[BUG] Plan mode prompts for permission on already-allowed read-only Bash commands

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Environment:

Claude Code VS Code extension v2.1.76
macOS (Darwin 23.4.0)
Working directory is a git worktree (not the main repo checkout)
Description:

When entering plan mode (which is inherently read-only), Claude Code prompts for user permission on every Bash call — even when those commands are read-only and explicitly listed in the project's .claude/settings.json allow list. This makes plan mode impractical for tasks like code reviews that require reading diffs, since each git diff, git status, or git log invocation triggers a permission prompt.

What Should Happen?

Read-only Bash commands that match an entry in permissions.allow should execute without prompting, regardless of whether plan mode is active. Plan mode's restriction is "no writes" — it shouldn't add a permission gate on top of the existing allow list for commands that are already approved and inherently read-only.

Error Messages/Logs

Steps to Reproduce

Reproduction steps:

Open a git repo (ideally a worktree) in VS Code with the Claude Code extension
Add read-only git commands to .claude/settings.json:

{
"permissions": {
"allow": [
"Bash(git diff:*)",
"Bash(git status:*)",
"Bash(git log:*)",
"Bash(ls:*)"
]
}
}
Start a conversation and enter plan mode (e.g. via /plan)
Ask Claude to review code changes — it will attempt git diff, git status, etc.
Observe: Each Bash call prompts for permission despite matching the allow list

Claude Model

Opus

Is this a regression?

No, this never worked

Last Working Version

_No response_

Claude Code Version

2.1.76

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

_No response_

#!/bin/bash
# auto-approve-readonly.sh
INPUT=$(cat)
CMD=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)

# Auto-approve read-only git/system commands
if echo "$CMD" | grep -qE '^\s*(git\s+(-C\s+\S+\s+)?(status|log|diff|show|branch|remote|tag)|ls|cat|head|tail|wc|find|which|echo|pwd|date|whoami)'; then
    echo '{"decision":"approve"}'
    exit 0
fi
exit 0

{
  "hooks": {
    "PreToolUse": [{
      "matcher": "Bash",
      "hooks": [{ "type": "command", "command": "bash ~/.claude/hooks/auto-approve-readonly.sh" }]
    }]
  }
}