[BUG] Title: Routine-driven ArtifactData writes trigger per-write consent dialogs, contradicting documented "no approval prompts during a run" behavior

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

An hourly Claude Code Remote Routine (scheduled trigger bound to a persistent session) writes to a published Artifact's shared database via the ArtifactData tool (batch/set/update/delete against a db capability collection). Every single write from this automated routine triggers a client-side "Allow Claude to edit this artifact's data?" consent dialog in the artifact owner's browser — requiring a manual click to Allow — even though the routine runs unattended on an hourly cron and the owner is frequently not present to approve it.

Expected behavior (per docs):
The Claude Code Routines documentation states routines "run autonomously as full Claude Code cloud sessions: there is no permission-mode picker and no approval prompts during a run," and that included connectors can write "without asking for permission during a run."

Actual behavior:

Every ArtifactData write issued by the routine's session surfaces a browser-side consent dialog to the artifact owner.
If the owner isn't present/reachable to click Allow, the write fails outright with an error like: this write reads back the stored document (a str_replace, or a write pinned with if_version) and has no approval record in this session — nothing was written; retry so it is checked again. There's no queuing behavior — it's an immediate failure, requiring the calling session to retry.
The dialog's own text implies the approval "covers the rest of the session," but in practice it recurs on subsequent writes from the same persistent session, sometimes within the same hour and sometimes after having been approved earlier that same day.
The consent payload uses an internal shape distinct from the documented ArtifactData tool contract — {action: "write_db", db_op: "batch", writes: [...]} — and includes a field __artifactConsentAskCanReachUser: true.

Impact:
This defeats the purpose of an hourly unattended routine that writes dashboard/status data to a shared artifact — a core supported use case. The routine's writes only succeed when the human owner happens to be at their browser to click Allow at the moment of the write, which for an hourly cron firing throughout the day means near-constant manual intervention.

Environment:

Trigger type: scheduled cron Routine (7 ), bound to a persistent session
Tool: ArtifactData, action batch (also reproduces on set/update/delete)
Target: a published Artifact with db capability declared

What Should Happen?

Either (a) honor the documented "no approval prompts during a run" guarantee for ArtifactData/artifact-db writes originating from a Routine-bound session the same way it applies to other connector writes, or (b) if per-write consent is intentional for artifact-database writes specifically, update the docs to say so explicitly and give routine owners a way to grant standing write consent (e.g., at artifact-sharing level) instead of a per-write dialog that doesn't actually persist as advertised.

Error Messages/Logs

Steps to Reproduce

Publish an Artifact with the db capability declared (capabilities: {db: {}}).
Create a scheduled Routine (Claude Code Remote trigger) on a recurring cron schedule (e.g. hourly), bound to a persistent session.
Give the routine a prompt that has it call the ArtifactData tool against that artifact's database — e.g. action: "batch" with a mix of set/update/delete writes to a collection.
Let the routine fire on its schedule without the artifact owner having the artifact page open in a browser at that moment.
Observe: the ArtifactData call does not complete. It returns an error along the lines of "this write reads back the stored document ... and has no approval record in this session — nothing was written; retry so it is checked again."
Have the artifact owner open the artifact in a browser. A dialog appears: "Allow Claude to edit this artifact's data?" Click Allow.
Retry the same tool call — it now succeeds.
Wait for the routine's next scheduled firing (or issue another ArtifactData write later in the same persistent session) without the owner re-opening the artifact tab.
Observe: the same consent dialog is required again, despite its own text implying the approval covers "the rest of the session" — the approval does not persist across the routine's subsequent firings, even though it's the same persistent session each time.

Claude Model

None

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

Claude Code version 2.1.270

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

_No response_