Permissions issues on macOS — page 3
Issues the maintainers labelled both platform:macos and area:permissions.
753 issues · 161 open · 592 resolved (79%) · first seen Aug 5, 2025
Is this getting better or worse?
This class of problem is converging. 256 new reports in the last 90 days vs 454 in the 90 before — -44%. The open backlog peaked at 189 in 2026-04 and sits at 161 today.
Derived by counting each matching issue from its creation date until it closed. First-party
computation over the anthropics/claude-code tracker — the trend is not published
anywhere upstream.
Which builds report this
510 of these reports name the Claude Code build they were running, spanning 146 releases. Heaviest reporters:
- Claude Code v2.1.119
- Claude Code v2.1.114
- Claude Code v2.1.81
- Claude Code v2.1.76
- Claude Code v2.1.112
- Claude Code v2.1.80
- Claude Code v2.1.233
- Claude Code v2.1.126
Report volume, not a defect count: an issue can mention a build without that build having caused the failure. Versions come from the version string in the bug-report template, matched against real published tags.
Do these get fixed?
Median time to close is 32 days across 592 closures. Of the 592 closures with a recorded reason, 24% were closed as completed and 452 as not-planned or duplicate. The most recent completed fix landed in 2026-08.
Workarounds reported by the community
193 of these issues post a workaround someone says worked. The highest-engagement ones:
- [BUG] autoAllowBashIfSandboxed bypassed for commands containing shell expansions and several other constructs
- …t's a significant workflow regression. Partial source-level workarounds: - Quote the variable AND ensure the string has literal content ( works; alone prompts). - No workaround for , brace expansion, ANSI-C strings, here…
Found in the description of #43713 · resolved - [BUG] Bypass/dangerously skip permissions now broken in all Claude Code versions newer than v2.1.77
- Update: The PreToolUse hook workaround (returning for protected directories) does NOT work on v2.1.81 / Windows 11. The hook fires and logs the auto-approve (confirmed via audit log), but the binary-level protected-direc…
Found in the thread of #36168 · still open - auto mode temporarily unavailable - cannot enter auto mode via Shift+Tab or defaultMode setting for Max user
- A note of caution regarding the workarounds suggested above (broad rules in settings.json, or hooks that auto-approve everything): These are not workarounds for auto mode . They simply skip the permission prompt for all…
Found in the thread of #33587 · resolved - [BUG] settings.local.json allow not working - keeps asking and wanting to add existing items again
- Non of the recommended workaround work for me on Windows. I tried - "Read( )" - "Read(~/ )" - "Read(./ )" - "Read(/../ )" - "Read(/.\\../ )"
Found in the thread of #6850 · still open - Built-in Plan agent ignores parent settings.json permissions and repeatedly prompts for pre-approved tools
- …agent permissions (e.g., ) 3. Option C : Add a setting like Workarounds Attempted None available. Cannot modify built-in agent configurations. Impact - Interrupts workflow with repeated permission prompts - Makes Plan mo…
Found in the description of #10906 · still open
Excerpts are quoted from the linked issue so you can judge relevance before opening it. Threads that only ask for a workaround, or report that there is none, are excluded. These are community suggestions, not official guidance from Anthropic — read the full thread before applying one.
Matching issues 201–300
Ranked by community engagement (reactions weighted over comments). Listing the top 300 of 753 matches; the statistics above cover all 753.
- Claude Code modified 1,008 user files without permission during 'test' of installed automation
- Auto-mode classifier overrides PreToolUse hook `ask` for in-flow `git commit` / `push`
- [Bug] Desktop: auto-mode silently rejected on Sonnet 4.6, no UI feedback
- [Bug] Security: Bash commands execute without user approval
- [BUG] Intermittent "Tool permission stream closed before response received" on Bash tool calls
- [BUG] Deny rules under permissions.deny not blocking file reads
- [BUG] TypeError: toolUseContext.getAppState is not a function when rendering permission prompt
- [BUG] Lead agent crashes with "toolUseContext.getAppState is not a function" when a teammate requests permission (regression in 2.1.93–2.1.112)
- [BUG] Hook PermissionRequest contract: setMode:'bypassPermissions' silently dropped in 2.1.110+, breaking a documented extension path
- Bash tool executed `brew install` without prompting user for approval
- --dangerously-skip-permissions resets mid-session, retoggling immediately reverts
- Edit/Write permission allow rules with path globs not auto-approving
- [Bug] Temporary directory access permissions not enforced
- EnterPlanMode tool unnecessarily blocked by 'auto mode unavailable' plan restriction
- Bash permission heuristic misparses shell command boundaries (escaped semicolons treated as separators)
- Permission prompts on heredoc body lines corrupt settings.local.json with garbage allow entries
- [BUG] Permission prompt triggered for files with : in path despite Edit being in allow list
- [Bug] Agent bypasses tool restrictions and performs destructive recovery without safety checks
- Global permissions not applied when project-level settings.local.json exists
- [BUG] `allowedMcpServers` in managed-settings.json can be bypassed via CLI flags
- Skill deny rules in settings.json do not block user-initiated slash commands
- Safety classifier outage blocks ALL Bash/tool calls: "claude-opus-4-8 is temporarily unavailable, so auto mode cannot determine the safety of Bash"
- [Bug] Approval prompt fails to render intermittently, causing session to hang
- Bash command with 2>&1 causes ~12min spinner hang with token usage climbing during the stall
- [BUG] Permission prompt immediately steals focus while typing (regression in 2.1.139+)
- Desktop app: "Allow bypass permissions mode" toggle is ON but runtime says it isn't enabled
- Background session: $CLAUDE_JOB_DIR writes trigger "sensitive file" prompt with non-persistent allow-list
- [Bug] Permission prompts hang when tool calls submitted during detailed output mode (ctrl+o)
- [BUG] VSCode extension requests permissions for commands already approved
- [BUG] Memory files bypass acceptEdits diff confirmation — no user review before write
- Automated QA workflows blocked by per-command approval — need batch/session approval mode
- [BUG] "Accept and auto mode" shows "Permission mode couldn't be changed" warning when accepting a plan (Claude for Mac)
- Chrome MCP returns `permission_required` with no UI to approve domain
- VSCode/Cursor extension: permission-IPC race kills sessions, error rendered as "[object Object]"
- [BUG] Auto mode disappears after shift + tab cycle in agents view
- [BUG] Action confirmation prompt requires more than keypress to be dismissed
- [Bug] Auto mode disabled by server-side feature flag override despite Max plan configuration
- [Feature Request] Add scope command to limit file access in monorepos
- [Bug] Team leader approval gate missing permission_response in SendMessage union types
- Plugin PreToolUse hooks silently override `bypassPermissions` / `acceptEdits` with no indication to the user
- [Bug] Auto Mode Classifier Incorrectly Denies Git Push Command
- [BUG] Claude Code (Opus 4.7) ran bulk DELETE against my live database with no confirmation — destroyed user data
- Concurrent subagent dispatch: child re-prompts on Edit / Write even when parent has explicit allow entries
- [Bug] Claude Code repeatedly requests permissions and forgets environment variables across sessions
- [DOCS] Permissions docs missing macOS `/private/*` dangerous `rm` targets
- [BUG] (macos) keyboard shortcut for allow-once vs always-allow
- Edit/Write guardrail blocks files with .claude/ anywhere in path, not just project-root .claude/
- [Bug] AutoMode fails with Claude Opus on Max plan
- Catastrophic data loss — autonomous `rm -rf` destroyed user home subtree despite APFS case-insensitive ambiguity and existing safeguards
- [Bug] Claude Code executed unauthorized rm -rf due to case-insensitive filesystem path resolution
- Write deny rules not enforced via managed settings (.mobileconfig)
- Permission mode reverts to "accept" for Edit tool despite "bypass" mode being set
- [Bug] Unintended file deletion: Claude deleted untracked file outside requested scope
- Permission prompts steal focus from message being typed
- [BUG]Sandbox bypass: Claude Code writes outside sandbox after user denied Write permission
- Self-modification guard ignores bypassPermissions mode
- Auto mode temporarily unavailable for MCP tools despite mcp__* in allow list
- [BUG]Bash(cmd *) trailing wildcard does not match command invoked without arguments
- [Bug] Agent self-approves and executes write operations without awaiting user confirmation
- [BUG] Write and Bash(cp) executed without permission despite restrictive settings.local.json
- [BUG] When Bash(mkdir:*) is listed in allowed-tools, Claude still prompts for permission
- tree-sitter-bash stubbed out in Bun single-file binary — all Bash permission checks use legacy fallback
- [BUG] Interpreting regular expressions as paths for permission checks
- [Bug] Code-review plugin excessive permission prompts and unnecessary cd calls
- Tool approval prompts have poor readability / unclear explanations
- Permission matcher treats quoted dash strings as flags
- [BUG] Claude not using same settings across worktrees of the same repo
- bypassPermissions stops working mid-session after sibling tool call error cascade
- Auto mode classifier denies tool calls in bypassPermissions sessions (v2.1.231)
- [Bug] Agent accesses production data without explicit permissions
- Transport loss writes a fabricated user denial into the session transcript
- Bash permission rules vs docker image-tag colons: silent dead rules, and settings.json rejects patterns --allowedTools accepts
- [BUG] sandbox.autoAllowBashIfSandboxed: true from server-managed settings is not applied — all non-allowlisted commands prompt
- Desktop app: Add Auto mode (bypass all permission prompts) equivalent to CLI's --dangerously-skip-permissions
- [BUG]
- [Bug] Ctrl-O exits batch processing and cancels all pending operations
- Edit tool bypassed 'ask before edit' permission mode
- 2.1.144/145: CLAUDE_CODE_SUBPROCESS_ENV_SCRUB=1 in settings.json + --chrome freezes input for ~3.5 min at startup (macOS)
- [FEATURE] Auto mode unavailable on Max plan - available on Team
- [BUG] Auto-mode classifier hard-blocks all mongosh invocations once a "prod"-named DB appears in context, even after user explicit authorization and switch to a separate database
- [Bug] Claude Code commits and pushes changes without explicit user approval
- [BUG] `claude agents --allow-dangerously-skip-permissions` defaults to bypass instead of allowing it
- [BUG] Deny List not Honored for Edit/Write
- [BUG] --agent mode ignores explicit permissions.allow rules for built-in read-only commands
- [Bug] Permission prompts not respected when auto-edit or bypass permissions toggle enabled
- [BUG] **Title: settings.json on Mac 2.1.128 failure
- [BUG] Cowork live artifact: connector tool calls on page load trigger one-shot Allow/Deny prompt with no "Always allow," even when connector permission is set to "Always Allow"
- Auto mode bundles permission automation with hidden behavior-reshaping system prompt
- [Bug] Claude executes git commands without explicit user confirmation during debugging
- v2.1.121 VSCode native extension: permissions.deny rules not enforced
- [BUG] Read tool fails with "Invalid regular expression: missing terminating ]" for every cwd-internal path, session-wide
- [Bug] Relative path permissions glob pattern (.*) applies incorrectly to subdirectories
- [BUG] Claude Code made unauthorized git push without explicit user confirmation
- [BUG] Shift+Tab accept-all mode still prompts for Read/Edit on every file.
- [Bug] Chrome extension permission prompts appear unreliably and difficult to locate
- [BUG] [Cowork] settings.json deny rules for WebFetch and WebSearch not enforced in Cowork desktop app
- Push-to-main rail in auto mode: wildcard allow rules don't override; only exact-match works
- [BUG] rm -rf command executed without asking permission during ambiguous prompting
- Auto-mode wrote a permissions allow-list entry for ssh-to-prod without per-action user approval
- [Bug] Unauthorized Git repository modifications by Claude agent