[BUG] Deny list bypassed when skipAutoPermissionPrompt: true is set

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Tools in the project-level deny list (.claude/settings.json → permissions.deny) are not blocked when skipAutoPermissionPrompt: true is set in user-level ~/.claude/settings.json. The denied command executes successfully instead of being hard-blocked.

This also reproduces in non-interactive mode (claude -p), where there is no TTY to prompt on — denied tools silently auto-approve.

What Should Happen?

Deny-listed tools should be unconditionally blocked regardless of:

• skipAutoPermissionPrompt setting
• Interactive vs non-interactive mode (-p flag)
• User-level vs project-level settings

The deny list should be a hard gate, not a "would prompt but skip" gate.

Error Messages/Logs

# No error — command runs successfully when it should be blocked
  $ cd /tmp/deny-list-repro
  $ claude -p "Run python3 -c \"print('hello')\" using the Bash tool"
  Output: `hello`

Steps to Reproduce

1. Create a project with a deny list:

mkdir -p /tmp/deny-list-repro/.claude && cd /tmp/deny-list-repro && git init
cat > .claude/settings.json << 'EOF'
{
"permissions": {
"allow": ["Bash(echo *)"],
"deny": ["Bash(python3 *)"],
"defaultMode": "auto"
}
}
EOF

1. Ensure user-level settings have skipAutoPermissionPrompt:

# ~/.claude/settings.json should contain:
# "skipAutoPermissionPrompt": true

1. Run:

claude -p "Run python3 -c \"print('hello')\" using the Bash tool"

1. Expected: blocked with permission error
2. Actual: prints hello — deny list bypassed

Claude Model

Opus

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.96 (Claude Code)

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

iTerm2

Additional Information

The deny list pattern Bash(python3 *) is in the project-level .claude/settings.json. The user-level ~/.claude/settings.json does not have a corresponding deny entry but has skipAutoPermissionPrompt: true. It appears the combination causes denied tools to be auto-approved instead of hard-blocked.