## Description When launching Claude Code with `--dangerously-skip-permissions`, the CLI still prompts for user confirmation on `Read` tool calls for files outside the project directory. ## Steps to Reproduce 1. Start Claude Code with: `claude --allow-dangerously-skip-permissions` 2. Confirm the flag is active via `ps aux` (shows `claude --allow-dangerously-skip-permissions`) 3. Confirm parent process via `ps -p $PPID -o tty=,args=` from within the session — output: `ttys000 claude --allow-d

--dangerously-skip-permissions still prompts for confirmation on Read tool

Status Fixed / completed

Maintainer reply None cached

Activity 4 comments · opened Mar 22, 2026 · closed Mar 26, 2026

Description

When launching Claude Code with --dangerously-skip-permissions, the CLI still prompts for user confirmation on Read tool calls for files outside the project directory.

Steps to Reproduce

Start Claude Code with: claude --allow-dangerously-skip-permissions
Confirm the flag is active via ps aux (shows claude --allow-dangerously-skip-permissions)
Confirm parent process via ps -p $PPID -o tty=,args= from within the session — output: ttys000 claude --allow-dangerously-skip-permissions
Ask the agent to read a file outside the project directory, e.g. /opt/homebrew/Cellar/dippy/0.2.6/libexec/src/dippy/dippy.py

Expected Behavior

The Read tool should execute without prompting, as --dangerously-skip-permissions should bypass all permission checks.

Actual Behavior

The CLI displays a confirmation prompt:

Read file

  Read(/opt/homebrew/Cellar/dippy/0.2.6/libexec/src/dippy/dippy.py)

 Do you want to proceed?
 ❯ 1. Yes
   2. Yes, allow reading from dippy/ during this session
   3. No

Environment

OS: macOS (Darwin 25.3.0)
Claude Code: latest (installed via npm)
Shell: zsh
Plugins active: superpowers, everything-claude-code, vercel, dippy, and others
Hooks: PreToolUse hooks from Dippy (Bash matcher only) and ECC (no Read matcher)

Analysis

The flag is confirmed active on the correct process (verified via ps -p $PPID)
No PreToolUse hooks match the Read tool — Dippy only matches Bash, ECC hooks match Bash|Write|Edit|MultiEdit or * (but none return ask for Read)
This appears to be a bug where the --dangerously-skip-permissions flag does not fully suppress the built-in permission system for Read operations on paths outside the project directory

Additional Context

The settings.json has "skipDangerousModePermissionPrompt": true configured, which may be related but does not resolve the issue.

View original on GitHub ↗

4 Comments

github-actions[bot] · 6 months ago

Found 3 possible duplicate issues:

This issue will be automatically closed as a duplicate in 3 days.

If your issue is a duplicate, please close it and 👍 the existing issue instead
To prevent auto-closure, add a comment or 👎 this comment

🤖 Generated with Claude Code

3lgr · 6 months ago

Root Cause Found

I added a diagnostic hook (PreToolUse, matcher *) that captures the raw JSON input from the CLI. Results:

Session started with --allow-dangerously-skip-permissions:

{
  "permission_mode": "default",
  "hook_event_name": "PreToolUse",
  "tool_name": "Bash",
  ...
}

Another session also started with --allow-dangerously-skip-permissions:

{
  "permission_mode": "acceptEdits",
  "hook_event_name": "PreToolUse",
  "tool_name": "Bash",
  ...
}

Neither session sends "permission_mode": "bypassPermissions" to hooks, despite both processes running with the flag:

elger  6904  claude --allow-dangerously-skip-permissions   (ttys002)
elger 17017  claude --allow-dangerously-skip-permissions   (ttys000)

Expected: When --allow-dangerously-skip-permissions is active, hooks should receive "permission_mode": "bypassPermissions" so they can auto-approve.

Actual: Hooks receive "permission_mode": "default" or "acceptEdits", causing tools like Dippy (which correctly checks for bypassPermissions at line 351) to fall through to their normal analysis and potentially prompt for confirmation.

Impact: Third-party PreToolUse hooks that implement bypass logic (like Dippy) cannot detect the flag, defeating the purpose of --dangerously-skip-permissions for hook-managed permissions.

Version: Claude Code 2.1.81, macOS Darwin 25.3.0 (arm64)

3lgr · 6 months ago

Resolution

The root cause was identified and documented above: when --dangerously-skip-permissions is active, the permission_mode field sent to PreToolUse hooks is "default" or "acceptEdits" instead of the expected "bypassPermissions". This prevents third-party hooks (like Dippy) from detecting the flag and auto-approving.

Workaround: Instead of relying on --dangerously-skip-permissions for hook-managed permissions, configure explicit allow rules in settings.json for the specific tools and paths needed. This gives deterministic behavior regardless of the flag propagation bug.

Closing as reported with root cause documented. The core bug (permission_mode not reflecting the CLI flag in hook input) remains a valid issue for the Claude Code team to address.