[BUG] Agent Teams teammates ignore bypassPermissions for Bash and don't inherit project settings.local.json

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

When spawning Agent Teams teammates via the Task tool with mode: "bypassPermissions", the teammates still prompt the parent session's user for Bash command approval. Additionally, permissions saved via "Yes, and always allow" from teammate prompts (which write to project settings.local.json) are not inherited by teammates in subsequent sessions.

Three separate issues compound here:

1. bypassPermissions doesn't bypass Bash prompts for teammates. Teammates spawned with mode: "bypassPermissions" still trigger permission prompts for Bash commands like mkdir, cat << heredoc, node /tmp/..., etc.

1. Teammates don't inherit project settings.local.json. The project-level settings file accumulates 100+ "always allow" entries over time, but teammates don't read them. Commands like Bash(mkdir:*), Bash(cat:*), Bash(node) are all present in project settings.local.json but teammates still prompt.

1. "Always allow" from teammate prompts doesn't persist. Selecting option 2 ("Yes, and always allow access to X from this project") on a teammate permission prompt does not prevent the same prompt in the next session's teammates.

What Should Happen?

1. mode: "bypassPermissions" should grant teammates full Bash execution without prompts, matching the behavior for non-team subagents.
2. Teammates should inherit permissions from the project's settings.local.json.
3. "Always allow" selections from teammate prompts should persist and apply to future teammate sessions.

Error Messages/Logs

No error messages — teammates function correctly once approved. The issue is the repeated user intervention required.

Example prompts that appear despite bypassPermissions:

Bash command · @architect
    mkdir -p <project>/.claude/state/feedback
    Ensure feedback directory exists

Do you want to proceed?
› 1. Yes
  2. Yes, and always allow access to feedback/ from this project
  3. No

Bash command · @architect
    cat << 'SCRIPT' > /tmp/generate-level1-1.mjs
    // Level generator script...

Do you want to proceed?
› 1. Yes
  2. Yes, and always allow...
  3. No

Same prompts appear for other teammates running node scripts to parse JSON files.

Steps to Reproduce

1. Start Claude Code (default permission mode, NOT delegate mode)
2. Create a team: TeamCreate: { team_name: "test-team" }
3. Spawn a teammate with bypassPermissions:

``
Task: {
subagent_type: "general-purpose",
mode: "bypassPermissions",
name: "worker",
team_name: "test-team",
prompt: "Run: mkdir -p /tmp/test-dir && echo hello > /tmp/test-dir/file.txt"
}
``

1. Observe: User is prompted to approve the mkdir and echo commands despite bypassPermissions.
2. Select "Yes, and always allow" on each prompt.
3. End session, start new session, repeat steps 2-4.
4. Observe: Same prompts appear again — "always allow" did not persist for teammates.

Environment

• Project settings.local.json contains 100+ allow rules including Bash(mkdir:*), Bash(cat:*), Bash(node), Bash(bash:*), Bash(grep:*), etc. — all accumulated from previous "always allow" selections. None are inherited by teammates.
• Global ~/.claude/settings.json allow rules were added as a workaround — effectiveness for teammates TBD.

Related Issues

• #24307 / #24073 / #23447: Delegate Mode strips ALL tools from teammates (more severe, different root cause)
• #11380: "Always allow" not persisting generally (Windows, not team-specific)
• #24505: Feature request for per-teammate hook configuration

Claude Model

Opus 4.6

Is this a regression?

I don't know

Claude Code Version

2.1.45

Platform

Anthropic API (Claude Max)

Operating System

macOS (Darwin, Apple Silicon)

Terminal/Shell

Ghostty

Additional Information

Workaround attempted: Adding Bash allow rules to global ~/.claude/settings.json instead of project settings.local.json. This may help if teammates read global but not project settings — testing in progress.

Impact: For workflows that spawn multiple teammates running many Bash commands (e.g., level generation pipelines with 10+ tasks), the user must manually approve dozens of prompts per session. This defeats the purpose of autonomous team operation and makes bypassPermissions ineffective for Agent Teams.