Routines: unattended cloud runs hang indefinitely on sensitive-file prompts for `.claude/` writes (PreToolUse allow does not override)

Summary

Unattended Routines (cloud) hang indefinitely when the session writes to a path under .claude/. A sensitive-file approval prompt is raised, nobody is there to answer it, and the run stalls until it is killed. All work done in the run is lost.

This is the unattended counterpart of #16762 and #43001 (both closed and locked). Those describe an interactive annoyance — the prompt reappears and "always allow" does not persist. In an unattended run the same mechanism is not an annoyance, it is silent total loss, and there is no configuration that avoids it.

Filing a new issue as the bot on those threads instructs.

Why this is worth separating from #16762 / #43001

| | #16762 / #43001 (interactive) | This report (unattended Routines) |
|---|---|---|
| Symptom | Prompt reappears every session | Run hangs until killed |
| Cost | Press a key | Every change in the run is discarded |
| Visible? | Yes, immediately | No. The run just never finishes |
| Workaround | Press the key | None via configuration (see below) |

Measured occurrences

Three runs on my account, all stalled on a write under .claude/:

| Date (JST) | Routine | Stalled for |
|---|---|---|
| 2026-08-21 | health check (daily) | 5h 27m |
| 2026-08-21 | night shift | 7h 12m |
| 2026-08-23 | health check (daily) | 13h 24m |

The 2026-08-23 run is the clearest case. The routine completed all of its work — it ran the full check and produced its result (FAIL 0 / WARN 1) — and then hung on the single step of writing that result to .claude/HANDOFF.md. Not one character was delivered. Session: cse_01BxwQoYGGtAPaW2pN8EPsZt.

What does not work

1. PreToolUse hook returning allow does not override it. The hook fires normally — the run log for the 08-23 session shows hook_started ×23 and hook_response ×23 — and the prompt still appears. This matters for diagnosis: it is easy to conclude "my hook isn't running" and spend a long time fixing the wrong thing. The hook is running; the sensitive-file check wins.

This is consistent with #43001's observation that the sensitive-file check appears to run before permission settings are consulted.

1. Switching tools does not avoid it. Writing with a Bash heredoc (cat >> .claude/... <<'EOF') is blocked the same way as Edit/Write. The classification is on the target path, not the tool.

1. Reads are not affected. head/Read on the same file work. Only writes are blocked.

Contradiction with the documentation

Automate work with routines states:

Routines run autonomously as full Claude Code cloud sessions: there is no permission-mode picker and no approval prompts during a run.

That is what I built around, and it is not what happens. Either the docs should note the sensitive-path exception, or unattended runs should not raise this prompt.

Steps to reproduce

1. Create a Routine (cloud) on a repository that contains a .claude/ directory.
2. Give the prompt a step that writes to a file under .claude/, e.g. append a line to .claude/HANDOFF.md.
3. Optionally add a PreToolUse hook that returns allow for that path, to confirm it does not help.
4. Let the routine fire on its schedule (unattended — do not open the session).
5. The run reaches the write step and stops. It stays there until the run is terminated.

Expected behaviour

In an unattended run, one of:

• the sensitive-file check is skipped (the run has no human to consult), or
• a PreToolUse hook returning allow overrides it, or
• the tool call is denied immediately so the session can handle the failure and still report.

Any of the three is workable. Blocking on a prompt that can never be answered is the one behaviour that cannot be handled, because the run cannot even report why it failed.

Denying fast would be my preference: an unattended agent can route around a denial, but it cannot route around an unanswerable question.

Workaround (for anyone hitting this)

Move the write target outside .claude/. I moved my routines' report file to docs/auto-reports/ and the hangs stopped. Reads from .claude/ can stay as they are.

Environment

• Claude Code Routines (cloud, research preview), Anthropic-managed environment
• Routines on schedule triggers, persist_session: false
• Models: claude-sonnet-5 (health check), claude-opus-5 (night shift)