# \[Bug\]: Claude Auto mode on orchestrator v2 runs ask-rule commands without prompting · Issue \#15353 · pingdotgg/t3code

[View on GitCafe](https://git.cafe/pingdotgg/t3code/issues/15353)

Repository: [pingdotgg/t3code](https://git.cafe/pingdotgg/t3code)

Visibility: public

State: backlog

Priority: 0

## Description

[Discussion and activity](https://git.cafe/pingdotgg/t3code/issues/15353)

---

### Before submitting

- [x] I searched existing issues and did not find a duplicate.
- [x] I included enough detail to reproduce or investigate the problem.

### Area

apps/server

### Steps to reproduce

1. Add an ask rule to Claude Code's user settings, for example `"permissions": { "ask": ["Bash(git push:*)"] }`.
2. Start a Claude thread on orchestrator v2 with the permission mode set to **Auto**.
3. Ask the agent to run `git push` (or any command matching the ask rule).

### Expected behavior

T3 Code shows an approval request, the same way Claude Code does in its own `auto` mode. The permission modes guide says Auto "uses the provider's automatic review to approve routine actions and ask about others".

### Actual behavior

The command runs with no prompt, the same as **Full access**.

Claude's `auto` mode sends anything it wants a human to decide (an ask rule match, a protected path, a classifier escalation) to the SDK `canUseTool` callback. In `ClaudeAdapterV2`, that callback answers `allow` whenever `requiresClaudeApproval` is false, and `installPermissionCallback` is false for `auto`. So every request Claude escalates gets approved without the user seeing it.

The V1 adapter skipped the prompt only for `full-access` and asked in Auto. #13786 fixed the same problem for Auto-accept edits and left Auto unchanged.

### Impact

Major degradation or frequent failure

### Version or commit

main @ 65731f986b

### Environment

Linux, Claude Code provider, orchestrator v2

### Workaround

Use **Supervised**, or add a PreToolUse hook that blocks the command.