[BUG] Unattended CCR routine sessions hang indefinitely on an unanswerable permission-mode prompt; run status disagrees across surfaces

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

A scheduled Claude Code cloud routine (CCR) using MCP connectors (Gmail,
Google Calendar, Google Drive) stalls immediately after startup on every
manual run, apparently waiting on an interactive set_permission_mode
control request that nothing can answer in an unattended context. No
config combination available through the routine create/update API
prevents this. Stuck sessions never reach a terminal state via the API,
have no available force-stop mechanism, and three different Anthropic
surfaces report contradictory statuses for the same runs.

What Should Happen?

An unattended CCR routine should never emit an interactive permission-mode
control request with no one able to answer it — it should run
non-interactively by construction, governed by whatever tool allowlist is
set at the connector (permitted_tools) and/or session (allowed_tools)
level. If a config gap causes a tool call outside the allowlist, the run
should fail fast/visibly, not hang forever.

Error Messages/Logs

- Session log frozen after a control_request/set_permission_mode event
  with no response — no further events, no error, no timeout.
- Updating job_config.ccr.session_context with auto_mode_allow /
  auto_mode_environment returns HTTP 200 but silently fails to persist —
  both fields read back as empty arrays afterward.
- Status conflict across 3 surfaces for the same 3 runs:
  - Routines API (list_runs): reports active/idle indefinitely
  - Direct session URLs (e.g. claude.ai/code/session_016svgYja9ga5cscrwmCopmN):
    "no session found"
  - claude.ai/code/routines web UI: shows all 3 as completed

Steps to Reproduce

1. Create a routine with job_config.ccr pointing at the Default

environment, mcp_connections for Gmail/Calendar/Drive connectors
(initially empty permitted_tools), and
session_context.allowed_tools: ["Artifact"].

1. Trigger a manual run (POST /v1/code/triggers/{id}/run).
2. Poll GET /v1/code/sessions/{session_id}/events.
3. Session boots, starts Claude Code, stalls indefinitely at the

set_permission_mode control request.

Reproduced 3 times with 3 different config fixes attempted between runs
(connector permitted_tools, session allowed_tools, auto_mode_allow) —
identical stall every time.

Claude Model

Sonnet (default)

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.275

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

The RemoteTrigger/routines API exposes list, get, create, update, run,
list_runs, get_run_log — no stop/cancel/delete for an individual run
session, so the 3 stuck sessions above can't be cleaned up.

• Unclear whether hung sessions accrue billable usage while idle.
• Routine is currently paused (enabled: false); prompt, schedule, and

connector config are otherwise intact and ready to re-enable once fixed.

• Open question: are auto_mode_allow / auto_mode_environment /

auto_mode_soft_deny meant to be settable via the trigger create/update
API? If so, what's the correct request shape? Is there an intended
non-interactive permission mode for CCR sessions (equivalent to
--permission-mode bypassPermissions in the CLI)?