fix(claude): make "Always allow for session" stick, and only for the session

[kakismash]

What changed

For the Claude provider, an acceptForSession decision in canUseToolEffect no longer echoes Claude Code's permission suggestions verbatim. A small normalizer (toSessionPermissionUpdates) now:

1. rescopes any received suggestions to destination: "session", and
2. synthesizes a whole-tool session allow rule ({ type: "addRules", rules: [{ toolName }], behavior: "allow", destination: "session" }) when Claude Code offered no suggestions at all.

Why it should exist

Fixes #4512. T3 keeps no session-permission state of its own for Claude — "Always allow this session" worked only if Claude Code happened to attach usable suggestions to the prompt. That breaks in both directions:

• MCP tools re-prompt forever. Claude Code sends empty or absent suggestions for MCP tools in several cases (tools flagged requiresUserInteraction, server-configured ask levels, ask-rule matches). The echo then produced no updatedPermissions, so acceptForSession silently degraded into a one-shot accept and the same tool prompted again on the next call — the exact behavior reported in [Bug]: "Always allow for session" permission is ignored for MCP tool calls (Repeatedly prompts for the same tools) #4512. Built-in tools always carry suggestions, which is why only MCP tools were affected. (The old guard also treated suggestions: [] as truthy, echoing an empty no-op array.)
• "This session" was persisted to disk. When suggestions were present they carried destination: "localSettings", so echoing them made Claude Code write a permanent allow rule into the workspace's .claude/settings.local.json — a session-scoped consent becoming durable state without the user asking for it.

The synthesized rule uses the fully qualified tool name (e.g. mcp__server__tool), which is the exact rule shape Claude Code's own matcher generates, so subsequent calls match natively. Other providers are unaffected (they map acceptForSession to their agent's native always-allow option).

No UI change.

Testing

• New test drives two acceptForSession round-trips through canUseTool: an MCP tool with empty suggestions (asserts the synthesized session rule) and a Bash call with a localSettings suggestion (asserts it is rescoped to session, preserving ruleContent)
• ClaudeAdapter.test.ts: 63 tests pass; typecheck clean

🤖 Generated with Claude Code

---

Note

Medium Risk
Touches Claude approval/permission handling in canUseTool, which affects tool execution consent and what rules Claude Code stores; scope is limited to the Claude adapter and is covered by new tests.

Overview
Fixes Claude "Always allow for session" so it actually applies session-only rules instead of echoing Claude Code's permission suggestions verbatim.

canUseTool now routes acceptForSession through toSessionPermissionUpdates, which rescopes any SDK suggestions to destination: "session" (avoiding writes to localSettings / .claude/settings.local.json) and, when suggestions are missing or empty—typical for MCP tools—synthesizes a whole-tool session allow rule so the choice persists for the session rather than behaving like a one-shot accept.

A new test covers MCP tools with empty suggestions and Bash with localSettings suggestions, asserting the returned updatedPermissions shape.

^{Reviewed by Cursor Bugbot for commit 48e6245. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Fix 'Always allow for session' to scope permission updates to the current session only

• In ClaudeAdapter, the acceptForSession decision now calls a new toSessionPermissionUpdates helper instead of spreading pendingApproval.suggestions directly.
• toSessionPermissionUpdates forces destination: 'session' on all suggestions, and when no suggestions exist (e.g. MCP tools), returns a fallback addRules allow entry scoped to the session.
• Previously, session-accept could either use wrong destination scoping from suggestions or produce no permission update at all for suggestion-less tools.

^{Macroscope summarized 48e6245.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 45dec02e-4d5c-4534-bf4e-57b12579aa3a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Approved 48e6245

This is a targeted bug fix ensuring session-scoped tool permissions actually persist for the session and don't accidentally get written to disk. The change is limited to adding a simple helper function and includes thorough test coverage.

^{You can customize Macroscope's approvability policy. Learn more.}