[BUG] mismatch between the Claude CLI control protocol and can_use_tool permission

There is a bug in `claude-agent-sdk-python`. Tracking it down:

```bash

▐▛███▜▌ Claude Code v2.1.6
▝▜█████▛▘ Sonnet 4.5 · Claude API
▘▘ ▝▝ ~/p/g/n/claude-agent-sdk-python

❯ We’re seeing a mismatch between the Claude CLI control protocol and the Python/Elixir SDKs’ can_use_tool permission
callbacks. We need to determine whether the CLI is supposed to emit control_request events (subtype: "can_use_tool")
when
--permission-prompt-tool stdio is active, and why it isn’t in CLI 2.1.6.
Context / expectation
- Both SDKs implement can_use_tool by enabling the control protocol and setting --permission-prompt-tool stdio.
- The control protocol defines control_request with subtype: "can_use_tool" and expects the SDK to respond
allow/deny.
- If the CLI does not emit those control callbacks, permission hooks can never fire (even though tool use itself
works).
What I did
I added a Python‑side repro script that uses the local SDK source (no install needed) and registers a can_use_tool
callback. It forces a Write tool call and fails if no permission callbacks are observed.
Script path:
/home/home/p/g/n/claude-agent-sdk-python/examples/permission_callback_probe.py
Current status / repro output (CLI 2.1.6)
$ python3 /home/home/p/g/n/claude-agent-sdk-python/examples/permission_callback_probe.py
====================================================================
Permission Callback Probe (Python SDK, live CLI)
====================================================================
Claude CLI: claude
Claude CLI version: 2.1.6 (Claude Code)
Prompt:
Use the Write tool to create a file with the exact path and content below.
file_path: /home/home/p/g/n/claude-agent-sdk-python/examples/_output/permissions_callback_probe.txt
content: hello from permissions probe
After the write completes, reply with exactly: WROTE
WROTE
FAILED:
- No can_use_tool callbacks observed from CLI control protocol.
Claude CLI version: 2.1.6 (Claude Code)
Why this matters
- Tool use is happening and the CLI completes the action, but no can_use_tool control callbacks are ever emitted, so
SDK
permission hooks never run.
- This blocks the SDK from enforcing/observing tool permissions even though the protocol says it should.
Questions
1. Is CLI 2.1.6 expected to emit control_request / can_use_tool callbacks when --permission-prompt-tool stdio is
set?
2. If yes, is this a known CLI regression?
3. If no, is the SDK’s permission callback feature ahead of the CLI and should be documented as not supported?
4. Is there a CLI flag or config required to enable these callbacks beyond --permission-prompt-tool stdio?
We need to confirm whether this is a CLI bug, a protocol mismatch, or a missing CLI flag.
```