[BUG] VSCode extension does not enforce permissions from ~/.claude/settings.json -

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Description:

The Claude Code VSCode extension ignores the permissions.allow list defined in ~/.claude/settings.json. Tools not in the allow list (specifically Edit and Write) execute successfully without any prompt or block.

Steps to Reproduce:

Configure ~/.claude/settings.json with a restrictive permissions allow list that does NOT include Edit or Write (See below):

Open a project in VSCode with the Claude Code extension
Ask Claude to edit a file
Claude successfully calls the Edit tool — no prompt, no block
Expected Behavior:

The Edit tool should either be blocked entirely or the user should be prompted to approve it, since Edit is not in the permissions.allow list.

Actual Behavior:

The Edit tool executes without any permission check. Claude was able to edit files 3 times in a single conversation without ever being prompted, despite Edit not being in the allow list.

Environment:

OS: Windows 11 Pro 10.0.26100
Shell: Git Bash
Claude Code VSCode Extension (sidebar mode)
Provider: AWS Bedrock
Model: claude-opus-4-6 (via claudeCode.selectedModel in VSCode settings)
~/.claude/settings.json is the only config defining permissions (the orphan permissions block was removed from VSCode's settings.json as it is not a valid claudeCode.* prefixed setting)
Additional Context:

Per the settings documentation, ~/.claude/settings.json is the user-level global settings file and should apply across all interfaces including the VSCode extension. Per the VS Code documentation, Claude Code settings in ~/.claude/settings.json are "shared between the extension and CLI" and should be used for "allowed commands, environment variables, hooks, and MCP servers."

The permissions block is correctly formatted and works as expected (unverified) in the CLI — the issue appears to be isolated to the VSCode extension not reading or enforcing it.

{
  "model": "anthropic.claude-opus-4-6-v1",
  "awsAuthRefresh": "aws sso login --profile claude-bedrock-demo",
  "env": {
    "AWS_PROFILE": "claude-bedrock-demo",
    "AWS_REGION": "us-east-1",
    "CLAUDE_CODE_USE_BEDROCK": "1"
  },
  "permissions": {
    "allow": [
      "Read(**)",
      "Read(C:/VS Code/**)",
      "Read(C:/%userprofile/.claude/**)",
      "Read(C:/%userprofile/AppData/Roaming/Code/User/**)",
      "Glob(**)",
      "Grep(**)",
      "Bash(cat:*)",
      "Bash(head:*)",
      "Bash(tail:*)",
      "Bash(less:*)",
      "Bash(more:*)",
      "Bash(grep:*)",
      "Bash(find:*)",
      "Bash(ls:*)",
      "Bash(pwd:*)",
      "Bash(echo:*)",
      "Bash(uname:*)",
      "Bash(whoami:*)",
      "Bash(which:*)",
      "Bash(whereis:*)",
      "Bash(type:*)",
      "Bash(stat:*)",
      "Bash(file:*)",
      "Bash(wc:*)",
      "Bash(diff:*)",
      "Bash(tree:*)",
      "Bash(du:*)",
      "Bash(df:*)",
      "Bash(env:*)",
      "Bash(printenv:*)",
      "Bash(realpath:*)",
      "Bash(readlink:*)",
      "Bash(git status:*)",
      "Bash(git log:*)",
      "Bash(git diff:*)",
      "Bash(git show:*)",
      "Bash(git branch:*)",
      "Bash(git remote:*)",
      "Bash(git ls-files:*)",
      "Bash(git ls-tree:*)",
      "Bash(git rev-parse:*)",
      "Bash(git describe:*)",
      "Bash(git config --get:*)",
      "Bash(git config --list:*)",
      "Bash(gh pr view:*)",
      "Bash(gh pr list:*)",
      "Bash(gh pr diff:*)",
      "Bash(gh issue view:*)",
      "Bash(gh issue list:*)",
      "Bash(gh repo view:*)",
      "Bash(/c/Program Files/Amazon/AWSCLIV2/aws.exe bedrock list-foundation-models:*)",
      "Bash(/c/Program Files/Amazon/AWSCLIV2/aws.exe bedrock get-foundation-model:*)",
      "Bash(/c/Program Files/Amazon/AWSCLIV2/aws.exe s3 ls:*)",
      "Bash(/c/Program Files/Amazon/AWSCLIV2/aws.exe ec2 describe-instances:*)",
      "Bash(/c/Program Files/Amazon/AWSCLIV2/aws.exe sts get-caller-identity:*)",
      "Bash(/c/Program Files/Amazon/AWSCLIV2/aws.exe configure list:*)",
      "Bash(npm list:*)",
      "Bash(npm ls:*)",
      "Bash(npm view:*)",
      "Bash(npm outdated:*)",
      "Bash(pip list:*)",
      "Bash(pip show:*)",
      "Bash(pip freeze:*)",
      "Bash(poetry show:*)",
      "Bash(yarn list:*)",
      "Bash(cargo tree:*)",
      "Bash(test:*)",
      "Bash([:*)",
      "Bash(command:*)",
      "Bash(hash:*)"
    ]
  }
}

{
    "workbench.colorTheme": "Default Dark Modern",
    "files.autoSave": "afterDelay",
    "cloudcode.duetAI.languages": [
        "powershell",
        "python",
        "ruby",
        "json",
        "dockercompose",
        "dockerfile",
        "ini",
        "sql",
        "yaml"
    ],
    "git.enableSmartCommit": true,
    "git.confirmSync": false,
    "git.autofetch": true,
    "workbench.externalBrowser": "chrome",
    "cloudcode.yaml.schemas": {},
    "json.schemas": [],
    "remote.SSH.defaultForwardedPorts": [],
    "remote.SSH.enableX11Forwarding": false,
    "remote.SSH.showLoginTerminal": true,
    "remote.SSH.logLevel": "trace",
    "remote.SSH.remotePlatform": {
        "sse-test-01.ssnc-corp.cloud": "linux",
        "jump.ssnc-corp.cloud": "linux"
    },
    "git.ignoreRebaseWarning": true,
    "geminicodeassist.project": "",
    "security.workspace.trust.untrustedFiles": "open",
    "diffEditor.codeLens": true,
    "[dockercompose]": {
        "editor.insertSpaces": true,
        "editor.tabSize": 2,
        "editor.autoIndent": "advanced",
        "editor.defaultFormatter": "redhat.vscode-yaml"
    },
    "[github-actions-workflow]": {
        "editor.defaultFormatter": "redhat.vscode-yaml"
    },
    "git.replaceTagsWhenPull": true,
    "chatgpt.cliExecutable": "",
    "chatgpt.localeOverride": "",
    "claudeCode.preferredLocation": "sidebar",
    "terminal.integrated.profiles.windows": {
        "PowerShell": {
            "source": "PowerShell",
            "icon": "terminal-powershell"
        },
        "Command Prompt": {
            "path": [
                "${env:windir}\\Sysnative\\cmd.exe",
                "${env:windir}\\System32\\cmd.exe"
            ],
            "args": [],
            "icon": {
                "id": "terminal-cmd"
            }
        },
        "Git Bash": {
            "source": "Git Bash",
            "icon": "terminal-git-bash"
        },
        "Ubuntu (WSL)": {
            "path": "C:\\WINDOWS\\System32\\wsl.exe",
            "args": [
                "-d",
                "Ubuntu"
            ]
        },
        "AlmaLinux-9 (WSL)": {
            "path": "C:\\WINDOWS\\System32\\wsl.exe",
            "args": [
                "-d",
                "AlmaLinux-9"
            ]
        }
    },
    "terminal.integrated.defaultProfile.windows": "AlmaLinux-9 (WSL)",
    "terminal.integrated.automationProfile.linux": {
        
    },
    "claudeCode.selectedModel": "global.anthropic.claude-opus-4-6-v1"
}

What Should Happen?

Not be able to edit files without prompting user.

Error Messages/Logs

Steps to Reproduce

Open a project in VSCode with the Claude Code extension
Ask Claude to edit a file
Claude successfully calls the Edit tool — no prompt, no block

Claude Model

Opus

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.59 (Claude Code)

Platform

AWS Bedrock

Operating System

Windows

Terminal/Shell

VS Code integrated terminal

Additional Information

_No response_