@shipit-ai/cli 1.166.2 → 1.167.1

package/dist/src/presentation/web/app/actions/agent-permissions.js

@@ -0,0 +1,181 @@
+'use server';
+import { resolve } from '../../lib/server-container.js';
+import { updateSettings as updateSettingsSingleton } from '../../../../../packages/core/src/infrastructure/services/settings.service.js';
+import { revalidatePath } from 'next/cache';
+import { AgentType, ClaudeCodePermissionMode, CursorPermissionMode, GeminiPermissionMode, CodexPermissionMode, CopilotPermissionMode, RovoDevPermissionMode, } from '../../../../../packages/core/src/domain/generated/output.js';
+const VALID_MODES = {
+    [AgentType.ClaudeCode]: [
+        {
+            value: ClaudeCodePermissionMode.BypassPermissions,
+            label: 'Bypass permissions',
+            description: 'Skip all permission checks. Fastest for batch runs.',
+            batchSafe: true,
+        },
+        {
+            value: ClaudeCodePermissionMode.AcceptEdits,
+            label: 'Accept edits',
+            description: 'Auto-approve file edits; prompt for shell/network.',
+            batchSafe: false,
+        },
+        {
+            value: ClaudeCodePermissionMode.Plan,
+            label: 'Plan',
+            description: 'Read-only; proposes changes without acting.',
+            batchSafe: false,
+        },
+        {
+            value: ClaudeCodePermissionMode.Default,
+            label: 'Default',
+            description: 'Prompt for everything except reads.',
+            batchSafe: false,
+        },
+    ],
+    [AgentType.Cursor]: [
+        {
+            value: CursorPermissionMode.Yolo,
+            label: 'Yolo',
+            description: 'Write files and execute commands autonomously.',
+            batchSafe: true,
+        },
+        {
+            value: CursorPermissionMode.Propose,
+            label: 'Propose',
+            description: 'Read and analyze; output a diff without writing.',
+            batchSafe: true,
+        },
+    ],
+    [AgentType.GeminiCli]: [
+        {
+            value: GeminiPermissionMode.Yolo,
+            label: 'Yolo',
+            description: 'Auto-approve all tool calls.',
+            batchSafe: true,
+        },
+        {
+            value: GeminiPermissionMode.AutoEdit,
+            label: 'Auto-edit',
+            description: 'Auto-approve edits; prompt for shell.',
+            batchSafe: false,
+        },
+        {
+            value: GeminiPermissionMode.Default,
+            label: 'Default',
+            description: 'Prompt for every tool call.',
+            batchSafe: false,
+        },
+    ],
+    [AgentType.CodexCli]: [
+        {
+            value: CodexPermissionMode.DangerFullAccess,
+            label: 'Full access',
+            description: 'No sandbox. Unrestricted access.',
+            batchSafe: true,
+        },
+        {
+            value: CodexPermissionMode.WorkspaceWrite,
+            label: 'Workspace write',
+            description: 'Writes inside worktree, no network.',
+            batchSafe: true,
+        },
+        {
+            value: CodexPermissionMode.ReadOnly,
+            label: 'Read only',
+            description: 'Cannot modify anything.',
+            batchSafe: true,
+        },
+    ],
+    [AgentType.CopilotCli]: [
+        {
+            value: CopilotPermissionMode.Yolo,
+            label: 'Yolo',
+            description: 'Disable all permission prompts.',
+            batchSafe: true,
+        },
+        {
+            value: CopilotPermissionMode.AllowPaths,
+            label: 'Allow paths',
+            description: 'Filesystem access auto-approved; shell prompts.',
+            batchSafe: false,
+        },
+        {
+            value: CopilotPermissionMode.Prompt,
+            label: 'Prompt',
+            description: 'Built-in tool category defaults.',
+            batchSafe: false,
+        },
+    ],
+    [AgentType.RovoDev]: [
+        {
+            value: RovoDevPermissionMode.Yolo,
+            label: 'Yolo',
+            description: 'Bypass all prompts.',
+            batchSafe: true,
+        },
+        {
+            value: RovoDevPermissionMode.Shadow,
+            label: 'Shadow',
+            description: 'Temporary workspace clone. Experimental.',
+            batchSafe: false,
+        },
+        {
+            value: RovoDevPermissionMode.Config,
+            label: 'Config',
+            description: 'Respect ~/.rovodev/config.yml settings.',
+            batchSafe: false,
+        },
+    ],
+};
+/** Agent type to AgentPermissionSettings key mapping */
+const AGENT_TYPE_TO_PERMISSION_KEY = {
+    [AgentType.ClaudeCode]: 'claudeCode',
+    [AgentType.Cursor]: 'cursor',
+    [AgentType.GeminiCli]: 'geminiCli',
+    [AgentType.CodexCli]: 'codexCli',
+    [AgentType.CopilotCli]: 'copilotCli',
+    [AgentType.RovoDev]: 'rovoDev',
+};
+export async function getAgentPermissionOptions(agentType) {
+    return VALID_MODES[agentType] ?? [];
+}
+export async function getCurrentAgentPermissionMode(agentType) {
+    const loadUseCase = resolve('LoadSettingsUseCase');
+    const settings = await loadUseCase.execute();
+    const key = AGENT_TYPE_TO_PERMISSION_KEY[agentType];
+    if (!key)
+        return undefined;
+    return settings.agent?.permissions?.[key];
+}
+export async function setAgentPermissionMode(agentType, mode) {
+    try {
+        const key = AGENT_TYPE_TO_PERMISSION_KEY[agentType];
+        if (!key) {
+            return { success: false, error: `Unsupported agent type: ${agentType}` };
+        }
+        const modes = VALID_MODES[agentType];
+        if (!modes?.some((m) => m.value === mode)) {
+            return { success: false, error: `Invalid permission mode: ${mode}` };
+        }
+        const loadUseCase = resolve('LoadSettingsUseCase');
+        const current = await loadUseCase.execute();
+        const updatedSettings = {
+            ...current,
+            agent: {
+                ...current.agent,
+                permissions: {
+                    ...current.agent?.permissions,
+                    [key]: mode,
+                },
+            },
+            updatedAt: new Date(),
+        };
+        const updateUseCase = resolve('UpdateSettingsUseCase');
+        await updateUseCase.execute(updatedSettings);
+        updateSettingsSingleton(updatedSettings);
+        revalidatePath('/', 'layout');
+        return { success: true };
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : 'Failed to update permission mode';
+        return { success: false, error: message };
+    }
+}

package/dist/src/presentation/web/app/actions/check-agent-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"check-agent-auth.d.ts","sourceRoot":"","sources":["../../../../../../src/presentation/web/app/actions/check-agent-auth.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,+CAA+C;IAC/C,SAAS,EAAE,OAAO,CAAC;IACnB,8CAA8C;IAC9C,aAAa,EAAE,OAAO,CAAC;IACvB,yCAAyC;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,gDAAgD;IAChD,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,0FAA0F;IAC1F,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,wDAAwD;IACxD,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AA+ID;;;GAGG;AACH,wBAAsB,cAAc,IAAI,OAAO,CAAC,eAAe,CAAC,CA4H/D"}
+{"version":3,"file":"check-agent-auth.d.ts","sourceRoot":"","sources":["../../../../../../src/presentation/web/app/actions/check-agent-auth.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,+CAA+C;IAC/C,SAAS,EAAE,OAAO,CAAC;IACnB,8CAA8C;IAC9C,aAAa,EAAE,OAAO,CAAC;IACvB,yCAAyC;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,gDAAgD;IAChD,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,0FAA0F;IAC1F,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,wDAAwD;IACxD,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AA4ID;;;GAGG;AACH,wBAAsB,cAAc,IAAI,OAAO,CAAC,eAAe,CAAC,CA4H/D"}

package/dist/src/presentation/web/app/actions/check-agent-auth.js

@@ -12,9 +12,6 @@ const AGENT_LABELS = {
     cursor: 'Cursor CLI',
     'gemini-cli': 'Gemini CLI',
     'rovo-dev': 'Rovo Dev CLI',
-    aider: 'Aider',
-    continue: 'Continue',
-    dev: 'Demo',
 };
 const AGENT_TOOL_MAP = {
     'claude-code': 'claude-code',
@@ -92,7 +89,7 @@ function tier1AuthCheck(agentType) {
             return existsSync(acliDir) ? 'file' : false;
         }
         default:
-            // dev, aider, continue — assume no auth needed
+            // Unknown agents — assume no auth needed
             return 'env-var';
     }
 }
@@ -169,7 +166,7 @@ export async function checkAgentAuth() {
     const label = AGENT_LABELS[agentType] ?? agentType;
     const toolId = AGENT_TOOL_MAP[agentType] ?? null;
     const binaryName = AGENT_BINARY_MAP[agentType] ?? null;
-    // Dev/demo agents — always good
+    // Agents without a tool mapping — always good
     if (!toolId) {
         return {
             agentType,

package/dist/src/presentation/web/app/actions/check-agent-tool.js

@@ -22,7 +22,7 @@ const AGENT_BINARY_MAP = {
 export async function checkAgentTool(agentType) {
     const toolId = AGENT_TOOL_MAP[agentType] ?? null;
     const binaryName = AGENT_BINARY_MAP[agentType] ?? null;
-    // Dev agent and unknown agents don't need a tool
+    // Agents without a tool mapping don't need a tool check
     if (!toolId) {
         return { agentType, toolId: null, tool: null, installed: true, binaryName: null };
     }

package/dist/src/presentation/web/app/actions/get-all-agent-models.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"get-all-agent-models.d.ts","sourceRoot":"","sources":["../../../../../../src/presentation/web/app/actions/get-all-agent-models.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,SAAS,EAAE,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;CACpB;AAoCD,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC,CAmDpE"}
+{"version":3,"file":"get-all-agent-models.d.ts","sourceRoot":"","sources":["../../../../../../src/presentation/web/app/actions/get-all-agent-models.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,SAAS,EAAE,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;CACpB;AAkCD,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC,CAsCpE"}

package/dist/src/presentation/web/app/actions/get-all-agent-models.js

@@ -8,9 +8,8 @@ const AGENT_LABELS = {
     cursor: 'Cursor CLI',
     'gemini-cli': 'Gemini CLI',
     'rovo-dev': 'Rovo Dev CLI',
-    dev: 'Demo',
 };
-/** Sort weight — higher = further down. Demo always last. */
+/** Sort weight — lower = further up in the list. */
 const AGENT_ORDER = {
     'claude-code': 0,
     'codex-cli': 1,
@@ -18,7 +17,6 @@ const AGENT_ORDER = {
     cursor: 3,
     'gemini-cli': 4,
     'rovo-dev': 5,
-    dev: 99,
 };
 /**
  * Maps agent types to their corresponding tool IDs for availability checks.
@@ -45,25 +43,12 @@ export async function getAllAgentModels() {
                 ...getModelMeta(id),
             })),
         }))
-            .map((g) => {
-            // Dev agent gets fun demo models
-            if (g.agentType === 'dev' && g.models.length === 0) {
-                return {
-                    ...g,
-                    models: [
-                        { id: 'gpt-8', ...getModelMeta('gpt-8') },
-                        { id: 'opus-7', ...getModelMeta('opus-7') },
-                    ],
-                };
-            }
-            return g;
-        })
             .filter((g) => g.models.length > 0);
         // Check which agents are actually installed
         const toolService = resolve('IToolInstallerService');
         const groupsWithStatus = await Promise.all(groups.map(async (group) => {
             const toolId = AGENT_TOOL_IDS[group.agentType];
-            if (!toolId || group.agentType === 'dev') {
+            if (!toolId) {
                 return { ...group, installed: true };
             }
             try {

package/dist/src/presentation/web/app/actions/get-merge-review-data.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"get-merge-review-data.d.ts","sourceRoot":"","sources":["../../../../../../src/presentation/web/app/actions/get-merge-review-data.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EACV,eAAe,EAEhB,MAAM,sDAAsD,CAAC;AAI9D,KAAK,wBAAwB,GAAG,eAAe,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAwDpE,wBAAsB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAuI7F"}
+{"version":3,"file":"get-merge-review-data.d.ts","sourceRoot":"","sources":["../../../../../../src/presentation/web/app/actions/get-merge-review-data.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EACV,eAAe,EAEhB,MAAM,sDAAsD,CAAC;AAI9D,KAAK,wBAAwB,GAAG,eAAe,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAwDpE,wBAAsB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,CAAC,CA4I7F"}

package/dist/src/presentation/web/app/actions/get-merge-review-data.js

@@ -130,6 +130,11 @@ export async function getMergeReviewData(featureId) {
                     isWithinRoot(resolvedEvidenceDir, resolvedHome)) {
                     const resolvedManifest = realpathOrNull(join(resolvedEvidenceDir, 'manifest.json'));
                     if (resolvedManifest && isWithinRoot(resolvedManifest, resolvedEvidenceDir)) {
+                        // SECURITY: resolvedManifest validated by realpathOrNull + isWithinRoot
+                        // containment on line 159. featureId flows through SHA-256 hash in
+                        // computeEvidenceDir (hex-only output neutralizes injection). Double
+                        // containment check: home dir → evidence dir → manifest. Alert
+                        // js/path-injection #27 dismissed as false positive.
                         const raw = JSON.parse(readFileSync(resolvedManifest, 'utf-8'));
                         // Pass the UNRESOLVED evidenceDir so returned paths share the
                         // same root form the evidence route's prefix check expects.

package/dist/src/presentation/web/app/actions/open-shell.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"open-shell.d.ts","sourceRoot":"","sources":["../../../../../../src/presentation/web/app/actions/open-shell.ts"],"names":[],"mappings":"AAmDA,UAAU,cAAc;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAsB,SAAS,CAC7B,KAAK,EAAE,cAAc,GACpB,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA2F9E"}
+{"version":3,"file":"open-shell.d.ts","sourceRoot":"","sources":["../../../../../../src/presentation/web/app/actions/open-shell.ts"],"names":[],"mappings":"AAmDA,UAAU,cAAc;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAsB,SAAS,CAC7B,KAAK,EAAE,cAAc,GACpB,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAgG9E"}

package/dist/src/presentation/web/app/actions/open-shell.js

@@ -77,6 +77,11 @@ export async function openShell(input) {
                         // shell treats as a single literal argument to `cd`.
                         const escapedPath = shellEscapePosixPath(targetPath);
                         const command = config.openDirectory.replaceAll('{dir}', escapedPath);
+                        // SECURITY: targetPath from realpathSync (must exist on disk); single-quote
+                        // shell-escaped via shellEscapePosixPath; localhost-only server action.
+                        // shell:true is required by tool configs using `cd {dir} && exec <tool>`.
+                        // CodeQL flags this because it does not model custom sanitizer functions —
+                        // alert js/command-line-injection #29 dismissed as false positive.
                         const child = spawn(command, [], {
                             detached: true,
                             stdio: 'ignore',

package/dist/src/presentation/web/components/common/base-drawer/base-drawer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"base-drawer.d.ts","sourceRoot":"","sources":["../../../../../../../src/presentation/web/components/common/base-drawer/base-drawer.tsx"],"names":[],"mappings":"AAIA,OAAO,EAAO,KAAK,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAiBlE,OAAO,EAAmB,KAAK,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAGpF,QAAA,MAAM,cAAc;;8EAWlB,CAAC;AAEH,MAAM,WAAW,eAAgB,SAAQ,YAAY,CAAC,OAAO,cAAc,CAAC;IAC1E,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,MAAM,IAAI,CAAC;IACpB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,yGAAyG;IACzG,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IACzB,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,MAAM,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,iBAAiB,CAAC;CAClC;AAED,wBAAgB,UAAU,CAAC,EACzB,IAAI,EACJ,OAAO,EACP,KAAa,EACb,qBAA6B,EAC7B,KAAgB,EAChB,IAAI,EACJ,MAAM,EACN,QAAQ,EACR,MAAM,EACN,SAAS,EACT,aAAa,EAAE,MAAM,EACrB,YAAY,GACb,EAAE,eAAe,2CAgJjB"}
+{"version":3,"file":"base-drawer.d.ts","sourceRoot":"","sources":["../../../../../../../src/presentation/web/components/common/base-drawer/base-drawer.tsx"],"names":[],"mappings":"AAIA,OAAO,EAAO,KAAK,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAiBlE,OAAO,EAAmB,KAAK,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAGpF,QAAA,MAAM,cAAc;;8EAWlB,CAAC;AAEH,MAAM,WAAW,eAAgB,SAAQ,YAAY,CAAC,OAAO,cAAc,CAAC;IAC1E,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,MAAM,IAAI,CAAC;IACpB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,yGAAyG;IACzG,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IACzB,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,MAAM,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,iBAAiB,CAAC;CAClC;AAED,wBAAgB,UAAU,CAAC,EACzB,IAAI,EACJ,OAAO,EACP,KAAa,EACb,qBAA6B,EAC7B,KAAgB,EAChB,IAAI,EACJ,MAAM,EACN,QAAQ,EACR,MAAM,EACN,SAAS,EACT,aAAa,EAAE,MAAM,EACrB,YAAY,GACb,EAAE,eAAe,2CAmLjB"}

package/dist/src/presentation/web/components/common/base-drawer/base-drawer.js

@@ -60,30 +60,64 @@ export function BaseDrawer({ open, onClose, modal = false, dismissOnOutsideClick
         return () => document.removeEventListener('keydown', handleKeyDown);
     }, [open, modal, onClose]);
     // Close when clicking outside the drawer panel (no overlay needed — canvas stays draggable).
-    // Uses `click` (not `pointerdown`) so canvas drags don't trigger this.
+    //
+    // Uses `click` (not `pointerdown`) as the trigger so canvas drags don't close the drawer,
+    // but tracks the `pointerdown` target separately. When the user presses the mouse on an
+    // in-drawer control that opens a portaled popover (Radix Select, DropdownMenu, Popover),
+    // Radix calls preventDefault on pointerdown and opens its portal over the trigger. By
+    // the time pointerup fires, the cursor is over the portal overlay, and Chrome computes
+    // the `click` event's target as the common ancestor of pointerdown/pointerup — which is
+    // `<body>` because the portal is detached from the drawer subtree. Without tracking the
+    // pointerdown origin we would misread this as an outside click and close the drawer.
     useEffect(() => {
         if (!open || modal)
             return;
+        // When dismissOnOutsideClick is false (default), also respect data-no-drawer-close guards.
+        const ignoreSelector = dismissOnOutsideClick
+            ? '[role="alertdialog"], [role="dialog"], [role="menu"], [role="listbox"], [data-radix-popper-content-wrapper]'
+            : '[data-no-drawer-close], [role="alertdialog"], [role="dialog"], [role="menu"], [role="listbox"], [data-radix-popper-content-wrapper]';
+        /** True when `el` is inside the drawer or an explicitly-ignored overlay. */
+        const isInsideOrIgnored = (el) => {
+            if (!el)
+                return false;
+            if (contentRef.current?.contains(el))
+                return true;
+            if (el.closest(ignoreSelector))
+                return true;
+            return false;
+        };
+        // Track the most recent pointerdown target so the click handler can check
+        // where the gesture ORIGINATED, not just where it landed.
+        let pointerDownOrigin = null;
+        const handlePointerDown = (e) => {
+            pointerDownOrigin = e.target;
+        };
         const handleClick = (e) => {
+            const origin = pointerDownOrigin;
+            // Clear for the next gesture regardless of outcome.
+            pointerDownOrigin = null;
             const target = e.target;
             // If the clicked element was unmounted by React before the event reached
             // the document (e.g. a "Next" button removed on the last step), it is no
             // longer in the DOM tree — treat it as an internal click, not an outside one.
             if (!document.body.contains(target))
                 return;
-            if (contentRef.current?.contains(target))
+            // Click landed inside the drawer or a protected overlay.
+            if (isInsideOrIgnored(target))
                 return;
-            // Don't close when clicking inside Radix overlays.
-            // When dismissOnOutsideClick is false (default), also respect data-no-drawer-close guards.
-            const ignoreSelector = dismissOnOutsideClick
-                ? '[role="alertdialog"], [role="dialog"], [role="menu"], [role="listbox"], [data-radix-popper-content-wrapper]'
-                : '[data-no-drawer-close], [role="alertdialog"], [role="dialog"], [role="menu"], [role="listbox"], [data-radix-popper-content-wrapper]';
-            if (target.closest(ignoreSelector))
+            // Click landed outside, but the gesture ORIGINATED inside the drawer or a
+            // protected overlay (e.g. a Radix Select trigger whose portal stole the
+            // pointerup target). This is not a real outside click — bail out.
+            if (isInsideOrIgnored(origin))
                 return;
             onClose();
         };
+        document.addEventListener('pointerdown', handlePointerDown, true);
         document.addEventListener('click', handleClick);
-        return () => document.removeEventListener('click', handleClick);
+        return () => {
+            document.removeEventListener('pointerdown', handlePointerDown, true);
+            document.removeEventListener('click', handleClick);
+        };
     }, [open, modal, onClose, dismissOnOutsideClick]);
     return (_jsxs(Drawer, { direction: drawerDirection, modal: modal, handleOnly: true, open: open, onOpenChange: (isOpen) => {
             if (!isOpen)

package/dist/src/presentation/web/components/common/feature-create-drawer/feature-create-drawer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"feature-create-drawer.d.ts","sourceRoot":"","sources":["../../../../../../../src/presentation/web/components/common/feature-create-drawer/feature-create-drawer.tsx"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AAM5E,OAAO,KAAK,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAC;AAE3F,YAAY,EAAE,cAAc,EAAE,MAAM,6DAA6D,CAAC;AAClG,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAC9C,YAAY,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,CAAC;AAC5E,YAAY,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAE3D,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,MAAM,IAAI,CAAC;IACpB,QAAQ,EAAE,CAAC,IAAI,EAAE,oBAAoB,KAAK,IAAI,CAAC;IAC/C,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,qEAAqE;IACrE,QAAQ,CAAC,EAAE,mBAAmB,EAAE,CAAC;IACjC,+EAA+E;IAC/E,YAAY,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAClC,kGAAkG;IAClG,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,8CAA8C;IAC9C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,yCAAyC;IACzC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,yEAAyE;IACzE,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,wBAAgB,mBAAmB,CAAC,EAClC,IAAI,EACJ,OAAO,EACP,QAAQ,EACR,cAAc,EACd,YAAoB,EACpB,gBAAgB,EAChB,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,kBAAkB,EAClB,eAAe,GAChB,EAAE,wBAAwB,2CA6L1B"}
+{"version":3,"file":"feature-create-drawer.d.ts","sourceRoot":"","sources":["../../../../../../../src/presentation/web/components/common/feature-create-drawer/feature-create-drawer.tsx"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AAM5E,OAAO,KAAK,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAC;AAE3F,YAAY,EAAE,cAAc,EAAE,MAAM,6DAA6D,CAAC;AAClG,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAC9C,YAAY,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,CAAC;AAC5E,YAAY,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAE3D,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,MAAM,IAAI,CAAC;IACpB,QAAQ,EAAE,CAAC,IAAI,EAAE,oBAAoB,KAAK,IAAI,CAAC;IAC/C,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,qEAAqE;IACrE,QAAQ,CAAC,EAAE,mBAAmB,EAAE,CAAC;IACjC,+EAA+E;IAC/E,YAAY,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAClC,kGAAkG;IAClG,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,8CAA8C;IAC9C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,yCAAyC;IACzC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,yEAAyE;IACzE,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,wBAAgB,mBAAmB,CAAC,EAClC,IAAI,EACJ,OAAO,EACP,QAAQ,EACR,cAAc,EACd,YAAoB,EACpB,gBAAgB,EAChB,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,kBAAkB,EAClB,eAAe,GAChB,EAAE,wBAAwB,2CAgM1B"}

package/dist/src/presentation/web/components/common/feature-create-drawer/feature-create-drawer.js

@@ -46,5 +46,5 @@ export function FeatureCreateDrawer({ open, onClose, onSubmit, repositoryPath, i
                                         form.validRepoPath.split('/').pop() })] })) : null, _jsx(PromptSection, { description: form.description, onDescriptionChange: form.setDescription, attachments: form.attachments, onRemoveFile: form.handleRemoveFile, onNotesChange: form.handleNotesChange, onPaste: form.handlePaste, onDragEnter: form.handleDragEnter, onDragLeave: form.handleDragLeave, onDragOver: form.handleDragOver, onDrop: form.handleDrop, onAddFiles: form.handleAddFiles, isDragOver: form.isDragOver, uploadError: form.uploadError, isPromptFocused: form.isPromptFocused, onPromptFocus: () => form.setIsPromptFocused(true), onPromptBlur: () => form.setIsPromptFocused(false), fast: form.fast, onFastChange: form.setFast, pending: form.pending, onPendingChange: form.setPending, overrideAgent: form.overrideAgent, overrideModel: form.overrideModel, currentAgentType: currentAgentType, currentModel: currentModel, onAgentModelChange: (agent, model) => {
                                 form.setOverrideAgent(agent);
                                 form.setOverrideModel(model);
-                            }, isSubmitting: isSubmitting }), hasFeatures && initialParentId !== undefined ? (_jsxs("div", { className: "flex flex-col gap-1.5", children: [_jsx(Label, { htmlFor: "parent-feature", className: "text-muted-foreground text-xs font-semibold tracking-wider", children: t('createDrawer.parentFeature') }), _jsx(ParentFeatureCombobox, { features: features, value: form.parentId, onChange: form.setParentId, disabled: isSubmitting })] })) : null, _jsx(WorkflowOptionsSection, { approvalGates: form.approvalGates, onApprovalGatesChange: form.setApprovalGates, enableEvidence: form.enableEvidence, onEnableEvidenceChange: form.setEnableEvidence, commitEvidence: form.commitEvidence, onCommitEvidenceChange: form.setCommitEvidence, push: form.push, onPushChange: form.setPush, openPr: form.openPr, onOpenPrChange: form.setOpenPr, ciWatchEnabled: form.ciWatchEnabled, onCiWatchChange: form.setCiWatchEnabled, rebaseBeforeBranch: form.rebaseBeforeBranch, onRebaseBeforeBranchChange: form.setRebaseBeforeBranch, commitSpecs: form.commitSpecs, onCommitSpecsChange: form.setCommitSpecs, forkAndPr: form.forkAndPr, onForkAndPrChange: form.setForkAndPr, canPush: form.canPush, fast: form.fast, computedPush: form.computedPush, computedOpenPr: form.computedOpenPr, isSubmitting: isSubmitting })] }) }) }) }));
+                            }, isSubmitting: isSubmitting }), hasFeatures && initialParentId !== undefined ? (_jsxs("div", { className: "flex flex-col gap-1.5", children: [_jsx(Label, { htmlFor: "parent-feature", className: "text-muted-foreground text-xs font-semibold tracking-wider", children: t('createDrawer.parentFeature') }), _jsx(ParentFeatureCombobox, { features: features, value: form.parentId, onChange: form.setParentId, disabled: isSubmitting })] })) : null, _jsx(WorkflowOptionsSection, { approvalGates: form.approvalGates, onApprovalGatesChange: form.setApprovalGates, enableEvidence: form.enableEvidence, onEnableEvidenceChange: form.setEnableEvidence, commitEvidence: form.commitEvidence, onCommitEvidenceChange: form.setCommitEvidence, push: form.push, onPushChange: form.setPush, openPr: form.openPr, onOpenPrChange: form.setOpenPr, ciWatchEnabled: form.ciWatchEnabled, onCiWatchChange: form.setCiWatchEnabled, rebaseBeforeBranch: form.rebaseBeforeBranch, onRebaseBeforeBranchChange: form.setRebaseBeforeBranch, commitSpecs: form.commitSpecs, onCommitSpecsChange: form.setCommitSpecs, forkAndPr: form.forkAndPr, onForkAndPrChange: form.setForkAndPr, canPush: form.canPush, fast: form.fast, computedPush: form.computedPush, computedOpenPr: form.computedOpenPr, isSubmitting: isSubmitting, agentType: form.overrideAgent ?? currentAgentType, permissionMode: form.permissionMode, onPermissionModeChange: form.setPermissionMode })] }) }) }) }));
 }

package/dist/src/presentation/web/components/common/feature-create-drawer/types.d.ts

@@ -50,6 +50,8 @@ export interface FeatureCreatePayload {
     agentType?: string;
     /** Optional model override for this feature run */
     model?: string;
+    /** Optional per-feature permission mode override (overrides agent default from settings) */
+    permissionMode?: string;
     sessionId?: string;
 }
 //# sourceMappingURL=types.d.ts.map

package/dist/src/presentation/web/components/common/feature-create-drawer/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../../src/presentation/web/components/common/feature-create-drawer/types.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,cAAc,EAAE,MAAM,6DAA6D,CAAC;AAElG,uFAAuF;AACvF,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,wDAAwD;IACxD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,0DAA0D;AAC1D,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CACd;AAED,iEAAiE;AACjE,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,oBAAoB;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,cAAc,EAAE,CAAC;IAC9B,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE;QACb,QAAQ,EAAE,OAAO,CAAC;QAClB,SAAS,EAAE,OAAO,CAAC;QACnB,UAAU,EAAE,OAAO,CAAC;KACrB,CAAC;IACF,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,cAAc,EAAE,OAAO,CAAC;IACxB,cAAc,EAAE,OAAO,CAAC;IACxB,cAAc,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,IAAI,EAAE,OAAO,CAAC;IACd,yEAAyE;IACzE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,yDAAyD;IACzD,SAAS,EAAE,OAAO,CAAC;IACnB,uFAAuF;IACvF,WAAW,EAAE,OAAO,CAAC;IACrB,gFAAgF;IAChF,kBAAkB,EAAE,OAAO,CAAC;IAC5B,wDAAwD;IACxD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mDAAmD;IACnD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../../src/presentation/web/components/common/feature-create-drawer/types.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,cAAc,EAAE,MAAM,6DAA6D,CAAC;AAElG,uFAAuF;AACvF,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,wDAAwD;IACxD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,0DAA0D;AAC1D,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CACd;AAED,iEAAiE;AACjE,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,oBAAoB;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,cAAc,EAAE,CAAC;IAC9B,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE;QACb,QAAQ,EAAE,OAAO,CAAC;QAClB,SAAS,EAAE,OAAO,CAAC;QACnB,UAAU,EAAE,OAAO,CAAC;KACrB,CAAC;IACF,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,cAAc,EAAE,OAAO,CAAC;IACxB,cAAc,EAAE,OAAO,CAAC;IACxB,cAAc,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,IAAI,EAAE,OAAO,CAAC;IACd,yEAAyE;IACzE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,yDAAyD;IACzD,SAAS,EAAE,OAAO,CAAC;IACnB,uFAAuF;IACvF,WAAW,EAAE,OAAO,CAAC;IACrB,gFAAgF;IAChF,kBAAkB,EAAE,OAAO,CAAC;IAC5B,wDAAwD;IACxD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mDAAmD;IACnD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4FAA4F;IAC5F,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB"}

package/dist/src/presentation/web/components/common/feature-create-drawer/use-feature-create-form.d.ts

@@ -50,6 +50,8 @@ export declare function useFeatureCreateForm({ open, onClose, onSubmit, reposito
     setOverrideAgent: import("react").Dispatch<import("react").SetStateAction<string | undefined>>;
     overrideModel: string | undefined;
     setOverrideModel: import("react").Dispatch<import("react").SetStateAction<string | undefined>>;
+    permissionMode: string | undefined;
+    setPermissionMode: import("react").Dispatch<import("react").SetStateAction<string | undefined>>;
     selectedRepoPath: string | undefined;
     setSelectedRepoPath: import("react").Dispatch<import("react").SetStateAction<string | undefined>>;
     localRepos: RepositoryOption[];

package/dist/src/presentation/web/components/common/feature-create-drawer/use-feature-create-form.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"use-feature-create-form.d.ts","sourceRoot":"","sources":["../../../../../../../src/presentation/web/components/common/feature-create-drawer/use-feature-create-form.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AAE5E,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAC;AAyEtF,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,MAAM,IAAI,CAAC;IACpB,QAAQ,EAAE,CAAC,IAAI,EAAE,oBAAoB,KAAK,IAAI,CAAC;IAC/C,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,YAAY,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAClC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,wBAAgB,oBAAoB,CAAC,EACnC,IAAI,EACJ,OAAO,EACP,QAAQ,EACR,cAAc,EACd,gBAAgB,EAChB,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,kBAAkB,EAClB,eAAe,GAChB,EAAE,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4BAwJuB,IAAI,EAAE;yBA8Df,KAAK,CAAC,SAAS;yBASf,KAAK,CAAC,SAAS;wBAShB,KAAK,CAAC,SAAS;oBAMhD,KAAK,CAAC,SAAS;qBAef,KAAK,CAAC,cAAc;sBAqBpB,KAAK,CAAC,SAAS,CAAC,eAAe,CAAC;;2BA6GI,MAAM;4BAIL,MAAM,SAAS,MAAM;;EA2EjE"}
+{"version":3,"file":"use-feature-create-form.d.ts","sourceRoot":"","sources":["../../../../../../../src/presentation/web/components/common/feature-create-drawer/use-feature-create-form.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AAE5E,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAC;AAyEtF,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,MAAM,IAAI,CAAC;IACpB,QAAQ,EAAE,CAAC,IAAI,EAAE,oBAAoB,KAAK,IAAI,CAAC;IAC/C,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,YAAY,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAClC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,wBAAgB,oBAAoB,CAAC,EACnC,IAAI,EACJ,OAAO,EACP,QAAQ,EACR,cAAc,EACd,gBAAgB,EAChB,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,kBAAkB,EAClB,eAAe,GAChB,EAAE,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4BA0JuB,IAAI,EAAE;yBA8Df,KAAK,CAAC,SAAS;yBASf,KAAK,CAAC,SAAS;wBAShB,KAAK,CAAC,SAAS;oBAMhD,KAAK,CAAC,SAAS;qBAef,KAAK,CAAC,cAAc;sBAqBpB,KAAK,CAAC,SAAS,CAAC,eAAe,CAAC;;2BA+GI,MAAM;4BAIL,MAAM,SAAS,MAAM;;EA6EjE"}

package/dist/src/presentation/web/components/common/feature-create-drawer/use-feature-create-form.js

@@ -111,6 +111,7 @@ export function useFeatureCreateForm({ open, onClose, onSubmit, repositoryPath,
     const [rebaseBeforeBranch, setRebaseBeforeBranch] = useState(true);
     const [overrideAgent, setOverrideAgent] = useState(undefined);
     const [overrideModel, setOverrideModel] = useState(undefined);
+    const [permissionMode, setPermissionMode] = useState(undefined);
     const [selectedRepoPath, setSelectedRepoPath] = useState(validRepoPath || undefined);
     const [localRepos, setLocalRepos] = useState(repositories ?? []);
     const [isDragOver, setIsDragOver] = useState(false);
@@ -185,6 +186,7 @@ export function useFeatureCreateForm({ open, onClose, onSubmit, repositoryPath,
         setRebaseBeforeBranch(true);
         setOverrideAgent(undefined);
         setOverrideModel(undefined);
+        setPermissionMode(undefined);
         setUploadError(null);
         dragCounterRef.current = 0;
         setIsDragOver(false);
@@ -334,6 +336,7 @@ export function useFeatureCreateForm({ open, onClose, onSubmit, repositoryPath,
             ...(pending ? { pending } : {}),
             ...(overrideAgent ? { agentType: overrideAgent } : {}),
             ...(overrideModel ? { model: overrideModel } : {}),
+            ...(permissionMode ? { permissionMode } : {}),
             ...(parentId ? { parentId } : {}),
             sessionId: sessionIdRef.current,
         });
@@ -357,6 +360,7 @@ export function useFeatureCreateForm({ open, onClose, onSubmit, repositoryPath,
         pending,
         overrideAgent,
         overrideModel,
+        permissionMode,
         parentId,
         createSound,
         resetForm,
@@ -456,6 +460,8 @@ export function useFeatureCreateForm({ open, onClose, onSubmit, repositoryPath,
         setOverrideAgent,
         overrideModel,
         setOverrideModel,
+        permissionMode,
+        setPermissionMode,
         selectedRepoPath,
         setSelectedRepoPath,
         localRepos,

package/dist/src/presentation/web/components/common/feature-create-drawer/workflow-options-section.d.ts

@@ -22,6 +22,12 @@ export interface WorkflowOptionsSectionProps {
     computedPush: boolean;
     computedOpenPr: boolean;
     isSubmitting: boolean;
+    /** Currently selected agent type (for permission mode options) */
+    agentType?: string;
+    /** Selected per-feature permission mode override */
+    permissionMode?: string;
+    /** Callback when permission mode changes */
+    onPermissionModeChange?: (mode: string | undefined) => void;
 }
-export declare function WorkflowOptionsSection({ approvalGates, onApprovalGatesChange, enableEvidence, onEnableEvidenceChange, commitEvidence, onCommitEvidenceChange, push: _push, onPushChange, openPr, onOpenPrChange, ciWatchEnabled, onCiWatchChange, rebaseBeforeBranch, onRebaseBeforeBranchChange, commitSpecs, onCommitSpecsChange, forkAndPr, onForkAndPrChange, canPush, fast, computedPush, computedOpenPr, isSubmitting, }: WorkflowOptionsSectionProps): import("react/jsx-runtime").JSX.Element;
+export declare function WorkflowOptionsSection({ approvalGates, onApprovalGatesChange, enableEvidence, onEnableEvidenceChange, commitEvidence, onCommitEvidenceChange, push: _push, onPushChange, openPr, onOpenPrChange, ciWatchEnabled, onCiWatchChange, rebaseBeforeBranch, onRebaseBeforeBranchChange, commitSpecs, onCommitSpecsChange, forkAndPr, onForkAndPrChange, canPush, fast, computedPush, computedOpenPr, isSubmitting, agentType, permissionMode, onPermissionModeChange, }: WorkflowOptionsSectionProps): import("react/jsx-runtime").JSX.Element;
 //# sourceMappingURL=workflow-options-section.d.ts.map

package/dist/src/presentation/web/components/common/feature-create-drawer/workflow-options-section.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workflow-options-section.d.ts","sourceRoot":"","sources":["../../../../../../../src/presentation/web/components/common/feature-create-drawer/workflow-options-section.tsx"],"names":[],"mappings":"AAWA,MAAM,WAAW,2BAA2B;IAC1C,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,qBAAqB,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IAChE,cAAc,EAAE,OAAO,CAAC;IACxB,sBAAsB,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;IACjD,cAAc,EAAE,OAAO,CAAC;IACxB,sBAAsB,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;IACjD,IAAI,EAAE,OAAO,CAAC;IACd,YAAY,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;IACvC,MAAM,EAAE,OAAO,CAAC;IAChB,cAAc,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;IACzC,cAAc,EAAE,OAAO,CAAC;IACxB,eAAe,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;IAC1C,kBAAkB,EAAE,OAAO,CAAC;IAC5B,0BAA0B,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;IACrD,WAAW,EAAE,OAAO,CAAC;IACrB,mBAAmB,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;IAC9C,SAAS,EAAE,OAAO,CAAC;IACnB,iBAAiB,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;IAC5C,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,OAAO,CAAC;IACd,YAAY,EAAE,OAAO,CAAC;IACtB,cAAc,EAAE,OAAO,CAAC;IACxB,YAAY,EAAE,OAAO,CAAC;CACvB;AAED,wBAAgB,sBAAsB,CAAC,EACrC,aAAa,EACb,qBAAqB,EACrB,cAAc,EACd,sBAAsB,EACtB,cAAc,EACd,sBAAsB,EACtB,IAAI,EAAE,KAAK,EACX,YAAY,EACZ,MAAM,EACN,cAAc,EACd,cAAc,EACd,eAAe,EACf,kBAAkB,EAClB,0BAA0B,EAC1B,WAAW,EACX,mBAAmB,EACnB,SAAS,EACT,iBAAiB,EACjB,OAAO,EACP,IAAI,EACJ,YAAY,EACZ,cAAc,EACd,YAAY,GACb,EAAE,2BAA2B,2CA4S7B"}
+{"version":3,"file":"workflow-options-section.d.ts","sourceRoot":"","sources":["../../../../../../../src/presentation/web/components/common/feature-create-drawer/workflow-options-section.tsx"],"names":[],"mappings":"AAoBA,MAAM,WAAW,2BAA2B;IAC1C,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,qBAAqB,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IAChE,cAAc,EAAE,OAAO,CAAC;IACxB,sBAAsB,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;IACjD,cAAc,EAAE,OAAO,CAAC;IACxB,sBAAsB,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;IACjD,IAAI,EAAE,OAAO,CAAC;IACd,YAAY,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;IACvC,MAAM,EAAE,OAAO,CAAC;IAChB,cAAc,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;IACzC,cAAc,EAAE,OAAO,CAAC;IACxB,eAAe,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;IAC1C,kBAAkB,EAAE,OAAO,CAAC;IAC5B,0BAA0B,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;IACrD,WAAW,EAAE,OAAO,CAAC;IACrB,mBAAmB,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;IAC9C,SAAS,EAAE,OAAO,CAAC;IACnB,iBAAiB,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;IAC5C,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,OAAO,CAAC;IACd,YAAY,EAAE,OAAO,CAAC;IACtB,cAAc,EAAE,OAAO,CAAC;IACxB,YAAY,EAAE,OAAO,CAAC;IACtB,kEAAkE;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oDAAoD;IACpD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,4CAA4C;IAC5C,sBAAsB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,KAAK,IAAI,CAAC;CAC7D;AAED,wBAAgB,sBAAsB,CAAC,EACrC,aAAa,EACb,qBAAqB,EACrB,cAAc,EACd,sBAAsB,EACtB,cAAc,EACd,sBAAsB,EACtB,IAAI,EAAE,KAAK,EACX,YAAY,EACZ,MAAM,EACN,cAAc,EACd,cAAc,EACd,eAAe,EACf,kBAAkB,EAClB,0BAA0B,EAC1B,WAAW,EACX,mBAAmB,EACnB,SAAS,EACT,iBAAiB,EACjB,OAAO,EACP,IAAI,EACJ,YAAY,EACZ,cAAc,EACd,YAAY,EACZ,SAAS,EACT,cAAc,EACd,sBAAsB,GACvB,EAAE,2BAA2B,2CAsT7B"}

package/dist/src/presentation/web/components/common/feature-create-drawer/workflow-options-section.js

@@ -1,13 +1,16 @@
 'use client';
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useEffect, useState } from 'react';
 import { useTranslation } from 'react-i18next';
-import { GitFork, FileText, RefreshCw } from 'lucide-react';
+import { GitFork, FileText, RefreshCw, Shield } from 'lucide-react';
 import { cn } from '../../../lib/utils.js';
 import { Label } from '../../ui/label.js';
 import { Switch } from '../../ui/switch.js';
+import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue, } from '../../ui/select.js';
 import { Tooltip, TooltipContent, TooltipTrigger } from '../../ui/tooltip.js';
+import { getAgentPermissionOptions } from '../../../app/actions/agent-permissions.js';
 const AUTO_APPROVE_OPTION_IDS = ['allowPrd', 'allowPlan', 'allowMerge'];
-export function WorkflowOptionsSection({ approvalGates, onApprovalGatesChange, enableEvidence, onEnableEvidenceChange, commitEvidence, onCommitEvidenceChange, push: _push, onPushChange, openPr, onOpenPrChange, ciWatchEnabled, onCiWatchChange, rebaseBeforeBranch, onRebaseBeforeBranchChange, commitSpecs, onCommitSpecsChange, forkAndPr, onForkAndPrChange, canPush, fast, computedPush, computedOpenPr, isSubmitting, }) {
+export function WorkflowOptionsSection({ approvalGates, onApprovalGatesChange, enableEvidence, onEnableEvidenceChange, commitEvidence, onCommitEvidenceChange, push: _push, onPushChange, openPr, onOpenPrChange, ciWatchEnabled, onCiWatchChange, rebaseBeforeBranch, onRebaseBeforeBranchChange, commitSpecs, onCommitSpecsChange, forkAndPr, onForkAndPrChange, canPush, fast, computedPush, computedOpenPr, isSubmitting, agentType, permissionMode, onPermissionModeChange, }) {
     const { t } = useTranslation('web');
     const AUTO_APPROVE_OPTIONS = [
         { id: 'allowPrd', label: t('createDrawer.prd'), description: t('createDrawer.prdDescription') },
@@ -51,5 +54,23 @@ export function WorkflowOptionsSection({ approvalGates, onApprovalGatesChange, e
                                                         // Auto-flip commitSpecs to false when enabling contribute mode
                                                         if (v)
                                                             onCommitSpecsChange(false);
-                                                    }, disabled: isSubmitting }), _jsxs(Label, { htmlFor: "fork-and-pr", className: "flex cursor-pointer items-center gap-1 text-xs font-medium", children: [_jsx(GitFork, { className: "h-3 w-3" }), t('createDrawer.forkAndPr')] })] }) }), _jsx(TooltipContent, { side: "bottom", children: t('createDrawer.forkAndPrDescription') })] }))] })] })] }));
+                                                    }, disabled: isSubmitting }), _jsxs(Label, { htmlFor: "fork-and-pr", className: "flex cursor-pointer items-center gap-1 text-xs font-medium", children: [_jsx(GitFork, { className: "h-3 w-3" }), t('createDrawer.forkAndPr')] })] }) }), _jsx(TooltipContent, { side: "bottom", children: t('createDrawer.forkAndPrDescription') })] }))] })] }), agentType && onPermissionModeChange ? (_jsx(PermissionModeRow, { agentType: agentType, permissionMode: permissionMode, onPermissionModeChange: onPermissionModeChange, isSubmitting: isSubmitting })) : null] }));
+}
+/** Internal sub-component for the permission mode select in the workflow options row. */
+function PermissionModeRow({ agentType, permissionMode, onPermissionModeChange, isSubmitting, }) {
+    const { t } = useTranslation('web');
+    const [options, setOptions] = useState([]);
+    useEffect(() => {
+        let cancelled = false;
+        getAgentPermissionOptions(agentType).then((opts) => {
+            if (!cancelled)
+                setOptions(opts);
+        });
+        return () => {
+            cancelled = true;
+        };
+    }, [agentType]);
+    if (options.length === 0)
+        return null;
+    return (_jsxs("div", { className: "border-input flex items-center gap-4 rounded-md border px-3 py-2.5", children: [_jsxs(Tooltip, { children: [_jsx(TooltipTrigger, { asChild: true, children: _jsxs("span", { className: "text-muted-foreground flex w-16 shrink-0 cursor-default items-center gap-1 text-xs font-semibold tracking-wider", children: [_jsx(Shield, { className: "h-3 w-3" }), t('feature.create.permissionMode')] }) }), _jsx(TooltipContent, { side: "bottom", children: t('settings.agent.permissions.description', { agent: agentType }) })] }), _jsx("div", { className: "flex-1", children: _jsxs(Select, { value: permissionMode ?? '__default__', onValueChange: (v) => onPermissionModeChange(v === '__default__' ? undefined : v), disabled: isSubmitting, children: [_jsx(SelectTrigger, { id: "permission-mode", "data-testid": "permission-mode-select", className: "h-7 text-xs", children: _jsx(SelectValue, {}) }), _jsxs(SelectContent, { children: [_jsx(SelectItem, { value: "__default__", children: t('feature.create.permissionModeDefault') }), options.map((opt) => (_jsx(SelectItem, { value: opt.value, children: opt.label }, opt.value)))] })] }) })] }));
 }

package/dist/src/presentation/web/components/common/feature-create-drawer/workflow-options-section.stories.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workflow-options-section.stories.d.ts","sourceRoot":"","sources":["../../../../../../../src/presentation/web/components/common/feature-create-drawer/workflow-options-section.stories.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAG5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAEpE,QAAA,MAAM,IAAI,EAAE,IAAI,CAAC,OAAO,sBAAsB,CAyC7C,CAAC;AAEF,eAAe,IAAI,CAAC;AACpB,KAAK,KAAK,GAAG,QAAQ,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAErD,kEAAkE;AAClE,eAAO,MAAM,OAAO,EAAE,KAAU,CAAC;AAEjC,kCAAkC;AAClC,eAAO,MAAM,gBAAgB,EAAE,KAI9B,CAAC;AAEF,mFAAmF;AACnF,eAAO,MAAM,cAAc,EAAE,KAK5B,CAAC;AAEF,mCAAmC;AACnC,eAAO,MAAM,eAAe,EAAE,KAM7B,CAAC;AAEF,uDAAuD;AACvD,eAAO,MAAM,kBAAkB,EAAE,KAOhC,CAAC;AAEF,oBAAoB;AACpB,eAAO,MAAM,WAAW,EAAE,KAKzB,CAAC;AAEF,+CAA+C;AAC/C,eAAO,MAAM,SAAS,EAAE,KAOvB,CAAC;AAEF,0FAA0F;AAC1F,eAAO,MAAM,eAAe,EAAE,KAQ7B,CAAC;AAEF,yDAAyD;AACzD,eAAO,MAAM,eAAe,EAAE,KAI7B,CAAC;AAEF,+CAA+C;AAC/C,eAAO,MAAM,UAAU,EAAE,KAQxB,CAAC;AAEF,0DAA0D;AAC1D,eAAO,MAAM,YAAY,EAAE,KAI1B,CAAC"}
+{"version":3,"file":"workflow-options-section.stories.d.ts","sourceRoot":"","sources":["../../../../../../../src/presentation/web/components/common/feature-create-drawer/workflow-options-section.stories.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAG5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAEpE,QAAA,MAAM,IAAI,EAAE,IAAI,CAAC,OAAO,sBAAsB,CA4C7C,CAAC;AAEF,eAAe,IAAI,CAAC;AACpB,KAAK,KAAK,GAAG,QAAQ,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAErD,kEAAkE;AAClE,eAAO,MAAM,OAAO,EAAE,KAAU,CAAC;AAEjC,kCAAkC;AAClC,eAAO,MAAM,gBAAgB,EAAE,KAI9B,CAAC;AAEF,mFAAmF;AACnF,eAAO,MAAM,cAAc,EAAE,KAK5B,CAAC;AAEF,mCAAmC;AACnC,eAAO,MAAM,eAAe,EAAE,KAM7B,CAAC;AAEF,uDAAuD;AACvD,eAAO,MAAM,kBAAkB,EAAE,KAOhC,CAAC;AAEF,oBAAoB;AACpB,eAAO,MAAM,WAAW,EAAE,KAKzB,CAAC;AAEF,+CAA+C;AAC/C,eAAO,MAAM,SAAS,EAAE,KAOvB,CAAC;AAEF,0FAA0F;AAC1F,eAAO,MAAM,eAAe,EAAE,KAQ7B,CAAC;AAEF,yDAAyD;AACzD,eAAO,MAAM,eAAe,EAAE,KAI7B,CAAC;AAEF,+CAA+C;AAC/C,eAAO,MAAM,UAAU,EAAE,KAQxB,CAAC;AAEF,0DAA0D;AAC1D,eAAO,MAAM,YAAY,EAAE,KAI1B,CAAC"}

package/dist/src/presentation/web/components/common/feature-create-drawer/workflow-options-section.stories.js

@@ -36,6 +36,9 @@ const meta = {
         computedPush: false,
         computedOpenPr: false,
         isSubmitting: false,
+        agentType: 'claude-code',
+        permissionMode: undefined,
+        onPermissionModeChange: fn(),
     },
 };
 export default meta;

package/dist/src/presentation/web/components/common/feature-list-item/feature-list-item.stories.js

@@ -67,8 +67,8 @@ export const WithClickHandler = {
     args: {
         name: 'API Gateway',
         status: 'action-needed',
-        agentType: 'dev',
-        modelId: 'gpt-8',
+        agentType: 'gemini-cli',
+        modelId: 'gemini-2.5-pro',
         onClick: () => alert('Clicked!'),
     },
 };

package/dist/src/presentation/web/components/common/feature-node/agent-type-icons.d.ts

@@ -1,6 +1,6 @@
 import type { ComponentType, SVGProps } from 'react';
-/** Agent type values mirroring the TypeSpec AgentType enum. */
-export type AgentTypeValue = 'claude-code' | 'codex-cli' | 'cursor' | 'gemini-cli' | 'aider' | 'continue' | 'dev';
+/** Agent type values mirroring the TypeSpec AgentType enum (UI-visible subset). */
+export type AgentTypeValue = 'claude-code' | 'codex-cli' | 'copilot-cli' | 'cursor' | 'gemini-cli' | 'rovo-dev';
 type IconProps = SVGProps<SVGSVGElement> & {
     className?: string;
 };