[BUG] `permissions.ask` confirmation prompt does not surface for Bash commands run by a background-dispatched subagent

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

A subagent dispatched to run in the background (via the Task tool) can execute a Bash command matching a permissions.ask rule in settings.json without any confirmation prompt ever being shown to the user — the command just executes immediately.

Repro: set "permissions": {"ask": ["Bash(git commit*)"]} in .claude/settings.json, then have Claude dispatch a background subagent (Task tool, background execution enabled) that runs git commit in a test repo. No permission dialog appears; the commit happens immediately.

I reproduced this on both Claude Code 2.1.197 and the current 2.1.285/2.1.286 (updated via claude update, fully restarted, re-tested — same result both times).

This is especially concerning for any subagent that reads externally-sourced or user-provided document content (a prompt-injection surface): ask rules are the only practical safety net for such agents, since deny rules only do simple prefix matching. That safety net appears to be silently absent for background dispatch.

Possibly related to (but distinct from): #25000 / #21460 (deny rules + PreToolUse hooks, closed as fixed), #29333 (the Task tool invocation itself ignoring ask, closed as not planned), #42797 (auto-mode ignoring ask). None of these specifically cover a Bash command run inside an already-running background subagent failing to trigger ask. The Week 26 changelog entry ("background subagents now surface permission prompts in the main session instead of auto-denying") suggests this exact path was supposed to work.

What Should Happen?

2.1.285

Error Messages/Logs

Steps to Reproduce

1. In a project's .claude/settings.json, configure:

{
  "permissions": {
    "ask": ["Bash(git commit*)"]
  }
}

1. Initialize a disposable git repo for testing (outside the main project):

mkdir /tmp/ask-test-repo && cd /tmp/ask-test-repo
git init -q && git config user.email a@a.com && git config user.name a
touch f.txt && git add f.txt

1. Ask Claude Code to dispatch a subagent (Task tool) configured to run in the background, with instructions to run:

cd /tmp/ask-test-repo && git commit -m "ask behavior test"

1. Observe whether a permission confirmation dialog appears before the commit executes.

Actual: No confirmation prompt appeared. The git commit command executed immediately and successfully, with the subagent reporting success. The user (watching the main session) did not see any permission dialog at any point during the background subagent's execution.

Claude Model

Sonnet (default)

Is this a regression?

Yes, this worked in a previous version

Last Working Version

_No response_

Claude Code Version

2.1.286

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

VS Code integrated terminal

Additional Information

_No response_