[BUG] VSCode Extension: Bash commands execute without permission prompt despite 'default' Initial Permission Mode on macOS

[h3x89]

Preflight Checklist

• I have searched existing issues and this hasn't been reported yet
• This is a single bug report (please file separate reports for different bugs)
• I am using the latest version of Claude Code

Related issue: #29159 covers the same root cause on Windows/AWS Bedrock. This report confirms the bug also affects macOS/Anthropic API.

What's Wrong?

The Claude Code VSCode extension executes Bash tool calls (date, hostname, gh issue list, etc.) without ever prompting for user approval, despite:

• Initial Permission Mode set to default in VSCode Extension settings (@ext:Anthropic.claude-code Permission)
• Allow Dangerously Skip Permissions unchecked (false) in VSCode Extension settings
• ~/.claude/settings.json having an empty permissions.allow list

Per documentation, default mode should ask before running Bash commands. The extension silently auto-approves them instead.

What Should Happen?

A permission prompt should appear before executing any Bash command, since allow list is empty and mode is default.

Error Messages/Logs

No error messages — commands execute silently without any prompt.

Steps to Reproduce

1. Open VSCode with Claude Code extension in sidebar
2. Set Initial Permission Mode to default (VSCode settings: @ext:Anthropic.claude-code Permission)
3. Ensure Allow Dangerously Skip Permissions is unchecked
4. Ensure ~/.claude/settings.json has empty allow list (see config below)
5. Ask Claude to run any Bash command, e.g. "what is today's date?" or "what is the hostname?"
6. Observe: command executes immediately with no approval prompt

Claude Model

Sonnet (default)

Is this a regression?

I don't know

Last Working Version

Unknown

Claude Code Version

2.1.76 (Claude Code)

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

VS Code integrated terminal

Additional Information

~/.claude/settings.json:

{
  "permissions": {
    "allow": [],
    "additionalDirectories": []
  }
}

VSCode Extension settings (screenshot):

• Claude Code: Initial Permission Mode = default
• Claude Code: Allow Dangerously Skip Permissions = unchecked (false)

The CLI permission model and the VSCode extension appear to use separate permission enforcement paths. The extension does not honour the ~/.claude/settings.json allowlist, resulting in all Bash commands being silently auto-approved regardless of configuration.

Related issues:

• [BUG] VSCode extension does not enforce permissions from ~/.claude/settings.json - #29159 — same root cause, Windows + AWS Bedrock
• [MODEL] #33772 — similar report of auto-approved Bash in VSCode extension

[yurukusa]

This looks related to #34315 (sandbox bypass without prompt in acceptEdits mode). The root cause may be the same — the VSCode extension's permission handling is auto-approving Bash calls that should require explicit consent.

Until this is fixed, you can add a PreToolUse:Bash hook as a safety layer that works regardless of the permission mode:

#!/bin/bash
# PreToolUse:Bash — require explicit patterns for allowed commands
INPUT=$(cat)
COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty')

# Allow safe read-only commands
if echo "$COMMAND" | grep -qE '^(ls|cat|head|tail|wc|echo|date|pwd|git status|git log|git diff)'; then
  exit 0
fi

# Block everything else with a message
echo "Hook review: $COMMAND"
echo "This command was not in the safe-list. Add it to the hook if it should be auto-approved."
exit 2

This is a whitelist approach — only commands matching known-safe patterns pass through. Everything else is blocked with exit 2. You can expand the whitelist as you build trust.

The key insight: hooks with exit 2 enforce at the tool execution level, independent of the permission mode UI. Even if the extension auto-approves everything, the hook still blocks.

[GMNGeoffrey]

I did some more thorough analysis of this in #34315 (comment). These are all fundamentally the same issue and you don't need custom hooks to work around it

[github-actions]

Closing for now — inactive for too long. Please open a new issue if this is still relevant.