Managed agents silently muted: Claude Code sessions spawn in deny-by-default (dont-ask) permission mode with no owner-facing way to configure it

[santhoshguru]

Summary

After a Buzz Desktop restart on 2026-08-08, all managed Claude agents on this machine came up in Claude Code's "don't ask" permission mode: every tool call not matching the project allowlist is auto-denied with no prompt. Because buzz messages send runs through Bash, agents could not even post an error — from the human's side they simply went silent mid-conversation.

Timeline / correlation

• Agents had run for weeks with working tool access (model: opus[1m]).
• Owner switched most agents' model to claude-fable-5[1m] and did a full app restart the same day. The muting appeared immediately after.
• Hypothesis: the new runtime/model default is deny-by-default for headless sessions, and buzz-acp passes no permission configuration at spawn, so agents inherit whatever the runtime defaults to.

Evidence

• managed-agents.json has no permission-related field per agent (keys inspected: acp_command, agent_args, agent_command, ..., respond_to, runtime, model — nothing about permissions).
• agent_args is [] for every agent, and global-agent-config.json has no permission setting either — there is no owner-facing knob, UI or file, to set the Claude Code permission mode for a managed agent.
• Recovery was only possible because the shared workspace's .claude/settings.local.json allowlist is honored: adding Bash(buzz *) and similar rules restored function live, with no restart needed. An agent cannot self-repair: the harness (correctly) refuses agent edits to its own settings file, so a human must hand-edit it.

Impact

Silent total outage of all managed agents; looks to the human like the agent is ignoring them. Related family of issues where agent runtime behavior is not what the owner expects: #3858 (workflow events lack auth tag) and the respond_to sync bug reported earlier.

Request

1. Have buzz-acp pass an explicit, owner-visible permission mode (or generated allowlist) when spawning agent sessions, rather than inheriting runtime defaults.
2. Surface send failures: if an agent turn ends with its message-send tool denied, show an error in Desktop instead of nothing.
3. Document the interaction between managed agents and the workspace .claude/settings.local.json allowlist.

[wolfyy970]

The immediate regression is fixed in #5325. It stops forcing dontAsk, leaves the adapter in its default permission flow, and answers an offered allow_once request through the existing ACP harness. That restores the tool path without returning to blanket bypassPermissions.

The current head is mergeable and the production wire regression is green. #5106 is the larger owner-facing Ask, Allow and Reject control; it still needs its runtime validation before merge. #5270 covers the separate failure where a directly addressed turn ends successfully without publishing a reply.