# Repeated t3_thread_read approvals after session approval in Claude Plan mode with Full access · Issue \#23918 · pingdotgg/t3code

[View on GitCafe](https://git.cafe/pingdotgg/t3code/issues/23918)

Repository: [pingdotgg/t3code](https://git.cafe/pingdotgg/t3code)

Visibility: public

State: backlog

Priority: 0

## Description

[Discussion and activity](https://git.cafe/pingdotgg/t3code/issues/23918)

---

### What happened

While using Claude in T3 Code Desktop with Full access selected and Plan enabled, reading another thread repeatedly displayed Command approval cards for `mcp__t3-code__t3_thread_read`.

Requests occurred while paging through messages, activity, and truncated item text. Session approval did not prevent later requests in the observed turn.

### Diagnosis

Source inspected at v0.1.2, commit `044f07257c9684ae4543bd1e1ebf9c394e9e3830`:

- [Plan takes precedence over Full access](https://github.com/pingdotgg/t3code/blob/044f07257c9684ae4543bd1e1ebf9c394e9e3830/apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.ts#L2036), and the adapter installs its permission callback in Plan mode.
- [t3_thread_read declares Readonly=false](https://github.com/pingdotgg/t3code/blob/044f07257c9684ae4543bd1e1ebf9c394e9e3830/apps/server/src/mcp/toolkits/orchestrator/tools.ts#L209). Reading a complete terminal result from a direct app-owned child can acknowledge completion delivery.
- [acceptForSession returns session permission updates](https://github.com/pingdotgg/t3code/blob/044f07257c9684ae4543bd1e1ebf9c394e9e3830/apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.ts#L2889).

These facts identify the permission path but do not establish why Claude requested approval again. SDK decision reasons, effective permission rules, process continuity, and subagent attribution were not captured.

### Steps to reproduce

Suggested minimal reproduction, not yet executed in isolation:

1. Create two test threads with enough dummy text to require pagination.
2. In the source thread, select Claude, Full access, and Plan before starting a turn.
3. Ask Claude to read the other thread, continuing through pages and truncated items.
4. On a `t3_thread_read` approval card, select Always allow this session.
5. Observe subsequent calls using `afterPosition` or `itemId`/`textOffset`.

Expected: an authorized history-reading workflow can continue within the stated permission scope, with any additional authorization explained.

Observed in the real session: repeated approval requests, including requests created after session approval.

### Version

Affected Desktop version reported: 0.1.2. The local server also reports 0.1.2. Triage CLI version only: 0.1.2-nightly.20261022.3541.

### Environment

Windows x64, build 10.0.26200. T3 Code Desktop Beta, Claude Agent provider, affected run model claude-opus-5-5. Effective Claude CLI and Agent SDK versions were not established.

### Evidence

```shell
Read-only SQLite inspection found, for one affected run:

tool: mcp__t3-code__t3_thread_read
distinct approval requests: 19
request kind: command
recorded decisions:
  accept: 9
  acceptForSession: 10
requests created after the first acceptForSession resolved: 17
distinct recorded providerThreadId values: 1
distinct recorded providerTurnId values: 1

These identifiers do not establish that all calls used the same Claude process. The original report counted 17 requests in a narrower history window.
```

### Related issues

No exact duplicate found in the searches performed. https://github.com/pingdotgg/t3code/issues/4974 concerns Auto mode outside Plan. https://github.com/pingdotgg/t3code/issues/3744 concerns side effects executing before plan approval.

### Fix applied or workaround

No fix applied. Session approval was used in the incident and is not a verified workaround. No correction for this exact symptom was confirmed in the upstream sources reviewed.

No permissions, service state, source code, or database contents were changed during triage.

### Filed by

Codex, GPT-6, via t3 triage.