[BUG] Routines cannot run fully unattended when the task publishes an Artifact — publish always requires manual approval

### Preflight Checklist

- [x] I have searched [existing issues](https://github.com/anthropics/claude-code/issues?q=is%3Aissue%20state%3Aopen%20label%3Abug) and this hasn't been reported yet
- [x] This is a single bug report (please file separate reports for different bugs)
- [x] I am using the latest version of Claude Code

### What's Wrong?

I have a Routine ("Daily earthquake relief tracker") scheduled to run every 3 hours on Cloud, whose job is to research news and republish updates to an existing Artifact (Artifact tool, publish action, url param set to update an existing artifact in place).

Every run that reaches the publish step gets stuck waiting on a manual permission prompt ("Allow Claude to update an artifact...?") with no one present to click Allow — the run then shows as "Scheduled · Cancelled" in the Runs list. This has happened repeatedly (visible in the run history).

I checked all three tabs of the routine editor (Connectors, Behavior, Notifications) and found no setting to auto-approve tool calls for a scheduled/unattended run — Connectors only auto-approves connector-sourced tools (Gmail, Calendar, Drive, Slack), not native tools like Artifact. I also tried setting permissions.defaultMode: "bypassPermissions" and explicit Artifact allow rules in ~/.claude/settings.json, which had no effect — the Cloud execution environment for this routine appears not to read/sync local settings.json changes (env var CLAUDE_CODE_REMOTE_SKIP_SETTINGS_SYNC=1 is set in the container).

Request: Add a setting in the Routine editor (e.g., under "Behavior") to allow a routine to run fully unattended, including auto-approving native-tool actions like Artifact publish, for routines the user has explicitly configured for scheduled/autonomous execution.

### What Should Happen?

The scheduled Routine should be able to complete its Artifact `publish` step automatically, without an interactive approval prompt — since scheduled/Cloud runs have no one present to click Allow. Currently every run that reaches the publish step hangs waiting for manual approval and ends up as "Scheduled · Cancelled" in the run history.

### Error Messages/Logs

```shell
Repeated runs of the routine show status "Scheduled · Cancelled" in the Runs list after reaching the Artifact publish step. No error is surfaced to the routine itself — the run simply times out waiting on an unanswered permission dialog ("Allow Claude to update an artifact from sismo-colombia-report.work.html?").
```

### Steps to Reproduce

1. Create a Routine in Claude Code (Routines panel → New routine) with instructions that include a step calling the Artifact tool to publish/update an existing artifact, e.g.:
"Read the artifact at https://claude.ai/code/artifact/, make an edit, then republish it with the Artifact tool using the same url."
2. Set the routine's environment to Cloud and configure a recurring trigger (e.g., "every 3 hours").
3. Save and let the routine fire on schedule with no one watching the session.
4. Open the routine's "Runs" list afterward.

Expected: the run completes, including the Artifact publish step.
Actual: the run reaches the Artifact publish step, a permission dialog appears ("Allow Claude to update an artifact from ?"), no one is present to click Allow/Deny, and the run eventually shows as "Scheduled · Cancelled".

Additional context: I confirmed there is no setting to avoid this — checked all three tabs of the routine editor (Connectors, Behavior, Notifications); Connectors only auto-approves connector-sourced tools (Gmail, Calendar, Drive, Slack), not native tools like Artifact. Also tried setting permissions.defaultMode: "bypassPermissions" and an explicit "Artifact" allow rule in ~/.claude/settings.json inside the session — had no effect, likely because the Cloud execution environment doesn't sync local settings.json (env var CLAUDE_CODE_REMOTE_SKIP_SETTINGS_SYNC=1 is set in the container).

### Claude Model

None

### Is this a regression?

I don't know

### Last Working Version

_No response_

### Claude Code Version

2.1.42

### Platform

Other

### Operating System

Other Linux

### Terminal/Shell

Non-interactive/CI environment

### Additional Information

Routine name for reference: "Daily earthquake relief tracker" (recurring every 3 hours, Cloud environment).

Attaching screenshots of:
1. The Runs list showing multiple "Scheduled · Cancelled" entries — this is the visible symptom of runs hanging on the unanswered Artifact publish approval.
2. The three tabs of the routine editor (Connectors, Behavior, Notifications) showing no permission/auto-approve setting exists for native tools.

For context: the Connectors tab does show an explicit warning that connector tools (Gmail, Calendar, Drive, Slack) run "without asking for permission during runs" — which confirms unattended tool execution is an intended pattern for Routines in general. The gap is specifically that this same auto-approval doesn't extend to native tools like Artifact publish, even when the routine's whole purpose is to publish/update that artifact unattended.

Reproduce from the issue steps on Claude Code 2.1.42: create a Cloud Routine with a recurring trigger that updates an existing Artifact and observe the Artifact publish approval prompt. Read the Routine editor behavior around connector auto-approval versus native tool permissions. Done means scheduled unattended runs either have an explicit safe setting for Artifact publish approval or the product clearly rejects that workflow.

由索引模型根据 Issue 内容生成。