Explicit ask rule for Bash command not respected — no permission prompt on default path (v2.1.216, macOS)

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Environment

• claude --version: 2.1.216
• OS: macOS, Apple Silicon
• Plan: Pro
• Mode at time of failure: default/manual (permissions.defaultMode: "default")
• No project-level .claude/settings.json exists.
• Local settings file (.claude/settings.local.json in the project directory): did not exist during gate tests 1–3 (verified by direct inspection at the time of testing). It was created afterward, as a side effect of enabling /sandbox (regular permissions), and now contains only:

``json
{"sandbox": {"enabled": true, "autoAllowBashIfSandboxed": false}}
``
This file plays no role in the bug itself — it documents the workaround's configuration, included here for completeness.

• Relevant permissions block from the global ~/.claude/settings.json, as loaded for gate tests 3–4. Note: the three interpreter ask rules (Bash(conda run:*), Bash(python:*), Bash(python3:*)) were added mid-morning, between gate test 1 and gate test 2 — they were not present for gate test 1:

``json
{
"permissions": {
"defaultMode": "default",
"deny": [
"Bash(sudo:*)",
"Read(~/.ssh/**)",
"Read(~/.aws/**)",
"Read(**/.env)",
"mcp__computer-use"
],
"ask": [
"Bash(rm:*)",
"Bash(mv:*)",
"Bash(pip install:*)",
"Bash(pip3 install:*)",
"Bash(conda install:*)",
"Bash(brew:*)",
"Bash(npm install:*)",
"Bash(curl:*)",
"Bash(wget:*)",
"Bash(git push:*)",
"Bash(conda run:*)",
"Bash(python:*)",
"Bash(python3:*)"
],
"allow": [
"Bash(ls:*)",
"Bash(pwd)",
"Bash(cat:*)",
"Bash(head:*)",
"Bash(tail:*)",
"Bash(grep:*)",
"Bash(mkdir:*)",
"Bash(git status)",
"Bash(git diff:*)",
"Bash(git log:*)"
]
}
}
``

Actual behaviour

Actual (gate test 3 — definitive repro): In a fresh session launched after the interpreter ask rules were added, with those rules confirmed visible in the /permissions Ask tab post-launch, the command executed immediately — no permission prompt appeared.

Earlier observations (caveated, not part of the definitive repro):

• Gate test 1: ran silently, but at this point no ask or allow rule matched the command at all — under default mode an unmatched command should itself trigger a prompt, so this may be the same defect in broader form (missing prompt for any unmatched command) rather than direct evidence against the conda run rule specifically.
• Gate test 2: ran silently immediately after the interpreter ask rules were added mid-session; a settings hot-reload failure could not be excluded as the cause. This ambiguity motivated gate test 3 as a fresh-session repro.

Localisation finding

To determine whether the ask rule itself was invalid or unloaded, /sandbox (regular permissions) was enabled, which created the local settings file shown above. The identical command was then re-run (gate test 4):

• A permission dialog appeared, explicitly citing: "Permission rule Bash(conda run:) requires confirmation for this command."*
• Only after approving did the command execute.

This isolates the failure to the default (non-sandbox) approval path failing to consult configured ask rules. The ask rule itself is valid, loaded, and correctly enforced once sandbox regular-permissions mode is active — the defect is specific to the default/manual approval path.

Related (searched, not duplicates)

• #42797 — auto-mode ignores permissions.ask (same failure direction; this report is default/manual mode, not auto)
• #78764 — invalid settings file drops ask/deny rules fail-open (this report's settings file is valid and confirmed loaded in the /permissions UI)
• #18846 and its cluster (#18160, #17321, #13340) — allow rules ignored (the mirror image: excess prompting; this report is missing prompting, fail-open)

What Should Happen?

Expected: Since Bash(conda run:*) is listed under permissions.ask, a permission dialog should appear before the command runs, requiring explicit approval.

Since Bash(conda run:*) is listed under permissions.ask, a permission dialog should appear before the command runs, requiring explicit approval — per the documented guarantee that explicit ask/deny rules are always respected in every mode. Instead the command executes with no prompt (fail-open).

Error Messages/Logs

N/A - no error is produced
— the command runs successfully with no prompt, no warning, and no error; the failure is silent (fail-open).

Steps to Reproduce

1. Start a session with permissions.defaultMode: "default" (no sandbox), no project-level settings file, and no local settings file present.
2. Run a command matching an explicit ask rule, e.g.:

``
conda run -n tess python -c "print('gate test N')"
`
This matches the Bash(conda run:*)` ask rule shown above.

1. Observe whether a permission prompt appears before the command executes.

Claude Model

Sonnet (default)

Is this a regression?

I don't know

Last Working Version

N/A / Unknown

Claude Code Version

2.1.216

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

_No response_