Claude Code agents froze at last line on .claude/ permission prompt

The setup was deliberately small: six scheduled Claude Code routines in the cloud — one daily monitor, four weekly implementers, and one month-end aggregator. Each was designed to fetch the repository, read its instructions and state files, advance one unit of work, and push to GitHub. The trial run looked like a success story: a Windows app lane handled .NET installation, core library work, 34 unit tests and CI in about five minutes. The stop came at the last line, when the agent tried to record its own progress.

What makes the episode interesting is the detour the author almost took. The first idea was to write to the protected location through Bash redirection instead of the Edit tool — a workaround that was accepted on the first agent. When the same instruction was attempted on the second, Claude Code's safety check refused it, saying the instruction told the agent to bypass protections. The author now argues that refusal was correct: such a rule would not treat STATE.md as a special case, and could become a general habit of looking for a side door around any protection.

The revised design separates configuration from working records, and treats stopping as normal rather than exceptional — commit and push as work reaches each meaningful boundary, so a run that dies partway still leaves something behind. The same day surfaced smaller traps too: outbound network access in the cloud environment was allowlist-only, personal GitHub connections did not cover organization repositories, and re-triggering a routine the same day did nothing because the agent judged the day's work already complete. The open question is how far this pattern generalizes: as agents get more capable, the design work may shift further toward where they stop and what they leave behind, not what they can do.