Permission denied errors — page 2
Issues 201–400 of the 2,858 matching this topic. The trend chart and topic overview are on page 1.
- Sandbox blocks macOS Security.framework trustd IPC, breaking all Go binaries (gh, terraform, tofu)
- Bash tool broken on Windows: Git Bash MSYS2 Bad file descriptor with piped stdout
- [BUG] Git commit with heredoc always fails on first attempt when sandbox is enabled - system prompt fights itself
- Atomic write to ~/.claude/settings.json fails with EROFS/EACCES when the file is a symlink-to-a-symlink
- [FEATURE] Workflow tool: byte-exact data channel between workflow scripts and the host (model-retyped transport corrupts commands and payloads)
- [BUG] Bash tool: exit 126 with "permission denied: /proc/self/fd/3" on Fedora 43 + zsh, blocks git writes, `ls -la`, `gh`
- Remote trigger MCP connectors not loading - tools unavailable in remote sandbox
- [BUG] Sandbox not activating on WSL2 despite enabled in settings and all dependencies installed
- sandbox.excludedCommands does not bypass network restrictions (SSH blocked for git)
- [BUG] /tmp/claude path collision on shared HPC/multi-user systems
- [Feature Request] Add side-by-side diff display in terminal output
- [BUG] ## CRITICAL: Claude Code executed rm -rf deleting entire home directory
- Claude Code SSH Authentication Issue
- [FEATURE] Claude Code on the web: allow read access to public GitHub repositories via user OAuth (no GitHub App install required)
- Claude Code web sandbox proxy allowlist blocks user-owned custom domains
- `--permission-mode dontAsk` bypasses `autoAllowBashIfSandboxed` for Bash commands containing shell variable expansion
- [BUG] Cowork EXDEV: cross-device link not permitted — rename within same directory (Windows 11 Pro, OneDrive present)
- Claude runs explicitly forbidden destructive git commands, ignores own memory rules, destroys user work twice in same session
- [BUG] .git, .claude, and other protected directories aren't writable without a prompt even in bypassPermissions mode in 2.1.78+
- [Bug] Anthropic API Error: Internal Server Error (500)
- [FEATURE] Auto-restrict sandbox to current working directory
- [Bug] Degraded code generation quality and increased correction rate
- [BUG] Cannot login to Claude Code CLI after updating to v2.0.30
- [BUG] Sub-agent Write tool operations don't persist to filesystem - Partial sandboxing (v2.0.14)
- Auto mode classifier blocks the account owner's own scheduled task ("Cowork Run Routine Now"), and blocked file transfer between the owner's own machines
- [BUG] Cowork (Windows): mcp__workspace__bash and web_fetch instantly denied in every session, no dialog — related to #57101 / #74324
- [BUG] 2.1.216 sandbox regression: "bwrap: Can't mkdir /opt/.claude" — ancestor-walk denyWrite mountpoints fail-closed on non-root installs under root-owned dirs
- [Bug] Sandbox write-deny on `.claude/.cc-writes` prevents git worktree removal after ExitWorktree
- `claude-api` skill dumps entire ~784KB SKILL.md into context for a simple usage-limit question, burning huge Pro-plan usage
- [BUG] Sandbox git-internals write-protection resolves paths against the worktree root, not `.git/` — collaterally blocks a project's top-level `config/` dir
- Read tool PDF support broken on Windows — sandbox rejects pdftoppm from all locations
- [BUG] BUG: Cowork Linux sandbox fails to start on Windows — persists after all Hyper-V service fixes
- [BUG] Preview server cannot read files from ~/Desktop on macOS despite Full Disk Access
- [BUG] bwrap fails in a worktree when .claude/skills is a symlink in a repository
- Sandbox sets TMPDIR to non-existent directory, causing child processes to hang
- sandbox.enabled: false setting ignored — bwrap still wraps all Bash commands
- dangerouslyDisableSandbox bypasses sandbox without user approval prompt
- [BUG] VS code Claude Code extension fails - Bedrock API Compatibility Issue - `eager_input_streaming` Parameter
- [BUG] Cowork workspace bricked after Chrome automation task on Windows 11 Home, no recovery path
- cannot send any message, error 500 (San Francisco Mission)
- [BUG] Code tab writes UI render metadata (start_timestamp/stop_timestamp/flags) into transcript JSONL, causing unrecoverable API 400 that recurs after full sanitization
- Auto mode classifier persistently unavailable — 2+ weeks, reproduces across accounts, machines, OSes, and CLI versions
- excludedCommands with a glob unsandboxes the entire Bash invocation, including commands that run before the excluded one
- [BUG] Extensions settings tab stuck on "Loading extensions..." — EventEmitter memory leak in IPC listeners
- Refuses all credential / sign-in / account-creation work even when intentional and authorized — used to work, ignores bypass-permissions
- Bash sandbox (bubblewrap) corrupts `!` to `\!` in commands, making the sandbox unusable for agentic workflows
- claude.ai MCP-Apps host silently drops `_meta.ui.csp.frameDomains`, blocking all third-party inline iframe embeds (YouTube, Salesforce, etc.)
- [BUG] Claude Code crashes with "exited with code 1" on multi-user macOS due to shared /tmp/claude-settings-<hash>.json
- [BUG] bwrap sandbox completely broken — "Can't create file at .zshrc: Read-only file system" kills ALL Bash tool calls
- sandbox.filesystem.denyWrite/denyRead silently ignore relative paths; only absolute paths work
- [FEATURE] Make OAuth/admin base URL configurable like ANTHROPIC_BASE_URL
- Sandbox crashes when auto-denied file paths traverse symlinks
- [BUG] disableBypassPermissionsMode in managed-settings.json has no effect (v2.1.92)
- CUA save_to_disk screenshots not accessible from filesystem
- [Bug] Claude Code performance degradation and compilation failures
- [BUG] Hook error messages shown on every tool call even when hooks exit 0
- [BUG] Claude Code makes high-frequency version polling requests (~2-4/min) to GCS
- [BUG] Regression in 2.1.72 (VS Code, Bedrock): `400 tools.0.custom.eager_input_streaming: Extra inputs are not permitted`
- Add sandbox status to status line JSON input
- Cowork VM: EXDEV error when installing marketplace plugins
- [BUG] git commit fails inside sandbox on macos
- [Bug] Permission denied error on every Bash command after macOS upgrade
- Streaming output in `--verbose --print`
- sandbox: filesystem reads are unrestricted, and the agent can silently break its own sandbox enforcement by editing settings.json
- Desktop rewind fails on conversation-only sessions: not on active chain (chain size 2/N)
- [BUG] Plugin install no longer copies symlinked skills to cache (regression in v2.1.117)
- Sandbox TLS verification fails for gh CLI despite github.com in allowedHosts
- excludedCommands glob matching unsandboxes entire shell invocation, enabling sandbox escape via command chaining
- [BUG] Cloud scheduled tasks: gRPC/HTTP2 blocked by sandbox TLS proxy to googleapis.com
- Cowork VM: HCS 0x80070005 (Access Denied) on Win11 25H2 - MSIX SYSTEM ACL missing
- [BUG] Claude Code Destructive Action + Repeated User Interaction Failures
- [BUG] claude sometimes wants to use /tmp even though CLAUDE_CODE_TMPDIR is set in the environment
- [BUG] Claude code for VSCode v2.1.72 gives 400 to every input
- [FEATURE] Sandbox should isolate all tool execution, not just Bash
- [Bug] Sibling tool call errored regression since v2.1.19
- [BUG] Network requests outside of sandbox don't trigger `PermissionRequest` hook
- EACCES: permission denied on Termux/Android - hardcoded /tmp path ignores $TMPDIR
- tmpclaude-xxxx-cwd are left littering project
- [BUG] Claude Code hangs entirely when /dev/stdin is read using Bash tool in a sandbox
- [BUG] React Hydration Error Prevents Claude Code Web Session Startup
- [BUG] Node.js error when `ps` is unavailable
- [Suggestion] Alternative for per-user NPM configuration so that `claude` does not want user to install into `/usr` as superuser.
- Sandbox creates empty `.claude/.cc-writes/` dirs in nested subfolders when working directory changes
- [Bug] macOS TCC permissions lost on auto-update due to versioned binary paths
- [FEATURE] Forward URL fragments into published artifacts so section deep links work
- Sandbox materializes & persists .git/config.lock in linked worktrees, blocking git config writes
- CCR routine sessions can't reach GitHub — outbound traffic appears routed through a broken internal proxy
- [BUG] Postgres network egress blocked even with full network permissions
- Add sandbox mode/status to statusline data fields
- [Bug] Claude Desktop VM workspace startup failure: path mismatch between AppData\Roaming and AppData\Local
- claude.ai code-execution sandbox: HTTP 503 'DNS cache overflow' on egress to Vercel-hosted host
- MCP connections return 503 DNS cache overflow from sandbox egress proxy (web/mobile)
- [BUG] Cowork sandbox disk at 100% capacity — base image too large for allocated disk
- [BUG] sandbox auto-allow does not work vor env-prefixed commands
- v2.1.98 regression: rw bind mounts inside ~/.claude shadowed by parent ro mount
- RTL (Right-to-Left) support for Hebrew/Arabic in VSCode extension chat
- [BUG] Cowork: FUSE mount of selected folder does not expose pre-existing files (Windows, non-home-dir path)
- [BUG] [VSCode Extension 2.1.72] Bedrock integration broken - eager_input_streaming error
- [Feature Request] excludedCommands should also bypass Mach port / IPC restrictions for local app CLIs
- You've hit your limit · resets 11pm (America/Anchorage)
- Security: dangerouslyDisableSandbox bypasses permission prompts when tool is auto-approved
- Image Upload Exceeds Size Limit: Base64 Image Too Large (6.2 MB > 5 MB)
- `claude plugin eval` refuses every Bash-granting run on a Mac with Docker Desktop (symlinks in ~/.docker/cli-plugins)
- [BUG] Cowork macOS: local sandbox VM starts with NO network route (only loopback) and cloud egress proxy returns 403 for every domain, despite "Allow network egress: All domains" — regression since 2026-09-10 ~23:15 UTC
- [BUG] Connected folders never mount inside VM — host reports Plan9 share added successfully, guest sees none
- [BUG] Bash sandbox fails to initialize on Ubuntu 24.04+ - conflict with the distro's default bwrap-userns-restrict AppArmor profile (not a Claude Code regression)
- [BUG] Sandbox masking of nonexistent ~/.claude/.config.json creates a transient empty file visible system-wide; concurrent sessions fail with 'contains invalid JSON'
- [BUG] Windows Desktop app: Read tool PDF fails with 'pdftoppm is not installed' while poppler is installed, on PATH, and resolvable by the same session's shells
- [BUG] No hook event fires for sandbox network permission popup in v2.1.120 (regression from v2.1.76)
- [BUG] macOS: Claude Desktop can't run hooks/git in TCC-protected folders (~/Documents) — `disclaimer` disclaims TCC responsibility, git getcwd() → "Operation not permitted"
- [BUG] Cowork sandbox: unlink(2) returns EPERM on owned files, breaks .git lock cleanup
- [Feature Request] Support GPG commit signing in sandboxed environment
- [BUG] Remote SSH sessions fail with EACCES on shared Linux host — /tmp/claude-settings-<static-hash>.json collision between users
- Feature: Preview tool should support rendering MCP Apps (ext-apps)
- Backslash-escaped whitespace check is too aggressive — flags legitimate paths with spaces
- [BUG] sandbox.enabled: false does not disable bwrap when working directory is ~/.claude/
- Bash tool returns exit code 1 with no stdout/stderr on CachyOS (Arch Linux)
- Bug: claude-plugins-official - learning/explanatory-output-style hook scripts missing execute permission
- [FEATURE] Apply user-level CLAUDE.md and rules to cloud sessions (web / mobile)
- [FEATURE] Support wildcard/regex for `sandbox.network.allowUnixSockets` on macOS
- [BUG] Bash tool fails on Windows when user profile path contains apostrophe
- [BUG] Cowork Windows: sandbox-helper fails to unmount host share, VM service won't start (Win 11 Pro)
- [BUG] Cowork on Windows fails at startup: "sandbox-helper: failed to unmount host share (tried both virtiofs and Plan9): invalid argument"
- [FEATURE] Sandbox denial should stop agent, not auto-retry with bypass prompt
- [Bug] Claude Code hangs indefinitely on Windows PowerShell until keyboard input
- [BUG] excludedCommands in sandbox settings doesn't bypass sandbox
- Background agents fail on Termux - hardcoded /tmp path
- [BUG] Sandbox fails with "bwrap: loopback: Failed RTM_NEWADDR: Operation not permitted"
- [BUG] claude code web sandbox: .NET NuGet Package Restore Fails Due to Proxy Authentication
- gh write commands execute without permission prompt despite Bash not being in allow list
- [Bug] /clear Command Fails to Actually Reset Conversation Context
- Agent Discovery Failure: Generated Agents Not Recognized or Loadable
- [BUG] Claude crashed while running a bash command
- [BUG] Perhaps another flag for --dangerously-skip-permissions that is OK with root
- Claude config path should be configurable (security/sandboxing blocker)
- Cloud environments (routines): headless Chromium gets ERR_CONNECTION_RESET on all sites even with Network access = Full (curl works)
- [FEATURE] SSH connections: support OpenSSH certificate authentication (CertificateFile) or delegate to system ssh
- Support Microsoft MXC sandboxing
- [BUG] Cowork stale-cache corruption reproduced under Claude Fable 5 — host writes are clean on disk, the sandbox read view truncates (full diagnosis + fix)
- [Bug] Linux sandbox unavailable: bash hard failure preventing tool execution
- [Bug] Anthropic API Error: Permission Denied (403) on Login
- [BUG] WSL2: Bash tool fails with E2BIG because Claude wraps bubblewrap in single /bin/bash -c string exceeding Linux MAX_ARG_STRLEN
- Claude Desktop (Electron) causes NTFS NonPaged Pool kernel memory leak on Windows (~0.5GB/min)
- Cowork installation fails at 80% on Windows - EXDEV cross-device link error
- You've hit your limit · resets 10pm (Europe/Istanbul)
- [FEATURE] Better tooling for binary file operations (JAR patching, large file handling)
- [BUG] [Linux] Bundled ripgrep binary missing execute permission — silently breaks all user commands/skills
- [BUG] macOS plist managed settings no longer override user settings in v2.1.80
- [BUG] "Don't ask again" on unsandboxed prompt is a no-op
- [Bug] Sandbox blocks cwd-tracking writes on macOS, causing all bash commands to exit with code 1
- [BUG] Version 2.1.69 breaks AWS Bedrock compatibility with `eager_input_streaming` error
- dangerouslyDisableSandbox: true does not prompt for user confirmation
- [Bug] Claude in Chrome WebSocket bridge fails behind Zscaler/corporate TLS proxy (unable to get local issuer certificate)
- Local dev server screenshot tool for visual QA
- [BUG] Sandbox mode generates ~607k token system prompt with large permissions.deny list
- Bug: unquoted TMPDIR path with spaces causes 'Permission denied' on every bash command (Windows)
- [BUG] messages.37.content.0.thinking.valid: Extra inputs are not permitted
- Crash: EPERM error when killing background shell process
- [BUG] TMPDIR not set in sandbox mode if bubblewrap is installed setuid root
- [Bug] Task Tool Isolation Prevents Real File Modifications
- [BUG] 2.1.283: sandbox.excludedCommands never unsandboxes aws calls with --profile or --endpoint-url (Linux)
- [BUG] Cowork (Windows): device VM egress ignores the account Domain allowlist - 403 blocked-by-allowlist while set to All domains
- Permission wildcard warning is not deny-aware, has no suppression, and cannot be followed for variable slots
- [BUG] Bash sandbox: TCC attribution fails for the live claude process (stale audit token), Documents access lost until TCC toggle
- [BUG] Daemon-hosted background worker deletes `~/.claude/settings.json` when it is a symlink into a read-only directory (nix/home-manager) — all user settings silently lost
- [MODEL] Supporting claims are presented as observed facts when they are inferred, sampled, or unobservable
- Sandbox masking placeholders are created in the project working directory instead of $HOME, appearing as untracked files on every Bash command
- [BUG] iOS Simulator panel helper (claude-ios-sim) crashes on launch on macOS 27 beta — seatbelt profile blocks Metal's new per-bundle shader-cache directory
- [Bug] Claude Code fails to launch with EPERM error on macOS
- [BUG] Cloud routines / Claude Code on the web have no non-interactive way to trust a project-scoped `.mcp.json` MCP server - daily routine broke after the untrusted-workspace gate
- Claude Desktop Code tab ignores NODE_EXTRA_CA_CERTS on Windows MSIX install behind corporate SSL proxy
- Feature request: Hard workspace boundary enforcement for project isolation
- [BUG] PowerShell tool fails Exit 1, empty stdout/stderr on Windows 10 DE-locale (v2.1.142, all environmental causes ruled out)
- [BUG] Ink rendering crash "<Box> can't be nested inside <Text>" when teammate requests sandbox bypass permission
- [BUG] bun install fails with 503 on private GitHub Packages (sandbox proxy rejects redirect with Authorization header)
- [Bug] virtiofs mount serves truncated file contents to sandboxed environment while host files are clean
- [BUG] Claude Desktop (Windows Store / MSIX): Code sessions silently fail to persist due to EXDEV error inside MSIX sandbox, even when everything is on C: — resolved by switching to Win32 installer
- MCP destructive tools silently denied without prompt in acceptEdits mode — misleading error message
- [BUG] MSIX: Code sessions lost on restart — EXDEV error in session save (fs.rename across VFS reparse point)
- [BUG] Session not logging into Subscription, using API credits instead.
- sandbox filesystem denyRead not enforced for Read tool or Bash commands
- Sandbox: allowedDomains not enforced for plain HTTP — only HTTPS CONNECT is filtered
- [BUG] Permissions error with git fsmonitor
- [BUG] Code mode broken after v2.1.78 update — .app bundle binary not spawnable by desktop SDK
- [BUG] Claude Code crashes on Windows Enterprise - EPERM: operation not permitted, uv_spawn 'reg'
- Allow configuring terminal tab/window title
- [BUG] sandbox denyRead seems ineffective
- [BUG] Cowork Windows - Downloads folder fails to mount: "sandbox-helper: failed to unmount host share (virtiofs and Plan9): invalid argument"
- [BUG] Background agents cannot run Bash commands - auto-denied without prompting user
- [BUG] add_dirs Grants Filesystem Access to Read/Write Tools but Not to Bash Tool
- [Feature Request] Improve Flatpak Chrome integration to support automatic detection and configuration
- [Bug] Claude in Chrome tool not available despite extension installed
- cant login to Max plan: OAuth Request Failed
- [FEATURE] Better error messages for tools (some existing ones are generic and or misleading)
- [BUG] Claude Code is adding "(project, gitignored)" to system prompt even if the skills are installed on user level
- [BUG] EPERM on long commands still crashing Claude Code
- [FEATURE] Claude Tag: support Bitbucket access
- [FEATURE] Programmatic tool calling for Claude Code's built-in tools (data-dependent Read/Grep/Edit steps without a model round trip each)
- macOS: auto-update triggers repeated, unlabeled "<version> would like to access data from other apps" TCC prompt
- [BUG] Cowork Windows 10 22H2 x64: `sandbox-helper: no Plan9 drive shares mounted` — device_bash dead since 2026-09-08, survives app restart and app update