Permissions issues on Windows
Issues the maintainers labelled both platform:windows and area:permissions.
541 issues · 182 open · 359 resolved (66%) · first seen Jan 30, 2026
Is this getting better or worse?
This class of problem is still growing. 230 new reports in the last 90 days vs 164 in the 90 before — +40%. The open backlog peaked at 182 in 2026-10 and sits at 182 today.
Derived by counting each matching issue from its creation date until it closed. First-party
computation over the anthropics/claude-code tracker — the trend is not published
anywhere upstream.
Which builds report this
323 of these reports name the Claude Code build they were running, spanning 139 releases. Heaviest reporters:
- Claude Code v2.1.258
- Claude Code v2.1.259
- Claude Code v2.1.283
- Claude Code v2.1.232
- Claude Code v2.1.197
- Claude Code v2.1.292
- Claude Code v2.1.286
- Claude Code v2.1.260
Report volume, not a defect count: an issue can mention a build without that build having caused the failure. Versions come from the version string in the bug-report template, matched against real published tags.
Do these get fixed?
Median time to close is 37 days across 359 closures. Of the 359 closures with a recorded reason, 16% were closed as completed and 301 as not-planned or duplicate. The most recent completed fix landed in 2026-10.
Workarounds reported by the community
164 of these issues post a workaround someone says worked. The highest-engagement ones:
- [BUG] Permission prompt incorrectly triggers on cd instead of the actual command in compound bash statements
- I'm having some success with the following very explicit workaround in :
Found in the thread of #28240 · still open - [BUG] Bash cd-compound-read guard prompts on absolute cd targets whenever a Read() deny rule exists (Windows Git Bash, 2.1.257-2.1.259)
- …ing the 2.1.259 changelog entry added. One more note on the workaround: removing the deny rules is not something the agent can do for you when is in effect. Both the Bash edit and the Edit tool call on are refused by the…
Found in the thread of #91650 · still open - [BUG] [Claude in Chrome] All tools blocked on reddit.com (and redd.it) with "not allowed due to safety restrictions" since 2026-09-18 — worked through 2026-09-17
- A local reverse proxy works as a workaround, altering the host name. I've built [this]( to set up such reverse proxy fast for any hostname.
Found in the thread of #95326 · still open - Auto mode classifier (claude-opus-4-8) repeatedly unavailable — blocks Bash/Write/Edit
- …o in-product trace, which makes diagnosis needlessly hard). Workarounds that held up for us, for anyone affected (a) the remedy that actually worked: cold re-login of the Desktop app (logout → login) to rotate the broker…
Found in the thread of #63819 · still open - [BUG] Unnecessary "cd" prepended to Bash commands on Windows due to path format mismatch
- …ermission system matches the instead of the actual command. Workaround — PreToolUse hook to auto-approve cd-prefixed commands: includes a hook that handles this pattern while still blocking dangerous commands in the chai…
Found in the thread of #30524 · resolved
Excerpts are quoted from the linked issue so you can judge relevance before opening it. Threads that only ask for a workaround, or report that there is none, are excluded. These are community suggestions, not official guidance from Anthropic — read the full thread before applying one.
Matching issues 1–100
Ranked by community engagement (reactions weighted over comments). Listing the top 300 of 541 matches; the statistics above cover all 541.
- [BUG] Permission prompt incorrectly triggers on cd instead of the actual command in compound bash statements
- [Feature Request] Add option to disable clickable Yes/No prompts in terminal
- [BUG] Bash cd-compound-read guard prompts on absolute cd targets whenever a Read() deny rule exists (Windows Git Bash, 2.1.257-2.1.259)
- [BUG] [Claude in Chrome] All tools blocked on reddit.com (and redd.it) with "not allowed due to safety restrictions" since 2026-09-18 — worked through 2026-09-17
- Auto mode classifier (claude-opus-4-8) repeatedly unavailable — blocks Bash/Write/Edit
- [BUG] Unnecessary "cd" prepended to Bash commands on Windows due to path format mismatch
- bypassPermissions mode now prompts on `cd DIR && grep …` when a Read() deny rule is configured (regression in 2.1.259)
- --dangerously-skip-permissions does not bypass Edit permission prompts
- Permission system UX: compound command blocking, rule accumulation, undiscoverable Bash(*) fix
- Bash Read() deny rules prompt on cd compounds even when the cd target is a literal path (2.1.259)
- [BUG] Plan mode broken - "Auto mode is unavailable for your plan" blocks all input
- [BUG] --dangerously-skip-permissions does not bypass "modify config files" prompt for ~/.claude/ writes
- [BUG] --dangerously-skip-permissions flag should bypass the permissions mode dialog without requiring persisted setting
- [BUG] --dangerously-skip-permissions does not bypass "edit its own settings" prompt for .claude/ directory writes
- Browser pane: no way to grant persistent site permission — per-action prompts persist despite launchPreviewAllowedOrigins, tool allowlist, and bypassPermissions
- [BUG] Windows Git Bash: static analysis false-positives on read-only cd-compound commands cause constant, unsuppressable permission prompts (since 2.1.232 / auto-mode rollout)
- mcp__Claude_in_Chrome__navigate silently denies non-pre-approved domains — no user-facing approval path exists anywhere
- Desktop app: bypassPermissions mode still prompts for confirmation
- [BUG] Dispatch slow to provide any feedback and infinitely asking permissions for every command
- Auto mode discourages Read/Edit/Write in favour of Bash (and TodoWrite is unavailable)
- [BUG] Permission patterns not working on Windows/WSL - session-level allow ignored
- [BUG] VSCode extension repeatedly asks for permission to edit the same file, even if Allow for this session is selected.
- [FEATURE] Desktop browser preview: auto-allow RFC 6761 reserved TLDs (*.test) that resolve to loopback, like *.localhost
- [Feature] Multi-agent runtime needs mechanical enforcement: 9 gaps that defeat unattended overnight operation
- [BUG] UNC paths in working directories cause settings.json permissions to be ignored
- [BUG] Desktop app ignores `permissions.allow` rules — prompts for everything, even Claude's own config directory
- [FEATURE] User-controlled allowlist override for server-side domain blocks (Claude in Chrome)
- [BUG] Browser pane per-action permission prompts never persist for non-localhost origins
- [BUG] 2.1.114 regression: background subagents cannot write to paths listed in permissions.allow — works in 2.1.112
- [BUG] Background subagents silently auto-deny permissions (Write tool)
- Desktop app always starts sessions in "Accept Edits" mode instead of "Bypass Permissions", even though defaultMode: "bypassPermissions" is set in ~/.claude/settings.json
- [Feature Request] Add setting to skip protected directory prompts when bypassPermissions is enabled
- [BUG] Claude Code desktop ignores permission configurations for WSL projects, requiring approval for every file operation despite proper settings
- [BUG] Remote Control not respecting Permissions set in Claude Code Desktop
- [Bug] Windows-only permission gate in 2.1.232 bypasses auto mode classifier and overrides `permissions.allow` rules
- [Bug] Plan-approval auto mode rejected with inconsistent gating, disables shift+tab auto
- "Yes, allow all edits during this session (shift+tab)" re-prompts on every edit to same file (v2.1.63)
- [BUG] v2.1.206 silently broke unattended scheduled tasks: runs no longer inherit permissions.defaultMode, fall back to Manual, and per-task mode has no programmatic or bulk control
- VS Code extension ignores Edit/Write permission rules in settings files
- [BUG] Bypass Permissions Mode will still require permissions for memory & skill edits
- Command runner false-positives: echo string with hyphens flagged as flag, glob patterns blocked in safe contexts
- Permission prompts not visible on iOS remote control client
- Auto mode classifier blocks actions the user explicitly ordered in-session (merge, deploy, reading test credentials, verification reads)
- [FEATURE] Browser pane: allow a persistent grant for interaction on an approved private-network host, not just for reading
- [BUG] send_message (cross-session) offers only "Allow once" — no persistent grant, unlike other requiresUserInteraction tools
- AskUserQuestion auto-completes with empty answers in v2.1.104 (regression from v2.1.101)
- Allow configuring protected directories in bypass permissions mode
- [BUG] PermissionDecision in PreToolUse is ignored in latest VS Code Extension
- [BUG] In "Ask before edit" permission mode, Claude Code executes Edit/Write tool calls without displaying a confirmation prompt to the user. Multiple files were modified across several tool calls with no opportunity to approve or deny.
- [BUG] Cowork (Windows): mcp__workspace__bash denied in every session after updating to 1.44121.1.0 — worked on 1.40609.1.0
- [BUG] Cowork (Windows): mcp__workspace__bash and web_fetch instantly denied in every session, no dialog — related to #57101 / #74324
- [Bug] Permission mode "auto" not inherited in new sessions and cannot be set mid-session
- PowerShell(*) wildcard has silent carve-out for subexpressions -- bypasses allowlist, prompts anyway -- v2.1.119
- Feature request: Sound notification for permission prompts in VSCode panel
- [BUG] constant permission requests and preference of Bash() calls over built-in tools
- AskUserQuestion Tool Regression with --dangerously-skip-permissions
- [BUG] VS Code extension ignores `bypassPermissions` mode; CLI honors it on same machine and config
- [BUG] settings.json or settings.local.json do NOT suppress permission prompts
- [MODEL] Severe multi-symptom degradation since 2026-06-08 on Opus 4.8 (Desktop app): ignores CLAUDE.md, bypasses permission prompts, hallucinates, refuses doable tasks, writes files unprompted
- [BUG] Workspace trust dialog asks on every session startup, doesn't persist acceptance
- Subagents don't inherit bypassPermissions mode from parent session
- Rules in .claude/rules/ and CLAUDE.md are advisory-only — no enforcement mechanism
- VSCode extension: repeatedly asks permission for already-allowed git commands (Opus 4.6)
- [BUG] VSCode extension does not enforce permissions from ~/.claude/settings.json -
- [Bug] Auto mode classifier returned no verdict error
- Auto-mode safety classifier denies the Co-Authored-By trailer that the Bash tool's own system prompt instructs the model to add
- [Bug] Command chain of pre-approved tools incorrectly requires auth
- [BUG] VS Code extension 2.1.259: Bash permission prompts fire despite bypassPermissions mode and a bare `Bash` allow rule
- [BUG] Cowork local sessions: all mcp__workspace__* tools denied without any prompt after SDK 2.1.258 (Windows)
- Model re-attempts denied tool call after user explicitly says 'no'
- --dangerously-skip-permissions flag stops working after exiting Plan Mode
- [Bug] Claude fabricates user messages to bypass approval for destructive actions
- [Bug] Auto-compact prompt causes Claude to self-approve and continue executing without user confirmation
- [Bug] Server-side auto mode classifier returns "no verdict" errors; allow-listed commands blocked
- [BUG] Permission prompt defaults to "Always allow" instead of "Allow once" - dangerous UX regression
- [BUG]Claude Desktop Cowork Projects: Editing project folder path does not update file access permissions
- [BUG] Auto Mode classifier false positives in legitimate multi-agent repo workflow after recent Claude Code update
- [Bug] Auto-mode repeatedly prompts for permission confirmation on basic commands like cd
- Windows: click-to-focus activates pending permission dialog option (click-through), submitting an unintended answer
- [Bug] CCR routines: 3 structural observability gaps — RemoteTrigger.run HTTP 400 + unmerged claude/* fire artifacts + MCP-permission-prompt deadlocks
- [BUG] AskUserQuestion fails with "Tool permission stream closed before response received" when dispatched in a parallel batch alongside other tool calls
- [BUG] Bash tool bypasses settings.json path deny rules — shell commands not subject to file tool access controls
- Plan Mode re-prompts on every call for parameterized MCP tools, even when covered by a permissions.allow wildcard
- [BUG] Claude in Chrome tools prompt on every call in Bypass mode; "Always allow" ignored (regression in 2.1.280, desktop Code tab, Windows)
- Compound-command permission prompting makes multi-session orchestration unusable (700+ prompts on non-mutating chains)
- [BUG] Connector tool permissions (Always Allow) reset to default after every Claude Desktop upgrade
- /remote-control: mobile session locked out when desktop has an unanswered permission prompt
- [DOCS] PowerShell docs omit key permission-check behavior
- bypassPermissions mode not persisted — resets mid-session and prompts for file edits
- Security: permission enforcement relies on LLM judgment rather than hard rules, settings.local.json may be bypassed
- [BUG] Title: CLAUDE.md project rules overridden by MCP server instructions — runaway token consumption
- permissions.defaultMode is ignored by the desktop app - new sessions always start in manual mode
- [Bug] Auto mode regression: unnecessary compound command permission prompts on Windows
- [BUG] Unacceptable File Access
- [BUG] Cloud MCP connectors (mcp__claude_ai_*) ignore permissions.allow — every call prompts for approval regardless of allowlist entries
- [BUG] Tool restrictions from claude.ai are ignored by the CLI / VS Code extension
- [BUG] Claude Code executed destructive command (adb shell pm clear) against explicit user instruction, causing permanent data loss
- `claude --bg` code-writing sessions stall on permission prompts with no non-interactive way to reply (acceptEdits insufficient)
- Windows: PowerShell permission classifier fails 'command line too long' when additionalDirectories list is large
- [BUG] Claude Code — Per-Agent Permission Control Gap