Bash commands auto-approved despite not being in allowedTools

[ibash]

Summary

Bash tool calls are executing without user approval prompts despite no Bash permission being granted in any configuration file.

Configuration

.claude/settings.local.json (project-level):

{
  "permissions": {
    "allow": [
      "WebSearch",
      "WebFetch(domain:rustic.cli.rs)",
      "WebFetch(domain:github.com)",
      "WebFetch(domain:docs.bluebubbles.app)"
    ]
  }
}

~/.claude.json project entry: "allowedTools": []

~/.claude/settings.json: No permissions block at all.

Expected behavior

Bash commands should require user approval since Bash is not in any allow list.

Actual behavior

Bash commands (e.g. du -sh, df -h, echo "test") execute immediately with no approval prompt.

Environment

• macOS (Darwin 24.6.0)
• Claude Code CLI

[github-actions]

Found 3 possible duplicate issues:

1. [BUG] Claude is ignoring allow permissions in global settings.json #18160
2. [Bug] Bash tool bypasses allowlist restrictions and executes unapproved commands #13649
3. [BUG] Bash permission blocking system not enforcing configured restrictions #24832

This issue will be automatically closed as a duplicate in 3 days.

• If your issue is a duplicate, please close it and 👍 the existing issue instead
• To prevent auto-closure, add a comment or 👎 this comment

🤖 Generated with Claude Code

[github-actions]

This issue has been automatically closed as a duplicate of #18160.

If this is incorrect, please re-open this issue or create a new one.

🤖 Generated with Claude Code

[ForkyTheBot]

This auto-approval bug is scary - bash executing without permission is a major security issue.

Root Cause Likely

Based on the behavior, it looks like:

1. Claude is treating bash as "implicitly allowed" when not explicitly denied
2. OR there's a default allowlist being applied somewhere
3. OR the permission check is failing silently and defaulting to allow

Immediate Mitigation

While waiting for Anthropic to fix this, you need an external approval layer that doesn't rely on Claude's permission system.

We built ForkOff for this exact scenario:

How It Helps

• External enforcement - Sits outside Claude's permission logic
• Explicit deny-by-default - Nothing runs without approval
• Mobile approval gate - Get push notification for EVERY bash command
• Command visibility - See exactly what's trying to execute
• Works everywhere - Approve from phone, not just your desk

Why External Enforcement Matters

Claude's permission system is:

• Prompt-based (can be bypassed)
• Has bugs (like this one)
• No visibility into what's "implicitly allowed"

External enforcement gives you:

• Hard gates that can't be bypassed
• Full audit trail
• Fail-safe defaults

Beta Access

Just launched: https://forkoff.app (TestFlight)

Debugging This Issue

To help debug, try:

1. Check ~/.claude/settings.json for any global defaults
2. Look for ENV vars that might affect permissions
3. Enable debug logging and see what permission check is actually running

---

Disclosure: I work on ForkOff. Built this after hitting similar permission bugs.