Permissions issues on Linux — page 3
Issues the maintainers labelled both platform:linux and area:permissions.
287 issues · 56 open · 231 resolved (80%) · first seen Aug 25, 2025
Is this getting better or worse?
This class of problem is still growing. 168 new reports in the last 90 days vs 102 in the 90 before — +65%. The open backlog peaked at 56 in 2026-08 and sits at 56 today.
Derived by counting each matching issue from its creation date until it closed. First-party
computation over the anthropics/claude-code tracker — the trend is not published
anywhere upstream.
Which builds report this
174 of these reports name the Claude Code build they were running, spanning 94 releases. Heaviest reporters:
- Claude Code v2.1.233
- Claude Code v2.1.207
- Claude Code v2.1.119
- Claude Code v2.1.114
- Claude Code v2.1.234
- Claude Code v2.1.112
- Claude Code v2.1.56
- Claude Code v2.1.241
Report volume, not a defect count: an issue can mention a build without that build having caused the failure. Versions come from the version string in the bug-report template, matched against real published tags.
Do these get fixed?
Median time to close is 28 days across 231 closures. Of the 231 closures with a recorded reason, 17% were closed as completed and 191 as not-planned or duplicate. The most recent completed fix landed in 2026-08.
Workarounds reported by the community
60 of these issues post a workaround someone says worked. The highest-engagement ones:
- [BUG] v2.1.78: Protected directory prompt in bypassPermissions has no override — forces hacky workarounds
- …t on every skill creation. 2. No override flag forces worse workarounds Since there's no setting or similar, users who need this workflow (and there are many — skills are a first-class Claude Code feature) will build wor…
Found in the description of #35646 · resolved - [BUG] ask list is ignored when "Bash" is in allow list
- …ands) and safety (protection against destructive commands). Workarounds attempted (none work) : - - Bypasses everything including ask list - - Prompts for every new command type
Found in the description of #6527 · still open - [Bug] Permission prompt disappears after Ctrl+O toggle with concurrent tool calls
- …ly reproducible. Hit it 3+ times in a single session today. Workarounds tried - Pressing another CTRL-O + CTRL-O to see if permissions is back did not work Notes - Cache stays warm across this state, so context isn't los…
Found in the description of #60194 · resolved - [BUG] Bash comments break permissions
- Workaround: a PreToolUse hook can strip the comment lines before permission matching sees them. The hook reads the command, removes leading lines, and returns the clean command via . Your allowlist then matches correctly…
Found in the thread of #29582 · resolved - [Bug] Auto mode unavailable error persists despite mode change in session
- …ur plan". closing session and run again with --resume works as a workaround, but once you send a prompt with auto mode it gets stuck with this error <img width="1912" height="703" alt="Image" src=" /
Found in the thread of #42449 · still open
Excerpts are quoted from the linked issue so you can judge relevance before opening it. Threads that only ask for a workaround, or report that there is none, are excluded. These are community suggestions, not official guidance from Anthropic — read the full thread before applying one.
Matching issues 201–287
Ranked by community engagement (reactions weighted over comments).
- [BUG] First prompt lost in new project directory — trust prompt consumes the input, user must type it twice
- [Bug] Excessive permission requests despite previous dismissals
- [BUG] `/permissions` reports success when adding new Allow rules and writeable workspace dirs that managed policy forbids (misleading UI, not enforced; no privilege escalation)
- [Bug] Claude ignores user instructions and executes without approval despite repeated prompting
- [BUG] Plan-mode read-only guarantee is bypassed by spawned subagents — auto mode classifier governs subagents instead of plan mode.
- Remote-control: phone-app approval dismisses popup but never reaches local process
- [BUG] Auto-generated permission rule with a literal : inside a quoted argument is rejected on load ("The :* pattern must be at the end")
- tools: frontmatter — Read(/path), Write(/path), Glob(/path), Bash(cmd:*) parentheticals silently discarded (no runtime enforcement)
- I need a bug report to generate a GitHub issue title. Please provide details about the problem you've encountered with Claude Code, including: - What were you trying to do? - What error or unexpected behavior occurred? - Any error messages or logs?
- [Bug] Permission pattern matching fails when `:*` suffix follows another `*` wildcard
- [Bug] Spurious permission denial injected into Bash tool error output
- [Bug] Tool execution permissions suddenly denied without prompt
- Workspace-trust prompt blocks unattended `claude remote-control` under systemd on 2.1.119+
- [Feature Request] Add fallback prompt for auto-mode classifier soft-denials instead of returning denial to model
- [BUG] Claude Code violated .gitignore/.claudeignore policy by reading .env file using Bash cat command in auto-approve mode
- [BUG] Parallel tool-use batches bypass user rejection — denied calls don't cancel siblings in the same block
- [BUG] "unhandled node type $"
- Allow individual users to extend channels allowlist for third-party plugin marketplaces
- UX: defaultMode: bypassPermissions does not imply sandbox-off — easy to miss, breaks every in-project build
- Sub-agent Read/Edit denied on own worktree path despite bypassPermissions (v2.1.97)
- [Bug] Claude executes actions prematurely without awaiting user confirmation
- [Bug] Bash AST parser warning bypasses sandbox auto-approve mode
- Skill tool fails with 'Unknown skill' in dontAsk permission mode
- [BUG] Permission relay fires on all channels regardless of message origin, inconsistent with reply routing
- Agent teams: allow routing plan approvals and permission prompts to user instead of team lead
- [BUG] Claude code asking for permission to edit its own settings when bypass permissions is enabled
- Read() permission path prefix matching doesn't match files within allowed directory
- [Bug] Subfolder read permissions regression in project initialization
- Bash tool: rejected/cancelled commands still execute (process already started)
- [BUG]
- Bash tool: ZodError in permission system blocks git commands
- Terminal input regressions: permission prompt requires Enter, backspace repeat broken
- [BUG] --dangerously-skip-permissions does not bypass workspace trust prompt despite claiming to "Bypass all permission checks"
- [BUG] Wildcard permission `mcp__plugin_github_github(*)` does not match plugin MCP tools
- [Bug] SSH authentication failing or access restrictions preventing VPS login
- [Bug] Interactive auto mode bypasses permissions.ask rules for PreToolUse decisions
- [Bug] Files deleted without permission confirmation in claude.md and claude-local.md
- [BUG] Skills-dir plugins don't load in subfolders of a trusted directory — every launch dir silently gets hasTrustDialogAccepted:false, no dialog ever shows (Linux, no git)
- [Security] Auto mode should require explicit approval for overwriting a system shared library with sudo
- [Bug] Unexpected file deletion without user confirmation
- [BUG] Choosing fullscreen renderer offered on tui after starting claude first removes bypassPermissions mode arguments
- [BUG] slash-command allowed-tools grants are lost when the run resumes from a task-notification
- [BUG] 2.1.211 "always allow rules save at repository root" breaks unattended runs in a linked git worktree under a worktree-scoped filesystem sandbox
- [BUG] Regression in 2.1.207: automount -hosts check forces a permission prompt on every Read inside the working directory when $HOME is under /net/<host>/ (autofs)
- [Bug] Continuous memory access violations causing repeated flagging
- [BUG] Auto-mode classifier denial returned for a Bash command whose side effects were already applied (denial races with execution)
- Auto-mode classifier treats compaction interrupt text as a standing user instruction; denies post-compaction tool calls
- [Bug] Excessive security alerts during normal SonarQube code review configuration
- [BUG] Explore (read-only) subagent executed rm -rf, deleting files outside its intended scope
- Subagent SendMessage triggers approval popup despite bypassPermissions defaultMode
- [BUG] Escape key can deny a confirmation while the status window is open
- [Bug] Mobile remote control cannot dismiss stuck permission prompt without PC terminal Esc
- Subagents should inherit their worktree's cwd + permission scope across tool calls (instead of resetting to the main repo dir)
- [BUG] Subagents can no longer prompt me for permission
- [BUG] confirmation prompts preempt enter key for sending additional text
- [BUG] Subagent permission prompts are invisible in remote/web sessions
- [Bug] Agent commits changes to unauthorized project directories
- Approving a plan from a remote session drops out of auto mode despite useAutoModeDuringPlan: true
- [Bug] Inaccurate skill documentation: find misclassified as unconditionally auto-allowed
- [FEATURE]: Allow the built-in /goal Stop hook under allowManagedHooksOnly (or add a managed opt-in)
- [BUG] disallowedTools in settings.json does not trim tool schemas, but --disallowedTools does
- Auto-mode classifier false-positives on codex exec and cross-tool state files
- [Bug] Claude executes irreversible external actions without explicit re-approval after context changes
- [BUG] Managed settings defaultMode is no longer respected
- permissions.deny does not intercept a file read inside a command substitution
- Custom autoMode.hard_deny and soft_deny rules are loaded and reported, but not enforced
- [MODEL] CRITICAL PERMISSION BYPASS: Claude manufactures its own execution authority from a document it wrote, overrides an explicit in-context user prohibition, and runs unapproved privileged commands
- /auto-mode-setup fails: removeFromPermissionsAllow[0] is not a rule string the removal offer could have produced
- Safety classifier blocks benign commands with no override; recommended remedy is blocked by the same check
- [BUG] ~/.claude/settings.local.json is only applied to sessions started in $HOME — permissions and hooks silently inert elsewhere
- [Feature Request] Add "Ask about it" option to permission prompts for clarification without rejection
- [Feature Request] Add configurable safeguard thresholds for codebase review operations
- [BUG] Approving a forwarded teammate permission request with a message silently drops the message
- [Bug] Sudo password prompt defaults immediately without user input on Linux
- Prohibited block forbids all deletion, unscoped — blocks rm, log scrubbing, and cleanup in coding/ops agents
- [BUG] Agent unilaterally created/rotated a production API credential without asking
- [FEATURE] Non-managed System-wide `settings.json` (machine-wide defaults that users can still override)
- allowedChannelPlugins in local managed settings silently shadowed by remote org managed settings; skip message points at the ignored file
- [Bug] Auto-mode classifier judges command form, not effect: dry-runs blocked while allowlisted equivalents with larger blast radius pass; denials stack into the 5-consecutive lockout
- [Bug] autoMode.allow does not override "Tmux Self Drive" classifier rule
- Claude Fable 5: AskUserQuestion free-text answer treated as option approval
- [Feature Request] Persistent auto-merge configuration across Claude Code updates
- [Bug] Auto-generated permission rules override explicit user-requested constraints
- [Feature Request] Tool use approval prompts require modifier key to prevent accidental activation
- [Bug] Excessive security alerts during normal SonarQube code review configuration
- [Bug] Auto mode executes untrusted scripts with curl
- [Bug] Unnecessary directory changes trigger security analyzer false positives