remote-control: client set_permission_mode=auto overrides --permission-mode bypassPermissions

What happened

claude remote-control --permission-mode bypassPermissions no longer produces sessions in bypass mode. The host spawns each child correctly, then the claude.ai client immediately overrides the mode to auto, and the mode picker in the web/mobile UI does not list Bypass permissions, so there is no way to set it back.

Every session I run is a remote-control session (headless hosts on a Mac and a Linux VPS, driven from claude.ai/code and the mobile app), so this removes bypass mode entirely for my setup.

Versions

• Host A (Linux VPS): CLI 2.1.226
• Host B (macOS): CLI 2.1.224 (local CLI on the same machine is 2.1.227)
• Same behavior on both, so this is not specific to one CLI version.

Repro

1. claude remote-control --name "example" --spawn=same-dir --permission-mode bypassPermissions
2. Start a session from claude.ai/code or the mobile app.
3. Open the mode picker: options are Auto, Manual, Accept edits, Plan. No Bypass permissions row.
4. Tool calls are judged by the auto-mode classifier and can be denied.

Evidence from the host debug log

Child is spawned with the flag intact:

[bridge:session] Child args: --print --sdk-url <redacted> --session-id <redacted> \
  --input-format stream-json --output-format stream-json --replay-user-messages \
  --debug-file <redacted> --permission-mode bypassPermissions

Two seconds later the client sets the mode:

<<< {"request":{"mode":"auto","subtype":"set_permission_mode"},"type":"control_request", ...}
<<< {"type":"control_response","response":{"subtype":"success","response":{"mode":"auto"}}}
<<< {"type":"system","subtype":"status","permissionMode":"auto", ...}

Expected

--permission-mode bypassPermissions on the remote-control host should either be honored for spawned sessions, or the client picker should offer Bypass permissions so the mode can be selected. Today the flag is accepted by the arg parser, passed to the child, then silently discarded.

Notes on things that do not work around it

• permissions.defaultMode: "bypassPermissions" in user settings is rejected under CLAUDE_CODE_REMOTE (only acceptEdits, plan, default, auto are allowed there).
• skipDangerousModePermissionPrompt and the accepted-disclaimer config flag do not apply; that path is gated on background session kind.
• Pinning an older CLI does not help, since 2.1.224 and 2.1.226 behave the same.