Scheduled routines prompt for connector tool approval; "Allow for all scheduled runs" errors instead of persisting

Routines created via the MCP create_trigger API attach a connector with an empty tool policy, so every firing prompts for approval that nobody is there to answer. The button meant to fix this errors.

What happens

A routine calls mcp__Supabase__execute_sql and blocks on "Allow Claude to Execute Sql?" with Allow once / Allow for all scheduled runs / Deny. Clicking Allow for all scheduled runs errors, so nothing persists and the next firing prompts again. Unattended firings stall.

What's expected

Docs state routines run as autonomous cloud sessions with no permission-mode picker and no approval prompts during a run, with reach determined by the repos, environment and connectors included. No prompt should appear.

Evidence

list_triggers shows the routine's stored connector grant is empty:

{
  "name": "Supabase",
  "url": "https://mcp.supabase.com/mcp",
  "permitted_tools": [],
  "tool_policy_overrides": [],
  "clear_tool_policy_overrides": false,
  "created_via": "meta_mcp"
}

Two separate routines on this account show the identical empty grant.

The account-level connector settings are not empty. In Customize > Connectors > Supabase: read-only tools (18) = Always allow; write/delete tools = Custom, with Execute SQL, Apply migration and Deploy Edge Function all set to allow. Routines appear not to read these.

Confirmed the account settings work in an interactive session: mcp__Supabase__get_project_url and mcp__Supabase__execute_sql (select 1) both ran with no prompt. Only routine-fired sessions prompt.

The project .claude/settings.json also carries permissions.allow entries mcp__Supabase__* and mcp__supabase__*, which per the permissions docs is valid wildcard syntax for all tools on a server.

Two bugs, possibly related

1. create_trigger accepts only connector names, with no field for per-tool policy, so API-created routines get a bare attachment with no policy snapshot and fall back to prompting.
2. Allow for all scheduled runs errors rather than writing tool_policy_overrides, so there is no way to recover from (1) at the prompt.

Doc gaps

Not documented: whether project-level .claude/settings.json allow rules are honored inside routine sessions, and what "Allow for all scheduled runs" persists, or where.