Cloud routines: read-only access (cp) to persisted tool-results files triggers 'sensitive file' edit permission prompt — unattended runs hang forever in requires_action

## Summary

In **cloud routine (scheduled agent) sessions**, when a tool call returns an oversized result, the harness persists it to `~/.claude/projects/**/tool-results/` and instructs the model to read it from there. But any subsequent Bash command that merely **references** such a file — including a plain read-only `cp ` with no write to the source — triggers:

```
permission prompt Bash: Claude requested permissions to edit /root/.claude/projects/-home-user//tool-results/ which is a sensitive file.
```

Since routine runs are unattended, nobody can answer the prompt and the session hangs indefinitely with `worker_status: requires_action`. There is no timeout, no failure, and no notification — the routine silently stops producing output until a human opens the session page.

## Why this looks like a bug

1. Per the permissions docs, `cp` is classified as a read-only command that should not prompt. The prompt also says **"edit"** although the command only reads the file.
2. The tool-results file is the session's **own tool output** that the harness itself told the model to consume ("Output has been saved to … Use offset and limit parameters to read specific portions of the file"). Reading it back should not be treated as touching sensitive Claude config.
3. The behavior is **nondeterministic**: across identical daily runs of the same routine, some of these prompts auto-resolve after ~13–33 seconds and the run completes; others hang forever. In one run the first `cp` batch resolved in 13s and a second, same-shaped `cp` batch minutes later hung permanently.

## Repro (cloud routine)

1. Create a routine whose prompt requires processing a large tool result, e.g. WebFetch of a ~1MB artifact page, or an MCP connector query returning a multi-MB JSON (result gets persisted to `tool-results/`).
2. Have the prompt instruct: "copy the persisted file to the scratchpad with cp, then only work on the copy" (added specifically to avoid editing the sensitive path).
3. Fire the routine (cron or run-now), unattended.
4. Observe via the runs list: session enters `requires_action` at the first Bash command that references the tool-results path, and never proceeds.

Observed on `model=claude-sonnet-5` routine sessions, multiple days in a row (4 of 5 recent runs hung; 1 completed after the prompt auto-resolved).

## Impact

Any unattended routine that must process large WebFetch/MCP results is unreliable — the harness forces large results into `tool-results/`, and consuming them from Bash rolls the dice on a permission prompt that unattended sessions can't answer. There is also no API to cancel or approve a stuck run programmatically.

## Expected

- Read-only access (cp/cat/python open-for-read) to the session's own `tool-results/` files should not require a sensitive-file edit permission, or
- routines should be able to pre-authorize this in their job config, or at minimum
- an unanswered permission prompt in an unattended routine should fail the run after a timeout (so failure is visible) instead of hanging in `requires_action` forever.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Start with the cloud routine run flow, Bash permission handling, and the requires_action state described in the report. Reproduce with an oversized WebFetch or MCP result followed by a read-only cp in an unattended routine, then trace where the sensitive-file prompt is created. Done means read-only access no longer hangs unattended runs, or an unanswered prompt produces a visible timeout failure.

Scritto dal modello di indicizzazione a partire dal testo della issue.