feat(provider): add Claude SDK "auto" permission mode as 4th runtime mode - #137
Merged
Conversation
…mode Expose the Claude Agent SDK's native permissionMode "auto" as a fourth RuntimeMode. The SDK's model classifier auto-approves safe tool calls while still gating risky ones; allowDangerouslySkipPermissions is never set. Includes a security guard so "auto" selected on a Codex thread maps to the conservative on-request/workspace-write policy instead of falling through to danger-full-access, and a mobile label fix so an auto thread isn't shown as "Full access". Server-side actor authorization is unchanged and remains mode-independent. Closes #135 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
github-actions
Bot
added
vouch:trusted
Add a buildThreadStartParams assertion that runtimeMode "auto" maps to the conservative on-request/workspace-write policy (not the danger default), closing the thread-start coverage gap alongside the existing turn-start test. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…o-permission-mode
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #135.
What
Adds the Claude Agent SDK's native
permissionMode: "auto"as a 4th runtime permission mode alongsideapproval-required,auto-accept-edits, andfull-access."auto"lets the SDK's model classifier auto-approve safe tool calls while still gating risky ones — a middle rung between ask/plan and full yolo. NoallowDangerouslySkipPermissionsis set. Reimplemented natively (not cherry-picked from upstream pingdotgg#3628).Changes
packages/contracts/src/orchestration.ts— add"auto"to theRuntimeModeliteral (single source of truth).DEFAULT_RUNTIME_MODEunchanged (full-access).apps/server/src/provider/Layers/ClaudeAdapter.ts— map"auto" → permissionMode: "auto".allowDangerouslySkipPermissionsstays unset (onlyfull-access/bypassPermissionssets it).apps/web/src/components/chat/ChatComposer.tsx+CompactComposerControlsMenu.tsx— add "Auto" to both permission-mode pickers.apps/server/src/provider/Layers/CodexSessionRuntime.ts— security guard: the web picker isn't engine-filtered, so "auto" can be selected on a Codex thread. Without an explicitcase "auto":it would fall intodefault:=danger-full-access/approvalPolicy: "never". Addedcase "auto":(stacked withauto-accept-edits) in both the thread-config and turn-sandbox switches, so Codex treats "auto" as the conservativeon-request/workspace-writepolicy.apps/mobile/.../ThreadComposer.tsx+NewTaskDraftScreen.tsx— fix the runtime-mode subtitle so an "auto" thread isn't mislabeled "Full access" (display-only; mobile still can't select auto — out of scope).ClaudeAdapter.test.ts(auto →permissionMode: "auto",allowDangerouslySkipPermissions === undefined),CodexSessionRuntime.test.ts(auto → conservative policy — guards the security case).Security / interaction with authz
=== "full-access"/=== "approval-required"), so "auto" lands in their existing conservative "ask" branch by construction — other engines unaffected.checkActorAuthorization(commandInvariants.ts) gates commands by actor/session-role with zeroruntimeModeconditional. A server-denied command is denied identically under "auto" as any other mode; a thread-scoped session still cannot self-approve.canUseToolgate, so those calls won't appear in GITS's local approval audit trail. This is inherent to what the issue asked for ("let the SDK auto-approve safe tool calls"); structural server authz and confinement (git-shim, allowed-root) still apply regardless of SDK mode.Verification
turbo run typecheck --force) 14/14 packages;ClaudeAdapter.test.ts64/64;CodexSessionRuntime.test.ts18/18; oxlint/oxfmt clean on touched paths.allowDangerouslySkipPermissionsnever set, Codex/Cursor/OpenCode all safe, authz mode-independent. Two review findings fixed (Codex "auto" test + mobile mislabel).runtime_mode = "auto"through the real command→event→projection pipeline; other modes still round-trip.commandInvariants.test.ts16/16 — server authz provably mode-independent.claude-sonnet-4-6turn in auto mode ran a read-only tool call auto-approved by the SDK classifier with no GITS approval prompt, correct result, real API cost — confirming SDK-native auto behavior end-to-end.Caveat (follow-up candidate, not blocking)
The SDK enforces its own per-model gate:
claude-opus-4-8rejectspermissionMode: "auto"with"auto mode unavailable for this model"(surfaced as the thread'slast_error; the string originates in the vendored SDK binary, not this code). A nice follow-up would be to surface that gracefully in the UI (or disable "auto" in the picker for models that don't support it) so it doesn't read as a silent failure. Also deferred: exposing "auto" as a selectable option in the mobile composer (this PR only fixes the mobile label).