Cloud routines: Artifact publish raises an interactive permission prompt, so unattended runs hang in requires_action

## Summary

In **cloud routine (scheduled agent) sessions**, the `Artifact` publish action raises an interactive permission prompt:

```
permission prompt Artifact: Claude wants to publish "/tmp/probe.html", uploading it to
claude.ai (Anthropic's servers) to host as a page, private to you until you share it.
```

Routine runs are unattended, so nothing can answer it. The session sits at `worker_status: requires_action` indefinitely. There is no timeout, no failure, and no notification. The routine silently stops producing output until a human opens the run and clicks.

This contradicts the documented contract. From [Automate work with routines](https://code.claude.com/docs/en/routines), verbatim:

> Routines run autonomously as full Claude Code cloud sessions: there is no permission-mode picker and no approval prompts during a run.

Same failure mode as #88112 (which is about read-only `cp` of persisted `tool-results/` files), on a different trigger. Filing separately because the triggering action differs and this one has a clean before/after boundary.

## It regressed mid-morning 2026-08-23 UTC

The same routine, publishing to the same artifact, stopped being able to publish unattended partway through the day. Nothing on my side changed the tool call.

| time (UTC) | run | model at `init:` | result |
|---|---|---|---|
| 2026-08-21, six runs | overnight sweep | `claude-sonnet-4-6` | all completed, no prompt |
| 07:37 | overnight sweep | `claude-sonnet-4-6` | completed, no prompt |
| 08:16 | overnight sweep | `claude-sonnet-4-6` | **completed, no prompt event in the log** |
| 10:47 | overnight sweep (scheduled) | `claude-sonnet-5` | prompted, hung ~3.3h until cleared by hand |
| 11:11 | weekly digest (scheduled) | `claude-sonnet-5` | prompted, hung ~2.9h until cleared by hand |
| 13:55 | overnight sweep (manual) | `claude-sonnet-5` | prompted, hung 8.5m until cleared by hand |

The 08:16 run (`cse_01W7zVG1WmpQhQbX6wj5g58q`) goes from `tool_use Artifact` to `tool_result: Published ... at https://...` in **1.6 seconds with no `permission prompt` event of any kind**. Resolved prompts *are* visible in these logs, so that absence is meaningful: the 13:46 run (`cse_01TttUTWAZTJH5VvhTVt1Cm8`) shows `permission prompt Artifact` at 13:49:54 followed by `Published` at 13:50:10.

## Ruled out: the model, and the tool-call shape

The regression window straddled a config edit of mine that pinned `session_context.model` from `claude-sonnet-4-6` to `claude-sonnet-5`, and sonnet-5 emits a richer Artifact payload (it passes `action` and `title`, which sonnet-4-6 omitted). Both looked like plausible causes and both are wrong.

Control: a throwaway routine pinned to `claude-sonnet-4-6`, publishing a trivial page with the minimal payload `{"favicon":"...","file_path":"/tmp/probe.html"}`, no `action`, no `title`, no `url`. That is the same model and the same call shape as the run that published silently six hours earlier.

It prompted. (`cse_01WiZybr9GPs2VeBzPCTpmR4`, prompt at 14:05:39.)

## Timing, and a negative control

#88112 reports that these prompts sometimes auto-resolve after roughly 13 to 33 seconds
and sometimes hang forever. Two of my publishes did complete in that band:

| run | prompt to result | outcome |
|---|---|---|
| `cse_01TttUTWAZTJH5VvhTVt1Cm8` | 16.3s | published |
| `cse_01WiZybr9GPs2VeBzPCTpmR4` | 12.2s | published |
| `cse_017bhTkETLe2HixweLJors6h` | ~3.3h | hung until cleared by hand |
| `cse_01E8GmqaKYmC74XEWzo6nbbs` | ~2.9h | hung until cleared by hand |
| `cse_01A3mwksgQLsaToYo5aCd3KH` | ~8.5m | hung until cleared by hand |

I was clearing a queue of stuck runs during that window, so I could not tell whether
those two were auto-resolved or clicked.

**Negative control, deliberately untouched:** I fired the same probe routine again
(`cse_01UrdfZaS9cY76zpmrxCKt3g`) and did not open the session or click anything. It
entered `requires_action` at 14:26:04 and was still there more than two minutes later,
roughly four times the upper bound of the band above.

So on this trigger the prompt does not appear to auto-resolve, and the two fast
completions were most likely a human clicking. Reporting the timings anyway in case
they are useful alongside #88112.

## The permission dialog offers no persistent grant

The dialog rendered for this prompt has exactly two controls, **Deny** and **Allow once**. There is no "always allow" option, so an operator cannot pre-authorize the action even once by hand and have it stick. Combined with each routine run being a fresh session, every single run needs a fresh human click.

The docs say ["Republishing an artifact you have already approved does not prompt again"](https://code.claude.com/docs/en/artifacts), which is not what happens here: the artifact had been published dozens of times to the same URL by the same routine.

## Repro

1. Create a cloud routine with no repository attached, any environment.
2. Prompt: write a trivial HTML file, then publish it with the Artifact tool.
3. Fire it, unattended.
4. The run reaches the publish, enters `requires_action`, and stays there.

## Impact

An artifact is the only durable output channel a repo-less routine has. A routine that publishes a dashboard or digest page is exactly the "unattended, repeatable, tied to a clear outcome" shape the routines docs recommend, and it cannot currently complete without a human. Worse, the failure is silent: `list_runs` has to be polled to discover a stuck run, and a run that did all its work correctly and then parked looks identical from the outside to one that has not started.

There is also still no API to approve or cancel a stuck run programmatically, as #88112 notes.

## Expected

Any of:

- Artifact publish in an unattended routine session should not require interactive approval, per the documented "no approval prompts during a run".
- Or routines should be able to pre-authorize it in the job config (note that `session_context.allowed_tools` is currently accepted and echoed back but has no effect).
- Or an unanswered permission prompt in an unattended routine should fail the run after a timeout, so the failure is visible instead of silent.

## Environment

- Cloud routine sessions, Anthropic-managed infrastructure, no repository attached
- Models: reproduced on both `claude-sonnet-5` and `claude-sonnet-4-6`
- Local CLI used to inspect runs: 2.1.241

Start by reproducing the unattended Artifact publish in a cloud routine and inspect the run logs around the permission prompt and requires_action state. Compare session_context.allowed_tools behavior with the documented routines and artifacts contracts, and trace list_runs visibility for stuck runs. Done means unattended publishes no longer block, or an unanswered prompt produces a visible timed-out failure.

索引モデルが issue の本文から書いたものです。