Remote Control sessions started from a Project ignore defaultMode and always run in auto mode

Summary

When Claude in a claude.ai Project starts a Remote Control session on my Windows PC (Claude Code, folder connected through Remote Control), that session always runs in auto permission mode. The defaultMode set in the folder's .claude/settings.json is ignored, and neither Claude nor I can choose the mode when the session is started from the Project. As a result, the folder's permissions.allow rules are never consulted: the auto mode classifier decides first.

Environment

• Claude Code on Windows 11, Git Bash, OpenSSH 9.7p1
• Remote Control session started from a claude.ai Project thread (start_rc_session), folder served from the Claude desktop app

Steps to reproduce

1. In the served folder, create .claude/settings.json:

{
  "permissions": {
    "defaultMode": "default",
    "allow": [
      "Bash(ssh -i ~/.ssh/<key> -o BatchMode=yes <user>@<internal-host>:*)"
    ]
  }
}

1. From a Project thread, have Claude start a new Remote Control session in that folder.
2. Ask that session to run exactly the allowed command, e.g. ssh -i ~/.ssh/<key> -o BatchMode=yes <user>@<internal-host> "hostname".

Expected

The session starts in default mode (as configured), the allow rule matches, and the command runs. Commands not covered by a rule prompt me for approval.

Actual

• The session reports it is in auto mode, on every new session (tested 4 times, settings changed between attempts).
• The allowed command is denied before execution, with no approval prompt: Permission for this action was denied by the Claude Code auto mode classifier. Reason: [Production Reads] (other attempts: [Credential Exploration], [Remote Shell Writes]).
• Changing the mode in the app did not affect sessions started afterwards from the Project.

Impact

I explicitly want Claude to run a narrow, pre-approved set of commands on one of my own servers. There is currently no way to grant that for Project-started Remote Control sessions: the only options are running every command myself or opening a separate local session by hand.

Request

Either honor defaultMode (and permissions.allow) from the folder's settings for Remote Control sessions, or let the user choose the permission mode (default / acceptEdits / auto) when approving or starting a Remote Control session from a Project.