getInitialPermissionMode() inspect() ignores Machine-level settings from devcontainer.json

Bug Description

getInitialPermissionMode() in the VS Code extension uses inspect() to read claudeCode.initialPermissionMode, but only checks three scopes:

let inspected = vscode.workspace.getConfiguration("claudeCode")
                     .inspect("initialPermissionMode");
let V = inspected?.workspaceFolderValue
     ?? inspected?.workspaceValue
     ?? inspected?.globalValue;

Machine-level settings are not covered by any of these. They appear in inspected.defaultValue (when set via DevContainer customizations.vscode.settings) or are accessible via plain get() — but inspect() intentionally separates them by scope, and none of the three checked scopes match Machine level.

Reproduction

1. Set in .devcontainer/devcontainer.json:

``json
"customizations": {
"vscode": {
"settings": {
"claudeCode.initialPermissionMode": "bypassPermissions",
"claudeCode.allowDangerouslySkipPermissions": true
}
}
}
``

1. Rebuild container, open VS Code
2. inspect("initialPermissionMode") returns:

``
workspaceFolderValue: undefined
workspaceValue: undefined
globalValue: undefined // User settings from host (empty)
defaultValue: "bypassPermissions" // Machine level — never checked
``

1. Result: V = undefined, falls through to "default" mode. Extension starts in default permission mode despite explicit configuration.

Expected Behavior

Settings from customizations.vscode.settings in devcontainer.json should be respected. Either:

• Check inspected?.defaultValue as a fallback, or
• Use getConfiguration("claudeCode").get("initialPermissionMode") which merges all scopes automatically

Workaround

Create .vscode/settings.json in the workspace with the same settings — inspect() picks up workspaceValue.

Related

• Protected directory prompts in bypass mode: #35942
• .claude/skills/ exemption not working: #36192

Environment

• Claude Code Extension: v2.1.79
• VS Code: 1.99.x
• Setup: DevContainer (Remote - Containers)
• Host: Windows 11 + Docker Desktop (WSL2)
• Container: node:22 (Debian)