[BUG] PowerShell tool executed destructive command with no permission prompt — no event recorded in transcript

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

az ad group delete was executed via the PowerShell tool with no permission prompt displayed. The Entra group was permanently deleted without the user being asked to approve or deny the action.

The session transcript confirms this is not a case of a prompt being silently auto-approved — there is no permission event recorded at all between the tool_use and tool_result entries. The tool call went straight to execution.

What Should Happen?

A permission prompt should appear. The command does not match any allow rule in settings.json or settings.local.json, and no session-level approval was granted by the user.

Steps to Reproduce

1. Have a settings.local.json with a specific exact-match PowerShell allow rule (e.g. a read-only az ad group member list command — notably not a wildcard)
2. Earlier in the same session, run several parallel PowerShell tool calls (e.g. group creates and role assignments) that the user was prompted for
3. Ask Claude to delete the same AD group
4. Claude issues PowerShell(az ad group delete ...) — no prompt appears, the command executes immediately

Evidence

• settings.json and settings.local.json reviewed — no rule covers PowerShell(az ad group delete *)
• User confirms no session-level approval was granted
• Session transcript (1cec244a-7e70-4c5c-afb4-97247d0f6c5a.jsonl) shows tool_use → tool_result with no permission event in between
• Other PowerShell commands earlier in the same session did prompt correctly
• permissionMode in transcript was acceptEdits throughout (auto-accepts file edits only, not shell commands)

Related Issues

• #68526 — similar Windows permissions gap, but that issue involves a prompt appearing and being auto-approved via buffered keypress; our case has no prompt generated at all
• #65910 — LIFO stack race condition with parallel agents; different mechanism

Impact

Irreversible — the Entra group was permanently deleted without user consent.

Claude Code Version

2.1.177

Platform

Claude Desktop (not VSCode)

Operating System

Windows 11 Enterprise 10.0.26200

Claude Model

claude-sonnet-4-6