[BUG] autoAllowBashIfSandboxed regression in v2.1.70+ VSCode extension — write commands prompt despite sandbox

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

autoAllowBashIfSandboxed: true stopped working for Bash write commands in the VSCode extension starting with v2.1.70. All Bash commands that modify the filesystem (printf, mkdir, rm, touch) now prompt for permission, even within the project directory. Read-only commands (whoami, ls, cat) continue to auto-approve correctly.

Downgrading to v2.1.68 restores correct behavior.

What Should Happen?

With autoAllowBashIfSandboxed: true, any Bash command that can run inside the sandbox should auto-approve without a permission prompt, regardless of whether it matches an explicit permissions.allow rule. This is how it worked in v2.1.68.

Error Messages/Logs

Steps to Reproduce

1. Configure .claude/settings.json:

{
  "sandbox": {
    "enabled": true,
    "autoAllowBashIfSandboxed": true
  }
}

1. Open the project in VSCode with Claude Code extension v2.1.70 or v2.1.71
2. Ask Claude to run: touch test-file.txt
3. Observe: permission prompt appears ("Allow this bash command?")
4. Pin extension to v2.1.68, restart VSCode
5. Ask Claude to run: touch test-file.txt
6. Observe: command auto-approves and runs without prompting

Claude Model

Not sure / Multiple models

Is this a regression?

Yes, this worked in a previous version

Last Working Version

v2.1.68 (vscode extension)

Claude Code Version

v2.1.71 (vscode extension)

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

VS Code integrated terminal

Additional Information

Write commands are evaluated against the permissions.allow list before sandbox auto-approval is checked. Commands not matching an explicit allow rule (e.g., Bash(mkdir:*)) get prompted even though they can run sandboxed. Only commands matching an allow rule OR read-only commands bypass the prompt.

| Command | v2.1.68 | v2.1.70+ |
| ----------------------- | ------------- | ------------- |
| whoami | Auto-approved | Auto-approved |
| ls /tmp | Auto-approved | Auto-approved |
| touch file.txt | Auto-approved | PROMPTS |
| mkdir -p /tmp/dir | Auto-approved | PROMPTS |
| printf 'x' > file.txt | Auto-approved | PROMPTS |
| rm file.txt | Auto-approved | PROMPTS |

Environment

• Claude Code CLI: 2.1.63 and 2.1.71
• Claude Code VSCode extension: 2.1.71 (broken), 2.1.68 (working)
• Platform: macOS (Darwin 25.1.0, Apple Silicon)
• VSCode: latest stable

Tested with a combination of:

• CLI 2.1.63 and extension 2.1.71 (broken)
• CLI 2.1.71 and extension 2.1.71 (broken)
• CLI 2.1.63 and extension 2.1.68 (working)
• CLI 2.1.71 and extension 2.1.68 (working)

Workaround

Pin the VSCode extension to v2.1.68 via Extensions panel > gear icon > "Install Another Version..." and disable auto-update.