Permissions in settings.local.json not respected after Edit tool modifies the file

[JWDavey]

Bug Description

When Claude (the AI assistant) edits .claude/settings.local.json using the Edit tool during a session, the permission rules in that file stop being respected. The user is repeatedly prompted for commands that are already in the permissions.allow list.

Steps to Reproduce

1. Start a Claude Code session in a project that has .claude/settings.local.json with permissions configured
2. Have Claude use the Edit tool to modify .claude/settings.local.json (e.g., adding new permission entries)
3. After the edit, run a Bash command that matches an existing allow rule (e.g., sqlcmd:*)
4. The user is prompted for approval even though the rule is in the allow list
5. User selects "Yes, and don't ask again for: sqlcmd:*"
6. The permission is added to the file (confirmed by reading it), but the user is prompted again on the next matching command

Expected Behavior

Permission rules in settings.local.json should be respected regardless of whether the file was modified by the Edit tool or by Claude Code's own permission-saving mechanism.

Actual Behavior

After the Edit tool modifies settings.local.json, the in-memory permission state appears to get out of sync with the file on disk. Even though the file contains the correct Bash(sqlcmd:*) allow rule, the user is repeatedly prompted. Selecting "Yes, and don't ask again" writes the rule to the file (it's already there), but the prompt reappears on subsequent matching commands.

Environment

• Platform: Windows 11 Pro (win32)
• Shell: bash (Git Bash)
• Claude Code version: Latest as of 2026-03-30

Workaround

Stop using the Edit tool to modify settings.local.json and only let Claude Code manage the file through its own permission prompt mechanism. Once Claude stops editing the file, user-approved permissions persist correctly.

Additional Context

The file on disk is correct -- reading it shows the permission rule is present. The issue appears to be that Claude Code's in-memory permission cache doesn't reload after an external (Edit tool) write, or that the Edit tool write triggers a file-watch event that reloads an older cached version.

[github-actions]

Found 3 possible duplicate issues:

1. Settings file changes should take effect without restarting #36826
2. Edit tool prompts for permission despite bypassPermissions mode + --dangerously-skip-permissions flag #37181
3. Edit permission rules in allow list have no effect — permission dialog always shown #37516

This issue will be automatically closed as a duplicate in 3 days.

• If your issue is a duplicate, please close it and 👍 the existing issue instead
• To prevent auto-closure, add a comment or 👎 this comment

🤖 Generated with Claude Code

[yurukusa]

The root cause is that Claude Code caches permission state in memory, and the Edit tool bypasses the internal permission-write path. When the Edit tool modifies the file, the in-memory cache becomes stale.
Workaround: Protect settings files from the Edit tool
Add a PreToolUse hook to block the Edit tool from touching settings files:

// .claude/settings.local.json
{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Edit|Write",
        "hook": "bash -c 'INPUT=$(cat); FILE=$(echo \"$INPUT\" | jq -r \".tool_input.file_path // empty\"); case \"$FILE\" in *settings.local.json|*settings.json) echo \"BLOCK: Do not edit settings files directly. Use /permissions or the approval prompt to manage permissions.\" >&2; exit 2;; esac'"
      }
    ]
  }
}

How it works:

• Intercepts Edit/Write tool calls before they execute
• Checks if the target file is a settings file
• If so, blocks the operation (exit code 2) with a message directing Claude to use the built-in permission mechanism
• Claude Code's own permission-saving path (the "Yes, and don't ask again" prompt) writes to the file and updates the in-memory cache atomically, so permissions persist correctly
  Alternative — CLAUDE.md instruction (lighter but less reliable):

<!-- CLAUDE.md -->
Never use the Edit or Write tool to modify .claude/settings.local.json or .claude/settings.json.
To manage permissions, tell the user to respond "Yes, and don't ask again" when prompted.

The hook approach is more reliable since instructions can be forgotten after context compression.

[CKarper]

This is an INSANE error to allow to persist. It happens in Claude Code as well as the embedded version in VS Code. The specific prompt to allow commands just pops over and over. Claude Code is easily the most frustrating AI tool I have to work with on the regular. I want it to be better, and that's why it's so frustrating.