Background agents cannot get Bash permissions — bypassPermissions ignored for Agent tool

Environment

• Claude Code desktop app (not CLI) on macOS Sequoia 25.3.0
• Claude Opus 4.6 (1M context)
• bypassPermissions set at all three levels: user (~/.claude/settings.json), project (.claude/settings.local.json), and worktree (.claude/settings.local.json)
• All three files verified as correct JSON

The problem

Background agents launched via the Agent tool cannot get Bash permissions. They fail immediately on their first tool call, regardless of what the parent session's permission settings are.

This is separate from the parent session permissions bug (#38662) where the user has to click Allow repeatedly. With agents, there is no user to click — the agent just dies.

Impact

Any task delegated to a background agent that requires Bash (database queries, script execution, file operations) fails silently. Today we attempted 4 background agents — all 4 failed on first Bash call. Each agent consumed tokens and time before reporting it could not proceed.

This breaks the entire agent architecture. Background agents are the only way to parallelise long-running work without blocking the user. Without Bash, they can do nothing useful.

Reproduction

1. Set bypassPermissions in all settings files
2. Launch a background agent with a prompt that requires Bash (e.g. "Query the database and report the count")
3. Agent will fail on first Bash call with a permissions error

Expected behaviour

Background agents should inherit the parent session's permission settings, or at minimum respect the bypassPermissions setting in the project/user config.

Actual behaviour

Agents cannot execute any Bash commands. No permission prompt is shown (there is no UI for agents). The agent simply cannot proceed and reports failure.

Related issues

#38662 (parent session permissions bug), #29026, #38148, #34923