Bypass permissions mode still prompts for edits to ~/.claude/settings.json

[ikamensh]

Bug Description

When running Claude Code with --dangerously-skip-permissions, editing Claude's own config files (e.g. ~/.claude/settings.json) still triggers a permission prompt ("Do you want to make this edit to settings.json?").

This defeats the purpose of the flag — all file operations should be auto-approved in this mode.

Steps to Reproduce

1. Launch Claude Code with claude --dangerously-skip-permissions
2. Ask Claude to modify a setting (e.g. "set effortLevel to high in settings.json")
3. Claude reads ~/.claude/settings.json, then attempts to edit it
4. A permission prompt appears asking to confirm the edit

Expected Behavior

The edit should proceed automatically without prompting, since --dangerously-skip-permissions is active.

Actual Behavior

Claude shows the diff and asks "Do you want to make this edit to settings.json?" — same as normal permission mode.

Environment

• Claude Code v2.1.81
• Model: Opus 4.6 (1M context), Claude Max
• Platform: macOS (Darwin, ARM64)
• ~/.claude/settings.json already contains "skipDangerousModePermissionPrompt": true

Screenshot

(Screenshot shows the permission prompt appearing in bypass mode when editing settings.json)

[github-actions]

Found 3 possible duplicate issues:

1. [BUG] .git, .claude, and other protected directories aren't writable without a prompt even in bypassPermissions mode in 2.1.78+ #36282
2. --dangerously-skip-permissions does not bypass Edit permission prompts #36192
3. Bug: SKILL.md creation prompts for permission even in bypass mode #36923

This issue will be automatically closed as a duplicate in 3 days.

• If your issue is a duplicate, please close it and 👍 the existing issue instead
• To prevent auto-closure, add a comment or 👎 this comment

🤖 Generated with Claude Code

[ModernBlueprints]

I have the same issue on Claude Code extension in VSCode. Dangerously Skip Permissions/Bypass Permissions is totally broken.

Amazng how Anthropic can ship such slop that It's F-ing annoyng.

[ddarbyson]

Similar reported bug - #11380 (comment)

Seems to be recent as of the last week or so.

[markshust]

I can confirm this issue is still very valid and happening even more frequently now, even with --dangerously-skip-permissions toggled on.

[yurukusa]

This is by design — ~/.claude/ is a hardcoded protected directory. Even --dangerously-skip-permissions won't bypass it, because the self-edit protection is meant to prevent the model from modifying its own hooks and settings (which could disable safety checks).
Workaround using PermissionRequest hooks:
Unlike PreToolUse, the PermissionRequest hook event fires after the built-in protection check, so it can override the prompt:

INPUT=$(cat)
FILE=$(echo "$INPUT" | jq -r '.tool_input.file_path // empty' 2>/dev/null)
case "$FILE" in
  */.claude/settings.json|*/.claude/hooks/*|*/.claude/skills/*)
    echo '{"hookSpecificOutput":{"hookEventName":"PermissionRequest","permissionDecision":"allow","permissionDecisionReason":"Auto-approved .claude/ write"}}'
    ;;
esac
exit 0

{
  "hooks": {
    "PermissionRequest": [{
      "matcher": "Edit|Write",
      "hooks": [{"type": "command", "command": "bash ~/.claude/hooks/allow-claude-dir.sh"}]
    }]
  }
}

Caveat: This has been reported as not working on some platforms (Windows, certain Claude Code versions). See #37765 for detailed testing by multiple users. If the hook doesn't work for you, please report your version and OS there — it helps narrow down when the built-in check overrides even PermissionRequest.
The cleanest fix would be an official --allow-self-edit flag or subdirectory allowlisting, which multiple users have requested.

[keenanwh]

Claude Code's auto-memory system blocks itself

The hardcoded .claude/ permission check doesn't just affect user-created files — it blocks Claude Code's own features:

Auto-memory writes: Claude Code's built-in memory system (the auto memory instructions in the system prompt) tells the model to write files to ~/.claude/projects/<project>/memory/ using the Write tool. This triggers the hardcoded .claude/ permission check every time, requiring manual approval for the model to use its own memory feature.

Additional findings from investigation:

• The check matches ANY directory named .claude/ in the path, not just ~/.claude/. Moving files to a different .claude directory (e.g. C:\Dev\.claude) still triggers the prompt.
• additionalDirectories in settings.json does NOT bypass this check.
• The PermissionRequest hook workaround (suggested in earlier comments) does NOT work on Windows.
• The only working bypass is using the Bash tool with jq/sed/python instead of Edit/Write — which defeats the purpose of having dedicated file tools.

Impact: ~10+ manual permission approvals per day for routine operations (memory writes, CLAUDE.md updates, editing files stored under ~/.claude/). This is on Windows 11, latest Claude Code version.

The product is blocking its own feature. Would an allowlist for ~/.claude/projects/ (or a --allow-self-edit flag) be feasible?