Claude Code's Computer Use approval survives only inside the session that granted it

Reading a binary with `strings` shows you that a literal is present. It is thinner evidence that one is absent. The trace, published in a dev.to write-up, was run on claude 2.1.266 to answer one question: whether the Computer Use approval can be pre-granted in a config file ^[3]. For the negative result to transfer to your install, your build has to read that setting by a literal key name, and its string table has to resemble 2.1.266's.

Two keys in `~/.claude.json` do persist. `bypassPermissionsModeAccepted: true` and `projects[*].hasTrustDialogAccepted: true` both hold across sessions, and the author set 85 of the latter in a single pass ^[8][9]. They suppress the dangerous-operation confirmation, which is a different dialog; with bypass accepted, the Computer Use prompt still appears ^[7][8]. "In other words, there's no room to fix this on the settings side," the author wrote ^[10]. The same pass turned up a parser detail: a `*` in the middle of an allow rule string, such as grep's `[^}]*`, draws a "wildcard before the rest" warning and the rule is rejected, while a trailing wildcard is accepted ^[11].

The first version of the daemon never pressed anything. Launched from launchd, it logged nine osascript timeouts at 22-second intervals, about 198 seconds of attempts with no keystroke delivered ^[13][1]. Run as a child of Terminal, it got `\r` to the dialog within seconds ^[14]. The post reports the reparenting as the fix and does not diagnose the cause.

The read path is where the daemon's cost sits. Terminal's `history` property is around 600KB per tab, so the script reads `contents of tab i of w`, the visible screen only ^[15]. Reading history instead, at a two-second poll, would move 300KB per second per tab, about 26GB a day ^[2]. There is an AppleScript trap in the loop: `repeat with t in tabs` with `contents of t` hands back the tab object rather than its text, so the tab has to be indexed explicitly ^[16].

Before sending anything, the script checks which option the cursor is on. It fires only when a tab contains both "Computer Use wants to control these apps" and "Enter to confirm" ^[19]. It then walks back from the confirm line to the highlighted option, the line beginning with the pointer glyph or with ">" in ASCII-only terminals, and skips unless that line contains "Allow for this session" ^[17]. Press Enter with the cursor on Deny and you have denied the request ^[18]. Sends are deduplicated per tty over 8 seconds, so at a two-second poll at most one Enter goes out per four sightings, and `fcntl.flock` stops a second instance racing the first ^[20][3].

Delivery is the neatest part of it. `do script "" in t` writes a single newline byte to that tab's tty and does not activate the window ^[21]. An approver that stole focus every few minutes would be worse than answering the dialog by hand.

On one mac, with Apple Terminal, I would run this. Anything portable has a harder problem: the trigger is a string match on the dialog's own wording ^[19], and the wording belongs to Anthropic.