[BUG] Auto permission mode: approval prompt (URL + content) mutates to a different pending tool call while user is reviewing

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

In --permission-mode auto, when multiple approval-gated tool calls stack up (a burst of parallel subagent WebFetch calls), the approval prompt the user is currently reviewing mutates in place. Both the URL shown and the surrounding prompt content change to a DIFFERENT pending tool call — without the user advancing or pressing anything.

While holding on the first prompt for ~30s (reading it, as if vetting the URL), the prompt swapped at least twice. On review of a screen recording, both the URL and the prompt content visibly change in place. This means an approval keystroke during the hold can land on an action the user never intended to approve.

Reproduced with a fully neutral prompt (zero language inviting Claude to skip approvals or auto-proceed), so this is not prompt-induced — it appears to be a timing/race condition in how stacked approval prompts are queued/rendered. Screen recording attached below.

What Should Happen?

The approval prompt under the user's selection should stay fixed until the user acts on it. A pending approval must not be replaced or mutated into a different tool call while it is on screen awaiting the user's decision. User should at least be warned that the approval request is about to change and perhaps there should also be a multi-second pause before a new approval request is surfaced to the user.

Error Messages/Logs

N/A — no error output. This is a UI/race issue; see attached screen recording.

Steps to Reproduce

1. Start Claude Code with --permission-mode auto.
2. Give a neutral prompt that spawns 4+ parallel subagents, each issuing multiple approval-gated WebFetch calls (~10 public URLs total), producing a burst of stacked approval prompts. Exact prompt used:

Research the public history of HTTP — the original HTTP/0.9, 1.0, 1.1, /2, and /3 specifications and major milestones. Write a summary to ./http-history.md in the current directory. Use parallel subagents to expedite: spawn at least 4
subagents, each responsible for fetching and synthesizing a different set of the URLs below; each subagent returns a synthesized summary and the main thread writes the final doc. URLs to distribute across subagents:
https://www.w3.org/Protocols/HTTP/AsImplemented.html https://www.rfc-editor.org/rfc/rfc1945 https://www.rfc-editor.org/rfc/rfc2616 https://www.rfc-editor.org/rfc/rfc7230 https://www.rfc-editor.org/rfc/rfc9110
https://www.rfc-editor.org/rfc/rfc9113 https://www.rfc-editor.org/rfc/rfc9114 https://httpwg.org/specs/ https://www.ietf.org/ https://www.iana.org/assignments/http-methods/

1. When the first approval prompt appears, HOLD — read it without pressing anything (as if vetting the URL).
2. Watch the prompt over ~30 seconds: the URL and prompt content change in place to a different pending tool call.

Claude Model

Opus

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.158

Platform

AWS Bedrock

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

Reproduced on the first run with a neutral baseline prompt (no autonomy-inviting language), which is why this is filed as an unambiguous bug rather than prompt-induced behavior. Screen recording (~30s) showing the URL + prompt swap during the hold is attached below.

https://github.com/user-attachments/assets/38d47b69-0de5-4187-8bc0-c726905a9a61