Permissions issues on macOS
Issues the maintainers labelled both platform:macos and area:permissions.
752 issues · 160 open · 592 resolved (79%) · first seen Aug 5, 2025
Is this getting better or worse?
This class of problem is converging. 258 new reports in the last 90 days vs 456 in the 90 before — -43%. The open backlog peaked at 189 in 2026-04 and sits at 160 today.
Derived by counting each matching issue from its creation date until it closed. First-party
computation over the anthropics/claude-code tracker — the trend is not published
anywhere upstream.
Which builds report this
509 of these reports name the Claude Code build they were running, spanning 146 releases. Heaviest reporters:
- Claude Code v2.1.119
- Claude Code v2.1.114
- Claude Code v2.1.81
- Claude Code v2.1.76
- Claude Code v2.1.112
- Claude Code v2.1.80
- Claude Code v2.1.233
- Claude Code v2.1.126
Report volume, not a defect count: an issue can mention a build without that build having caused the failure. Versions come from the version string in the bug-report template, matched against real published tags.
Do these get fixed?
Median time to close is 32 days across 592 closures. Of the 592 closures with a recorded reason, 24% were closed as completed and 452 as not-planned or duplicate. The most recent completed fix landed in 2026-08.
Workarounds reported by the community
193 of these issues post a workaround someone says worked. The highest-engagement ones:
- [BUG] autoAllowBashIfSandboxed bypassed for commands containing shell expansions and several other constructs
- …t's a significant workflow regression. Partial source-level workarounds: - Quote the variable AND ensure the string has literal content ( works; alone prompts). - No workaround for , brace expansion, ANSI-C strings, here…
Found in the description of #43713 · resolved - [BUG] Bypass/dangerously skip permissions now broken in all Claude Code versions newer than v2.1.77
- Update: The PreToolUse hook workaround (returning for protected directories) does NOT work on v2.1.81 / Windows 11. The hook fires and logs the auto-approve (confirmed via audit log), but the binary-level protected-direc…
Found in the thread of #36168 · still open - auto mode temporarily unavailable - cannot enter auto mode via Shift+Tab or defaultMode setting for Max user
- A note of caution regarding the workarounds suggested above (broad rules in settings.json, or hooks that auto-approve everything): These are not workarounds for auto mode . They simply skip the permission prompt for all…
Found in the thread of #33587 · resolved - [BUG] settings.local.json allow not working - keeps asking and wanting to add existing items again
- Non of the recommended workaround work for me on Windows. I tried - "Read( )" - "Read(~/ )" - "Read(./ )" - "Read(/../ )" - "Read(/.\\../ )"
Found in the thread of #6850 · still open - Built-in Plan agent ignores parent settings.json permissions and repeatedly prompts for pre-approved tools
- …agent permissions (e.g., ) 3. Option C : Add a setting like Workarounds Attempted None available. Cannot modify built-in agent configurations. Impact - Interrupts workflow with repeated permission prompts - Makes Plan mo…
Found in the description of #10906 · still open
Excerpts are quoted from the linked issue so you can judge relevance before opening it. Threads that only ask for a workaround, or report that there is none, are excluded. These are community suggestions, not official guidance from Anthropic — read the full thread before applying one.
Matching issues 1–100
Ranked by community engagement (reactions weighted over comments). Listing the top 300 of 752 matches; the statistics above cover all 752.
- [BUG] autoAllowBashIfSandboxed bypassed for commands containing shell expansions and several other constructs
- [BUG] Bypass/dangerously skip permissions now broken in all Claude Code versions newer than v2.1.77
- auto mode temporarily unavailable - cannot enter auto mode via Shift+Tab or defaultMode setting for Max user
- [BUG] settings.local.json allow not working - keeps asking and wanting to add existing items again
- Built-in Plan agent ignores parent settings.json permissions and repeatedly prompts for pre-approved tools
- [BUG] Plan Mode can't be used with Bypass Permissions
- [BUG] Desktop: Bypass Permissions mode can't be enabled on macOS — reverts to Accept Edits, "Permission mode couldn't be changed" (2.1.148)
- [BUG] permissions from user settings.json is NOT applied at project level
- Desktop app ignores settings.json permissions.allow and defaultMode: bypassPermissions
- [CRITICAL] Subagent spawning and subagent pattern bugs trigger infinite recursion, infinite token usage, grossly inefficient token usage, and lost accumulated subagent work.
- [BUG] Dispatch-spawned Claude Code sessions ignore user's model and permission-mode settings — no way to change from mobile
- [BUG] Claude always using cd command into current working directory in combination with Git commands, requiring approval for whitelisted commands
- [BUG] Auto mode temporarily unavailable on macOS - persists across restarts (v2.1.80)
- [BUG] permissions.additionalDirectories does not load skills from added directories (--add-dir CLI flag does)
- [BUG] Claude Code v2.1.212 asks approval for ALL bash commands in plan mode
- [BUG] Auto mode blocks all Bash actions with endless retries when Opus 4.8 classifier is temporarily unavailable
- AskUserQuestion tool completes without user input, returning empty answer
- Bypass permissions mode still prompts for edits to ~/.claude/settings.json
- [Bug] Sonnet 4.6 sessions: auto mode not available via any entry path (UI, flag, settings), while Opus 4.7 in same install works
- [BUG] Auto-mode ignores permissions.ask
- [BUG] Permission mode toggle broken on desktop app - "Permission mode couldn't be changed" – AUTO MODE not staying on
- [BUG] defaultMode: bypassPermissions in settings.json has no effect — permission prompts still appear
- ExitPlanMode fails when plan mode toggled via Shift+Tab after starting with --dangerously-skip-permissions
- [BUG] Pressing Esc to exit /btw mode rejects the pending tool-use prompt instead of just exiting the mode
- [BUG] PreToolUse permissionDecision: "allow" no longer suppresses prompt for Bash with dangerouslyDisableSandbox: true (2.1.116+ regression)
- Auto mode injects undocumented behavioral system-reminder that steers beyond its documented permission-gate contract
- [BUG] Team leader crashes with "getAppState is not a function" when teammate requests tool permission
- AskUserQuestion auto-completes with empty answers when listed in command allowed-tools
- bypassPermissions mode still prompts for edits to ~/.claude/ files
- [BUG] AskUserQuestion permission channel closes silently on Cowork (macOS) — agent receives "Tool permission stream closed before response received", user sees no popup
- Auto mode classifier 'temporarily unavailable' in bursts — fail-closed blocks nearly all Bash (compound commands) during peak windows
- [BUG] `autoAllowBashIfSandboxed` prompts for commands containing `key=value` arguments
- Permission mode reverts from bypassPermissions to acceptEdits on first prompt (Claude Desktop 2.1.149 / Cowork, macOS)
- Allow customizing chat:cycleMode permission mode list
- [BUG] --dangerously-skip-permissions flag does not suppress permission prompts
- --dangerously-skip-permissions still prompts for confirmation on Bash commands
- [BUG] Remote Routine — MCP connector calls blocked by 'approval required' despite Always Allow (Team plan, macOS)
- VS Code: Edit tool prompts for permission despite bypassPermissions mode
- Allow pre-approving EnterWorktree for worktree paths outside .claude/worktrees/
- additionalDirectories setting does not grant Read tool access to files outside project
- [Bug] Plan mode incorrectly requests permissions for non-destructive operations like explore and Bash commands
- Workflow subagents don't inherit project settings.local.json permission allow-rules (prompt per tool call)
- [BUG] FOR THE LOVE OF GOD AND ALL THATS HOLY -STOP THE PERMISSION PROMPTS!!!!!
- [BUG] useAutoModeDuringPlan never applies when a session starts in plan mode (permissions.defaultMode: "plan")
- Auto mode cannot be enabled via UI despite meeting all requirements (Team plan, Sonnet 4.6, admin enabled)
- Permission mode resets from 'Bypass permissions' to 'Edit automatically' mid-session
- Project-level skills in .claude/skills/ are now uneditable — protection conflicts with core feature design
- [Bug] Plugin skills prompted for Read permission on their own plugin directory files
- Spawned agents: bypassPermissions ineffective, worktree data loss, plan mode loop
- [BUG] "Clear context" option missing from plan mode exit dialog in --dangerously-skip-permissions mode
- [BUG] CLAUDE_CODE_ATTRIBUTION_HEADER=0 also blocks auto classifier model
- [BUG] Approval prompt hidden when tool detail view (Ctrl+O) is expanded
- Agent output and permission-prompt rate increase as work becomes mechanical, inverse to cognitive load
- Desktop app ignores bypassPermissions on macOS — every tool call prompts, every session, for months
- AskUserQuestion auto-completes without user input in acceptEdits permission mode
- Desktop app Code tab mode picker missing "auto" and "bypass" modes
- [BUG] Privacy & filesystem access | Claude Code requests macOS TCC access to Desktop / Documents / Downloads / iCloud Drive with no apparent trigger
- [Bug] Agent teams crash when team members request permission: getAppState is not a function
- allow_cowork_file_delete tool returns "Permission denied" without showing permission dialog
- Plan mode doesn't deactivate bypass permissions mode
- Bypass permissions mode no longer appears in session UI on Claude Code Desktop (Mac) despite Settings toggle being enabled
- [BUG] Write permission allowlist ignores relative file_path that resolves to absolute-path rule target (still broken in 2.1.122 — see #29098 / #37220 / #38391)
- [BUG] PreToolUse hook "ask" permissionDecision is auto-approved in auto mode — no way to force prompt
- [Bug] Plan mode triggers 'Auto mode is unavailable for your plan' on Max subscription
- [BUG] if auto-mode gets triggered in session on Max plan, the entire session stops with "auto-mode not enabled on this plan". have to restart session
- [BUG] CoWork "Always allow" does not persist within same prompt — repeated permission prompts for each file edit
- [BUG] Agent mode status shows "working" during permission prompts instead of "waiting for input"
- VS Code extension ignores Bash permission allow rules from settings.json
- Edit tool prompts for permission despite bypassPermissions mode + --dangerously-skip-permissions flag
- [BUG] Claude Code v2.1.78 rejecting edits in `.claude` dir in `dontAsk` mode
- Bug: Wildcard Permission Matching Fails for Some MCP Tools
- Add a setting to disable background agents' auto-commit / auto-push / auto-PR (v2.1.198)
- [BUG] WorkspaceTrustError: Workspace requires trust approval before starting a session.
- [BUG] PreToolUse "if: Bash(foo*)" falsely matches Bash commands containing $()
- [Bug] Bash tool permission syntax silently fails with deprecated colon syntax
- [BUG] Bash tool's heredoc commit format triggers approval prompt on every commit regardless of auto-accept settings
- [BUG] Bogus "ANSI-C quoting" in Bash permission prompt rationale
- [Feature Request] Remove time limits from interactive questions
- Desktop app launches claude with --permission-mode default hardcoded; auto mode toggle fails
- Claude runs explicitly forbidden destructive git commands, ignores own memory rules, destroys user work twice in same session
- [Bug] Permissions repeatedly requested despite bypass permissions enabled
- PreToolUse(Bash) hook returning permissionDecision: "defer" causes "[Tool result missing due to internal error]"
- [BUG] Subagent permission cascade-failure when multiple Agent tool calls in one message (2.1.126)
- [BUG] When using Opus 4.7, auto-mode no longer works: "claude-opus-4-7 is temporarily unavailable, so auto mode cannot determine the safety of..."
- Permission prompt appears despite --dangerously-skip-permissions flag
- dangerouslyDisableSandbox bypasses sandbox without user approval prompt
- [BUG] Permission prompts repeatedly triggered for paths containing spaces (iCloud "Mobile Documents")
- [Feature Request] Remove or make configurable 60-second timeout for user input prompts
- [BUG] disableBypassPermissionsMode in managed-settings.json has no effect (v2.1.92)
- Edit permission rules in allow list have no effect — permission dialog always shown
- VS Code: initialPermissionMode setting not respected — always defaults to 'Edit automatically'
- [BUG] Desktop file viewer blocks files in permissions.additionalDirectories ("This file is outside the working directory") — regression
- [BUG] Root cause identified: GrowthBook A/B flags tengu_permission_friction + tengu_quill_harbor silently override defaultMode:bypassPermissions via periodic server sync — macOS Desktop
- --dangerously-skip-permissions still prompts for Edit/Write tool confirmations
- ExitPlanMode resets permission mode to acceptEdits instead of restoring previous mode
- [FEATURE] Allow users to add custom directories outside Cowork home folder to workspace restrictions
- AskUserQuestion returns empty answer when PreToolUse hook + skill allowed-tools are both present
- [BUG] /auto-mode-setup stores autoMode.environment globally with no per-repo key — facts from different repos get silently blended
- [BUG] Grep/Glob restore opt-in (2.1.162) only works via --allowedTools CLI args — settings.json permission rules are ignored
- [BUG] Stop pushing "AUTO"-mode