[BUG] VSCode extension ignores ~/.claude/settings.json permissions.allow rules and prompts for permissions on all Bash commands despite correct Bash(cmd:*) syntax

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

The VSCode extension does not honor permissions.allow rules defined in ~/.claude/settings.json. On every new session, it prompts for permission on Bash commands that are explicitly covered by allowlist entries using the correct Bash(cmd:) colon syntax (e.g. Bash(ls:), Bash(grep:), Bash(jira:), Bash(aws sts:*), etc.). The rules are present in the settings file with correct syntax before the session starts, yet the extension still prompts.

The global settings file is at ~/.claude/settings.json and uses the colon syntax documented in Anthropic's own docs. The claudeCode.initialPermissionMode VSCode setting is set to "default". The same rules appear to work correctly in the CLI; the bug is specific to the VSCode extension.

What Should Happen?

Expected behavior: Commands matching an allow rule in ~/.claude/settings.json should never prompt for user's approval, in any session.

Why this is bad? Because during a dayful of development, one has to approve potentially hundreds of read-only operations, even as mundate as cat, grep, or ls. There should be an easy way to enable this, with VSCode not blocking the settings but fully honoring them.

This is a big usability issue which is useless activity that adds up as being hard on the eyes and the fingers of any user.

Pretty please, could this be fixed? :))

Error Messages/Logs

From ~/Library/Application Support/Code/logs/<session>/window1/exthost/Anthropic.claude-code/Claude VSCode.log:


[DEBUG] hooks module cc-plugin-sec-default@builtin classic.PermissionRequest settled in 0.3ms (native link, next() included)
[DEBUG] "Permission suggestions for Bash: [{"type":"addRules","rules":[...],"behavior":"allow","destination":"session"}]"
tool_permission_response: {"behavior":"allow","updatedInput":"<object>","updatedPermissions":"<array(0)>"}
[INFO] tool_dispatch_start tool=Bash permissionDecisionMs=1345
Every Bash call triggers cc-plugin-sec-default@builtin before the allow list is checked. Permission approvals come back with updatedPermissions: [] (empty) — nothing is being persisted. The destination: "session" in permission suggestions confirms approvals are session-scoped only, regardless of the allow list entries in ~/.claude/settings.json.

Steps to Reproduce

1. Add Bash(ls:) (or any Bash(cmd:) pattern) to permissions.allow in ~/.claude/settings.json
2. Set claudeCode.initialPermissionMode to "default" in VSCode user settings
3. Reload VSCode (Cmd+Shift+P -> "Developer: Reload Window")
4. Open a Claude Code panel in VSCode
5. Ask Claude to run any ls command (e.g. ls /some/path)

Observe: permission prompt appears despite the allow rule
Expected: No prompt — the rule in ~/.claude/settings.json should auto-approve the command.

Actual: Prompt appears every time, on every new session, for every Bash command regardless of allow list content.

Claude Model

Sonnet (default)

Is this a regression?

No, this never worked

Last Working Version

_No response_

Claude Code Version

2.1.227 (Claude Code)

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

This has been reported in one fashion or another by other users, see, for example, these:
https://github.com/anthropics/claude-code/issues/18160
https://github.com/anthropics/claude-code/issues/15921
https://github.com/anthropics/claude-code/issues/33595
https://github.com/anthropics/claude-code/issues/56648

Some are just staying open with no one assigned, and some are closed 'due to inactivity'.