[BUG] Bash tool rejected as "user denied" with no permission prompt — regression of #9383 on v2.1.128 / Windows ARM64 / Cowork

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet (filing per #9383's lock-bot recommendation)
• [x] This is a single bug report
• [x] I am using the latest version of Claude Code (v2.1.128)

What's Wrong?

A Bash tool call fell outside my allowlist, hit the permission prompt path, and was rejected as "user denied" — but no permission dialog was shown. Identical symptom to #9383 (closed Feb 2026 as fixed; now auto-locked).

Repro

2026-05-07T21:12:20.867Z — assistant fires Bash("npm --version")
2026-05-07T21:12:50.374Z — tool_result: is_error=true,
                          content="The user doesn't want to proceed with this tool use..."
                          toolUseResult="User rejected tool use"

29.5 second gap. No prompt was ever displayed. I confirmed in real time — I didn't click anything.

Why npm --version triggered the path

My allowlist has Bash(npm install*), Bash(npm run*), Bash(npm test*), Bash(npm ci*) — none match npm --version, so it correctly fell through to the prompt path. The prompt then failed to display.

What's identical to #9383

• Symptom: rejected without UI prompt, immediate-feeling failure (here, after a 30s timeout)
• Affects Bash tool with commands that fall outside allowlist
• Platform labels: platform:windows, area:ide

What's different / new in May 2026

• Version: 2.1.128 (#9383 was on an earlier version, fixed 2026-02-06)
• Wrapper: Cowork desktop (entrypoint: "claude-desktop" in JSONL)
• Architecture: Windows ARM64
• 30s gap between tool_use and rejection record — strongly suggests a hardcoded timeout in the prompt-display path

What Should Happen?

The permission dialog should display, allowing me to approve npm --version for this session (or "Yes, don't ask again"). Today the harness fabricates a "user rejected" outcome on prompt-display failure, which is indistinguishable from a real denial in the JSONL record.

Environment

• Version: v2.1.128
• OS: Windows 11 Home 10.0.26200, ARM64
• Wrapper: Cowork desktop (Claude Code rides on entrypoint: "claude-desktop")
• Shell: Git Bash (configured via env.PATH in ~/.claude/settings.json)
• Reproducibility: First-try repro on npm --version. Did not attempt to verify rate.

Related issues

• #9383 — same symptom, platform:windows + area:ide, closed 2026-02-06 as fixed. Probable regression source.
• #53314 — same symptom on macOS + MCP, OPEN
• #46788 — same symptom on macOS + Cowork, OPEN
• #50532 — same symptom in auto mode, OPEN

The recurrence across multiple platform/wrapper/tool combinations suggests a shared prompt-display path with multiple regression vectors.

Side-channel ask (filing as a related feature request would also work)

If the harness can't always show a prompt, please consider emitting a tool_aborted_by_platform event distinguishable from "user clicked deny." Right now, the model has no way to know whether to retry or to truly stop. From the model's perspective, every bogus rejection looks like a real one.