Permissions issues on Windows
Issues the maintainers labelled both platform:windows and area:permissions.
391 issues · 106 open · 285 resolved (73%) · first seen Jan 30, 2026
Is this getting better or worse?
This class of problem is converging. 156 new reports in the last 90 days vs 215 in the 90 before — -27%. The open backlog peaked at 106 in 2026-08 and sits at 106 today.
Derived by counting each matching issue from its creation date until it closed. First-party
computation over the anthropics/claude-code tracker — the trend is not published
anywhere upstream.
Which builds report this
219 of these reports name the Claude Code build they were running, spanning 105 releases. Heaviest reporters:
- Claude Code v2.1.232
- Claude Code v2.1.233
- Claude Code v2.1.81
- Claude Code v2.1.197
- Claude Code v2.1.119
- Claude Code v2.1.114
- Claude Code v2.1.78
- Claude Code v2.1.63
Report volume, not a defect count: an issue can mention a build without that build having caused the failure. Versions come from the version string in the bug-report template, matched against real published tags.
Do these get fixed?
Median time to close is 35 days across 285 closures. Of the 285 closures with a recorded reason, 19% were closed as completed and 232 as not-planned or duplicate. The most recent completed fix landed in 2026-08.
Workarounds reported by the community
121 of these issues post a workaround someone says worked. The highest-engagement ones:
- [BUG] Permission prompt incorrectly triggers on cd instead of the actual command in compound bash statements
- I'm having some success with the following very explicit workaround in :
Found in the thread of #28240 · still open - Auto mode classifier (claude-opus-4-8) repeatedly unavailable — blocks Bash/Write/Edit
- …o in-product trace, which makes diagnosis needlessly hard). Workarounds that held up for us, for anyone affected (a) the remedy that actually worked: cold re-login of the Desktop app (logout → login) to rotate the broker…
Found in the thread of #63819 · still open - [BUG] Unnecessary "cd" prepended to Bash commands on Windows due to path format mismatch
- …ermission system matches the instead of the actual command. Workaround — PreToolUse hook to auto-approve cd-prefixed commands: includes a hook that handles this pattern while still blocking dangerous commands in the chai…
Found in the thread of #30524 · resolved - --dangerously-skip-permissions does not bypass Edit permission prompts
- …oth scoped and unscoped options are offered inconsistently. Workaround Moving to the parent project settings ( ) resolves the issue, but this is overly broad — it affects all sub-projects when only one should have bypass…
Found in the description of #36192 · resolved - Permission system UX: compound command blocking, rule accumulation, undiscoverable Bash(*) fix
- …th anything. Still prompts for the whole string every time. Workaround in case it helps anyone hitting this thread: a PreToolUse hook that re-splits the command on shell separators (quote-aware, bails out on /backticks)…
Found in the thread of #31523 · still open
Excerpts are quoted from the linked issue so you can judge relevance before opening it. Threads that only ask for a workaround, or report that there is none, are excluded. These are community suggestions, not official guidance from Anthropic — read the full thread before applying one.
Matching issues 1–100
Ranked by community engagement (reactions weighted over comments). Listing the top 300 of 391 matches; the statistics above cover all 391.
- [BUG] Permission prompt incorrectly triggers on cd instead of the actual command in compound bash statements
- [Feature Request] Add option to disable clickable Yes/No prompts in terminal
- Auto mode classifier (claude-opus-4-8) repeatedly unavailable — blocks Bash/Write/Edit
- [BUG] Unnecessary "cd" prepended to Bash commands on Windows due to path format mismatch
- --dangerously-skip-permissions does not bypass Edit permission prompts
- [BUG] Plan mode broken - "Auto mode is unavailable for your plan" blocks all input
- Permission system UX: compound command blocking, rule accumulation, undiscoverable Bash(*) fix
- [BUG] --dangerously-skip-permissions does not bypass "modify config files" prompt for ~/.claude/ writes
- [BUG] --dangerously-skip-permissions flag should bypass the permissions mode dialog without requiring persisted setting
- [BUG] --dangerously-skip-permissions does not bypass "edit its own settings" prompt for .claude/ directory writes
- [BUG] Windows Git Bash: static analysis false-positives on read-only cd-compound commands cause constant, unsuppressable permission prompts (since 2.1.232 / auto-mode rollout)
- Desktop app: bypassPermissions mode still prompts for confirmation
- [BUG] Dispatch slow to provide any feedback and infinitely asking permissions for every command
- mcp__Claude_in_Chrome__navigate silently denies non-pre-approved domains — no user-facing approval path exists anywhere
- [BUG] Permission patterns not working on Windows/WSL - session-level allow ignored
- [BUG] VSCode extension repeatedly asks for permission to edit the same file, even if Allow for this session is selected.
- [Feature] Multi-agent runtime needs mechanical enforcement: 9 gaps that defeat unattended overnight operation
- [BUG] UNC paths in working directories cause settings.json permissions to be ignored
- [Feature Request] Add setting to skip protected directory prompts when bypassPermissions is enabled
- [FEATURE] User-controlled allowlist override for server-side domain blocks (Claude in Chrome)
- [BUG] Desktop app ignores `permissions.allow` rules — prompts for everything, even Claude's own config directory
- [BUG] Background subagents silently auto-deny permissions (Write tool)
- Desktop app always starts sessions in "Accept Edits" mode instead of "Bypass Permissions", even though defaultMode: "bypassPermissions" is set in ~/.claude/settings.json
- [BUG] 2.1.114 regression: background subagents cannot write to paths listed in permissions.allow — works in 2.1.112
- [BUG] Claude Code desktop ignores permission configurations for WSL projects, requiring approval for every file operation despite proper settings
- [BUG] Remote Control not respecting Permissions set in Claude Code Desktop
- [Bug] Plan-approval auto mode rejected with inconsistent gating, disables shift+tab auto
- "Yes, allow all edits during this session (shift+tab)" re-prompts on every edit to same file (v2.1.63)
- [Bug] Windows-only permission gate in 2.1.232 bypasses auto mode classifier and overrides `permissions.allow` rules
- [BUG] Bypass Permissions Mode will still require permissions for memory & skill edits
- VS Code extension ignores Edit/Write permission rules in settings files
- Command runner false-positives: echo string with hyphens flagged as flag, glob patterns blocked in safe contexts
- Permission prompts not visible on iOS remote control client
- AskUserQuestion auto-completes with empty answers in v2.1.104 (regression from v2.1.101)
- Allow configuring protected directories in bypass permissions mode
- [BUG] PermissionDecision in PreToolUse is ignored in latest VS Code Extension
- [BUG] In "Ask before edit" permission mode, Claude Code executes Edit/Write tool calls without displaying a confirmation prompt to the user. Multiple files were modified across several tool calls with no opportunity to approve or deny.
- [BUG] send_message (cross-session) offers only "Allow once" — no persistent grant, unlike other requiresUserInteraction tools
- [Bug] Permission mode "auto" not inherited in new sessions and cannot be set mid-session
- Feature request: Sound notification for permission prompts in VSCode panel
- [BUG] constant permission requests and preference of Bash() calls over built-in tools
- AskUserQuestion Tool Regression with --dangerously-skip-permissions
- [BUG] v2.1.206 silently broke unattended scheduled tasks: runs no longer inherit permissions.defaultMode, fall back to Manual, and per-task mode has no programmatic or bulk control
- PowerShell(*) wildcard has silent carve-out for subexpressions -- bypasses allowlist, prompts anyway -- v2.1.119
- [BUG] Workspace trust dialog asks on every session startup, doesn't persist acceptance
- [BUG] settings.json or settings.local.json do NOT suppress permission prompts
- Subagents don't inherit bypassPermissions mode from parent session
- Rules in .claude/rules/ and CLAUDE.md are advisory-only — no enforcement mechanism
- VSCode extension: repeatedly asks permission for already-allowed git commands (Opus 4.6)
- [BUG] VSCode extension does not enforce permissions from ~/.claude/settings.json -
- [MODEL] Severe multi-symptom degradation since 2026-06-08 on Opus 4.8 (Desktop app): ignores CLAUDE.md, bypasses permission prompts, hallucinates, refuses doable tasks, writes files unprompted
- Auto-mode safety classifier denies the Co-Authored-By trailer that the Bash tool's own system prompt instructs the model to add
- [Bug] Command chain of pre-approved tools incorrectly requires auth
- Model re-attempts denied tool call after user explicitly says 'no'
- --dangerously-skip-permissions flag stops working after exiting Plan Mode
- [Bug] Claude fabricates user messages to bypass approval for destructive actions
- [Bug] Auto-compact prompt causes Claude to self-approve and continue executing without user confirmation
- [BUG] Permission prompt defaults to "Always allow" instead of "Allow once" - dangerous UX regression
- [BUG]Claude Desktop Cowork Projects: Editing project folder path does not update file access permissions
- [BUG] AskUserQuestion fails with "Tool permission stream closed before response received" when dispatched in a parallel batch alongside other tool calls
- [BUG] Bash tool bypasses settings.json path deny rules — shell commands not subject to file tool access controls
- [Bug] Auto-mode repeatedly prompts for permission confirmation on basic commands like cd
- Windows: click-to-focus activates pending permission dialog option (click-through), submitting an unintended answer
- [Bug] CCR routines: 3 structural observability gaps — RemoteTrigger.run HTTP 400 + unmerged claude/* fire artifacts + MCP-permission-prompt deadlocks
- /remote-control: mobile session locked out when desktop has an unanswered permission prompt
- bypassPermissions mode not persisted — resets mid-session and prompts for file edits
- Security: permission enforcement relies on LLM judgment rather than hard rules, settings.local.json may be bypassed
- [BUG] Title: CLAUDE.md project rules overridden by MCP server instructions — runaway token consumption
- [BUG] Tool restrictions from claude.ai are ignored by the CLI / VS Code extension
- [BUG] Connector tool permissions (Always Allow) reset to default after every Claude Desktop upgrade
- Windows: PowerShell permission classifier fails 'command line too long' when additionalDirectories list is large
- [BUG] Claude Code — Per-Agent Permission Control Gap
- permissions.allow in project .claude/settings.json is ignored by VS Code extension
- Max plan: 'Auto mode is unavailable for your plan' crash mid-session (bypassPermissions + EnterPlanMode)
- [DOCS] PowerShell docs omit key permission-check behavior
- Permissions in settings.local.json not respected after Edit tool modifies the file
- [BUG] Claude Code hangs indefinitely when additionalDirectories contains unreachable network path
- [BUG] claude tends to get stuck using find/grep/sed to READ files during Explore() tool causing many permission prompts
- [BUG] Windows: Drive Letter Change Triggers Permission Resolver Explosion + Arbitrary .claude/ Directory Creation Outside Workspace
- [BUG] Critical Bug: Claude Code executed 'rm -rf' and deleted project files unexpectedly
- [Bug] Auto mode regression: unnecessary compound command permission prompts on Windows
- Compound-command permission prompting makes multi-session orchestration unusable (700+ prompts on non-mutating chains)
- Let read-only ccd_session_mgmt__search_session_transcripts be pre-authorized (it forces manual approval on every call)
- [BUG] Unacceptable File Access
- [BUG] Cloud MCP connectors (mcp__claude_ai_*) ignore permissions.allow — every call prompts for approval regardless of allowlist entries
- [BUG] Claude Code executed destructive command (adb shell pm clear) against explicit user instruction, causing permanent data loss
- `claude --bg` code-writing sessions stall on permission prompts with no non-interactive way to reply (acceptEdits insufficient)
- [BUG] Claude Code permission bypass using @../ attachment syntax outside workspace boundary
- [BUG][Windows] Desktop app ignores defaultMode: bypassPermissions in settings.json — mode picker missing "Bypass permissions" option
- [BUG] Sub-agent permission mode inheritance broken — permissionMode frontmatter and parent acceptEdits both ineffective for Edit tool calls
- Auto Mode silently weakened by hook auto-blocks — functionally identical to Accept Edits On
- [BUG] Code tab (Windows Desktop App) resolves net use mapped drives to UNC paths via fs.realpath(), causing constant permission prompts
- [Bug] Bypass permissions mode resets to ask permissions on every edit
- [FEATURE] Allow opt-out of .claude/ protected directory prompts via settings.json
- [Bug] Read/Write/Edit tools not invoked in auto/bypass modes
- Auto-mode permission classifier (claude-opus-4-8) failing at scale since ~2026-06-20 — persists after incidents support cited as resolved; forces users into Bypass permissions
- [BUG] No permission prompt before reading/searching files OUTSIDE the working directory
- Claude for Chrome extension: add global 'always allow all actions' setting to bypass per-site permission dialogs
- [BUG] Subagent autonomously ran destructive DELETE scripts against production data
- [Bug] False positive blocking beneficial outcomes in tool execution