Permissions issues on macOS
Issues the maintainers labelled both platform:macos and area:permissions.
991 issues · 278 open · 713 resolved (72%) · first seen Aug 5, 2025
Is this getting better or worse?
This class of problem is holding steady. 338 new reports in the last 90 days vs 368 in the 90 before — -8%. The open backlog peaked at 278 in 2026-10 and sits at 278 today.
Derived by counting each matching issue from its creation date until it closed. First-party
computation over the anthropics/claude-code tracker — the trend is not published
anywhere upstream.
Which builds report this
705 of these reports name the Claude Code build they were running, spanning 188 releases. Heaviest reporters:
- Claude Code v2.1.119
- Claude Code v2.1.114
- Claude Code v2.1.296
- Claude Code v2.1.81
- Claude Code v2.1.283
- Claude Code v2.1.289
- Claude Code v2.1.258
- Claude Code v2.1.259
Report volume, not a defect count: an issue can mention a build without that build having caused the failure. Versions come from the version string in the bug-report template, matched against real published tags.
Do these get fixed?
Median time to close is 33 days across 713 closures. Of the 713 closures with a recorded reason, 21% were closed as completed and 566 as not-planned or duplicate. The most recent completed fix landed in 2026-10.
Workarounds reported by the community
254 of these issues post a workaround someone says worked. The highest-engagement ones:
- [BUG] autoAllowBashIfSandboxed bypassed for commands containing shell expansions and several other constructs
- …t's a significant workflow regression. Partial source-level workarounds: - Quote the variable AND ensure the string has literal content ( works; alone prompts). - No workaround for , brace expansion, ANSI-C strings, here…
Found in the description of #43713 · resolved - [BUG] Bypass/dangerously skip permissions now broken in all Claude Code versions newer than v2.1.77
- Update: The PreToolUse hook workaround (returning for protected directories) does NOT work on v2.1.81 / Windows 11. The hook fires and logs the auto-approve (confirmed via audit log), but the binary-level protected-direc…
Found in the thread of #36168 · still open - auto mode temporarily unavailable - cannot enter auto mode via Shift+Tab or defaultMode setting for Max user
- A note of caution regarding the workarounds suggested above (broad rules in settings.json, or hooks that auto-approve everything): These are not workarounds for auto mode . They simply skip the permission prompt for all…
Found in the thread of #33587 · resolved - [BUG] settings.local.json allow not working - keeps asking and wanting to add existing items again
- Non of the recommended workaround work for me on Windows. I tried - "Read( )" - "Read(~/ )" - "Read(./ )" - "Read(/../ )" - "Read(/.\\../ )"
Found in the thread of #6850 · still open - Built-in Plan agent ignores parent settings.json permissions and repeatedly prompts for pre-approved tools
- …agent permissions (e.g., ) 3. Option C : Add a setting like Workarounds Attempted None available. Cannot modify built-in agent configurations. Impact - Interrupts workflow with repeated permission prompts - Makes Plan mo…
Found in the description of #10906 · still open
Excerpts are quoted from the linked issue so you can judge relevance before opening it. Threads that only ask for a workaround, or report that there is none, are excluded. These are community suggestions, not official guidance from Anthropic — read the full thread before applying one.
Matching issues 1–100
Ranked by community engagement (reactions weighted over comments). Listing the top 300 of 991 matches; the statistics above cover all 991.
- [BUG] autoAllowBashIfSandboxed bypassed for commands containing shell expansions and several other constructs
- [BUG] Bypass/dangerously skip permissions now broken in all Claude Code versions newer than v2.1.77
- auto mode temporarily unavailable - cannot enter auto mode via Shift+Tab or defaultMode setting for Max user
- [BUG] settings.local.json allow not working - keeps asking and wanting to add existing items again
- Built-in Plan agent ignores parent settings.json permissions and repeatedly prompts for pre-approved tools
- [BUG] Desktop: Bypass Permissions mode can't be enabled on macOS — reverts to Accept Edits, "Permission mode couldn't be changed" (2.1.148)
- [BUG] Plan Mode can't be used with Bypass Permissions
- [BUG] permissions from user settings.json is NOT applied at project level
- Desktop app ignores settings.json permissions.allow and defaultMode: bypassPermissions
- [CRITICAL] Subagent spawning and subagent pattern bugs trigger infinite recursion, infinite token usage, grossly inefficient token usage, and lost accumulated subagent work.
- bypassPermissions mode now prompts on `cd DIR && grep …` when a Read() deny rule is configured (regression in 2.1.259)
- [BUG] Site permissions ("Allow all websites") ignored by the built-in browser in Claude Code Desktop
- [BUG] Dispatch-spawned Claude Code sessions ignore user's model and permission-mode settings — no way to change from mobile
- [BUG] Claude always using cd command into current working directory in combination with Git commands, requiring approval for whitelisted commands
- [BUG] Auto mode temporarily unavailable on macOS - persists across restarts (v2.1.80)
- [BUG] permissions.additionalDirectories does not load skills from added directories (--add-dir CLI flag does)
- [BUG] Claude Code v2.1.212 asks approval for ALL bash commands in plan mode
- [BUG] Auto mode blocks all Bash actions with endless retries when Opus 4.8 classifier is temporarily unavailable
- AskUserQuestion tool completes without user input, returning empty answer
- Bypass permissions mode still prompts for edits to ~/.claude/settings.json
- [Bug] Sonnet 4.6 sessions: auto mode not available via any entry path (UI, flag, settings), while Opus 4.7 in same install works
- [BUG] Built-in browser ignores Allowed sites for internal hostnames (*.habifino.local): "Site-level permissions are disabled for this site", prompt on every action
- [BUG] Auto-mode ignores permissions.ask
- Allow pre-approving EnterWorktree for worktree paths outside .claude/worktrees/
- Desktop built-in browser can't grant standing permissions for .local hosts (WordPress Studio sites)
- [BUG] Permission mode toggle broken on desktop app - "Permission mode couldn't be changed" – AUTO MODE not staying on
- [BUG] Pressing Esc to exit /btw mode rejects the pending tool-use prompt instead of just exiting the mode
- [BUG] defaultMode: bypassPermissions in settings.json has no effect — permission prompts still appear
- [Bug] Auto mode still prompts for grep tool authorization despite being in Auto Mode
- ExitPlanMode fails when plan mode toggled via Shift+Tab after starting with --dangerously-skip-permissions
- [BUG] PreToolUse permissionDecision: "allow" no longer suppresses prompt for Bash with dangerouslyDisableSandbox: true (2.1.116+ regression)
- Auto mode injects undocumented behavioral system-reminder that steers beyond its documented permission-gate contract
- [BUG] Team leader crashes with "getAppState is not a function" when teammate requests tool permission
- Read() deny rules force manual approval on unrelated Bash grep commands after cd with relative glob
- [Bug] Anthropic API Error: Auto mode classifier unavailable blocks Bash/Edit calls
- AskUserQuestion auto-completes with empty answers when listed in command allowed-tools
- [BUG] AskUserQuestion permission channel closes silently on Cowork (macOS) — agent receives "Tool permission stream closed before response received", user sees no popup
- bypassPermissions mode still prompts for edits to ~/.claude/ files
- [Bug] Classifier service unavailable or non-functional
- [Bug] Excessive permission prompts for allowed directories in auto mode
- Auto mode classifier 'temporarily unavailable' in bursts — fail-closed blocks nearly all Bash (compound commands) during peak windows
- Permission mode reverts from bypassPermissions to acceptEdits on first prompt (Claude Desktop 2.1.149 / Cowork, macOS)
- [BUG] `autoAllowBashIfSandboxed` prompts for commands containing `key=value` arguments
- [BUG] Remote Routine — MCP connector calls blocked by 'approval required' despite Always Allow (Team plan, macOS)
- Allow customizing chat:cycleMode permission mode list
- [BUG] --dangerously-skip-permissions flag does not suppress permission prompts
- --dangerously-skip-permissions still prompts for confirmation on Bash commands
- [BUG] Read(**/.env) deny rule prompts on every rg directory search, though rg skips hidden files by default
- VS Code: Edit tool prompts for permission despite bypassPermissions mode
- [Bug] Auto mode classifier returns no verdict for project-local write operations
- Workflow subagents don't inherit project settings.local.json permission allow-rules (prompt per tool call)
- [Bug] Plan mode incorrectly requests permissions for non-destructive operations like explore and Bash commands
- additionalDirectories setting does not grant Read tool access to files outside project
- `grep -r` with `--include` filters falsely triggers `Read(.env)` deny prompt (v2.1.259) — breaks every recursive search
- [BUG] useAutoModeDuringPlan never applies when a session starts in plan mode (permissions.defaultMode: "plan")
- [BUG] FOR THE LOVE OF GOD AND ALL THATS HOLY -STOP THE PERMISSION PROMPTS!!!!!
- Read() deny rule arms an unwhitelistable cd+relative-read prompt in bypassPermissions (2.1.257+), and the predicate ignores the rule's patterns
- [BUG] Privacy & filesystem access | Claude Code requests macOS TCC access to Desktop / Documents / Downloads / iCloud Drive with no apparent trigger
- Auto mode cannot be enabled via UI despite meeting all requirements (Team plan, Sonnet 4.6, admin enabled)
- Permission mode resets from 'Bypass permissions' to 'Edit automatically' mid-session
- Project-level skills in .claude/skills/ are now uneditable — protection conflicts with core feature design
- [Bug] Plugin skills prompted for Read permission on their own plugin directory files
- Spawned agents: bypassPermissions ineffective, worktree data loss, plan mode loop
- [BUG] blockReadsOutsideWorkingDirectories blocks reads inside working directory when path is resolved via cd + glob
- [BUG] Approval prompt hidden when tool detail view (Ctrl+O) is expanded
- [BUG] "Clear context" option missing from plan mode exit dialog in --dangerously-skip-permissions mode
- Auto mode: read-only Bash compounds starting with `cd DIR` lost static auto-approval in 2.1.258, causing frequent permission prompts
- [BUG] Claude in Chrome v1.0.75: 'Always allow' for browser actions not honored — re-prompts on every action (~300/session)
- [BUG] CLAUDE_CODE_ATTRIBUTION_HEADER=0 also blocks auto classifier model
- Desktop app Code tab mode picker missing "auto" and "bypass" modes
- Agent output and permission-prompt rate increase as work becomes mechanical, inverse to cognitive load
- allow_cowork_file_delete tool returns "Permission denied" without showing permission dialog
- Desktop app ignores bypassPermissions on macOS — every tool call prompts, every session, for months
- AskUserQuestion auto-completes without user input in acceptEdits permission mode
- Bypass permissions mode no longer appears in session UI on Claude Code Desktop (Mac) despite Settings toggle being enabled
- [Bug] Agent teams crash when team members request permission: getAppState is not a function
- Plan mode doesn't deactivate bypass permissions mode
- [BUG] Bogus "ANSI-C quoting" in Bash permission prompt rationale
- [BUG] Write permission allowlist ignores relative file_path that resolves to absolute-path rule target (still broken in 2.1.122 — see #29098 / #37220 / #38391)
- [BUG] PreToolUse hook "ask" permissionDecision is auto-approved in auto mode — no way to force prompt
- [Bug] Plan mode triggers 'Auto mode is unavailable for your plan' on Max subscription
- [BUG] if auto-mode gets triggered in session on Max plan, the entire session stops with "auto-mode not enabled on this plan". have to restart session
- [BUG] CoWork "Always allow" does not persist within same prompt — repeated permission prompts for each file edit
- Add a setting to disable background agents' auto-commit / auto-push / auto-PR (v2.1.198)
- [BUG] Agent mode status shows "working" during permission prompts instead of "waiting for input"
- VS Code extension ignores Bash permission allow rules from settings.json
- Edit tool prompts for permission despite bypassPermissions mode + --dangerously-skip-permissions flag
- [BUG] Claude Code v2.1.78 rejecting edits in `.claude` dir in `dontAsk` mode
- Bug: Wildcard Permission Matching Fails for Some MCP Tools
- [BUG] WorkspaceTrustError: Workspace requires trust approval before starting a session.
- [BUG] PreToolUse "if: Bash(foo*)" falsely matches Bash commands containing $()
- [Bug] Bash tool permission syntax silently fails with deprecated colon syntax
- [BUG] Bash tool's heredoc commit format triggers approval prompt on every commit regardless of auto-accept settings
- [BUG] /auto-mode-setup stores autoMode.environment globally with no per-repo key — facts from different repos get silently blended
- [Feature Request] Add API fallback mechanism for auto-mode classifier
- [Feature Request] Remove time limits from interactive questions
- PreToolUse(Bash) hook returning permissionDecision: "defer" causes "[Tool result missing due to internal error]"
- Desktop app launches claude with --permission-mode default hardcoded; auto mode toggle fails
- Claude runs explicitly forbidden destructive git commands, ignores own memory rules, destroys user work twice in same session
- [Bug] Permissions repeatedly requested despite bypass permissions enabled