Why does Claude Code ask permission every time I run the same command?

Claude Code asks for approval before running a Bash command unless a permission rule allows it. Approving a command in the moment does not persist it — approvals are per-invocation, not remembered across sessions. To stop the prompts you add the command to permissions.allow in .claude/settings.json, which is read at the start of every session.

Where is the Claude Code permissions file?

In your project, at .claude/settings.json, checked into the repo so everyone gets the same rules. A personal, uncommitted version can live at .claude/settings.local.json. There is also a user-level file at ~/.claude/settings.json that applies across all your projects.

Should I just allow everything in Claude Code?

No. The allowlist is what lets you stop reading every prompt, which only works if the dangerous things are still stopped. Allow your read-only git commands, your test and lint commands, and your package installs. Leave anything destructive, anything that pushes, and anything that reads secrets out of it.

Why is my allow rule not working?

Usually the rule does not match the command as written. Bash(npm test) matches only that exact string, so npm test -- --watch will still prompt; Bash(npm test:*) matches it and its arguments. The other common cause is editing the wrong file — a rule in the user-level settings will not apply if the project file is what is being read.

Claude Code keeps asking permission for the same command

It is not broken and it is not learning. Nothing has told it that command is allowed, so it asks every time — forever.

Last updated: 2026-09-20

Why it happens

Claude Code asks before it runs a shell command. When you approve one, that approval covers that run — it is not remembered for next time and it is not remembered tomorrow. If nothing in a settings file says npm test is allowed, you will be asked about npm test for the rest of your life.

So the prompts are not a sign that something is misconfigured. They are a sign that nothing is configured.

The fix: a permissions allowlist

Create .claude/settings.json at the root of your project:

{
  "permissions": {
    "allow": [
      "Bash(git status)",
      "Bash(git diff:*)",
      "Bash(git log:*)",
      "Bash(npm test:*)",
      "Bash(npm run lint:*)",
      "Bash(npm install)"
    ],
    "deny": [
      "Bash(rm -rf:*)",
      "Bash(git push --force:*)",
      "Read(./.env*)"
    ]
  }
}

Restart Claude Code. The prompts for those commands stop.

The three reasons it still does not work

Symptom	Cause	Fix
Still prompts for `npm test -- --watch`	`Bash(npm test)` matches that exact string only	Use `Bash(npm test:)` — the `:` covers arguments
Nothing changed at all	Edited the wrong settings file, or the JSON has a trailing comma and silently fails to parse	Confirm the path is `.claude/settings.json` in this project, then check it parses
Works for you, not your teammate	The rules are in `settings.local.json`, which is personal and usually gitignored	Move shared rules into `settings.json` and commit it

Do not allow everything

An allowlist is worth having because it lets you stop reading the prompts. That is only safe if the prompts you would want to read are still there. Allow the boring, repeated, read-only things. Leave deletes, force-pushes and anything that reads .env outside it.

A blanket allow-all turns a safety feature into decoration, and you will not notice until the day it matters.

Copy a working one

The free starter repo has a settings file with both lists already filled in, plus the CLAUDE.md that fixes the other week-one problem — see Claude Code forgets my project every session.

Free starter repo

What does it cost to have someone set this up?

Flat prices, written scope, stop at any rung. No call to book, no retainer.

Rung	What you get	Clock
Free — starter repo	A real setup you copy yourself	now
$29 — Setup Lite	One project: CLAUDE.md, allowlist, one skill, as a pull request you review	24 hours
$99 — Setup Sprint	3–5 skills, hooks, up to 3 MCP servers, plus a runbook	48 hours
$79 — Surface Audit	Already set up and still fighting it: contradictions and an exact fix list	48 hours

Setup Lite $29 Or start free

Clocks run from a complete intake, not from the Stripe receipt.