Preflight Checklist

• I have searched existing issues and this hasn't been reported yet
• This is a single bug report (please file separate reports for different bugs)
• I am using the latest version of Claude Code

What's Wrong?

Tools in the project-level deny list (.claude/settings.json → permissions.deny) are not blocked when skipAutoPermissionPrompt: true is set in user-level ~/.claude/settings.json. The denied command executes successfully instead of being hard-blocked.

This also reproduces in non-interactive mode (claude -p), where there is no TTY to prompt on — denied tools silently auto-approve.

What Should Happen?

Deny-listed tools should be unconditionally blocked regardless of:

• skipAutoPermissionPrompt setting
• Interactive vs non-interactive mode (-p flag)
• User-level vs project-level settings

The deny list should be a hard gate, not a "would prompt but skip" gate.

Error Messages/Logs

# No error — command runs successfully when it should be blocked
  $ cd /tmp/deny-list-repro
  $ claude -p "Run python3 -c \"print('hello')\" using the Bash tool"
  Output: `hello`

Steps to Reproduce

1. Create a project with a deny list: mkdir -p /tmp/deny-list-repro/.claude && cd /tmp/deny-list-repro && git init cat > .claude/settings.json << 'EOF' { "permissions": { "allow": ["Bash(echo *)"], "deny": ["Bash(python3 *)"], "defaultMode": "auto" } } EOF

2. Ensure user-level settings have skipAutoPermissionPrompt:

~/.claude/settings.json should contain:

"skipAutoPermissionPrompt": true

1. Run: claude -p "Run python3 -c "print('hello')" using the Bash tool"

2. Expected: blocked with permission error

3. Actual: prints hello — deny list bypassed

Claude Model

Opus

Is this a regression?

I don't know

Last Working Version

No response

Claude Code Version

2.1.96 (Claude Code)

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

iTerm2

Additional Information

The deny list pattern Bash(python3 *) is in the project-level .claude/settings.json. The user-level ~/.claude/settings.json does not have a corresponding deny entry but has skipAutoPermissionPrompt: true. It appears the combination causes denied tools to be auto-approved instead of hard-blocked.