[BUG] Cowork: a context: fork skill's connector tool calls are refused with no permission prompt unless the tool is set to Always allow

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [ ] I am using the latest version of Claude Code (Cowork bundles 2.1.286; the latest CLI is newer)

What's Wrong?

In Cowork, a skill with context: fork can't use a connector (MCP) tool unless that tool is already set to "Always allow" in the connector's tool permissions. A tool on "Needs approval" is refused inside the forked subagent straight away, and no permission prompt appears anywhere, in the task or elsewhere.

The forked skill gets an error back; the user sees nothing unless the skill happens to report it. So forking a skill that calls connectors turns a visible permission prompt into a failure nobody notices.

Tested variants, all refused with no prompt:

| Fork | Pre-approval in the skill | Result |
| :- | :- | :- |
| background: false | none | refused, no prompt |
| background: false | allowed-tools naming the exact tool | refused, no prompt |
| background: false | allowed-tools naming the server | refused, no prompt |
| background (default) | none | refused, no prompt in the main task |

Setting the tool to "Always allow" makes the same call succeed inside the fork. Choosing "Allow once" on a prompt in the main task doesn't carry into a later fork.

Everything else about context: fork worked as documented in Cowork: the fork ran on the skill's model: (typed and model-invoked, foreground and background), received its arguments as ARGUMENTS: <value>, and couldn't see the conversation. ToolSearch inside the fork finds and loads the connector tools; only the call is refused.

What Should Happen?

The fork should raise a permission prompt the user can approve, as the docs describe for subagents: "Foreground subagents block the main conversation until complete. Permission prompts are passed through to you as they come up", and background subagents surface their prompts in the main session (https://code.claude.com/docs/en/sub-agents, "Run subagents in foreground or background").

Error Messages/Logs

Claude requested permissions to use mcp__<Connector>__<tool>, but you haven't granted it yet.

This is the tool result the forked subagent receives. Nothing is shown to the user.

Steps to Reproduce

1. Pick any connector in Cowork and set one of its read-only tools to "Needs approval" in that connector's tool permissions.
2. Install a plugin with this skill, replacing <connector> and <tool>:

```markdown
---
name: perm-control
description: Permission test. Use only when the user asks to run perm-control.
model: haiku
context: fork
background: false
---

Your task: answer the three questions below as a numbered list, right now. Do not ask the user anything.

1. Your exact model ID, as your system prompt states it.
2. Use ToolSearch to find the <connector> <tool> tool, load it, and call it. Report the first line of the result, or the exact error.
3. The exact name of the tool you called.

```

1. In a new Cowork task, type /perm-control.
2. Observed: the fork reports the "haven't granted it yet" error; no permission prompt appears.
3. Optional variants: remove background: false (background fork), or add allowed-tools: mcp__<Connector>__<tool> to the frontmatter. Same result.
4. Set the tool to "Always allow" and run /perm-control again: the call succeeds.

Claude Model

Not sure / Multiple models

(Session on Sonnet 5.5, forked skill on Haiku 4.5.)

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.286 (bundled with the Claude desktop app's Cowork mode)

Platform

Other

(Claude desktop app, Cowork mode, Team/Enterprise plan)

Operating System

macOS

Terminal/Shell

Other

Additional Information

Related, but not the same:

• #69482: subagent permission prompts invisible in remote and web sessions, where the session hangs rather than refusing.
• #59707 and #84688: AskUserQuestion prompts not reaching the user in Cowork.
• #14956: a skill's allowed-tools doesn't grant permission in Claude Code either, so the allowed-tools rows above may share that cause.