[BUG] VS Code extension ignores `bypassPermissions` mode; CLI honors it on same machine and config

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

The VS Code extension does not apply bypassPermissions mode when configured in VS Code's Workspace or User settings. The CLI applies it correctly on the same machine, with the same config, in the same repo, for the same command.

With claudeCode.initialPermissionMode set to bypassPermissions and Allow Dangerously Skip Permissions enabled, the extension still shows permission prompts for shell commands during plan mode. Running the identical prompt through claude --permission-mode bypassPermissions in a terminal executes without prompting.

<img width="590" height="155" alt="Image" src="https://github.com/user-attachments/assets/637837ec-d856-4e05-9059-59850bdc0e3b" />

<img width="595" height="121" alt="Image" src="https://github.com/user-attachments/assets/a94b6799-28cb-4ba6-9184-c3f0fb12cdf9" />

Separately, and possibly the same root cause: the extension prompts for plain read commands (a grep against a file path), which should not require approval in any permission mode.

What Should Happen?

With bypassPermissions configured as the initial permission mode and the dangerously-skip toggle enabled, the extension should start conversations in bypass and execute shell commands without approval prompts, matching CLI behavior.

Read-only commands should not prompt regardless of mode.

Error Messages/Logs

No error is shown. A normal permission approval prompt appears. Nothing indicates that the configured mode was not applied.

Steps to Reproduce

Case A — bypassPermissions not applied in the extension

1. In VS Code settings (User), enable Claude Code: Allow Dangerously Skip Permissions.
2. Set Claude Code: Initial Permission Mode to bypassPermissions.
3. In ~/.claude/settings.json, set "permissions": { "defaultMode": "bypassPermissions" }.
4. Open a git repo in VS Code and start a new Claude Code conversation from the repo root.
5. Switch to plan mode.
6. Ask Claude to download a file — e.g. "download the CSLB master license CSV to a scratch file and show me the headers." Claude issues:

``bash
curl -sS -o "<temp>/MasterLicenseData.csv" \
-D "<temp>/master-headers.txt" \
-w "http=%{http_code} bytes=%{size_download}" \
"https://www2.cslb.ca.gov/OnlineServices/DataPortal/DownLoadFile.ashx?fName=MasterLicenseData&type=C"
``

Result: permission prompt.

1. In a terminal at the same repo root, run claude --permission-mode bypassPermissions, enter plan mode, and give the same prompt.

Result: command executes, no prompt.

Case B — read commands prompt in the extension

1. In the extension, in plan mode, ask Claude to grep a file outside the repo:

``bash
grep -n "initializationFailedHandler" "C:/Users/<user>/.vscode/extensions/ortus-solutions.vscode-boxlang-1.23.3/node_modules/vscode-languageclient/lib/common/client.js"
``

Result: permission prompt for a read-only command.

Relevant ~/.claude/settings.json

{
  "permissions": {
    "defaultMode": "bypassPermissions",
    "allow": ["Bash(git log:*)", "Bash(rg:*)", "Bash(find:*)"],
    "deny": ["Read(**/.env)", "Bash(git push --force:*)", "Bash(git reset --hard:*)"],
    "additionalDirectories": ["D:\\Dropbox\\Repositories"]
  },
  "useAutoModeDuringPlan": true
}

/doctor reports all settings files parse, no managed policy file, no project .claude/settings.json, and auto mode healthy and unoverridden.

Claude Model

Not sure / Multiple models

Is this a regression?

Yes, this worked in a previous version

Last Working Version

Unsure of the exact version. Plan mode did not prompt for reads or ordinary shell commands before approximately September 1, 2026.

Claude Code Version

2.1.276

Platform

Other

Operating System

Windows

Terminal/Shell

PowerShell

Additional Information

The two symptoms may share a root cause: if the extension is falling back to a lower-privilege mode rather than applying bypassPermissions, both follow.

Workaround note for anyone else hitting this: permission allow rules do not help. Claude frequently issues compound commands (cd <path> && grep ... | head) and git -C <path> log ..., neither of which a prefix rule can match. The only reliable workaround found was switching to the CLI.