Bypass permissions mode still prompts for edits to ~/.claude/settings.json

Found 3 possible duplicate issues:

1. https://github.com/anthropics/claude-code/issues/36282
2. https://github.com/anthropics/claude-code/issues/36192
3. https://github.com/anthropics/claude-code/issues/36923

This issue will be automatically closed as a duplicate in 3 days.

• If your issue is a duplicate, please close it and 👍 the existing issue instead
• To prevent auto-closure, add a comment or 👎 this comment

🤖 Generated with Claude Code

I have the same issue on Claude Code extension in VSCode. Dangerously Skip Permissions/Bypass Permissions is totally broken.

Amazng how Anthropic can ship such slop that It's F-ing annoyng.

Similar reported bug - https://github.com/anthropics/claude-code/issues/11380#issuecomment-4104350262

Seems to be recent as of the last week or so.

I can confirm this issue is still very valid and happening even more frequently now, even with --dangerously-skip-permissions toggled on.

This is by design — ~/.claude/ is a hardcoded protected directory. Even --dangerously-skip-permissions won't bypass it, because the self-edit protection is meant to prevent the model from modifying its own hooks and settings (which could disable safety checks).
Workaround using PermissionRequest hooks:
Unlike PreToolUse, the PermissionRequest hook event fires after the built-in protection check, so it can override the prompt:

INPUT=$(cat)
FILE=$(echo "$INPUT" | jq -r '.tool_input.file_path // empty' 2>/dev/null)
case "$FILE" in
  */.claude/settings.json|*/.claude/hooks/*|*/.claude/skills/*)
    echo '{"hookSpecificOutput":{"hookEventName":"PermissionRequest","permissionDecision":"allow","permissionDecisionReason":"Auto-approved .claude/ write"}}'
    ;;
esac
exit 0

{
  "hooks": {
    "PermissionRequest": [{
      "matcher": "Edit|Write",
      "hooks": [{"type": "command", "command": "bash ~/.claude/hooks/allow-claude-dir.sh"}]
    }]
  }
}

Caveat: This has been reported as not working on some platforms (Windows, certain Claude Code versions). See #37765 for detailed testing by multiple users. If the hook doesn't work for you, please report your version and OS there — it helps narrow down when the built-in check overrides even PermissionRequest.
The cleanest fix would be an official --allow-self-edit flag or subdirectory allowlisting, which multiple users have requested.

Claude Code's auto-memory system blocks itself

The hardcoded .claude/ permission check doesn't just affect user-created files — it blocks Claude Code's own features:

Auto-memory writes: Claude Code's built-in memory system (the auto memory instructions in the system prompt) tells the model to write files to ~/.claude/projects/<project>/memory/ using the Write tool. This triggers the hardcoded .claude/ permission check every time, requiring manual approval for the model to use its own memory feature.

Additional findings from investigation:

• The check matches ANY directory named .claude/ in the path, not just ~/.claude/. Moving files to a different .claude directory (e.g. C:\Dev\.claude) still triggers the prompt.
• additionalDirectories in settings.json does NOT bypass this check.
• The PermissionRequest hook workaround (suggested in earlier comments) does NOT work on Windows.
• The only working bypass is using the Bash tool with jq/sed/python instead of Edit/Write — which defeats the purpose of having dedicated file tools.

Impact: ~10+ manual permission approvals per day for routine operations (memory writes, CLAUDE.md updates, editing files stored under ~/.claude/). This is on Windows 11, latest Claude Code version.

The product is blocking its own feature. Would an allowlist for ~/.claude/projects/ (or a --allow-self-edit flag) be feasible?

Affecting me too

FYI I pegged my Claude Code on version 2.1.77.

Add to ~/.bashrc or ~/.zshrc:

export DISABLE_AUTOUPDATER=1

Then install that specific version:

curl -fsSL https://claude.ai/install.sh | bash -s 2.1.77

I haven't had any model regressions or permission errors since doing this. This is why I was confused about recent punted model regressions -- I haven't experienced any.

I'm also clueless as to the updates to CC since I did this 😅

This is a duplicate of #38950, which was fixed as of version 2.1.126.

This is a duplicate of #38950, which was fixed as of version 2.1.126.

This issue was not fixed at 2.1.152 (Claude Code), even I have explicit settings, claude still ask for allow bypassPermissions?

~/.claude/settings.json

{
    "permissions": {
        "defaultMode": "bypassPermissions"
    },
    "skipDangerousModePermissionPrompt": true
}

This issue has been automatically locked since it was closed and has not had any activity for 7 days. If you're experiencing a similar issue, please file a new issue and reference this one if it's relevant.