[BUG] VSCode Extension: Bash commands execute without permission prompt despite 'default' Initial Permission Mode on macOS

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

Related issue: #29159 covers the same root cause on Windows/AWS Bedrock. This report confirms the bug also affects macOS/Anthropic API.

What's Wrong?

The Claude Code VSCode extension executes Bash tool calls (date, hostname, gh issue list, etc.) without ever prompting for user approval, despite:

• Initial Permission Mode set to default in VSCode Extension settings (@ext:Anthropic.claude-code Permission)
• Allow Dangerously Skip Permissions unchecked (false) in VSCode Extension settings
• ~/.claude/settings.json having an empty permissions.allow list

Per documentation, default mode should ask before running Bash commands. The extension silently auto-approves them instead.

What Should Happen?

A permission prompt should appear before executing any Bash command, since allow list is empty and mode is default.

Error Messages/Logs

No error messages — commands execute silently without any prompt.

Steps to Reproduce

1. Open VSCode with Claude Code extension in sidebar
2. Set Initial Permission Mode to default (VSCode settings: @ext:Anthropic.claude-code Permission)
3. Ensure Allow Dangerously Skip Permissions is unchecked
4. Ensure ~/.claude/settings.json has empty allow list (see config below)
5. Ask Claude to run any Bash command, e.g. "what is today's date?" or "what is the hostname?"
6. Observe: command executes immediately with no approval prompt

Claude Model

Sonnet (default)

Is this a regression?

I don't know

Last Working Version

_Unknown_

Claude Code Version

2.1.76 (Claude Code)

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

VS Code integrated terminal

Additional Information

~/.claude/settings.json:

{
  "permissions": {
    "allow": [],
    "additionalDirectories": []
  }
}

VSCode Extension settings (screenshot):

• Claude Code: Initial Permission Mode = default
• Claude Code: Allow Dangerously Skip Permissions = unchecked (false)

The CLI permission model and the VSCode extension appear to use separate permission enforcement paths. The extension does not honour the ~/.claude/settings.json allowlist, resulting in all Bash commands being silently auto-approved regardless of configuration.

Related issues:

• #29159 — same root cause, Windows + AWS Bedrock
• #33772 — similar report of auto-approved Bash in VSCode extension