[BUG] mismatch between the Claude CLI control protocol and can_use_tool permission #469
Description
There is a bug in claude-agent-sdk-python I am tracking down but while doing that, claude code locked me out
▐▛███▜▌ Claude Code v2.1.6
▝▜█████▛▘ Sonnet 4.5 · Claude API
▘▘ ▝▝ ~/p/g/n/claude-agent-sdk-python
❯ We’re seeing a mismatch between the Claude CLI control protocol and the Python/Elixir SDKs’ can_use_tool permission
callbacks. We need to determine whether the CLI is supposed to emit control_request events (subtype: "can_use_tool")
when
--permission-prompt-tool stdio is active, and why it isn’t in CLI 2.1.6.
Context / expectation
- Both SDKs implement can_use_tool by enabling the control protocol and setting --permission-prompt-tool stdio.
- The control protocol defines control_request with subtype: "can_use_tool" and expects the SDK to respond
allow/deny.
- If the CLI does not emit those control callbacks, permission hooks can never fire (even though tool use itself
works).
What I did
I added a Python‑side repro script that uses the local SDK source (no install needed) and registers a can_use_tool
callback. It forces a Write tool call and fails if no permission callbacks are observed.
Script path:
/home/home/p/g/n/claude-agent-sdk-python/examples/permission_callback_probe.py
Current status / repro output (CLI 2.1.6)
$ python3 /home/home/p/g/n/claude-agent-sdk-python/examples/permission_callback_probe.py
====================================================================
Permission Callback Probe (Python SDK, live CLI)
====================================================================
Claude CLI: claude
Claude CLI version: 2.1.6 (Claude Code)
Prompt:
Use the Write tool to create a file with the exact path and content below.
file_path: /home/home/p/g/n/claude-agent-sdk-python/examples/_output/permissions_callback_probe.txt
content: hello from permissions probe
After the write completes, reply with exactly: WROTE
WROTE
FAILED:
- No can_use_tool callbacks observed from CLI control protocol.
Claude CLI version: 2.1.6 (Claude Code)
Why this matters
- Tool use is happening and the CLI completes the action, but no can_use_tool control callbacks are ever emitted, so
SDK
permission hooks never run.
- This blocks the SDK from enforcing/observing tool permissions even though the protocol says it should.
Questions
1. Is CLI 2.1.6 expected to emit control_request / can_use_tool callbacks when --permission-prompt-tool stdio is
set?
2. If yes, is this a known CLI regression?
3. If no, is the SDK’s permission callback feature ahead of the CLI and should be documented as not supported?
4. Is there a CLI flag or config required to enable these callbacks beyond --permission-prompt-tool stdio?
We need to confirm whether this is a CLI bug, a protocol mismatch, or a missing CLI flag.
● I'll help investigate this permission callback mismatch between the CLI and SDK. Let me start by examining the repro script and the SDK's control protocol implementation.
● Read(examples/permission_callback_probe.py)
⎿ Read 174 lines
● Read(src/claude_agent_sdk/_internal/transport/subprocess_cli.py)
⎿ Read 673 lines
● Search(pattern: "**/*control*protocol*.py")
⎿ Found 0 files
● Let me search for the control protocol implementation in the SDK.
● Search(pattern: "control_request|can_use_tool|control.*protocol", glob: "**/*.py")
⎿ Found 11 files (ctrl+o to expand)
● Search(pattern: "permission_prompt_tool|permission_mode", glob: "**/*.py")
⎿ Found 13 files (ctrl+o to expand)
● Read(src/claude_agent_sdk/_internal/client.py)
⎿ Read 125 lines
● Read(src/claude_agent_sdk/types.py)
⎿ Read 200 lines
⎿ API Error: 403 {"type":"error","error":{"type":"permission_error","message":"Permission
denied"},"request_id":"req_011CX4oGLtE9GArYL71aPBbj"} · Please run /login
now I am unable to use Claude Code at all. So it's a bug within a bug.