Claude Code “Permission Denied” — Causes & Fixes
Start with the exact resource that failed. EACCES or EPERM plus a local path points to operating-system access; “publickey” or a remote URL points to Git or SSH authentication; an approval or sandbox message points to Claude Code policy. Fix only that layer instead of widening permissions everywhere.
2494 related issues · 481 open · 2013 resolved · peaked at 481 open (2026-08)
Fast diagnosis
What to do now
- Classify the error: Copy the complete message and identify whether it names a local path, a Git remote or SSH key, or a Claude Code approval or sandbox rule.
- Reproduce outside Claude Code: Run the same read-only check or failing command in your normal terminal. If it fails there too, investigate the operating system or Git; if it fails only inside Claude Code, inspect the tool permission and sandbox decision.
- Repair the narrowest access boundary: For a local path, verify the owner and required read, write, or execute bit on that path and its parent directories. For Git or SSH, verify the selected remote and key. Grant only the access the operation needs.
- Retry without privilege escalation: Repeat the original operation as your normal user. Avoid running Claude Code with sudo or applying recursive world-writable permissions, which can hide the cause and create a larger security problem.
Reference: Claude Code troubleshooting
Backlog trend over time
The line shows how many issues in this topic were open at the end of each month, derived by
counting each issue from its creation date until it was closed. First-party data from the
anthropics/claude-code tracker.
Common questions
- Why does Claude Code say “permission denied”?
- The message can come from three different layers: filesystem ownership or mode bits, Git or SSH authentication, or Claude Code tool and sandbox policy. The resource named in the complete error identifies which layer to test first.
- Should I run Claude Code with sudo to fix EACCES?
- No. Running the whole agent as root gives every command more access than it needs. Correct ownership or the specific permission on the failing path, then retry as your normal user.
- Is “Permission denied (publickey)” a filesystem error?
- Usually not. That wording comes from SSH authentication. Verify the Git remote, account access, and selected SSH key independently in a normal terminal before changing local file permissions.
All permission denied errors issues
Ranked by community engagement (reactions and comments).
- Claude Code does not respect the XDG Base Directory specification
- [BUG] Cowork: Folder picker rejects folders outside home directory, symlinks/junctions also blocked
- [FEATURE] Secure secrets injection for Claude Code on the web
- [BUG] autoAllowBashIfSandboxed bypassed for commands containing shell expansions and several other constructs
- [BUG] Claude Desktop spawns 1.8 GB Hyper-V VM on every launch, even for chat-only use
- Sandbox: allow outbound connections to localhost
- [BUG]Cowork network egress allowlist not working - custom domains blocked with 403 blocked-by-allowlist
- [BUG] macOS sandbox blocks Security.framework TLS verification, breaking Go binaries (gh, terraform, etc.)
- [BUG] apply-seccomp fails on Linux - cannot write /proc/self/setgroups
- [BUG] Bash tool calls emitted as raw <invoke> text instead of executing
- [BUG] claude -p fails with "tools.3.custom.input_examples: Extra inputs are not permitted"
- Go-based CLI tools (gh, terraform, etc.) fail with TLS error due to built-in HTTPS proxy
- [BUG] Plugin install fails with EXDEV when /tmp is tmpfs
- [BUG] Claude Code Web Cannot Use gh CLI Commands (Permission Denied)
- Feature Request: claude remote-control --headless — daemonizable remote control without TTY dependency
- [BUG] Cowork web GUI unavailable on Linux -- only macOS and Windows supported
- [FEATURE] Support OpenTelemetry (OTel) configuration in Claude Code on the Web (claude.ai/code)
- [BUG] The setting excludedCommands doesn't seem to be respected.
- Marketplace plugin cloning should default to HTTPS instead of SSH
- Sandbox blocks Go TLS cert verification on macOS (gh CLI fails)
- Feature: combine remote-control with --dangerously-skip-permissions
- [BUG] API Error 400: context_management: Extra inputs are not permitted
- [FEATURE] Task queue for queuing multiple prompts/tasks
- [BUG] Claude creating file limit filesystem bug on long or many sessions
- [BUG] "operation not permitted: /tmp/claude-501/cwd-*" error on macOS in sandbox mode
- [BUG] Claude Desktop fails to launch on Windows — orphaned Silo / Job Object after app crash, only logoff or reboot recovers (HRESULT 0x80070020 in AppModel-Runtime EventID 215/208)
- [Bug] Private marketplace clone fails with HTTPS authentication error
- [BUG] Cowork Edit/Write tools silently truncate files via byte-conservation buffer cap (deterministic, fires at all file sizes)
- [BUG] Cowork — "Additional allowed domains" allowlist non-functional
- [BUG] Maven/Gradle builds fail in Claude Code Web cloud environment - DNS resolution failure for repo.maven.apache.org
- [BUG] Claude Code on the Web .NET SDK binary downloads blocked by proxy even with "All domains" network access enabled
- 2.1.120: --continue/--resume fails with 'sandbox required but unavailable' even with sandbox.enabled=false (regression vs 2.1.119)
- [BUG] Cowork sessions ignore user hooks and managed settings — sandbox platform mismatch breaks all settings resolution
- [BUG] /sandbox reports as unsupported in Linux when run under WSL2
- Sandbox stubs break `git add .` and are indistinguishable from real repo state to the agent
- [BUG] Linux sandbox broken - bad bwrap calls and no allow permissions
- Desktop app ignores env.PATH from settings.json (sandbox overrides)
- [BUG] [Desktop App] Cowork VM completely broken on Windows 11 Insider (MSIX) - Unresolved EXDEV rename bug in v1.1.4010
- /sandbox creates empty stub files in project root when using git worktrees
- [BUG] sandbox: SOCKS5 proxy requires authentication that BSD nc cannot negotiate, breaking SSH git operations
- [FEATURE] GPU device passthrough in sandbox mode
- [BUG] Bash tool: all commands fail with Bad file descriptor on Windows (Git Bash stdout broken)
- [BUG] SyntaxError: Unexpected token 'S', "[SandboxDeb"... is not valid JSON Troubleshooting resources
- [BUG] Background tasks ignore $TMPDIR and hardcode /tmp/claude/
- [FEATURE] CLAUDE_DATA_DIR env var or config key to relocate %APPDATA%\Claude\ on Windows
- [BUG] Claude in Chrome MCP tools: "Navigation to this domain is not allowed" on all domains (v1.0.66)
- [BUG] Terminal clears frequently and for no reason, hiding conversation history
- Hardcoded /tmp/claude paths break on Termux (Android)
- Add setting to block dangerouslyOverrideSandbox parameter in Bash tool calls
- [DOCS/BUG] Browser automation tools (Playwright/Puppeteer) incompatible with web sandbox proxy
- [BUG] [Cowork] sandbox.network.allowedDomains ignored — external APIs blocked (api.zotero.org, crossref.org, etc.)
- [BUG] macOS sandbox cannot be enabled, shows Linux pre-requisites
- [BUG] Allowed write commands (e.g. mkdir) still prompt for permission
- [BUG] /sandbox seccomp filter instructions don't work, paths not read from settings
- [BUG] Claude Code on the Web: Gradle wrapper fails to download distribution - Java doesn't honor https_proxy
- [Bug] Subagents unable to write files and call MCP tools silently
- [FEATURE] Linux (bwrap): Add allowUnixSockets / allowAllUnixSockets equivalent for seccomp BPF
- [BUG] CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS doesn't remove ?beta=true query params and anthropic-beta headers
- Sandbox (bubblewrap) fails in git worktrees due to .git file structure
- API Error 400: eager_input_streaming parameter not permitted in Claude Code VS Code Extension v2.1.72
- [BUG] Edit(.git/**) permission doesn't allow git to write .git/config in sandbox
- [Bug] v2.1.117 regression: parallel Bash tool calls corrupt fd 3 in nested-Docker sandbox; permanent /proc/self/fd/3: Permission denied
- Sandbox UI: tab cycling not working on /sandbox screen
- Sandbox sets TMPDIR=/tmp/claude but writable dir is /tmp/claude-$UID
- [Feature Request] Native sandbox support for Windows (non-WSL)
- [Bug] Anthropic API Error: Invalid message format with thinking blocks
- Plugin install fails with EXDEV when ~/.claude and /tmp are on different filesystems
- [BUG] Failed to clone marketplace repository for both HTTPs and SSH
- [BUG] Claude Cowork sandbox never becomes ready on Windows ARM64 / Snapdragon X Plus
- [BUG] Claude Desktop blank screen on Windows + Cowork unusable + sandbox API errors — Max subscriber, 9-day outage
- [BUG] Auto mode is not showing up in the VS code extension on windows
- [BUG] Cowork on Windows: bash sandbox can create files on mounted host folder but unlink is denied — breaks all git write operations
- [BUG] Stream idle timeout / partial response during long tool-use turns on Claude Code Web (Opus 4.7, 1M and non-1M)
- [BUG] PreToolUse permissionDecision: "allow" no longer suppresses prompt for Bash with dangerouslyDisableSandbox: true (2.1.116+ regression)
- [BUG] Sandbox: Bash cwd tracking writes to blocked /tmp/ path causing error noise on all commands
- [BUG] --dangerously-skip-permissions cannot be used with root/sudo privileges for security reasons
- Sandbox fails with "bwrap: execvp /bin/bash: No such file or directory" on Ubuntu 24.04
- Bash tool error on Windows when username contains spaces
- [BUG] claude-code for Windows is NOT available due to its port
- [BUG] Onboarding broken at chat redirect
- Multi-user permission conflicts with /tmp/claude-*-cwd files
- Sandboxed Bash intermittently fails: apply-seccomp: unshare(CLONE_NEWUSER): Invalid argument
- [BUG] RPC error: useradd failed (exit status 12) — cannot start any new Cowork tasks
- [BUG] Sandbox mode breaks zsh heredocs - TMPPREFIX not set to sandbox-allowed path
- [BUG/UX] Sandbox network whitelist: No way to proactively configure domains, git operations fail without prompts
- [BUG] `autoAllowBashIfSandboxed` prompts for commands containing `key=value` arguments
- [FEATURE] Session-Based Permission Approval
- [BUG] Worktree isolation hard-blocks ALL `git -C <main-checkout>` calls — even read-only, even after a PreToolUse hook explicitly approves it
- WebSearch always fails with a 400 when effort is set to xhigh
- [BUG] Claude Code v2.1.24+ broken on macOS - cache_control.ephemeral.scope error
- [Bug] Sandbox blocks uv cache access during pytest execution
- Add support for running all commands through a shell or another command
- [Bug] Anthropic API Error: Internal Server Error (500)
- Claude Desktop update breaks LAN SSH/network access (OPERON_SANDBOXED_NETWORK=1)
- 2.1.141: Notification:permission_prompt hook event stops firing during active thinking (regression from 2.1.139)
- [BUG] Sandbox `denyWithinAllow` list omits `.git/` prefix from git-internal file paths
- [BUG] Cowork crashes on M4 Mac - seccomp killed error
- Link to JSON Schema for settings.json in the official docs
- Feature: Introduce Integrated Runtime Sandboxing for Tool Execution
- [BUG] `sandbox.filesystem.allowWrite` setting has no effect on macOS Seatbelt sandbox
- [BUG] Hooks fail with posix_spawn '/bin/sh' ENOENT due to sandbox restrictions
- [Bug] Alt+M keyboard shortcut does not activate planning mode
- Ctrl+V clipboard paste fails on macOS - sandbox-exec blocks hiservices XPC service
- [Bug] Sandbox profile E2BIG with many git worktrees due to unbounded ancestor rule expansion
- [BUG] Claude Code in Claude Desktop fails to work with local projects (macos)
- Sandbox: zsh writes to /tmp/claude-501/cwd-* causing 'operation not permitted' errors
- [BUG] Plugin install uses SSH for public GitHub repos, fails without SSH keys configured
- [BUG] Claude Code sandbox Bash tool loses pipe data when pipeline is last element
- [DOCS] Sandbox Edit permissions for bash write access not clearly documented
- macOS sandbox unusable: Seatbelt profile passed inline via 'sandbox-exec -p' exceeds ARG_MAX with many git worktrees
- [FEATURE] Enable spellcheck in VSCode extension input (blocked on microsoft/vscode#214367)
- [Bug] Linux sandbox (bash) permanently fails — cloud workspace not provisioning for Windows Cowork sessions (6+ sessions affected)
- additionalDirectories setting does not grant Read tool access to files outside project
- Cowork 'Failed to create bridge sockets' error on session resume (allowedDomains=0)
- [BUG] Plugin cache keeps old versions and runs their hooks!
- [BUG] Error: kill EPERM
- Erratic Task/Subagent Behavior in Plan/Act Workflow: Premature Edits, Nested Plans, and UI Flickering
- [BUG] bwrap sandbox broken on merged-usr systems (Arch): "Can't mount tmpfs on /newroot/lib64" — enableWeakerNestedSandbox does not fix it, MCP servers fail to start
- [BUG] Cowork mode - Linux bash sandbox never starts on Windows (Workspace unavailable since first launch)
- [BUG] Horizontal scrollbar appears in panel mode due to missing horizontal padding in webview container
- [Bug] Anthropic API Error: Safety Classifier Unavailable - Auto Mode Blocked for Tool Execution
- Feature: Allow whitelisting sites (including localhost) in Claude in Chrome extension
- [BUG] Sandbox git proxy rejects git push updates to existing main with HTTP 403
- [BUG] Remote session (ultraplan) receives wrong project context
- /login shows "Login successful" but immediately reverts to "Not logged in"
- [FEATURE] Add path-scoped Unix socket creation (bind) support in sandbox
- Use thru Bedrock throws blocking errors due to citations
- [FEATURE] Cowork: Remove folder picker restriction to user profile directory (Windows)
- [Bug] 2.1.69 TUI hangs on Windows due to config directory creation failure (EEXIST)
- EACCES permission denied on /tmp/claude/* on Android/Termux
- [BUG] SANDBOX: Cannot express “workspace-only filesystem access” with current sandbox rules
- [FEATURE] /sandbox command support in Claude Desktop app
- Claude desktop local-agent VM (claudevm.bundle/rootfs.img) grows unboundedly and is never reclaimed — silently fills disk, causes out-of-space failures
- VS Code extension ignores sandbox settings.json / /sandbox unavailable (approval-fatigue fix unreachable in IDE)
- Sandbox auto-adds config/ to denyWithinAllow, breaking git checkout across refs
- [BUG] Sandbox fails with "bwrap: loopback: Failed RTM_NEWADDR: Operation not permitted" on Ubuntu 25.10 / kernel 6.17 (still broken, ref #14719)
- [BUG] Claude for Chrome MCP tools return "Navigation to this domain is not allowed" for ALL domains (v1.0.66+ regression)
- [FEATURE] Expose configurable memory and CLAUDE.md paths in Cowork mode
- [BUG] Standalone CLI binary missing seccomp binaries — /doctor reports "seccomp not available"
- [BUG] Bash tool EINVAL on Windows persists in v2.1.53 — stdio fd regression from v2.1.45 not fully fixed
- [BUG]
- [BUG] Bash tool fails with spawn E2BIG — sandbox profile size scales with working-tree file count, gated by git-repo detection
- [Windows] Visible console window flashes on every tool use in v2.1.143
- [BUG] Auto-update creates broken claude.exe symlink on macOS, leaving CLI unusable after restart
- v2.1.116 fails with Bedrock: output_config.effort not permitted
- [BUG] Claude Code Sandbox Bypass Security Breach
- [BUG] API Error: 400 error
- Claude Code cannot read claude.ai artifact links (sandboxed frame blocks text extraction, scrolling, and export)
- [FEATURE] Expose allowGitConfig from sandbox-runtime in settings schema
- allow_cowork_file_delete tool returns "Permission denied" without showing permission dialog
- [BUG] `apply-seccomp` binary loses execute bit after auto-update (Linux)
- [DOCS] Permissions and settings docs missing bash auto-approval allowlist enumeration
- [BUG] Claude for Excel & PowerPoint: "Extra inputs are not permitted" on code_execution_20250825.use_web_search_purpose
- Task agent fails on Termux: EACCES permission denied for /tmp/claude
- [BUG] OAuth login fails with ERR_INVALID_IP_ADDRESS behind corporate proxy (regression since 2.0.37)
- [BUG] Claude won't start "SandboxDEB is not valid JSON" error
- [Bug] `/context` command not functioning with sonnet[1m]
- [BUG] Is `/sandbox` command supported on WSL2? Getting "Unknown slash command: sandbox" error
- Allow running sub-processes under a Seatbelt policy
- dangerously-skip-permissions using a devcontainer
- [FEATURE] Allow the Dynamic Workflows sandbox to execute external code / tools
- Cowork: Support Claude Code hooks (~/.claude/settings.json — UserPromptSubmit, Stop, etc.)
- [BUG] 2.1.129 prints "47 skill descriptions dropped" — same files load clean on 2.1.128
- [BUG] Claude in Chrome MCP: navigate and read_page denied on ALL domains from Claude Desktop (Windows 11) — no approval popup renders
- [BUG] macOS sandbox blocks `bind()` on Unix domain sockets for child processes, breaking `dotnet build` parallelism
- [Bug] Claude Desktop Code mode unresponsive - no loading indicator after message send
- [BUG] Cowork: VirtioFS mount fails for users with macOS username "shared" — path collision with /Users/Shared/
- [Bug] tmux pane spawning fails in GitBash with tmux enabled
- [Bug] Incorrect keyboard shortcuts and non-functional Alt+M planning mode toggle
- [BUG] can not add marketplace on windows
- Symlinked files in .claude/rules/ are not auto-loaded (contradicts docs)
- [BUG] Cowork: Linux bash sandbox never finishes booting on macOS — every command returns "Workspace still starting"
- [BUG] Claude Code Desktop MacOS can't find git , but git is installed
- [BUG] False positive Ask prompt in sandbox auto-allow for python3 -c with inline # comments
- [BUG] Co-work Windows: sandbox environment leaks into child processes, breaking Unix domain socket IPC (JVM NIO, Gradle, MCP servers affected)
- [BUG] Cowork EXDEV rename fails on dual-drive Windows 11 MSIX install — symlinks, junctions, and VHD workarounds all fail
- [BUG] All Bash tool commands hang indefinitely
- Plugin manager doesn't preserve execute permissions on shell scripts
- Sandbox blocks macOS Security.framework trustd IPC, breaking all Go binaries (gh, terraform, tofu)
- Bash tool broken on Windows: Git Bash MSYS2 Bad file descriptor with piped stdout
- [BUG] Git commit with heredoc always fails on first attempt when sandbox is enabled - system prompt fights itself
- [BUG] Bash tool: exit 126 with "permission denied: /proc/self/fd/3" on Fedora 43 + zsh, blocks git writes, `ls -la`, `gh`
- Remote trigger MCP connectors not loading - tools unavailable in remote sandbox
- Ralph Loop plugin: stop-hook.sh missing execute permission on Linux
- [BUG] Sandbox not activating on WSL2 despite enabled in settings and all dependencies installed
- sandbox.excludedCommands does not bypass network restrictions (SSH blocked for git)
- [BUG] /tmp/claude path collision on shared HPC/multi-user systems
- [Feature Request] Add side-by-side diff display in terminal output
- [BUG] ## CRITICAL: Claude Code executed rm -rf deleting entire home directory
- Claude Code SSH Authentication Issue
- Prohibited-actions rule blocks agents from testing login/account-creation flows in sandboxed dev/QA environments
- [BUG] Repo-committed extraKnownMarketplaces + enabledPlugins never processed in claude.ai/code cloud sandboxes (hooks from the same settings.json work)
- [FEATURE] Workflow tool: byte-exact data channel between workflow scripts and the host (model-retyped transport corrupts commands and payloads)
- `--permission-mode dontAsk` bypasses `autoAllowBashIfSandboxed` for Bash commands containing shell variable expansion
- Claude runs explicitly forbidden destructive git commands, ignores own memory rules, destroys user work twice in same session
- [BUG] .git, .claude, and other protected directories aren't writable without a prompt even in bypassPermissions mode in 2.1.78+
- [Bug] Anthropic API Error: Internal Server Error (500)
- [FEATURE] Auto-restrict sandbox to current working directory
- [Bug] Degraded code generation quality and increased correction rate
- [BUG] Cannot login to Claude Code CLI after updating to v2.0.30