Claude Code “Permission Denied” — Causes & Fixes
Start with the exact resource that failed. EACCES or EPERM plus a local path points to operating-system access; “publickey” or a remote URL points to Git or SSH authentication; an approval or sandbox message points to Claude Code policy. Fix only that layer instead of widening permissions everywhere.
2858 related issues · 517 open · 2341 resolved · peaked at 517 open (2026-10)
Fast diagnosis
What to do now
- Classify the error: Copy the complete message and identify whether it names a local path, a Git remote or SSH key, or a Claude Code approval or sandbox rule.
- Reproduce outside Claude Code: Run the same read-only check or failing command in your normal terminal. If it fails there too, investigate the operating system or Git; if it fails only inside Claude Code, inspect the tool permission and sandbox decision.
- Repair the narrowest access boundary: For a local path, verify the owner and required read, write, or execute bit on that path and its parent directories. For Git or SSH, verify the selected remote and key. Grant only the access the operation needs.
- Retry without privilege escalation: Repeat the original operation as your normal user. Avoid running Claude Code with sudo or applying recursive world-writable permissions, which can hide the cause and create a larger security problem.
Reference: Claude Code troubleshooting
Backlog trend over time
The line shows how many issues in this topic were open at the end of each month, derived by
counting each issue from its creation date until it was closed. First-party data from the
anthropics/claude-code tracker.
Common questions
- Why does Claude Code say “permission denied”?
- The message can come from three different layers: filesystem ownership or mode bits, Git or SSH authentication, or Claude Code tool and sandbox policy. The resource named in the complete error identifies which layer to test first.
- Should I run Claude Code with sudo to fix EACCES?
- No. Running the whole agent as root gives every command more access than it needs. Correct ownership or the specific permission on the failing path, then retry as your normal user.
- Is “Permission denied (publickey)” a filesystem error?
- Usually not. That wording comes from SSH authentication. Verify the Git remote, account access, and selected SSH key independently in a normal terminal before changing local file permissions.
All permission denied errors issues
Ranked by community engagement (reactions and comments).
- Claude Code does not respect the XDG Base Directory specification
- [BUG] Cowork: Folder picker rejects folders outside home directory, symlinks/junctions also blocked
- [FEATURE] Secure secrets injection for Claude Code on the web
- [BUG] Cowork (Windows): all Plan9 shares fail with "Plan9 mount failed: invalid argument" after Windows update KB5124008 (26200.9445) — uninstalling the KB fixes it
- [BUG] autoAllowBashIfSandboxed bypassed for commands containing shell expansions and several other constructs
- [BUG] Claude Desktop spawns 1.8 GB Hyper-V VM on every launch, even for chat-only use
- [BUG]Cowork network egress allowlist not working - custom domains blocked with 403 blocked-by-allowlist
- Sandbox: allow outbound connections to localhost
- [BUG] Claude Desktop fails to launch on Windows — orphaned Silo / Job Object after app crash, only logoff or reboot recovers (HRESULT 0x80070020 in AppModel-Runtime EventID 215/208)
- [FEATURE] Task queue for queuing multiple prompts/tasks
- [BUG] macOS sandbox blocks Security.framework TLS verification, breaking Go binaries (gh, terraform, etc.)
- [BUG] apply-seccomp fails on Linux - cannot write /proc/self/setgroups
- Go-based CLI tools (gh, terraform, etc.) fail with TLS error due to built-in HTTPS proxy
- [BUG] Bash tool calls emitted as raw <invoke> text instead of executing
- [BUG] claude -p fails with "tools.3.custom.input_examples: Extra inputs are not permitted"
- [BUG] Plugin install fails with EXDEV when /tmp is tmpfs
- Feature Request: claude remote-control --headless — daemonizable remote control without TTY dependency
- [BUG] Claude Code Web Cannot Use gh CLI Commands (Permission Denied)
- [BUG] Cowork web GUI unavailable on Linux -- only macOS and Windows supported
- [BUG] Claude creating file limit filesystem bug on long or many sessions
- Marketplace plugin cloning should default to HTTPS instead of SSH
- [FEATURE] Support OpenTelemetry (OTel) configuration in Claude Code on the Web (claude.ai/code)
- [BUG] sandbox: SOCKS5 proxy requires authentication that BSD nc cannot negotiate, breaking SSH git operations
- [BUG] The setting excludedCommands doesn't seem to be respected.
- Sandbox stubs break `git add .` and are indistinguishable from real repo state to the agent
- Sandbox blocks Go TLS cert verification on macOS (gh CLI fails)
- [BUG] Cowork — "Additional allowed domains" allowlist non-functional
- Feature: combine remote-control with --dangerously-skip-permissions
- [BUG] API Error 400: context_management: Extra inputs are not permitted
- [BUG] Claude Code on the Web .NET SDK binary downloads blocked by proxy even with "All domains" network access enabled
- [BUG] "operation not permitted: /tmp/claude-501/cwd-*" error on macOS in sandbox mode
- [FEATURE] CLAUDE_DATA_DIR env var or config key to relocate %APPDATA%\Claude\ on Windows
- [Bug] Private marketplace clone fails with HTTPS authentication error
- [BUG] Cowork Windows: September 2026 cumulative update breaks Plan9 share attach — device_bash dead on both ARM64 (KB5124012 / 28000.2954) and x64 (KB5124008 / 26200.9445); confirmed by rollback A/B on five machines
- [BUG] Cowork Edit/Write tools silently truncate files via byte-conservation buffer cap (deterministic, fires at all file sizes)
- [BUG] Maven/Gradle builds fail in Claude Code Web cloud environment - DNS resolution failure for repo.maven.apache.org
- [BUG] Cowork sessions ignore user hooks and managed settings — sandbox platform mismatch breaks all settings resolution
- 2.1.120: --continue/--resume fails with 'sandbox required but unavailable' even with sandbox.enabled=false (regression vs 2.1.119)
- [FEATURE] GPU device passthrough in sandbox mode
- [BUG] /sandbox reports as unsupported in Linux when run under WSL2
- [BUG] Linux sandbox broken - bad bwrap calls and no allow permissions
- Desktop app ignores env.PATH from settings.json (sandbox overrides)
- [BUG] [Desktop App] Cowork VM completely broken on Windows 11 Insider (MSIX) - Unresolved EXDEV rename bug in v1.1.4010
- /sandbox creates empty stub files in project root when using git worktrees
- [BUG] Claude in Chrome MCP tools: "Navigation to this domain is not allowed" on all domains (v1.0.66)
- [BUG] Bash tool: all commands fail with Bad file descriptor on Windows (Git Bash stdout broken)
- [BUG] Background tasks ignore $TMPDIR and hardcode /tmp/claude/
- [BUG] SyntaxError: Unexpected token 'S', "[SandboxDeb"... is not valid JSON Troubleshooting resources
- [BUG] Terminal clears frequently and for no reason, hiding conversation history
- Add setting to block dangerouslyOverrideSandbox parameter in Bash tool calls
- Hardcoded /tmp/claude paths break on Termux (Android)
- [DOCS/BUG] Browser automation tools (Playwright/Puppeteer) incompatible with web sandbox proxy
- [BUG] [Cowork] sandbox.network.allowedDomains ignored — external APIs blocked (api.zotero.org, crossref.org, etc.)
- [BUG] macOS sandbox cannot be enabled, shows Linux pre-requisites
- [FEATURE] Linux (bwrap): Add allowUnixSockets / allowAllUnixSockets equivalent for seccomp BPF
- [BUG] Allowed write commands (e.g. mkdir) still prompt for permission
- [BUG] /sandbox seccomp filter instructions don't work, paths not read from settings
- [BUG] Claude Code on the Web: Gradle wrapper fails to download distribution - Java doesn't honor https_proxy
- [Bug] Subagents unable to write files and call MCP tools silently
- [BUG] CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS doesn't remove ?beta=true query params and anthropic-beta headers
- Sandbox (bubblewrap) fails in git worktrees due to .git file structure
- [Feature Request] Native sandbox support for Windows (non-WSL)
- API Error 400: eager_input_streaming parameter not permitted in Claude Code VS Code Extension v2.1.72
- [BUG] Edit(.git/**) permission doesn't allow git to write .git/config in sandbox
- [BUG] Claude Cowork sandbox never becomes ready on Windows ARM64 / Snapdragon X Plus
- [BUG] Cowork on Windows: bash sandbox can create files on mounted host folder but unlink is denied — breaks all git write operations
- [Bug] v2.1.117 regression: parallel Bash tool calls corrupt fd 3 in nested-Docker sandbox; permanent /proc/self/fd/3: Permission denied
- [BUG] Auto mode is not showing up in the VS code extension on windows
- Sandbox UI: tab cycling not working on /sandbox screen
- Sandbox sets TMPDIR=/tmp/claude but writable dir is /tmp/claude-$UID
- [Bug] Anthropic API Error: Invalid message format with thinking blocks
- Plugin install fails with EXDEV when ~/.claude and /tmp are on different filesystems
- [BUG] Failed to clone marketplace repository for both HTTPs and SSH
- [BUG] Claude Desktop blank screen on Windows + Cowork unusable + sandbox API errors — Max subscriber, 9-day outage
- [BUG] Cowork cloud sandbox: egress allowlist collapses to ~5 hosts despite account setting "All domains"
- [BUG] Stream idle timeout / partial response during long tool-use turns on Claude Code Web (Opus 4.7, 1M and non-1M)
- Sandboxed Bash intermittently fails: apply-seccomp: unshare(CLONE_NEWUSER): Invalid argument
- [BUG] PreToolUse permissionDecision: "allow" no longer suppresses prompt for Bash with dangerouslyDisableSandbox: true (2.1.116+ regression)
- Claude desktop local-agent VM (claudevm.bundle/rootfs.img) grows unboundedly and is never reclaimed — silently fills disk, causes out-of-space failures
- [BUG] Sandbox: Bash cwd tracking writes to blocked /tmp/ path causing error noise on all commands
- Sandbox fails with "bwrap: execvp /bin/bash: No such file or directory" on Ubuntu 24.04
- [BUG] --dangerously-skip-permissions cannot be used with root/sudo privileges for security reasons
- Claude Code cannot read claude.ai artifact links (sandboxed frame blocks text extraction, scrolling, and export)
- Bash tool error on Windows when username contains spaces
- [BUG] claude-code for Windows is NOT available due to its port
- [BUG] Onboarding broken at chat redirect
- Multi-user permission conflicts with /tmp/claude-*-cwd files
- [BUG] Worktree isolation hard-blocks ALL `git -C <main-checkout>` calls — even read-only, even after a PreToolUse hook explicitly approves it
- [BUG] RPC error: useradd failed (exit status 12) — cannot start any new Cowork tasks
- [BUG] Sandbox mode breaks zsh heredocs - TMPPREFIX not set to sandbox-allowed path
- [BUG/UX] Sandbox network whitelist: No way to proactively configure domains, git operations fail without prompts
- [BUG] bwrap: execvp /bin/bash: No such file or directory — sandbox completely broken on all merged-usr Linux distros (Debian/Ubuntu/Arch), still unfixed after 3+ prior reports (#41863, #69583, #88059, #64799)
- Claude Desktop 3p + custom gateway (`ANTHROPIC_BASE_URL`): sandbox network pinned to gateway + api.anthropic.com, `sandbox.network.allowedDomains` ignored even after full app restart
- Symlinked files in .claude/rules/ are not auto-loaded (contradicts docs)
- Cowork cloud sessions cannot access any GitHub repository, and the git proxy instructs the agent to call a nonexistent add_repo tool
- WebSearch always fails with a 400 when effort is set to xhigh
- [FEATURE] Transfer session to another claude code instance
- [BUG] `autoAllowBashIfSandboxed` prompts for commands containing `key=value` arguments
- [FEATURE] Session-Based Permission Approval
- DesignSync has no non-interactive authorization path — blocks headless/CI design-system sync
- Claude Desktop update breaks LAN SSH/network access (OPERON_SANDBOXED_NETWORK=1)
- [BUG] Claude Code v2.1.24+ broken on macOS - cache_control.ephemeral.scope error
- [Bug] Sandbox blocks uv cache access during pytest execution
- Add support for running all commands through a shell or another command
- [Bug] Anthropic API Error: Internal Server Error (500)
- [Bug] Sandbox profile E2BIG with many git worktrees due to unbounded ancestor rule expansion
- 2.1.141: Notification:permission_prompt hook event stops firing during active thinking (regression from 2.1.139)
- [Bug] Anthropic API Error: Safety Classifier Unavailable - Auto Mode Blocked for Tool Execution
- [BUG] Sandbox `denyWithinAllow` list omits `.git/` prefix from git-internal file paths
- [BUG] Cowork crashes on M4 Mac - seccomp killed error
- Link to JSON Schema for settings.json in the official docs
- Feature: Introduce Integrated Runtime Sandboxing for Tool Execution
- [BUG] 2.1.277: excludedCommands "every part must match" also drops single commands carrying a pre-subcommand flag (git -C, -c, --git-dir)
- macOS sandbox unusable: Seatbelt profile passed inline via 'sandbox-exec -p' exceeds ARG_MAX with many git worktrees
- [BUG] Claude Code in Claude Desktop fails to work with local projects (macos)
- [BUG] `sandbox.filesystem.allowWrite` setting has no effect on macOS Seatbelt sandbox
- [BUG] Hooks fail with posix_spawn '/bin/sh' ENOENT due to sandbox restrictions
- [Bug] Alt+M keyboard shortcut does not activate planning mode
- Ctrl+V clipboard paste fails on macOS - sandbox-exec blocks hiservices XPC service
- sandbox.excludedCommands has no effect — excluded commands still run sandboxed (2.1.232, macOS)
- Sandbox filesystem protection leaves stray placeholder files / bind mounts in project working tree
- [FEATURE] Enable spellcheck in VSCode extension input (blocked on microsoft/vscode#214367)
- [BUG] bwrap sandbox broken on merged-usr systems (Arch): "Can't mount tmpfs on /newroot/lib64" — enableWeakerNestedSandbox does not fix it, MCP servers fail to start
- Sandbox: zsh writes to /tmp/claude-501/cwd-* causing 'operation not permitted' errors
- [BUG] Plugin install uses SSH for public GitHub repos, fails without SSH keys configured
- [BUG] Claude Code sandbox Bash tool loses pipe data when pipeline is last element
- [DOCS] Sandbox Edit permissions for bash write access not clearly documented
- Prohibited-actions rule blocks agents from testing login/account-creation flows in sandboxed dev/QA environments
- Sandbox auto-adds config/ to denyWithinAllow, breaking git checkout across refs
- [Bug] Linux sandbox (bash) permanently fails — cloud workspace not provisioning for Windows Cowork sessions (6+ sessions affected)
- [BUG] Cowork mode - Linux bash sandbox never starts on Windows (Workspace unavailable since first launch)
- [BUG] Horizontal scrollbar appears in panel mode due to missing horizontal padding in webview container
- Feature: Allow whitelisting sites (including localhost) in Claude in Chrome extension
- additionalDirectories setting does not grant Read tool access to files outside project
- Cowork 'Failed to create bridge sockets' error on session resume (allowedDomains=0)
- [BUG] Plugin cache keeps old versions and runs their hooks!
- [BUG] Error: kill EPERM
- Erratic Task/Subagent Behavior in Plan/Act Workflow: Premature Edits, Nested Plans, and UI Flickering
- [BUG] Bash tool fails with spawn E2BIG — sandbox profile size scales with working-tree file count, gated by git-repo detection
- [Windows] Visible console window flashes on every tool use in v2.1.143
- /login shows "Login successful" but immediately reverts to "Not logged in"
- sandbox.excludedCommands has no effect: listed commands still run sandboxed
- VS Code extension ignores sandbox settings.json / /sandbox unavailable (approval-fatigue fix unreachable in IDE)
- [BUG] Sandbox git proxy rejects git push updates to existing main with HTTP 403
- [BUG] Remote session (ultraplan) receives wrong project context
- [FEATURE] Add path-scoped Unix socket creation (bind) support in sandbox
- Use thru Bedrock throws blocking errors due to citations
- [FEATURE] Cowork: Remove folder picker restriction to user profile directory (Windows)
- [Bug] 2.1.69 TUI hangs on Windows due to config directory creation failure (EEXIST)
- EACCES permission denied on /tmp/claude/* on Android/Termux
- [BUG] SANDBOX: Cannot express “workspace-only filesystem access” with current sandbox rules
- [FEATURE] /sandbox command support in Claude Desktop app
- [BUG] Auto-update creates broken claude.exe symlink on macOS, leaving CLI unusable after restart
- [BUG] Sandbox fails with "bwrap: loopback: Failed RTM_NEWADDR: Operation not permitted" on Ubuntu 25.10 / kernel 6.17 (still broken, ref #14719)
- [BUG] Claude for Chrome MCP tools return "Navigation to this domain is not allowed" for ALL domains (v1.0.66+ regression)
- allow_cowork_file_delete tool returns "Permission denied" without showing permission dialog
- [FEATURE] Expose configurable memory and CLAUDE.md paths in Cowork mode
- [BUG] Standalone CLI binary missing seccomp binaries — /doctor reports "seccomp not available"
- [BUG] Bash tool EINVAL on Windows persists in v2.1.53 — stdio fd regression from v2.1.45 not fully fixed
- [BUG]
- [BUG] 2.1.278: a file redirection on a single excluded command defeats sandbox.excludedCommands (gh fails TLS)
- Linux sandbox: recursive Read() deny globs expand to per-file bwrap binds → E2BIG on every command (incl. echo hello) when a denied directory holds many files
- [FEATURE] Expose allowGitConfig from sandbox-runtime in settings schema
- v2.1.116 fails with Bedrock: output_config.effort not permitted
- [DOCS] Permissions and settings docs missing bash auto-approval allowlist enumeration
- [BUG] Claude Code Sandbox Bypass Security Breach
- [BUG] API Error: 400 error
- [BUG] Repo-committed extraKnownMarketplaces + enabledPlugins never processed in claude.ai/code cloud sandboxes (hooks from the same settings.json work)
- [FEATURE] Browser view / browser tools in Claude Code cloud sessions (Claude Code on the web)
- [FEATURE] Allow the Dynamic Workflows sandbox to execute external code / tools
- [BUG] Claude in Chrome MCP: navigate and read_page denied on ALL domains from Claude Desktop (Windows 11) — no approval popup renders
- [BUG] `apply-seccomp` binary loses execute bit after auto-update (Linux)
- [BUG] Claude for Excel & PowerPoint: "Extra inputs are not permitted" on code_execution_20250825.use_web_search_purpose
- Task agent fails on Termux: EACCES permission denied for /tmp/claude
- [BUG] OAuth login fails with ERR_INVALID_IP_ADDRESS behind corporate proxy (regression since 2.0.37)
- [BUG] Claude won't start "SandboxDEB is not valid JSON" error
- [Bug] `/context` command not functioning with sonnet[1m]
- [BUG] Is `/sandbox` command supported on WSL2? Getting "Unknown slash command: sandbox" error
- Allow running sub-processes under a Seatbelt policy
- dangerously-skip-permissions using a devcontainer
- [BUG] Cowork: Linux bash sandbox never finishes booting on macOS — every command returns "Workspace still starting"
- Cowork: Support Claude Code hooks (~/.claude/settings.json — UserPromptSubmit, Stop, etc.)
- [Tahoe 26.x] terminal process tree EPERM in ~/Documents — root cause analysis & data
- [BUG] 2.1.129 prints "47 skill descriptions dropped" — same files load clean on 2.1.128
- [BUG] Claude Code Desktop MacOS can't find git , but git is installed
- [BUG] Co-work Windows: sandbox environment leaks into child processes, breaking Unix domain socket IPC (JVM NIO, Gradle, MCP servers affected)
- [BUG] Cowork EXDEV rename fails on dual-drive Windows 11 MSIX install — symlinks, junctions, and VHD workarounds all fail
- [BUG] macOS sandbox blocks `bind()` on Unix domain sockets for child processes, breaking `dotnet build` parallelism
- [Bug] Claude Desktop Code mode unresponsive - no loading indicator after message send
- [BUG] Cowork: VirtioFS mount fails for users with macOS username "shared" — path collision with /Users/Shared/
- [Bug] tmux pane spawning fails in GitBash with tmux enabled
- [Bug] Incorrect keyboard shortcuts and non-functional Alt+M planning mode toggle
- [BUG] can not add marketplace on windows
- [FEATURE] Desktop Code tab: allow custom display names for project groups in the sidebar
- [BUG] Cowork local sandbox not mounting after update in Claude Desktop 1.49585.0.0 (Windows)
- [BUG] ENV_SCRUB=1 sandbox leaves persistent 0-byte placeholder files in cwd AND $HOME (.netrc, .bashrc, .gitconfig) — still in v2.1.211
- [BUG] False positive Ask prompt in sandbox auto-allow for python3 -c with inline # comments
- [BUG] All Bash tool commands hang indefinitely
- Plugin manager doesn't preserve execute permissions on shell scripts
- Ralph Loop plugin: stop-hook.sh missing execute permission on Linux