[Bug] Permission allowlist and mode toggles not suppressing Read/Write/Edit prompts

Edit tool prompts for permission in acceptEdits and bypassPermissions/auto modes — affects both CLI and desktop app (v2.1.126)

Summary

In Claude Code 2.1.126, the Edit tool fires a permission prompt even when the session is in acceptEdits or auto / bypassPermissions mode. The bug:

• Reproduces in both the CLI and the desktop app with identical symptoms — implicating the shared permission-resolver layer, not any client-specific code.
• Reproduces with zero user configuration (i.e. with ~/.claude/settings.json removed entirely).
• Does not affect the Write tool in auto mode, despite Write being in the same tool category and same modes — which scopes the bug narrowly to Edit's permission resolution path.

This blocks normal day-to-day use because every file edit interrupts the workflow with a prompt that no documented mechanism (mode toggle, allowlist, skipAutoPermissionPrompt) can suppress.

Environment

• Claude Code version: 2.1.126
• Surfaces affected: Claude Code CLI and Claude Code desktop app — bug reproduces in both with identical symptoms.
• OS: macOS 26.4.1 (build 25E253), Darwin 25.4.0, arm64
• Install method (CLI): native (/Users/<user>/.local/share/claude/versions/2.1.126)
• Shell: zsh
• /doctor output: all green — auto-updates enabled, latest channel, no version-lock conflicts.

The fact that the same bug reproduces in both the CLI and the desktop app rules out terminal/TTY handling, shell integration, and CLI-specific Shift-Tab parsing as causes. The bug must live in the shared permission-resolver layer that both clients use.

Steps to reproduce (clean-room — settings file removed)

1. mv ~/.claude/settings.json ~/.claude/settings.json.bak (no project-level settings, empty settings.local.json).
2. Start a brand-new Claude Code session.
3. Press Shift-Tab to switch to acceptEdits mode. The system reminder confirms the mode change is registered.
4. Ask Claude to edit a file (e.g. please add a line to note.txt).
5. Observed: Permission prompt fires for Edit(...).
6. Press Shift-Tab again to switch to auto / bypassPermissions mode. System reminder confirms "Auto Mode Active".
7. Ask Claude to edit a file again.
8. Observed: Permission prompt still fires for Edit(...).
9. Ask Claude to write a new file with Write in the same auto-mode session.
10. Observed: No prompt — Write is correctly auto-approved.

Expected behavior

• acceptEdits mode is documented to auto-approve Edit, Write, and NotebookEdit. Edit should not prompt.
• bypassPermissions / auto mode is documented to auto-approve all non-destructive tools. Edit should not prompt.

Actual behavior

• Edit prompts in acceptEdits mode.
• Edit prompts in auto / bypassPermissions mode.
• Write does not prompt in auto mode (working as expected).
• Read prompts in acceptEdits mode (this is expected — acceptEdits is for edit tools only — but mentioning for completeness).
• Read does not prompt in auto mode (working as expected).

Earlier (non-clean-room) findings

Before stripping the config, the user's ~/.claude/settings.json contained:

{
  "permissions": {
    "allow": [
      "Read",
      "Bash(ls:*)",
      "Bash(grep:*)",
      "..."
    ],
    "defaultMode": "default"
  },
  "skipAutoPermissionPrompt": true
}

• Adding "Read" to the allowlist correctly silenced Read prompts in all modes.
• Adding "Write" and "Edit" to the allowlist (tested previously) did not silence Edit prompts.
• skipAutoPermissionPrompt: true had no effect on Edit prompts.

So three independent suppression mechanisms (allowlist, mode, skipAutoPermissionPrompt) all fail for Edit specifically.

Plugin / hook audit

Confirmed no installed plugin registers a PreToolUse hook. The two plugins with hooks/hooks.json files (vercel, explanatory-output-style) only register SessionStart / SessionEnd hooks. So plugin interception is ruled out.

The clean-room reproduction further rules out plugins entirely, since the test session ran with no enabledPlugins config.

Hypothesis for maintainers

Because Edit and Write differ in behavior despite being in the same tool category and the same modes:

• There may be an additional safety-check path that fires for Edit ("you're about to modify existing content") that is not properly gated on acceptEdits / bypassPermissions mode.
• Or, the allowlist matcher silently does not match the Edit pattern even when literally "Edit" is configured, while it does match "Read" and "Write".

Both hypotheses predict the observed asymmetry between Edit and Write.

Impact

Daily use is significantly degraded. Every routine file edit interrupts the workflow with a prompt that no documented in-product mechanism can suppress. The user has confirmed that all four of the following bypass mechanisms fail to suppress Edit prompts in v2.1.126:

1. Allowlisting "Edit" explicitly in ~/.claude/settings.json — no effect.
2. acceptEdits mode (Shift-Tab toggle) — no effect.
3. Auto / bypassPermissions mode (Shift-Tab toggle) — no effect.
4. "skipAutoPermissionPrompt": true setting — no effect.

The only mechanism that does currently suppress Edit prompts is launching with the --dangerously-skip-permissions CLI flag. This is not a viable day-to-day workaround because it disables all permission resolution globally and is documented as unsafe.

Cross-version progression (potentially useful for maintainers)

The --dangerously-skip-permissions behavior changed across versions:

• v2.1.123: --dangerously-skip-permissions did not suppress Edit prompts.
• v2.1.126: --dangerously-skip-permissions does suppress Edit prompts.

So progress was made between these two releases on at least one bypass path. However, the four documented (non---dangerously- ) mechanisms above still don't work for Edit. This suggests the fix between 2.1.123 → 2.1.126 patched the --dangerously-skip-permissions flag's path specifically, but the corresponding fix for acceptEdits, bypassPermissions, allowlist matching, and skipAutoPermissionPrompt was not made. A grep for whatever change unblocked the --dangerously- path may point directly at where the analogous fix needs to go for the other paths.

Repro environment available

Happy to provide:

• Full ~/.claude/settings.json
• Full /doctor output
• A short screen recording of the clean-room repro on request.