Problem
The Claude Code desktop app's session-management MCP tool (mcp__ccd_session_mgmt__send_message) requires explicit user confirmation on every cross-session message, even when mcp__ccd_session_mgmt is in permissions.allow. There is no setting, flag, or env var to relax this (verified against current docs).
For a single-user machine running a coordinator-session pattern — one session reviewing, unblocking, and relaying findings between ~10 concurrent local sessions — this means the human must click through an approval for every relay. One coordination sweep today cost ~10 approval clicks, and the human is reduced to a button-pressing proxy for messages they asked the coordinator to send.
What I tried
permissions.allow: ["mcp__ccd_session_mgmt"] (server-wide rule) — permission layer passes, app-layer confirmation still appears on every send.- Native
SendMessage tool — cannot address independent desktop sessions (teammates/subagents only; verified empirically).
- Agent teams — prompt-free, but only within a spawned hierarchy; cannot bridge already-running standalone sessions.
Request
An opt-in trust mechanism for same-user, same-machine session messaging. Possible shapes:
- A setting like
trustedPeerSessions: true (analogous to the existing isolatePeerMachines semantics, which implies same-machine peer messaging was considered) that suppresses per-message approval for local sessions owned by the same user;
- or a per-session grant ("allow this session to message other sessions without asking"), so a designated coordinator can be trusted without trusting every session;
- or a permission-rule extension, e.g.
mcp__ccd_session_mgmt__send_message(to:local_*).
Security acknowledgment
I understand the confirmation exists as a prompt-injection firewall — without it, a compromised session could silently puppet others. An opt-in setting with clear provenance labeling on delivered messages (the existing "From {session}" attribution) and default-off behavior preserves that protection for everyone who doesn't explicitly choose the coordinator workflow. The per-session grant variant would keep the blast radius narrowest.
Environment
- Claude Code desktop app 2.1.209, macOS (darwin 25.3)
- Filed via Claude Code acting as the user's session coordinator, at the user's request
🤖 Generated with Claude Code
Problem
The Claude Code desktop app's session-management MCP tool (
mcp__ccd_session_mgmt__send_message) requires explicit user confirmation on every cross-session message, even whenmcp__ccd_session_mgmtis inpermissions.allow. There is no setting, flag, or env var to relax this (verified against current docs).For a single-user machine running a coordinator-session pattern — one session reviewing, unblocking, and relaying findings between ~10 concurrent local sessions — this means the human must click through an approval for every relay. One coordination sweep today cost ~10 approval clicks, and the human is reduced to a button-pressing proxy for messages they asked the coordinator to send.
What I tried
permissions.allow: ["mcp__ccd_session_mgmt"](server-wide rule) — permission layer passes, app-layer confirmation still appears on every send.SendMessagetool — cannot address independent desktop sessions (teammates/subagents only; verified empirically).Request
An opt-in trust mechanism for same-user, same-machine session messaging. Possible shapes:
trustedPeerSessions: true(analogous to the existingisolatePeerMachinessemantics, which implies same-machine peer messaging was considered) that suppresses per-message approval for local sessions owned by the same user;mcp__ccd_session_mgmt__send_message(to:local_*).Security acknowledgment
I understand the confirmation exists as a prompt-injection firewall — without it, a compromised session could silently puppet others. An opt-in setting with clear provenance labeling on delivered messages (the existing "From {session}" attribution) and default-off behavior preserves that protection for everyone who doesn't explicitly choose the coordinator workflow. The per-session grant variant would keep the blast radius narrowest.
Environment
🤖 Generated with Claude Code