Permissions issues on macOS — page 2
Issues the maintainers labelled both platform:macos and area:permissions.
996 issues · 280 open · 716 resolved (72%) · first seen Aug 5, 2025
Is this getting better or worse?
This class of problem is holding steady. 342 new reports in the last 90 days vs 364 in the 90 before — -6%. The open backlog peaked at 280 in 2026-10 and sits at 280 today.
Derived by counting each matching issue from its creation date until it closed. First-party
computation over the anthropics/claude-code tracker — the trend is not published
anywhere upstream.
Which builds report this
710 of these reports name the Claude Code build they were running, spanning 189 releases. Heaviest reporters:
- Claude Code v2.1.119
- Claude Code v2.1.114
- Claude Code v2.1.296
- Claude Code v2.1.81
- Claude Code v2.1.283
- Claude Code v2.1.289
- Claude Code v2.1.258
- Claude Code v2.1.259
Report volume, not a defect count: an issue can mention a build without that build having caused the failure. Versions come from the version string in the bug-report template, matched against real published tags.
Do these get fixed?
Median time to close is 33 days across 716 closures. Of the 716 closures with a recorded reason, 21% were closed as completed and 569 as not-planned or duplicate. The most recent completed fix landed in 2026-10.
Workarounds reported by the community
256 of these issues post a workaround someone says worked. The highest-engagement ones:
- [BUG] autoAllowBashIfSandboxed bypassed for commands containing shell expansions and several other constructs
- …t's a significant workflow regression. Partial source-level workarounds: - Quote the variable AND ensure the string has literal content ( works; alone prompts). - No workaround for , brace expansion, ANSI-C strings, here…
Found in the description of #43713 · resolved - [BUG] Bypass/dangerously skip permissions now broken in all Claude Code versions newer than v2.1.77
- Update: The PreToolUse hook workaround (returning for protected directories) does NOT work on v2.1.81 / Windows 11. The hook fires and logs the auto-approve (confirmed via audit log), but the binary-level protected-direc…
Found in the thread of #36168 · still open - auto mode temporarily unavailable - cannot enter auto mode via Shift+Tab or defaultMode setting for Max user
- A note of caution regarding the workarounds suggested above (broad rules in settings.json, or hooks that auto-approve everything): These are not workarounds for auto mode . They simply skip the permission prompt for all…
Found in the thread of #33587 · resolved - [BUG] settings.local.json allow not working - keeps asking and wanting to add existing items again
- Non of the recommended workaround work for me on Windows. I tried - "Read( )" - "Read(~/ )" - "Read(./ )" - "Read(/../ )" - "Read(/.\\../ )"
Found in the thread of #6850 · still open - Built-in Plan agent ignores parent settings.json permissions and repeatedly prompts for pre-approved tools
- …agent permissions (e.g., ) 3. Option C : Add a setting like Workarounds Attempted None available. Cannot modify built-in agent configurations. Impact - Interrupts workflow with repeated permission prompts - Makes Plan mo…
Found in the description of #10906 · still open
Excerpts are quoted from the linked issue so you can judge relevance before opening it. Threads that only ask for a workaround, or report that there is none, are excluded. These are community suggestions, not official guidance from Anthropic — read the full thread before applying one.
Matching issues 101–200
Ranked by community engagement (reactions weighted over comments). Listing the top 300 of 996 matches; the statistics above cover all 996.
- [Bug] Permissions repeatedly requested despite bypass permissions enabled
- [Feature Request] Remove or make configurable 60-second timeout for user input prompts
- [BUG] Subagent permission cascade-failure when multiple Agent tool calls in one message (2.1.126)
- [BUG] When using Opus 4.7, auto-mode no longer works: "claude-opus-4-7 is temporarily unavailable, so auto mode cannot determine the safety of..."
- Permission prompt appears despite --dangerously-skip-permissions flag
- dangerouslyDisableSandbox bypasses sandbox without user approval prompt
- [BUG] Permission prompts repeatedly triggered for paths containing spaces (iCloud "Mobile Documents")
- Claude for Chrome: site-level permissions unavailable for some domains, with no way to grant them
- [BUG] Desktop file viewer blocks files in permissions.additionalDirectories ("This file is outside the working directory") — regression
- [BUG] Root cause identified: GrowthBook A/B flags tengu_permission_friction + tengu_quill_harbor silently override defaultMode:bypassPermissions via periodic server sync — macOS Desktop
- [BUG] disableBypassPermissionsMode in managed-settings.json has no effect (v2.1.92)
- Edit permission rules in allow list have no effect — permission dialog always shown
- VS Code: initialPermissionMode setting not respected — always defaults to 'Edit automatically'
- [BUG] Grep/Glob removal on native macOS/Linux is a breaking API change, not a docs gap (re: #51781)
- [Bug] MCP allowlisted tools still trigger permission prompt on fresh session
- [BUG] VSCode extension: plan approval with "Yes, and auto-accept edits" enters acceptEdits instead of Auto mode (terminal enters Auto mode)
- [BUG] Grep/Glob restore opt-in (2.1.162) only works via --allowedTools CLI args — settings.json permission rules are ignored
- [BUG] Stop pushing "AUTO"-mode
- [BUG] Cowork Chrome extension: JS execution permission prompts fire on every call during manual tasks — approvals do not persist
- --dangerously-skip-permissions still prompts for Edit/Write tool confirmations
- ExitPlanMode resets permission mode to acceptEdits instead of restoring previous mode
- Background agents cannot get Bash permissions — bypassPermissions ignored for Agent tool
- [FEATURE] Allow users to add custom directories outside Cowork home folder to workspace restrictions
- AskUserQuestion returns empty answer when PreToolUse hook + skill allowed-tools are both present
- [BUG] Desktop (macOS): Claude Projects threads on a local folder create hidden phantom sessions, and approvals and notifications send you there
- defaultMode: bypassPermissions in .claude/settings.local.json silently ignored, missing from Shift+Tab cycle
- Bypass-permissions mode steers file edits to Bash sed/heredocs, silently removing all edit diffs
- [Bug] Anthropic API Error: Model temporarily unavailable blocks auto mode safety checks
- [BUG] Desktop app shows "Bypass Permissions mode isn't enabled" notification on every new session despite defaultMode: bypassPermissions in settings.json
- Claude Code CLI Bug Report — Permission System Broken + Agent Fails to Follow Workspace Rules
- [BUG] --dangerously-skip-permissions still does not bypass workspace trust prompt (blocks agent team teammates)
- [BUG] Backticks inside heredoc quoted strings trigger false-positive permission prompt
- [BUG] Remote settings not getting saved, re-triggering env var approval every hour
- AskUserQuestion returns empty inside Skill tool (GSD plugin context)
- Safety classifier outage blocks ALL Bash/tool calls: "claude-opus-4-8 is temporarily unavailable, so auto mode cannot determine the safety of Bash"
- [BUG] Cross-session send_message shows the approval dialog in bypass/auto permission modes, then fails after clicking Approve
- [BUG] Claude took liberties it really shouldn't with my global config
- Auto mode unavailable despite Max plan subscription
- bypassPermissions mode resets to 'default' during long sessions at system boundaries
- Regression: .claude/skills/ writes prompt for confirmation in bypassPermissions mode since 2.1.78
- [BUG] Bypass permissions mode blocks Edit/Write on .claude/ files (v2.1.78 regression)
- [BUG] Permission glob `Read(/path/**)` inconsistently matches files — some reads prompt, others don't
- Permission "don't ask again" suggests wrong command in piped chains
- [BUG] The server-side auto mode classifier is temporarily unavailable (error)
- Clicking to refocus iTerm2 window can be captured as a mouse click on the permission prompt, silently selecting "No"
- Permission dialog silently steals focus and destroys typed input — accessibility issue
- Path-pattern scanner false-positives on macOS usernames containing `.`, and "always allow" option fails to persist a rule (Bash and Write only; Edit unaffected)
- Sub-agents can escalate permission mode beyond parent session (default → auto)
- Opus 4.7: Excessive confirmation friction blocks autonomous workflows — regression vs Sonnet 4.6
- [BUG] ralph-loop plugin (claude-plugins-official): permission check failure
- [BUG] Server-managed settings from admin console not syncing to Claude Code CLI
- [BUG] "Don't ask again" on unsandboxed prompt is a no-op
- [BUG] --dangerously-skip-permissions not working on latest release v2.1.78
- Bash permission matching fails when command contains backslash-escaped spaces
- Critical: Destructive actions without user consent, ignored safety rules, dismissive behavior
- bypassPermissions does not bypass Read/Bash for paths outside project root in background subagents
- Co-work teammate silently stalls when agent calls AskUserQuestion
- [BUG] Built-in browser prompts per site even in "Skip all approvals" mode with "Allow all sites" set
- Permission wildcard warning is not deny-aware, has no suppression, and cannot be followed for variable slots
- [BUG] Interactive session refuses to prompt for trust for projects with settings.json saying the session is not interactive
- Auto-accept mode runs destructive framework DB commands (e.g. `php artisan migrate:fresh`) without confirmation → data loss
- PermissionRequest hook does not override .claude/** sensitive-path prompt on macOS 2.1.119
- [BUG] macOS Desktop: Permission prompt has no Enter keybinding — requires ⌘⇧↵ / ⌘↵ only
- Auto mode classifier should block `--break-system-packages` by default
- MCP destructive tools silently denied without prompt in acceptEdits mode — misleading error message
- Claude ran git clean -fd without permission, destroyed untracked files
- [BUG] Permission Prompts Ignore "Allow for Session" Selection
- [BUG] Auto mode classifier blocks explicitly authorized git push / git branch -D, with no reason given and no in-chat way to authorize
- claude.ai connectors mount under connection UUIDs in Desktop local sessions, so `mcp__claude_ai_<name>__*` permission rules never match there (re-raising #77598, closed as stale)
- [Bug] Anthropic API Error: Model temporarily unavailable blocking Bash operations
- Claude Code commits and pushes without permission, ignoring explicit CLAUDE.md prohibitions
- [Bug] Permission allowlist and mode toggles not suppressing Read/Write/Edit prompts
- TUI duplicates recent output into scrollback after permission-prompt modal dismisses
- bypassPermissions .claude/skills/ safeguard: Edit tool not covered by exemption, and session allows are ignored
- defaultMode: "auto" in settings.json does not activate auto mode on session start (Max plan, Opus 4.7, macOS)
- [Cowork] "Always allow" permission prompts not persisting — reads and writes — v1.1617.0
- deniedPaths bypassed by Bash tool — security policy not enforced uniformly across tools
- Plan mode deactivates after using bypass permission
- Permission wildcard Bash(command:*) fails when command arguments contain parentheses
- [BUG] Bypass permission mode resets after a PreToolUse hook returns "ask"
- Global settings.json allow list not applied in git worktree sessions
- [BUG] No way to "Allow all domains" for `WebFetch` and `WebSearch` from mobile Remote Control session
- Background auto-mode sessions execute Bash calls matching ask rules (and PreToolUse hook ask decisions) without any prompt (2.1.215)
- [Feature Request] Expose auto-mode denial reason in PermissionDenied hook payload
- [BUG] VSCode extension ignores all managed settings (managed-settings.json, MDM profile, user settings.json) on macOS
- `.claude/` edits prompt on every edit in acceptEdits mode; `permissions.allow` rules and the per-session option don't suppress it (2.1.169)
- Permission rules are bypassed by semantically-equivalent command%2 0forms (`git -C`, `cd &&`, env prefixes)
- [BUG] Auto mode ran an unrequested wildcard `rm` in a user directory and deleted user files with no confirmation
- [BUG] PreToolUse hook is not invoked after a static ask rule for the same command pattern receives session-level approval
- Agent tool: spawned sub-agents go idle immediately without executing prompt
- [Bug] Auto mode bypasses manual permission prompt for dangerouslyDisableSandbox commands
- [Bug] Agent teams crash when team members request permission: getAppState is not a function
- [BUG] Bypassed global settings to read secret keys
- "Accept edits on" mode still prompts for Edit tool approval
- Documentation discrepancy: Read(...) deny rules affect Bash tool calls (undocumented behavior)
- [Bug] Auto-added Read/Edit permissions generate double-slash paths (//Users/... instead of /Users/...)
- Background agents don't inherit Write/Edit tool allow rules from project settings
- Desktop app: Auto mode and Bypass permissions greyed out despite account toggles enabled
- PreToolUse hooks don't block in headless (-p) mode or with allowedTools wildcard
- Subagents don't inherit session-level permissions