[BUG] Remote routines lose MCP connector permissions every run — tools blocked in ephemeral container

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

I have a remote routine (scheduled hourly) that uses Shopify MCP and Supermetrics MCP connectors. Both connectors are connected and show as active in the routine settings.

As of ~May 20, 2026, every run now prompts for MCP tool-level permissions ("Allow Claude to edit settings.json?") even though the connectors are properly configured. The routine tries to self-heal by writing permissions to settings.json, but that write itself requires approval — creating a blocking loop.

Key observations:

• The remote container environment is ephemeral — the home directory changes between runs (/root/.claude/ on some runs, /home/user/.claude/ on others)
• Even clicking "Always allow" doesn't persist to the next run because the container is fresh
• The routine worked perfectly for weeks before this started
• Connectors show as connected in the routine settings UI
• The same MCP tools work fine in local interactive sessions
• Spawning a sub-agent from the routine hits the same permission wall

What Should Happen?

Remote routines with connected MCP connectors should be able to call those connector tools without any permission prompts. The routine's connected connectors should be pre-authorized in the ephemeral runtime, matching the documented behavior.

This worked correctly until ~May 20, 2026.

Error Messages/Logs

The routine session shows:

"Both Shopify and Supermetrics MCP tools are blocked requiring approval."
"The Shopify and Supermetrics MCP tools are blocked pending permission approval."

Then attempts to write /root/.claude/settings.json (or /home/user/.claude/settings.json) which also requires permission approval, creating a blocking loop.

Steps to Reproduce

1. Create a remote routine that uses MCP connectors (e.g., Shopify, Supermetrics)
2. Confirm connectors show as "connected" in routine settings
3. Let the routine fire on its cron schedule or trigger manually
4. Observe: routine prompts for MCP tool permissions instead of running autonomously
5. Click "Always allow" on the permission prompt
6. Wait for the next scheduled run
7. Observe: permission prompt reappears (ephemeral container doesn't persist)

Claude Model

Sonnet (default)

Is this a regression?

Yes, this worked in a previous version

Last Working Version

2.1.122

Claude Code Version

2.1.123

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

• Likely a regression — same routine ran successfully for weeks before ~May 20
• Attempted workarounds that did NOT help: adding tools to local settings.json allowlist, sub-agent dispatcher pattern
• Ephemeral container home directory inconsistent between runs (/root/ vs /home/user/)
• Related issues: #44785, #42033, #43397, #40470, #47180
• Platform: macOS, Claude Code latest

<img width="705" height="283" alt="Image" src="https://github.com/user-attachments/assets/9a0845be-6f18-4c1d-afa9-f3575d0f2c1c" />
<img width="715" height="589" alt="Image" src="https://github.com/user-attachments/assets/29511efe-9a6b-4b4a-963a-6c7174da1e3b" />