claude-code - 💡(How to fix) Fix [BUG] --dangerously-skip-permissions and PreToolUse hooks both bypassed after background task completion [1 comments, 2 participants]

Preflight Checklist

• I have searched existing issues and this hasn't been reported yet
• This is a single bug report (please file separate reports for different bugs)
• I am using the latest version of Claude Code

What's Wrong?

When running Claude Code with --dangerously-skip-permissions --permission-mode bypassPermissions, both the CLI flag AND configured PreToolUse hooks stop taking effect after certain events during a session — specifically after background tasks complete.

This is related to #40241 (subagent permission propagation) and #1498 (intermittent permission prompts), but more severe: not only does the CLI flag stop working, but PreToolUse hooks are not even called.

What Should Happen?

Expected Behavior

All tool calls should proceed without permission prompts for the entire session lifetime, since:

• --dangerously-skip-permissions is set ("Bypass all permission checks")
• --permission-mode bypassPermissions is set
• PreToolUse hook returns permissionDecision: "allow" for all tools

Error Messages/Logs

## Actual Behavior

After the background task completes:
- The prompt "Permission rule **Bash** requires confirmation for this command" appears
- The hook log shows **no entry** for the blocked command — the hook was never called
- Earlier commands in the same session have hook log entries with `decision=allow`

Steps to Reproduce

1. Configure a PreToolUse hook in ~/.claude/settings.json with matcher: ".*" that logs every invocation and returns permissionDecision: "allow"
2. Start Claude with: claude --dangerously-skip-permissions --permission-mode bypassPermissions
3. Run several tool calls — they all go through without prompts, and hook log confirms they are being called
4. Start a background task (e.g., Bash with run_in_background: true)
5. Wait for the background task to complete
6. Run any subsequent tool call (e.g., a simple cat file | tail -1)

Evidence from Hook Log

# Hook is being called and returning allow for all commands:
2026-04-14 15:53:33 tool=Bash decision=allow input_bytes=951 elapsed_ms=23 reason=none
2026-04-14 15:53:39 tool=Bash decision=allow input_bytes=849 elapsed_ms=23 reason=none
2026-04-14 15:58:35 tool=Agent decision=allow input_bytes=1203 elapsed_ms=24 reason=none
2026-04-14 16:00:39 tool=Bash decision=allow input_bytes=427 elapsed_ms=21 reason=none
2026-04-14 16:01:01 tool=Bash decision=allow input_bytes=484 elapsed_ms=17 reason=none
# ^^^ last hook entry before the blocked command
# The blocked `cat ... | tail -1` has NO log entry — hook was never invoked

Additional Observations

• The same pattern occurs after extended idle periods (e.g., leaving terminal for 30+ minutes)
• Once the permission state "degrades," it does not recover — all subsequent tool calls prompt
• settings.json also has defaultMode: "bypassPermissions", skipDangerousModePermissionPrompt: true, and sandbox.autoAllowBashIfSandboxed: true — none of these prevent the issue
• This affects real interactive sessions, not just sandboxed/CI environments

Hook Configuration

{
  "hooks": {
    "PreToolUse": [{
      "matcher": ".*",
      "hooks": [{
        "type": "command",
        "command": "/path/to/hook.sh",
        "timeout": 30
      }]
    }]
  }
}

The hook script logs every invocation to a file and returns {"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"allow"}} for all non-dangerous commands.

Claude Model

Sonnet (default)

Is this a regression?

No, this never worked

Last Working Version

No response

Claude Code Version

v2.1.107

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

No response