Permissions issues on macOS — page 2
Issues the maintainers labelled both platform:macos and area:permissions.
753 issues · 161 open · 592 resolved (79%) · first seen Aug 5, 2025
Is this getting better or worse?
This class of problem is converging. 256 new reports in the last 90 days vs 454 in the 90 before — -44%. The open backlog peaked at 189 in 2026-04 and sits at 161 today.
Derived by counting each matching issue from its creation date until it closed. First-party
computation over the anthropics/claude-code tracker — the trend is not published
anywhere upstream.
Which builds report this
510 of these reports name the Claude Code build they were running, spanning 146 releases. Heaviest reporters:
- Claude Code v2.1.119
- Claude Code v2.1.114
- Claude Code v2.1.81
- Claude Code v2.1.76
- Claude Code v2.1.112
- Claude Code v2.1.80
- Claude Code v2.1.233
- Claude Code v2.1.126
Report volume, not a defect count: an issue can mention a build without that build having caused the failure. Versions come from the version string in the bug-report template, matched against real published tags.
Do these get fixed?
Median time to close is 32 days across 592 closures. Of the 592 closures with a recorded reason, 24% were closed as completed and 452 as not-planned or duplicate. The most recent completed fix landed in 2026-08.
Workarounds reported by the community
193 of these issues post a workaround someone says worked. The highest-engagement ones:
- [BUG] autoAllowBashIfSandboxed bypassed for commands containing shell expansions and several other constructs
- …t's a significant workflow regression. Partial source-level workarounds: - Quote the variable AND ensure the string has literal content ( works; alone prompts). - No workaround for , brace expansion, ANSI-C strings, here…
Found in the description of #43713 · resolved - [BUG] Bypass/dangerously skip permissions now broken in all Claude Code versions newer than v2.1.77
- Update: The PreToolUse hook workaround (returning for protected directories) does NOT work on v2.1.81 / Windows 11. The hook fires and logs the auto-approve (confirmed via audit log), but the binary-level protected-direc…
Found in the thread of #36168 · still open - auto mode temporarily unavailable - cannot enter auto mode via Shift+Tab or defaultMode setting for Max user
- A note of caution regarding the workarounds suggested above (broad rules in settings.json, or hooks that auto-approve everything): These are not workarounds for auto mode . They simply skip the permission prompt for all…
Found in the thread of #33587 · resolved - [BUG] settings.local.json allow not working - keeps asking and wanting to add existing items again
- Non of the recommended workaround work for me on Windows. I tried - "Read( )" - "Read(~/ )" - "Read(./ )" - "Read(/../ )" - "Read(/.\\../ )"
Found in the thread of #6850 · still open - Built-in Plan agent ignores parent settings.json permissions and repeatedly prompts for pre-approved tools
- …agent permissions (e.g., ) 3. Option C : Add a setting like Workarounds Attempted None available. Cannot modify built-in agent configurations. Impact - Interrupts workflow with repeated permission prompts - Makes Plan mo…
Found in the description of #10906 · still open
Excerpts are quoted from the linked issue so you can judge relevance before opening it. Threads that only ask for a workaround, or report that there is none, are excluded. These are community suggestions, not official guidance from Anthropic — read the full thread before applying one.
Matching issues 101–200
Ranked by community engagement (reactions weighted over comments). Listing the top 300 of 753 matches; the statistics above cover all 753.
- [BUG] Desktop app shows "Bypass Permissions mode isn't enabled" notification on every new session despite defaultMode: bypassPermissions in settings.json
- [BUG] Cowork Chrome extension: JS execution permission prompts fire on every call during manual tasks — approvals do not persist
- Background agents cannot get Bash permissions — bypassPermissions ignored for Agent tool
- Claude Code CLI Bug Report — Permission System Broken + Agent Fails to Follow Workspace Rules
- [BUG] --dangerously-skip-permissions still does not bypass workspace trust prompt (blocks agent team teammates)
- [BUG] Backticks inside heredoc quoted strings trigger false-positive permission prompt
- [BUG] Remote settings not getting saved, re-triggering env var approval every hour
- AskUserQuestion returns empty inside Skill tool (GSD plugin context)
- [Bug] MCP allowlisted tools still trigger permission prompt on fresh session
- [BUG] VSCode extension: plan approval with "Yes, and auto-accept edits" enters acceptEdits instead of Auto mode (terminal enters Auto mode)
- [Bug] Anthropic API Error: Model temporarily unavailable blocks auto mode safety checks
- Auto mode unavailable despite Max plan subscription
- bypassPermissions mode resets to 'default' during long sessions at system boundaries
- Regression: .claude/skills/ writes prompt for confirmation in bypassPermissions mode since 2.1.78
- [BUG] Bypass permissions mode blocks Edit/Write on .claude/ files (v2.1.78 regression)
- [BUG] Permission glob `Read(/path/**)` inconsistently matches files — some reads prompt, others don't
- Permission "don't ask again" suggests wrong command in piped chains
- [BUG] Cross-session send_message shows the approval dialog in bypass/auto permission modes, then fails after clicking Approve
- [BUG] Claude took liberties it really shouldn't with my global config
- Sub-agents can escalate permission mode beyond parent session (default → auto)
- Opus 4.7: Excessive confirmation friction blocks autonomous workflows — regression vs Sonnet 4.6
- [BUG] ralph-loop plugin (claude-plugins-official): permission check failure
- [BUG] Server-managed settings from admin console not syncing to Claude Code CLI
- [BUG] "Don't ask again" on unsandboxed prompt is a no-op
- [BUG] --dangerously-skip-permissions not working on latest release v2.1.78
- Bash permission matching fails when command contains backslash-escaped spaces
- Critical: Destructive actions without user consent, ignored safety rules, dismissive behavior
- bypassPermissions does not bypass Read/Bash for paths outside project root in background subagents
- Co-work teammate silently stalls when agent calls AskUserQuestion
- Clicking to refocus iTerm2 window can be captured as a mouse click on the permission prompt, silently selecting "No"
- Permission dialog silently steals focus and destroys typed input — accessibility issue
- Path-pattern scanner false-positives on macOS usernames containing `.`, and "always allow" option fails to persist a rule (Bash and Write only; Edit unaffected)
- PermissionRequest hook does not override .claude/** sensitive-path prompt on macOS 2.1.119
- [BUG] macOS Desktop: Permission prompt has no Enter keybinding — requires ⌘⇧↵ / ⌘↵ only
- Auto mode classifier should block `--break-system-packages` by default
- MCP destructive tools silently denied without prompt in acceptEdits mode — misleading error message
- [BUG] Permission Prompts Ignore "Allow for Session" Selection
- [BUG] Interactive session refuses to prompt for trust for projects with settings.json saying the session is not interactive
- Claude Code commits and pushes without permission, ignoring explicit CLAUDE.md prohibitions
- [Bug] Permission allowlist and mode toggles not suppressing Read/Write/Edit prompts
- TUI duplicates recent output into scrollback after permission-prompt modal dismisses
- bypassPermissions .claude/skills/ safeguard: Edit tool not covered by exemption, and session allows are ignored
- defaultMode: "auto" in settings.json does not activate auto mode on session start (Max plan, Opus 4.7, macOS)
- [Cowork] "Always allow" permission prompts not persisting — reads and writes — v1.1617.0
- deniedPaths bypassed by Bash tool — security policy not enforced uniformly across tools
- Claude ran git clean -fd without permission, destroyed untracked files
- Plan mode deactivates after using bypass permission
- Permission wildcard Bash(command:*) fails when command arguments contain parentheses
- [BUG] Bypass permission mode resets after a PreToolUse hook returns "ask"
- Global settings.json allow list not applied in git worktree sessions
- [Bug] Anthropic API Error: Model temporarily unavailable blocking Bash operations
- Auto-accept mode runs destructive framework DB commands (e.g. `php artisan migrate:fresh`) without confirmation → data loss
- [BUG] Claude in Chrome v1.0.75: 'Always allow' for browser actions not honored — re-prompts on every action (~300/session)
- Agent tool: spawned sub-agents go idle immediately without executing prompt
- [Bug] Auto mode bypasses manual permission prompt for dangerouslyDisableSandbox commands
- [Bug] Agent teams crash when team members request permission: getAppState is not a function
- [BUG] Bypassed global settings to read secret keys
- "Accept edits on" mode still prompts for Edit tool approval
- Documentation discrepancy: Read(...) deny rules affect Bash tool calls (undocumented behavior)
- [Bug] Auto-added Read/Edit permissions generate double-slash paths (//Users/... instead of /Users/...)
- Background agents don't inherit Write/Edit tool allow rules from project settings
- Desktop app: Auto mode and Bypass permissions greyed out despite account toggles enabled
- PreToolUse hooks don't block in headless (-p) mode or with allowedTools wildcard
- Subagents don't inherit session-level permissions
- Bash permission pattern Bash(mkdir:*) not auto-allowing mkdir commands
- Claude Code performs destructive actions beyond the scope requested by the user
- Background auto-mode sessions execute Bash calls matching ask rules (and PreToolUse hook ask decisions) without any prompt (2.1.215)
- [BUG] VSCode extension ignores all managed settings (managed-settings.json, MDM profile, user settings.json) on macOS
- `.claude/` edits prompt on every edit in acceptEdits mode; `permissions.allow` rules and the per-session option don't suppress it (2.1.169)
- Permission rules are bypassed by semantically-equivalent command%2 0forms (`git -C`, `cd &&`, env prefixes)
- [BUG] Auto mode ran an unrequested wildcard `rm` in a user directory and deleted user files with no confirmation
- [BUG] PreToolUse hook is not invoked after a static ask rule for the same command pattern receives session-level approval
- [Bug] Agent executes destructive database operations without confirmation, causing data loss
- Auto mode hangs silently when a tool call is rejected by sandbox/permissions
- Crash: toolUseContext.getAppState is not a function when subagent triggers a Bash permission prompt
- [BUG] Organization-level policies bypassed when ANTHROPIC_BASE_URL is set, despite claude.ai OAuth authentication
- Subagents should inherit settings.local.json permissions
- Claude auto-responds to itself, acting on unapproved user messages
- Bypass permissions mode spontaneously switches to Plan Mode mid-session
- Dangerous/bypass mode still prompts for some Bash commands
- Permission prompt garbles ~/.claude path as ~/.claire
- No way to enforce approval on all file modifications
- --dangerously-skip-permissions still prompts for confirmation on Read tool
- bypassPermissions resets to acceptEdits when editing files under nested .claude/ directories
- [Bug] Remote Control disabled by organization policy with no user override option
- Managed settings deny rules from Console not enforced (remote-settings.json)
- [BUG] Cowork scheduled tasks: WebFetch permission gate (PROVENANCE_REQUIRED) blocks unattended runs on parallel calls
- PreToolUse hook permissionDecision "ask" is silently auto-approved under bypassPermissions (deny works)
- PreToolUse hook `allow` does not suppress prompt for compound commands leading with `cd … 2>/dev/null || cd …` (2.1.207 fix incomplete)
- [BUG] Classifier blocks user-authorized actions inside forked skills — parent-turn intent is invisible to the fork, and no per-action override exists
- Agent tool subagents can access file paths outside approved permission boundaries
- Intermittent reasonless permission denial on Edit/Write (fail-closed), persists under bypassPermissions
- Claude in Chrome (MCP): navigate/javascript_tool denied 'Permission denied by user' with no approval popup; approved-sites list can't be populated — survives reinstall + reconnect
- [BUG] Security: permissions.deny rules not working
- [BUG] VSCode 2.1.139: acceptEdits / Edit automatically mode still prompts for Edit tool approval (regression persists since v2.1.79)
- [BUG] `--dangerously-skip-permissions` skips trust dialog without persisting `hasTrustDialogAccepted=true`, silently disabling project-level `statusLine` / hooks'
- Edit permission glob ** pattern does not recursively match nested directories
- [BUG] False positive: macOS username ending in . triggers "suspicious Windows path pattern" on every write
- Bash tool calls not in allowlist executed without authorization prompt
- [Bug] Auto-mode yields to user after Agent tool returns instead of continuing pipeline