UNC path check false-positive blocks WSL paths even with bypassPermissions

Status Fixed / completed

Maintainer reply ✓ Yes — ashwin-ant

Activity 4 comments · opened Apr 16, 2026 · closed Apr 18, 2026

💡 Likely answer: A maintainer (ashwin-ant, collaborator) responded on this thread — see the highlighted reply below.

Problem

On Windows with WSL2, all file operations targeting WSL paths (\\wsl.localhost\Ubuntu-24.04\... or \\wsl$\Ubuntu-24.04\...) trigger a "suspicious Windows path pattern" prompt that cannot be bypassed — even with permissionMode: "bypassPermissions", skipDangerousModePermissionPrompt: true, and explicit allow rules for every UNC path variant.

The message:

Claude requested permissions to write to \\wsl.localhost\Ubuntu-24.04\home\mav\..., 
which contains a suspicious Windows path pattern that requires manual approval.

Root Cause

In cli.js, function om() detects UNC paths with this regex:

if (/\\\\[^\s\\/]+(?:@(?:\d+|ssl))?(?:[\\/]|$|\s)/i.test(q)) return true

This matches \\wsl.localhost\... the same as \\remote-server\.... The result is returned with classifierApprovable: false, which means bypass permissions cannot override it.

WSL paths are local — wsl.localhost and wsl$ are Windows-native virtual filesystem mounts, not network resources. They should be whitelisted.

Impact

Any developer on Windows using WSL2 (which is the standard Docker/Linux dev setup on Windows) gets permission prompts on every file edit. This makes Claude Code significantly harder to use for the large population of Windows+WSL2 developers.

Suggested Fix

Whitelist \\wsl.localhost\ and \\wsl$\ prefixes in the UNC path check, since they are guaranteed-local filesystem mounts:

function om(q) {
  if (N1() !== "windows") return false;
  // WSL paths are local, not network
  if (/^\\\\(wsl\.localhost|wsl\$)\\/i.test(q)) return false;
  if (/^\/\/(wsl\.localhost|wsl\$)\//i.test(q)) return false;
  // ... rest of checks
}

Environment

Windows 11 + WSL2 (Ubuntu 24.04)
Claude Code v2.1.94
Settings: permissionMode: "bypassPermissions", explicit allow rules for all UNC path variants in permissions.allow

View original on GitHub ↗

4 Comments

0xbrainkid · 6 months ago

The \\wsl.localhost\... and \\wsl$\... paths being matched by the UNC network path regex is a false-positive classification — WSL paths are local virtual filesystem mounts, not network shares. The classifier treating them as "suspicious network paths" that bypass permissionMode: "bypassPermissions" is a hardcoded security policy that breaks the intended permission override for a large population of Windows+WSL2 users.

From an agent capability perspective, this prevents the agent from operating on WSL paths at all under autonomous/scripted workflows — every file operation requires manual approval regardless of user-configured permission settings, making Claude Code effectively unusable for the standard Windows developer setup.

The fix is straightforward: whitelist the known WSL mount patterns before the suspicious-path regex runs:

// Add before the UNC check:
const WSL_PATTERNS = /^\\\\(wsl\.localhost|wsl\$)\\/i;
if (WSL_PATTERNS.test(q)) return false; // WSL paths are local, not suspicious

// Existing UNC check follows
if (/\\\\[^\s\\/]+(?:@(?:\d+|ssl))?(?:[\\/]|$|\s)/i.test(q)) return true

This correctly exempts the two known WSL virtual filesystem mount points (wsl.localhost and wsl$) while preserving the UNC check for actual network paths.

Why classifierApprovable: false is the root problem: The path is flagged with classifierApprovable: false, which creates a hard override that permissionMode: "bypassPermissions" and explicit allow rules cannot override. This design is correct for genuinely dangerous patterns — but WSL paths are not dangerous, they are local. The whitelist fix restores the correct behavior: users who set bypassPermissions can proceed without prompts on their local WSL files.

github-actions[bot] · 6 months ago

Found 3 possible duplicate issues:

This issue will be automatically closed as a duplicate in 3 days.

If your issue is a duplicate, please close it and 👍 the existing issue instead
To prevent auto-closure, add a comment or 👎 this comment

🤖 Generated with Claude Code

ashwin-ant collaborator · 6 months ago

This was fixed in v2.1.105 — \\wsl$\ and \\wsl.localhost\ paths are now exempt from the UNC safety check, so bypassPermissions works for WSL-mounted projects. If you're still seeing this in the latest version, please comment with your version and repro and we'll reopen.

github-actions[bot] · 5 months ago

This issue has been automatically locked since it was closed and has not had any activity for 7 days. If you're experiencing a similar issue, please file a new issue and reference this one if it's relevant.