bypassPermissions mode still prompts for edits to ~/.claude/ files

Found 3 possible duplicate issues:

1. https://github.com/anthropics/claude-code/issues/37029
2. https://github.com/anthropics/claude-code/issues/37107
3. https://github.com/anthropics/claude-code/issues/37157

This issue will be automatically closed as a duplicate in 3 days.

• If your issue is a duplicate, please close it and 👍 the existing issue instead
• To prevent auto-closure, add a comment or 👎 this comment

🤖 Generated with Claude Code

The \~/.claude/\ directory is intentionally protected — it's a hardcoded exception in the permission system to prevent the model from modifying its own settings, hooks, and rules (which would be a security concern).
This is by design, not a bug. Even \bypassPermissions\ won't bypass this protection because:

• Hooks in \~/.claude/hooks/\ control what Claude can do
• Settings in \~/.claude/settings.json\ define permissions
• If Claude could modify these, it could escalate its own permissions

Workaround: Use a PreToolUse hook that auto-approves edits to specific \~/.claude/\ subdirectories you trust:
\\\bash
INPUT=\$(cat)
TOOL=\$(echo "\$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
FILE=\$(echo "\$INPUT" | jq -r '.tool_input.file_path // empty' 2>/dev/null)
[[ "\$TOOL" != "Edit" && "\$TOOL" != "Write" ]] && exit 0
case "\$FILE" in
*/\.claude/commands/*|*/\.claude/rules/*)
jq -n '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"allow","permissionDecisionReason":"custom commands/rules auto-approved"}}'
exit 0
;;
esac
exit 0
\\\
This selectively allows edits to \commands/\ and \rules/\ while keeping \hooks/\ and \settings.json\ protected.

@William-1776 Yes it is on purpose as described in https://code.claude.com/docs/en/permissions#permission-modes

You could maybe add:

  "permissions": {
    "allow": ["Edit(/.claude/path/to/what/you/want/**)"]
  },

if that is really what you want.

Seeing a related but potentially distinct issue on v2.1.81 Linux. In my case, the file being created is inside the project working directory (not inside .claude/): commands/csw:cleanup.md. Bypass permissions is active per the status bar but the creation prompt still fires. The colon in the filename (csw:cleanup.md) may be a separate trigger — the namespace:command.md naming convention is common for slash commands. Happy to file separately if this is a different code path.

<img width="1328" height="742" alt="Image" src="https://github.com/user-attachments/assets/46abb65a-a6e7-4df6-9246-5b32249a41e5" />
<img width="1432" height="700" alt="Image" src="https://github.com/user-attachments/assets/f9f9f10f-6042-46cc-ba0b-1e816b9cc70b" />
<img width="1260" height="992" alt="Image" src="https://github.com/user-attachments/assets/aace415e-bfc4-4d0d-9edc-19cf910fdb5b" />

Seeing a related but potentially distinct issue on v2.1.81 Linux. In my case, the file being created is inside the project working directory (not inside .claude/): commands/csw:cleanup.md. Bypass permissions is active per the status bar but the creation prompt still fires. The colon in the filename (csw:cleanup.md) may be a separate trigger — the namespace:command.md naming convention is common for slash commands. Happy to file separately if this is a different code path. <img alt="Image" width="1328" height="742" src="https://private-user-images.githubusercontent.com/80126/568288030-46abb65a-a6e7-4df6-9246-5b32249a41e5.png?jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3NzQ0MjcwNjgsIm5iZiI6MTc3NDQyNjc2OCwicGF0aCI6Ii84MDEyNi81NjgyODgwMzAtNDZhYmI2NWEtYTZlNy00ZGY2LTkyNDYtNWIzMjI0OWE0MWU1LnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNjAzMjUlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjYwMzI1VDA4MTkyOFomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWFmNGZlM2VjNTYxZjE2ZTM4MmU2YzhlNDZlYjI0OWJlNDk4NTk4MGQwNjYzNGQxODk1MjVlMTRmMjhhZmU4N2ImWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0In0.JVNyVm8dFLToSqCbWp3IX_5eMdeAc4uLcD0qcE-5zVc"> <img alt="Image" width="1432" height="700" src="https://private-user-images.githubusercontent.com/80126/568288277-f9f9f10f-6042-46cc-ba0b-1e816b9cc70b.png?jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3NzQ0MjcwNjgsIm5iZiI6MTc3NDQyNjc2OCwicGF0aCI6Ii84MDEyNi81NjgyODgyNzctZjlmOWYxMGYtNjA0Mi00NmNjLWJhMGItMWU4MTZiOWNjNzBiLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNjAzMjUlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjYwMzI1VDA4MTkyOFomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPThlYTM2ODlkMDcwOTNkMWIwYjU2NGZkNzlkZjYzNWFiYzVjZGYzNDRkOTA2OGMxZTFkM2Q5ZTQ2N2UzMzMzZWImWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0In0.wHl8bkSILLwDc-LoJeYg21mav9XYjYqNuGLMvRDNM_s"> <img alt="Image" width="1260" height="992" src="https://private-user-images.githubusercontent.com/80126/568288398-aace415e-bfc4-4d0d-9edc-19cf910fdb5b.png?jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3NzQ0MjcwNjgsIm5iZiI6MTc3NDQyNjc2OCwicGF0aCI6Ii84MDEyNi81NjgyODgzOTgtYWFjZTQxNWUtYmZjNC00ZDBkLTllZGMtMTljZjkxMGZkYjViLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNjAzMjUlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjYwMzI1VDA4MTkyOFomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTM4ODE5NzBiNjA4YjlmZmQwNzU1MjQ3YTFiMjU3ZGRhMjdiN2Q2NzRlNThmMjI5ZjI4MWQ2MjVjMzcxMTQzNzUmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0In0.9ehHpEbTPKTL9Uf60w2IDHWtd9rE7UDlyb0EBxoxp3Q">

Yes it is different.

Same issue on CLI (not just VS Code)

Experiencing the same behavior on Claude Code CLI with bypassPermissions mode.

Reproduction

settings.json:

{
  "permissions": {
    "allow": ["Bash"],
    "defaultMode": "bypassPermissions"
  },
  "skipDangerousModePermissionPrompt": true
}

Action: Bash(rm agent.md ...) inside ~/.claude/commands/sc/

Result:

"Claude requested permissions to edit /Users/.../\.claude/commands/sc/agent.md which is a sensitive file."

The Bash tool is already in permissions.allow, and bypassPermissions is active — yet the "sensitive file" guard still fires.

Workaround

Adding PermissionRequest hooks for all three tools that touch files:

"PermissionRequest": [
  { "matcher": "Edit",  "hooks": [{ "type": "command", "command": "echo '{\"hookSpecificOutput\":{\"hookEventName\":\"PermissionRequest\",\"decision\":{\"behavior\":\"allow\"}}}'" }] },
  { "matcher": "Write", "hooks": [/* same */] },
  { "matcher": "Bash",  "hooks": [/* same */] }
]

This defeats the purpose of bypassPermissions — you shouldn't need to manually re-bypass permissions that are already supposed to be bypassed.

Environment

• Claude Code CLI (not VS Code)
• macOS 15 (Darwin 25.4.0)
• defaultMode: "bypassPermissions" in ~/.claude/settings.json

Same issue here.

macOS 15, VS Code latest, Claude Code extension latest.
bypassPermissions configured in:

• VS Code User Settings
• VS Code Workspace Settings (.vscode/settings.json)
• ~/.claude/settings.json (defaultMode: dontAsk)
• .claude/settings.json (project, defaultMode: dontAsk)

Still getting "Make this edit to [file]?" dialog when editing files inside .claude/skills/.

This is very disruptive when using Claude Code for automated workflows — every skill edit requires manual approval despite full bypass configuration.

This being on purpose does NOT make sense at all for memory file edits though... whats the point of having a living memory system if it will need permissions constantly in order to stay up to date... same for skills

This is the second most important annoying issue after this https://github.com/anthropics/claude-code/issues/24726 i guess.

Closing for now — inactive for too long. Please open a new issue if this is still relevant.

ai 만드는 회사가 이런 버그도 못 고치다니...