Background subagents stall on permission prompts in bypassPermissions mode (2.1.296)

What happened

With permissions.defaultMode: "bypassPermissions", background subagents (Agent tool, run_in_background) stopped on interactive permission prompts for some Bash commands. Nobody was at the terminal, so they hung for hours; I came back to about 7 queued prompts.

Expected: bypass mode never prompts. Failing that, a background agent with no attached user should get the tool call refused with a reason it can act on, instead of blocking indefinitely.

Repro

1. Run claude with bypassPermissions.
2. Spawn a background subagent and have it run a long compound Bash command, for example:

• several cds chained with &&,
• bash -c '…' with nested quotes,
• a multi-line here-doc inside $(…) carrying a comment body for gh api.

1. It shows a permission prompt instead of running.

One simple command per Bash call runs without a prompt.

Ruled out

• No PreToolUse or PermissionRequest hook returns "ask". The one PreToolUse guard only ever returns "deny", and the status hook prints nothing.
• No ask permission rules in user or project settings.
• No managed settings file.
• blockReadsOutsideWorkingDirectories not set.

Environment

• Claude Code 2.1.296
• macOS (Darwin 25.6.0)
• Background session with subagents of type general-purpose and a custom reviewer agent

Ask

• Document which Bash commands still prompt under bypassPermissions.
• When a background agent with no attached user hits one, fail the tool call with a reason instead of waiting.

Workaround: we tell agents to keep one simple command per Bash call, write bodies to files and pass them by path.