are not allowed via configuration files or command line arguments. It is not able to use the Write tool without permission, though.

Steps to Reproduce

❯ claude -p "use the Bash tool to get the current datetime"
Wed Jun 18 22:52:25 MDT 2025

❯ claude -p "check if you are allowed to use the WebSearch tool by trying to issue a simple search"
Yes, the WebSearch tool is working properly. The search was successful and returned relevant results.

❯ claude -p "write a file called test.txt to the current directory"
I need permission to write the file. Please grant permission for the Write tool.

Expected Behavior

Should follow the behavior described in this table in the docs

Actual Behavior

Tools like Bash (!!!) and WebSearch are allowed to be run even without permissions, even though the table above says they require permissions.

Additional Context

This is also happening via the TypeScript SDK. I can't find any files on either of my machines or in devcontainers that would grant these permissions.