[BUG] Claude Code Projects (Beta). The auto-mode permission check blocks approved work in cloud environments and Projects

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

The auto-mode permission check blocks approved work in cloud environments and Projects

Date: 24 September 2026
Product: Claude Code on the web: cloud environments with the Projects feature (coordinator and thread sessions)
Severity for us: blocking. We cannot use cloud sessions for operations work, and we move that work to a local agent.

Summary

The auto-mode permission check stops the agent when it changes our own infrastructure (our database host's branches and our hosting provider's settings). This occurs after I gave clear approval. There is no way in the cloud session or the Projects UI to approve the blocked action. So the agent does the preparation, stops, and gives me a prompt to paste into a local agent. The local agent has no such check.

What happened (real examples, 23 and 24 September 2026)

| # | Action the agent tried | My approval before it | Result |
|---|------------------------|------------------------|--------|
| 1 | Run a database migration on our staging database branch | I wrote "Merge and migrate", then "yes" | Blocked twice. The thread could not finish, so the coordinator started a new thread |
| 2 | Push a small documentation commit | The task was mine | Blocked in one thread. A different thread pushed the same change |
| 3 | Turn on the magic link plugin and turn off password sign-up on staging (the auth service API of our database host) | My request came to the thread from the coordinator, with my message quoted | Blocked ("Permission Grant") |
| 4 | The same action as #3 | I replied "yes" to the agent's message, which named the 2 changes | Blocked ("Feature Flag Writes") |
| 5 | The same action as #3 | I typed the full action: "Turn on the [auth service] magic link plugin and turn off email and password sign-up on the [staging] branch" (names replaced here) | Allowed |
| 6 | Add a trusted domain to the auth service on our production branch (first step of a plan the agent had written out) | I replied "yo do it" to the plan | Blocked ("Production Deploy"). The denial also tells the agent not to try again in later turns, so my approval can never unblock it in this session |

The agent had all the credentials and connectors it needed: an API key for our database host, and connectors for the database host and the hosting provider. Only the permission check stopped it.

Why this is blocking

• An approval does not count unless I type the action again in full. A "yes" to a message that names the action is not enough (#4). This is slow on a phone, and I cannot know which words the check will accept.
• My approval does not carry across Projects. In Projects, I talk to the coordinator, and the coordinator gives the work to a thread. The thread gets my exact message, marked as my words, but the check does not accept it (#3).
• Production is blocked with no way to approve it. After one denial, the agent must not try again in any later turn (#6). So the only way to change production is outside the cloud session.
• I cannot see or change the rules. The Projects UI shows no permission setting and no "approve this action" button. The agent can only tell me what it cannot do. The denial labels ("Containment Escape", "Feature Flag Writes") do not tell me what to change.
• The result is more risk, not less. I copy a long prompt into a local agent that has no check, instead of approving one exact action in the cloud session where I can see it.

What would fix it

1. An approve button on a blocked action. Show me the exact action (command or API call, target resource) in the thread, with Approve once and Deny. This is the same model as the permission prompt in the terminal.
2. Permission rules per environment or project in the UI. Examples: "allow writes to database project X, branches staging and main"; "allow environment variable changes in hosting project Y"; "ask me first for production". Show them in the environment settings, next to network access and secrets.
3. Accept a clear yes. When the agent's last message names the action and I reply "yes" (or tap a button), treat that as approval for that action only.
4. Accept my quoted words in Projects. When the coordinator passes on my message as my words (the server marks it as mine), let it approve the action it names.
5. Clear denial messages for the user. Say what was blocked, why, and the one thing I can do to allow it.

Environment details

• Claude Code on the web, cloud environment with GitHub, database host and hosting provider connectors, and a database host API key in the environment secrets.
• Projects feature: a coordinator session and several thread sessions, all working for one private project.
• Targets: our own database project (staging and production branches) and our own hosting project, in our own accounts. No action deleted anything.

What Should Happen?

What would fix it
An approve button on a blocked action. Show me the exact action (command or API call, target resource) in the thread, with Approve once and Deny. This is the same model as the permission prompt in the terminal.
Permission rules per environment or project in the UI. Examples: "allow writes to database project X, branches staging and main"; "allow environment variable changes in hosting project Y"; "ask me first for production". Show them in the environment settings, next to network access and secrets.
Accept a clear yes. When the agent's last message names the action and I reply "yes" (or tap a button), treat that as approval for that action only.
Accept my quoted words in Projects. When the coordinator passes on my message as my words (the server marks it as mine), let it approve the action it names.
Clear denial messages for the user. Say what was blocked, why, and the one thing I can do to allow it.

Error Messages/Logs

Steps to Reproduce

Setup

1. In Claude Code on the web, make a cloud environment. Put an API key for a service you own in the environment secrets (we used a database host with staging and production branches). Leave the default permission mode (auto mode).
2. Start a cloud session in that environment, with the repo that uses the service.

A. A "yes" does not approve the action

1. Ask: "Use the API key to turn on setting X on my staging resource. Tell me the exact change first."
2. The agent replies and names the exact API call and target.
3. Reply: "yes".
4. Expected: the agent makes the call. Actual: the permission check blocks it (for us: "Feature Flag Writes"). The agent asks me to type the action again.
5. Type the whole action as one sentence ("Turn on setting X on the staging resource"). Now the same call is allowed.

B. Approval does not pass from the coordinator to a thread (Projects)

1. In a Project, ask for the same kind of change in the project chat. The coordinator starts a thread and passes on your message, marked as your words.
2. Expected: the thread makes the call. Actual: blocked (for us: "Permission Grant").

C. A production change cannot be approved at all

1. Ask for a change to a resource named production (or main). The agent writes a plan.
2. Reply: "do it".
3. Expected: the agent makes the change, or shows me an approve button. Actual: blocked ("Production Deploy"). The denial tells the agent not to try again in any later turn. No setting or button in the UI lets me approve it.

How often: every time in our tests (5 blocks in 6 attempts, 23 and 24 September 2026). The one allowed attempt was step 7.
Workaround: run the same steps in a local Claude Code session, which does not have this check.

Claude Model

Opus

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

claude code projects on the web

Platform

Anthropic API

Operating System

Other

Terminal/Shell

Other

Additional Information

https://claude.ai/code/projects/ so a web project not local