defaultMode: acceptEdits silently overrides per-path permissions.ask rules for Write/Edit

Summary

When permissions.defaultMode is set to "acceptEdits", all Write and Edit tool calls are auto-approved regardless of explicit per-path entries in permissions.ask. The ask rules silently never fire. Users configuring path-specific guardrails (e.g. protecting ~/.claude/projects/**/memory/** or settings.json) get no protection and no warning that their rules are inert.

Severity rationale

Confidentiality / integrity: an agent can silently write to user-profile-scoped paths (memory, plans, hooks, even settings.json itself) that the user explicitly listed in ask expecting a prompt. The presence of the rule in ask creates a false sense of protection — worse than no rule, because the user trusts it.

Reproduction

~/.claude/settings.json:

{
  "permissions": {
    "ask": [
      "Write(C:\\Users\\<user>\\.claude\\projects\\**\\memory\\**)",
      "Edit(C:\\Users\\<user>\\.claude\\projects\\**\\memory\\**)"
    ],
    "defaultMode": "acceptEdits"
  }
}

1. Start a Claude Code session.
2. Have the agent invoke Write against C:\Users\<user>\.claude\projects\<proj>\memory\test.md.
3. Expected: prompt (the ask rule matches).
4. Actual: file written silently, no prompt.

Precedence currently observed (reverse-engineered from behavior)

1. deny — wins (correct)
2. defaultMode: acceptEdits short-circuits all Write / Edit calls
3. allow / ask per-path entries — never consulted for Write/Edit

Expected precedence (principle of least surprise)

1. deny
2. ask (per-path) — explicit-most rules win
3. allow (per-path)
4. defaultMode — fallback only when no rule matches

Workarounds available to users today

• Move per-path protections from ask → deny (verified to work — deny wins over acceptEdits).
• Drop defaultMode: acceptEdits entirely — every edit prompts.

Both impose friction the design clearly tried to avoid.

Proposed fix

ask (and allow) entries that explicitly match the candidate tool+path should take precedence over defaultMode. defaultMode is a fallback, not a master switch. At minimum, document the current precedence loudly in settings docs and emit a startup warning when both acceptEdits and per-path ask rules for Write/Edit are present.

Environment

• Claude Code (VS Code extension)
• OS: Windows 11 Pro 10.0.26200
• settings.json schema: https://json.schemastore.org/claude-code-settings.json