[BUG]

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

A scheduled Trigger in Claude Code on the web (a "routine" that runs a
Claude Code session daily, unattended, with no human present) gets stuck
indefinitely waiting for manual tool-permission approval when Claude tries
to call an MCP tool (mcp__gmail__send_email), even though the repository's
.claude/settings.json already sets the most permissive configuration
possible: permissions.defaultMode = "bypassPermissions", the specific tool
explicitly listed in permissions.allow, and enableAllProjectMcpServers =
true. Since nobody is present to click "Allow" on an unattended trigger
run, the session hangs forever.
We also checked the trigger's own "Edit routine" dialog (Connectors /
Behavior / Notifications tabs) for any permission-mode setting that could
override this, and found none: "Connectors" shows no available options
(this project's MCP servers are defined in .mcp.json, not via the native
Connectors system), and "Behavior" only exposes a "Automatic PR fixing"
toggle.

What Should Happen?

f a repository's .claude/settings.json sets
permissions.defaultMode="bypassPermissions" and explicitly allowlists a
tool, a session launched by a scheduled Trigger should honor that and run
the tool without prompting for approval — since Trigger runs are by
definition unattended and there's no UI-exposed way (that we could find)
to pre-approve tools at the Trigger level itself. At minimum, Triggers
should expose their own permission-mode setting so unattended runs can be
configured to never block on approval.

Error Messages/Logs

No error text — it's a confirmation dialog, not an error. The dialog
reads: "¿Permitir que Claude usar send email (gmail)?" (localized UI —
"Allow Claude to use send email (gmail)?") with three options: "Denegar"
(Deny) / "Permitir siempre" (Always allow) / "Permitir una vez" (Allow
once). The session sits on this screen with no further activity since no
one is present to respond.

Steps to Reproduce

1. Create a repo with a project-scoped MCP server in .mcp.json (in our

case, Gmail via @gongrzhe/server-gmail-autoauth-mcp, launched via
npx), with credentials supplied by a SessionStart hook.

1. In .claude/settings.json, set:

• "permissions.defaultMode": "bypassPermissions"
• "permissions.allow" including the specific MCP tool, e.g.

"mcp__gmail__send_email"

• "enableAllProjectMcpServers": true

1. In Claude Code on the web, create a scheduled Trigger on that repo that

runs a prompt/routine daily, unattended.

1. Have the routine's prompt instruct Claude to call the allow-listed MCP

tool (e.g., send a summary email via mcp__gmail__send_email).

1. Let the Trigger fire on its schedule with nobody watching.
2. Intermittently (not on every run), the session stops at a tool

permission confirmation dialog for the already-allow-listed tool and
never completes, since it's unattended.

Claude Model

Sonnet (default)

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.209

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

Is this a regression?

Yes. The same Trigger/routine ran successfully every day without this
issue from at least mid-June 2026 through ~2026-06-30. The blocking
behavior started appearing around 2026-07-01–2026-07-03. We added the
bypassPermissions config above on 2026-07-03 as a fix attempt, which
reduced but did not eliminate the problem — it reproduced again on
2026-07-12 with that fix already in place.

Last Working Version

Not applicable in the usual sense — this is Claude Code on the web
(hosted product, Triggers feature), not a locally installed CLI version,
so we don't have a version number to pin the regression to. Behaviorally,
"last known working" was routine runs through ~2026-06-30.

Claude Code Version

Not applicable / unknown from our side — this issue occurs in the hosted
Claude Code on the web product (Triggers), which we access only through
the browser UI, not via a local claude CLI install, so we have no
claude --version output to provide for the environment where the bug
occurs.

Additional Information

• Repository: JaimeArboleda/docs-ia
• Trigger name: "Revisión de documentación" (daily at 9:20 CEST)
• We checked all three tabs of the Trigger's "Edit routine" dialog

(Connectors, Behavior, Notifications) looking for a permission-mode
setting; found none relevant.

• A screenshot of the blocked permission dialog is available — happy to

attach separately.

• Relevant repo config:
• .claude/settings.json: permissions.defaultMode="bypassPermissions",

permissions.allow includes mcp__gmail__send_email,
mcp__gmail__list_emails, and various mcp__playwright__* tools;
enableAllProjectMcpServers: true.

• .mcp.json: defines gmail (@gongrzhe/server-gmail-autoauth-mcp

via npx) and playwright (@playwright/mcp via npx) as stdio MCP
servers.