Permissions issues on macOS — page 3
Issues the maintainers labelled both platform:macos and area:permissions.
996 issues · 280 open · 716 resolved (72%) · first seen Aug 5, 2025
Is this getting better or worse?
This class of problem is holding steady. 342 new reports in the last 90 days vs 364 in the 90 before — -6%. The open backlog peaked at 280 in 2026-10 and sits at 280 today.
Derived by counting each matching issue from its creation date until it closed. First-party
computation over the anthropics/claude-code tracker — the trend is not published
anywhere upstream.
Which builds report this
710 of these reports name the Claude Code build they were running, spanning 189 releases. Heaviest reporters:
- Claude Code v2.1.119
- Claude Code v2.1.114
- Claude Code v2.1.296
- Claude Code v2.1.81
- Claude Code v2.1.283
- Claude Code v2.1.289
- Claude Code v2.1.258
- Claude Code v2.1.259
Report volume, not a defect count: an issue can mention a build without that build having caused the failure. Versions come from the version string in the bug-report template, matched against real published tags.
Do these get fixed?
Median time to close is 33 days across 716 closures. Of the 716 closures with a recorded reason, 21% were closed as completed and 569 as not-planned or duplicate. The most recent completed fix landed in 2026-10.
Workarounds reported by the community
256 of these issues post a workaround someone says worked. The highest-engagement ones:
- [BUG] autoAllowBashIfSandboxed bypassed for commands containing shell expansions and several other constructs
- …t's a significant workflow regression. Partial source-level workarounds: - Quote the variable AND ensure the string has literal content ( works; alone prompts). - No workaround for , brace expansion, ANSI-C strings, here…
Found in the description of #43713 · resolved - [BUG] Bypass/dangerously skip permissions now broken in all Claude Code versions newer than v2.1.77
- Update: The PreToolUse hook workaround (returning for protected directories) does NOT work on v2.1.81 / Windows 11. The hook fires and logs the auto-approve (confirmed via audit log), but the binary-level protected-direc…
Found in the thread of #36168 · still open - auto mode temporarily unavailable - cannot enter auto mode via Shift+Tab or defaultMode setting for Max user
- A note of caution regarding the workarounds suggested above (broad rules in settings.json, or hooks that auto-approve everything): These are not workarounds for auto mode . They simply skip the permission prompt for all…
Found in the thread of #33587 · resolved - [BUG] settings.local.json allow not working - keeps asking and wanting to add existing items again
- Non of the recommended workaround work for me on Windows. I tried - "Read( )" - "Read(~/ )" - "Read(./ )" - "Read(/../ )" - "Read(/.\\../ )"
Found in the thread of #6850 · still open - Built-in Plan agent ignores parent settings.json permissions and repeatedly prompts for pre-approved tools
- …agent permissions (e.g., ) 3. Option C : Add a setting like Workarounds Attempted None available. Cannot modify built-in agent configurations. Impact - Interrupts workflow with repeated permission prompts - Makes Plan mo…
Found in the description of #10906 · still open
Excerpts are quoted from the linked issue so you can judge relevance before opening it. Threads that only ask for a workaround, or report that there is none, are excluded. These are community suggestions, not official guidance from Anthropic — read the full thread before applying one.
Matching issues 201–300
Ranked by community engagement (reactions weighted over comments). Listing the top 300 of 996 matches; the statistics above cover all 996.
- Bash permission pattern Bash(mkdir:*) not auto-allowing mkdir commands
- Claude Code performs destructive actions beyond the scope requested by the user
- [Bug] Anthropic API Error: Auto Mode Classifier No Verdict for Write Action
- [BUG] Desktop: Plan mode prompts for every non-read-only Bash command since 2.1.270 (plan+bypass quiet path now requires isInteractive; Desktop sessions get no quiet path)
- PreToolUse hooks can't reach the Bash file-command recognition that Read/Edit deny rules use, and the Bash-first directive routes reads there
- Browser pane: no way to trust private-network origins — per-action prompts and blocked subresources on LAN-resolving HTTPS sites
- permissions.deny (Bash(curl *)) silently bypassed under Auto Mode
- Auto mode classifier denies tool calls in bypassPermissions sessions (v2.1.231)
- [BUG] Cowork scheduled tasks: WebFetch permission gate (PROVENANCE_REQUIRED) blocks unattended runs on parallel calls
- PreToolUse hook permissionDecision "ask" is silently auto-approved under bypassPermissions (deny works)
- PreToolUse hook `allow` does not suppress prompt for compound commands leading with `cd … 2>/dev/null || cd …` (2.1.207 fix incomplete)
- [BUG] Classifier blocks user-authorized actions inside forked skills — parent-turn intent is invisible to the fork, and no per-action override exists
- Agent tool subagents can access file paths outside approved permission boundaries
- Intermittent reasonless permission denial on Edit/Write (fail-closed), persists under bypassPermissions
- [BUG] Security: permissions.deny rules not working
- [Bug] Agent executes destructive database operations without confirmation, causing data loss
- [BUG] False positive: macOS username ending in . triggers "suspicious Windows path pattern" on every write
- [BUG] Deny rules under permissions.deny not blocking file reads
- Auto mode hangs silently when a tool call is rejected by sandbox/permissions
- Crash: toolUseContext.getAppState is not a function when subagent triggers a Bash permission prompt
- [BUG] Organization-level policies bypassed when ANTHROPIC_BASE_URL is set, despite claude.ai OAuth authentication
- Subagents should inherit settings.local.json permissions
- Claude auto-responds to itself, acting on unapproved user messages
- Bypass permissions mode spontaneously switches to Plan Mode mid-session
- Dangerous/bypass mode still prompts for some Bash commands
- Permission prompt garbles ~/.claude path as ~/.claire
- No way to enforce approval on all file modifications
- --dangerously-skip-permissions still prompts for confirmation on Read tool
- bypassPermissions resets to acceptEdits when editing files under nested .claude/ directories
- [Bug] Remote Control disabled by organization policy with no user override option
- Managed settings deny rules from Console not enforced (remote-settings.json)
- [BUG] Auto-mode classifier blocks recording a user's own explicit approval ("Instruction Poisoning"), stalling an approved overnight multi-agent run
- Desktop app: auto mode classifier keeps blocking user-approved Claude in Chrome actions after leaving auto mode; no manual-approval retry offered
- [BUG] Opus 5.5: classifier blocks ordinary work (public research, own-machine scripts), and loses track early in short sessions
- [BUG] background-mode permission dialog shows only a Deny button, no way to Accept
- Auto-mode permission classifier denies read-only MCP tools on servers named "production"
- [BUG] Fork subagents ignore prompt-level write restrictions due to unconstrained inherited tool access
- Scheduled task session hangs forever on unattended permission prompt, then per_task_limit silently starves all future runs
- Claude in Chrome (MCP): navigate/javascript_tool denied 'Permission denied by user' with no approval popup; approved-sites list can't be populated — survives reinstall + reconnect
- [Bug] Approval prompt fails to render intermittently, causing session to hang
- Bash command with 2>&1 causes ~12min spinner hang with token usage climbing during the stall
- Desktop app: "Allow bypass permissions mode" toggle is ON but runtime says it isn't enabled
- Chrome MCP returns `permission_required` with no UI to approve domain
- [BUG] Action confirmation prompt requires more than keypress to be dismissed
- [BUG] VSCode 2.1.139: acceptEdits / Edit automatically mode still prompts for Edit tool approval (regression persists since v2.1.79)
- [BUG] `--dangerously-skip-permissions` skips trust dialog without persisting `hasTrustDialogAccepted=true`, silently disabling project-level `statusLine` / hooks'
- Edit permission glob ** pattern does not recursively match nested directories
- Bash tool calls not in allowlist executed without authorization prompt
- [Bug] Auto-mode yields to user after Agent tool returns instead of continuing pipeline
- Claude Code modified 1,008 user files without permission during 'test' of installed automation
- Auto-mode classifier overrides PreToolUse hook `ask` for in-flow `git commit` / `push`
- [Bug] Desktop: auto-mode silently rejected on Sonnet 4.6, no UI feedback
- [Bug] Security: Bash commands execute without user approval
- [BUG] Intermittent "Tool permission stream closed before response received" on Bash tool calls
- [DOCS] Permissions docs missing macOS `/private/*` dangerous `rm` targets
- [BUG] TypeError: toolUseContext.getAppState is not a function when rendering permission prompt
- [BUG] Lead agent crashes with "toolUseContext.getAppState is not a function" when a teammate requests permission (regression in 2.1.93–2.1.112)
- [BUG] Hook PermissionRequest contract: setMode:'bypassPermissions' silently dropped in 2.1.110+, breaking a documented extension path
- Catastrophic data loss — autonomous `rm -rf` destroyed user home subtree despite APFS case-insensitive ambiguity and existing safeguards
- Bash tool executed `brew install` without prompting user for approval
- --dangerously-skip-permissions resets mid-session, retoggling immediately reverts
- Edit/Write permission allow rules with path globs not auto-approving
- [Bug] Temporary directory access permissions not enforced
- EnterPlanMode tool unnecessarily blocked by 'auto mode unavailable' plan restriction
- Bash permission heuristic misparses shell command boundaries (escaped semicolons treated as separators)
- Permission prompts on heredoc body lines corrupt settings.local.json with garbage allow entries
- [BUG] Permission prompt triggered for files with : in path despite Edit being in allow list
- [Bug] Agent bypasses tool restrictions and performs destructive recovery without safety checks
- Global permissions not applied when project-level settings.local.json exists
- [BUG] `allowedMcpServers` in managed-settings.json can be bypassed via CLI flags
- Skill deny rules in settings.json do not block user-initiated slash commands
- Cowork scheduled tasks: action classifier intermittently denies authorized browser writes to a logged-in CRM; same action succeeds when user is present; no trusted-site setting
- Worktrees outside .claude/worktrees/ cost one approval prompt per switch
- [FEATURE] Directory allowlist / default-deny support for Read/Write/Edit tools (currently only Bash has real sandboxing)
- [BUG] While in Plan mode, it writes files
- [Bug] Agent accesses production data without explicit permissions
- Transport loss writes a fabricated user denial into the session transcript
- [Bug] Auto-mode classifier latches onto stale "user rejection" from a meta-complaint; blocks explicitly re-authorized actions
- Bash permission rules vs docker image-tag colons: silent dead rules, and settings.json rejects patterns --allowedTools accepts
- [BUG] sandbox.autoAllowBashIfSandboxed: true from server-managed settings is not applied — all non-allowlisted commands prompt
- [BUG]
- [Bug] Ctrl-O exits batch processing and cancels all pending operations
- [BUG] Permission prompt immediately steals focus while typing (regression in 2.1.139+)
- Background session: $CLAUDE_JOB_DIR writes trigger "sensitive file" prompt with non-persistent allow-list
- [Bug] Permission prompts hang when tool calls submitted during detailed output mode (ctrl+o)
- [BUG] VSCode extension requests permissions for commands already approved
- 2.1.144/145: CLAUDE_CODE_SUBPROCESS_ENV_SCRUB=1 in settings.json + --chrome freezes input for ~3.5 min at startup (macOS)
- [BUG] Memory files bypass acceptEdits diff confirmation — no user review before write
- Automated QA workflows blocked by per-command approval — need batch/session approval mode
- [BUG] "Accept and auto mode" shows "Permission mode couldn't be changed" warning when accepting a plan (Claude for Mac)
- VSCode/Cursor extension: permission-IPC race kills sessions, error rendered as "[object Object]"
- [BUG] Auto mode disappears after shift + tab cycle in agents view
- [Bug] Auto mode disabled by server-side feature flag override despite Max plan configuration
- [Feature Request] Add scope command to limit file access in monorepos
- [Bug] Team leader approval gate missing permission_response in SendMessage union types
- Plugin PreToolUse hooks silently override `bypassPermissions` / `acceptEdits` with no indication to the user
- [Bug] Auto Mode Classifier Incorrectly Denies Git Push Command
- [BUG] Claude Code (Opus 4.7) ran bulk DELETE against my live database with no confirmation — destroyed user data
- Concurrent subagent dispatch: child re-prompts on Edit / Write even when parent has explicit allow entries
- [Bug] Claude Code repeatedly requests permissions and forgets environment variables across sessions