Permissions issues on WSL
Issues the maintainers labelled both platform:wsl and area:permissions.
54 issues · 10 open · 44 resolved (81%) · first seen Feb 27, 2026
Is this getting better or worse?
This class of problem is converging. 16 new reports in the last 90 days vs 33 in the 90 before — -52%. The open backlog peaked at 22 in 2026-04 and sits at 10 today.
Derived by counting each matching issue from its creation date until it closed. First-party
computation over the anthropics/claude-code tracker — the trend is not published
anywhere upstream.
Which builds report this
36 of these reports name the Claude Code build they were running, spanning 32 releases. Heaviest reporters:
- Claude Code v2.1.160
- Claude Code v2.1.114
- Claude Code v2.1.73
- Claude Code v2.1.63
- Claude Code v2.1.247
- Claude Code v2.1.241
- Claude Code v2.1.240
- Claude Code v2.1.233
Report volume, not a defect count: an issue can mention a build without that build having caused the failure. Versions come from the version string in the bug-report template, matched against real published tags.
Do these get fixed?
Median time to close is 35 days across 44 closures. Of the 44 closures with a recorded reason, 30% were closed as completed and 31 as not-planned or duplicate. The most recent completed fix landed in 2026-08.
Workarounds reported by the community
16 of these issues post a workaround someone says worked. The highest-engagement ones:
- Remote Control: mobile app shows permission prompts despite --dangerously-skip-permissions
- …s addressed), but if anyone needs a working mobile workflow in the meantime, this has been reliable for me. (Disclosure: I'm the author.)
Found in the thread of #29214 · still open - [BUG] Remote Control: "Always allow" permission from Android app breaks tool calls
- …rmission gate, not in a wedged subprocess. The "Allow once" workaround already documented in this issue is consistent with the diagnosis: that path doesn't go through -persistence and so doesn't hit the broken parser. Sa…
Found in the thread of #45942 · still open - `.claude/skills/` edits prompt for permission despite being documented as exempt (regression in 2.1.79)
- …ill development involves dozens of file writes per session. Workaround Attempted Added and to the allow list — untested whether this overrides the directory protection in 2.1.79+. Environment - Claude Code: 2.1.79 / 2.1.…
Found in the description of #36497 · still open - [BUG] Permission patterns not working on Windows/WSL - session-level allow ignored
- …Permission prompt appears again despite session-level allow Workaround Using flag: claude --model sonnet --dangerously-skip-permissions Result: ✅ No permission prompts - works perfectly Note: This is an acceptable workar…
Found in the description of #29574 · resolved - [BUG] "Claude Code executed command on physical IoT device (Tasmota) without user confirmation despite explicit rules requiring approval before any action"
- …ous What Should Happen? Claude should have responded with: "You can fix this by sending this MQTT command: mosquitto pub -t 'bastian/cmnd/Timezone' -m '99'. Want me to do it?" — and then waited for explicit approval. Err…
Found in the description of #40537 · resolved
Excerpts are quoted from the linked issue so you can judge relevance before opening it. Threads that only ask for a workaround, or report that there is none, are excluded. These are community suggestions, not official guidance from Anthropic — read the full thread before applying one.
Matching issues 1–54
Ranked by community engagement (reactions weighted over comments).
- Remote Control: mobile app shows permission prompts despite --dangerously-skip-permissions
- [FEATURE] Add option to disable 'Contains backslash-escaped whitespace' warning
- [BUG] Remote Control: "Always allow" permission from Android app breaks tool calls
- `.claude/skills/` edits prompt for permission despite being documented as exempt (regression in 2.1.79)
- Desktop app: bypassPermissions mode still prompts for confirmation
- [BUG] Permission patterns not working on Windows/WSL - session-level allow ignored
- [BUG] VSCode extension repeatedly asks for permission to edit the same file, even if Allow for this session is selected.
- [BUG] "Claude Code executed command on physical IoT device (Tasmota) without user confirmation despite explicit rules requiring approval before any action"
- [BUG] Claude Code desktop ignores permission configurations for WSL projects, requiring approval for every file operation despite proper settings
- `--permission-mode dontAsk` bypasses `autoAllowBashIfSandboxed` for Bash commands containing shell variable expansion
- [BUG] CLI does not emit can_use_tool control_request when --permission-prompt-tool stdio
- [BUG] ExitPlanMode auto-approved without user interaction under acceptEdits permission mode (v2.1.63)
- Edit tool prompts for approval despite --dangerously-skip-permissions and bypassPermissions settings
- Discord reply blocked after answering permission prompt via Discord
- Background subagents do not inherit Write/Edit permission allow rules from settings.json or settings.local.json
- Bash tool blocked (exit 126 "Request interrupted by user") after 2.1.117 auto-writes skipAutoPermissionPrompt + defaultMode:auto
- [BUG] Heredoc as first argument bypasses pipe target permission checks
- [BUG] `**/` glob prefix in deny rules causes massive context bloat on Linux/WSL but not macOS
- Session-level permission caching bypasses allow list for Bash commands when sandbox mode is enabled
- Permission allow rules with ** glob not matching paths outside working directory
- AI ignores user-defined rules: performs unauthorized code/doc changes despite CLAUDE.md constraints
- [BUG] Task tool with subagent_type "Bash" auto-denies Bash commands when run_in_background: true
- [BUG] Deny rules in settings.json are not enforced — denied files and commands remain accessible`
- [FEATURE] Allow user override of sandbox auto-deny on .claude/skills/ (currently hard-coded in 2.1.x)
- UNC path check false-positive blocks WSL paths even with bypassPermissions
- [BUG] tengu_harbor_permissions feature flag overrides user-configured dangerouslySkipPermissions: true
- [BUG] bypassPermissions not working on Windows/WSL — still prompts for Edit/Write
- [BUG] AskUserQuestion silently skipped when explicitly listed in skill's allowed-tools
- [MODEL] Auto-mode permission classifier misses content visibility from prior Write tool calls in the same conversation
- [Feature Request] Auto mode classifier too aggressive, blocks legitimate SSH operations and forces suboptimal fallback plans
- [BUG] Permission relay not working with --dangerously-load-development-channels server: channels
- [Bug] Permission prompt pattern field edits ignored when saving
- ExitPlanMode auto-rejected after repeated user rejections, trapping user in plan mode
- [BUG] Auto mode fails to block tool calls that are not allowed by custom configuration
- [BUG] `claude rc` on the home directory: accepting the trust dialog never persists (`hasTrustDialogAccepted` stays false), trust loops forever
- Bash permission `allow` rules (wildcard and exact-match) never suppress prompts on WSL project opened via `\\wsl$` UNC path (VSCode WSL Remote)
- [BUG] Fullscreen mode ignores --dangerously-skip-permissions
- [BUG] Permission approval prompt disappears before any interaction
- [BUG] Repo-level .claude/settings.json not loaded when session is rooted at a parent directory
- [BUG] Permission prompt explanation feature broken: Ctrl+E does nothing, hint missing (regression in 2.1.143)
- [OPUS4.7] Read tool returns different content for ~/.claude/settings.json across calls within the same session — effective-view rendering or bug?
- tools: frontmatter — misleading error message + silent acceptance of non-documented Agent(a), Agent(b) syntax
- [BUG] Permission relay fires on all channels regardless of message origin, inconsistent with reply routing
- [BUG] Claude Code edits my files without asking, despite "Ask Before Edits" being on
- [BUG] Claude code CLI has degraded approval UX compared to android app
- [BUG] sandbox.network.allow hosts still prompt for network access
- [Bug] Claude policy enforcement not respecting user preferences
- Workspace trust dialog shows a fraction of the pre-approved permissions and offers no way to review them
- Subagent SendMessage triggers approval popup despite bypassPermissions defaultMode
- [BUG] Subagent frontmatter `disallowedTools` silently ignores MCP glob patterns (`mcp__<server>__*`) while `tools` honors them
- Self-reported misalignment: agent repeated a user-rejected git commit after reinterpreting the denial (refusal persistence)
- Claude commits and amends git history unprompted while generating commit messages
- Docs say workflow subagents always run in acceptEdits, but they inherit the session's permission mode (2.1.241)
- [Data Loss] Claude Code ran rm -rf on $HOME in auto mode — destructive code hidden inside a script the assistant wrote itself (5th report of this class)