VS Code: "Yes, allow … for all projects" never suppresses prompt for files outside workspace folder

Summary

In the VS Code extension, when editing a file outside the workspace folder (e.g. ~/.claude/skills/<name>/SKILL.md while the workspace is /Users/me/work/), the "Make this edit?" prompt appears on every Edit. Clicking option 2, "Yes, allow ~/.claude/skills/… for all projects", does write a permission rule to ~/.claude/settings.json — but the next edit to the same file prompts again. The choice never sticks.

Repro

1. Open VS Code with a workspace folder, e.g. ~/work.
2. Open a file outside that workspace, e.g. ~/.claude/skills/foo/SKILL.md.
3. Ask Claude Code to edit it. Dialog appears. Click option 2.
4. Settings.json gets a new rule: Edit(~/.claude/skills/foo/**).
5. Make a second edit to the same file. Dialog appears again. Click option 2 again. Same rule re-appended (or no-op).
6. Repeat indefinitely.

What I tried before filing

All of the following were already present in ~/.claude/settings.json. None of them suppressed the prompt:

{
  "permissions": {
    "allow": [
      "Edit",
      "Write",
      "Edit(/Users/me/.claude)",
      "Write(/Users/me/.claude)",
      "Edit(/Users/me/.claude/skills)",
      "Write(/Users/me/.claude/skills)",
      "Edit(/Users/me/.claude/skills/**)",
      "Edit(~/.claude/skills/foo/**)"
    ],
    "defaultMode": "acceptEdits",
    "additionalDirectories": [
      "/Users/me/.claude",
      "/Users/me/.claude/skills"
    ]
  }
}

Tried: bare Edit allow, absolute paths, tilde paths, with ** glob, without ** (directory prefix form), parent dir, exact subdir. Tried adding the path to additionalDirectories. Tried defaultMode: "acceptEdits". None of these stop the prompt.

The dialog dutifully appends Edit(~/.claude/skills/foo/**) each time option 2 is clicked, but the rule has no effect — the prompt fires again on the next edit. After many attempts the allow-list ends up with a stack of dead per-skill rules.

Hypothesis

The "edit is to a file outside the workspace folder" check appears to run before the permission allow-list is consulted, and is a hardcoded prompt that no settings.json rule can opt out of. If true, the dialog's option 2 is misleading — the rule it writes is consulted by a code path that never runs for these edits.

Versions

• Claude Code CLI: 2.1.114
• VS Code extension: anthropic.claude-code 2.1.131 (darwin-arm64)
• VS Code: 1.118.1
• macOS: 26.3.1 (darwin arm64)

Expected

Either:

• option 2 writes a rule that genuinely suppresses future prompts for matching paths, OR
• the dialog explains that this is a workspace-boundary guard and offers a way to widen the workspace boundary persistently (e.g. an explicit "trust this directory across sessions" setting).