acdev 1.1.1 → 1.2.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "acdev",
-  "version": "1.1.1",
+  "version": "1.2.0",
   "description": "Local CLI + web UI for running AI agents on GitHub issues via git worktrees",
   "type": "module",
   "bin": {

package/public/app.js

@@ -22,6 +22,7 @@ const RUN_STATUSES = new Set([
   'preparing_worktree',
   'running',
   'applying_feedback',
+  'awaiting_permission',
   'awaiting_review',
   'pr_opened',
   'failed',
@@ -49,6 +50,7 @@ const STATUS_LABELS = {
   preparing_worktree: 'Preparing worktree…',
   running: 'Agent running…',
   applying_feedback: 'Applying review feedback…',
+  awaiting_permission: 'Needs permission',
   awaiting_review: 'Awaiting review',
   pr_opened: 'PR opened',
   discarded: 'Discarded',
@@ -56,6 +58,25 @@ const STATUS_LABELS = {
   'retry queued': 'Retry queued',
 };
 
+/**
+ * Agent permission modes, mirroring Claude Code's own permission modes.
+ * @type {Record<'manual' | 'auto_edit' | 'full_auto', { label: string, hint: string }>}
+ */
+const PERMISSION_MODE_META = {
+  manual: {
+    label: 'Manual review',
+    hint: 'Every tool call (read, edit, or command) pauses and waits for your Allow/Deny decision.',
+  },
+  auto_edit: {
+    label: 'Auto-accept edits',
+    hint: 'File reads and edits proceed automatically; shell commands still pause for your decision.',
+  },
+  full_auto: {
+    label: 'Full auto',
+    hint: 'The agent never asks — reads, edits, and shell commands all proceed automatically.',
+  },
+};
+
 const THEME_KEY = 'acdev-theme';
 const DISMISS_KEY = 'acdev-dismissed-alerts';
 const REVIEW_FILTER_KEY = 'acdev-review-filter';
@@ -162,6 +183,8 @@ let availableModels = [];
 let ticketSource = 'github';
 /** @type {'claude' | 'openrouter'} */
 let llmProvider = 'claude';
+/** @type {'manual' | 'auto_edit' | 'full_auto'} */
+let permissionMode = 'full_auto';
 /** @type {Array<{ name: string, column?: string, board?: string }>} */
 let jiraStatusOptions = [];
 /** @type {Array<{ name: string, projectTitle?: string }>} */
@@ -249,6 +272,8 @@ const els = {
   overviewReviewEmpty: document.getElementById('overview-review-empty'),
   overviewQueue: document.getElementById('overview-queue'),
   overviewQueueEmpty: document.getElementById('overview-queue-empty'),
+  overviewPermission: document.getElementById('overview-permission'),
+  overviewPermissionEmpty: document.getElementById('overview-permission-empty'),
   runsList: document.getElementById('runs-list'),
   runsEmpty: document.getElementById('runs-empty'),
   reviewEmpty: document.getElementById('review-empty'),
@@ -359,6 +384,11 @@ const els = {
   settingsLlmProvider: document.getElementById('settings-llm-provider'),
   settingsLlmProviderHint: document.getElementById('settings-llm-provider-hint'),
   overviewLlmProvider: document.getElementById('overview-llm-provider'),
+  settingsPermissionMode: document.getElementById('settings-permission-mode'),
+  settingsPermissionModeHint: document.getElementById('settings-permission-mode-hint'),
+  overviewPermissionMode: document.getElementById('overview-permission-mode'),
+  overviewPermissionModeHint: document.getElementById('overview-permission-mode-hint'),
+  overviewPermissionModeFeedback: document.getElementById('overview-permission-mode-feedback'),
   sidebarAgentLabel: document.getElementById('sidebar-agent-label'),
   settingsTabs: document.getElementById('settings-tabs'),
 };
@@ -1414,7 +1444,7 @@ function pipelineStates(job) {
   if (job.status === 'preparing_worktree') {
     return ['done', 'done', 'active', 'pending', 'pending'];
   }
-  if (job.status === 'running') {
+  if (job.status === 'running' || job.status === 'awaiting_permission') {
     return ['done', 'done', 'active', 'pending', 'pending'];
   }
   if (job.status === 'failed') {
@@ -1432,8 +1462,12 @@ function pipelineStates(job) {
 }
 
 function currentStepLabel(job) {
-  if (job.status === 'failed') return job.error || 'failed';
+  if (job.status === 'failed') return truncate(String(job.error || 'failed').replace(/\s+/g, ' '), 160);
   if (job.status === 'awaiting_review') return 'awaiting review';
+  if (job.status === 'awaiting_permission') {
+    const tool = job.pendingPermission?.tool;
+    return tool ? `waiting on your permission decision — ${tool}` : 'waiting on your permission decision';
+  }
   if (job.status === 'pr_opened') return 'PR opened';
   const logs = job.logs || [];
   for (let i = logs.length - 1; i >= 0; i--) {
@@ -2352,6 +2386,19 @@ function collectAlerts(jobs) {
         actions: ['retry', 'clear'],
       });
     }
+    if (job.status === 'awaiting_permission' && job.pendingPermission) {
+      const req = job.pendingPermission;
+      alerts.push({
+        id: `permission:${job.id}:${req.id}`,
+        jobId: job.id,
+        title: `${jobTitle(job)} needs permission`,
+        text: `${req.tool} · ${truncate(summarizeToolInput(req.input), 140)}`,
+        repo: meta.repo,
+        number: String(meta.number),
+        time: formatTime(req.requestedAt),
+        actions: ['decide-permission'],
+      });
+    }
     for (const log of job.logs || []) {
       if (log.type !== 'error' && log.type !== 'warn') continue;
       const payload = String(log.payload || '');
@@ -2447,6 +2494,7 @@ function statusPill(job) {
 
 function renderOverview(jobs) {
   const running = jobs.filter((j) => RUNNING_STATUSES.has(j.status));
+  const permission = jobs.filter((j) => j.status === 'awaiting_permission');
   const review = jobs.filter((j) => j.status === 'awaiting_review');
   const queued = jobs.filter((j) => j.status === 'queued');
 
@@ -2487,6 +2535,54 @@ function renderOverview(jobs) {
     els.overviewRunning.appendChild(row);
   }
 
+  els.overviewPermission.innerHTML = '';
+  els.overviewPermissionEmpty.classList.toggle('hidden', permission.length > 0);
+  for (const job of permission) {
+    const row = document.createElement('div');
+    row.className = 'job-row';
+    row.innerHTML = `
+      ${stepDotsHtml(pipelineStates(job))}
+      <div class="job-main">
+        <div class="job-title"></div>
+        <div class="job-sub mono"></div>
+      </div>
+    `;
+    row.querySelector('.job-title').textContent = jobTitle(job);
+    row.querySelector('.job-sub').textContent = jobSubLine(job);
+    const badge = typeBadgeEl(job);
+    if (badge) row.appendChild(badge);
+    if (job.pendingPermission) {
+      const toolChip = document.createElement('span');
+      toolChip.className = 'usage-chip mono';
+      toolChip.textContent = `${job.pendingPermission.tool} · ${summarizeToolInput(job.pendingPermission.input) || '—'}`;
+      row.appendChild(toolChip);
+    }
+    const allowBtn = document.createElement('button');
+    allowBtn.type = 'button';
+    allowBtn.className = 'btn btn-primary btn-sm';
+    allowBtn.textContent = 'Allow';
+    allowBtn.addEventListener('click', (e) => {
+      e.stopPropagation();
+      if (job.pendingPermission) decidePermission(job.id, job.pendingPermission.id, 'allow');
+    });
+    row.appendChild(allowBtn);
+    const denyBtn = document.createElement('button');
+    denyBtn.type = 'button';
+    denyBtn.className = 'btn btn-danger-text btn-sm';
+    denyBtn.textContent = 'Deny';
+    denyBtn.addEventListener('click', (e) => {
+      e.stopPropagation();
+      if (job.pendingPermission) decidePermission(job.id, job.pendingPermission.id, 'deny');
+    });
+    row.appendChild(denyBtn);
+    row.style.cursor = 'pointer';
+    row.addEventListener('click', () => {
+      setView('runs');
+      selectRun(job.id);
+    });
+    els.overviewPermission.appendChild(row);
+  }
+
   els.overviewReview.innerHTML = '';
   els.overviewReviewEmpty.classList.toggle('hidden', review.length > 0);
   for (const job of review) {
@@ -2566,6 +2662,43 @@ function renderOverview(jobs) {
   });
 }
 
+/**
+ * Build the Allow/Deny card shown in a run's detail pane while it is
+ * paused waiting on a permission decision.
+ * @param {object} job
+ */
+function buildPermissionRequestCard(job) {
+  const req = job.pendingPermission;
+  const card = document.createElement('div');
+  card.className = 'permission-card';
+  card.innerHTML = `
+    <div class="permission-card-header">
+      <span class="permission-card-icon" aria-hidden="true">🔒</span>
+      <div>
+        <div class="permission-card-title"></div>
+        <div class="permission-card-sub">Nothing else runs until you decide.</div>
+      </div>
+    </div>
+    <pre class="permission-card-input"></pre>
+    <div class="actions">
+      <button type="button" class="btn btn-primary btn-sm" data-decision="allow">Allow</button>
+      <button type="button" class="btn btn-danger-text btn-sm" data-decision="deny">Deny</button>
+    </div>
+  `;
+  card.querySelector('.permission-card-title').textContent = `Agent wants to run ${req.tool}`;
+  card.querySelector('.permission-card-input').textContent = formatRawPayload(req.input);
+  card.querySelectorAll('[data-decision]').forEach((btn) => {
+    btn.addEventListener('click', (e) => {
+      e.stopPropagation();
+      card.querySelectorAll('button').forEach((b) => {
+        b.disabled = true;
+      });
+      decidePermission(job.id, req.id, btn.dataset.decision);
+    });
+  });
+  return card;
+}
+
 function renderRuns(jobs) {
   const runs = jobs.filter((j) => RUN_STATUSES.has(j.status)).slice(0, 40);
   els.runsList.innerHTML = '';
@@ -2619,8 +2752,10 @@ function renderRuns(jobs) {
       preview.className = 'run-log-preview';
       for (const ev of previewLogs) {
         const line = document.createElement('div');
+        line.className = 'run-log-preview-line';
         const f = formatLogEvent(ev);
-        line.textContent = `[${formatTime(ev.ts)}] ${f.text}`;
+        const text = truncate(String(f.text || '').replace(/\s+/g, ' '), 140);
+        line.textContent = `[${formatTime(ev.ts)}] ${text}`;
         preview.appendChild(line);
       }
       card.appendChild(preview);
@@ -2663,6 +2798,10 @@ function renderRuns(jobs) {
         detail.appendChild(banner);
       }
 
+      if (job.status === 'awaiting_permission' && job.pendingPermission) {
+        detail.appendChild(buildPermissionRequestCard(job));
+      }
+
       if (job.status === 'failed') {
         const err = document.createElement('div');
         err.className = 'error-banner';
@@ -3202,6 +3341,18 @@ function renderAlerts(jobs) {
       actions.appendChild(retry);
     }
 
+    if (alert.actions.includes('decide-permission')) {
+      const decide = document.createElement('button');
+      decide.type = 'button';
+      decide.className = 'btn btn-primary btn-sm';
+      decide.textContent = 'Decide';
+      decide.addEventListener('click', () => {
+        setView('runs');
+        selectRun(alert.jobId);
+      });
+      actions.appendChild(decide);
+    }
+
     if (alert.actions.includes('clear')) {
       const clear = document.createElement('button');
       clear.type = 'button';
@@ -3350,6 +3501,30 @@ async function clearJob(jobId) {
   }
 }
 
+/**
+ * Resolve a pending tool-approval request for a job awaiting permission.
+ * @param {string} jobId
+ * @param {string} requestId
+ * @param {'allow' | 'deny'} decision
+ */
+async function decidePermission(jobId, requestId, decision) {
+  try {
+    const res = await fetch(`/api/jobs/${jobId}/permission`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ requestId, decision }),
+    });
+    const data = await readJson(res);
+    if (!res.ok) {
+      alert(data.error || `Could not record decision (HTTP ${res.status})`);
+      return;
+    }
+  } catch (err) {
+    alert(`Could not record decision: ${err.message}`);
+  }
+  await fetchJobs();
+}
+
 async function fetchJobs() {
   try {
     const res = await fetch('/api/jobs');
@@ -4755,6 +4930,58 @@ async function saveLlmProvider(next) {
   }
 }
 
+/**
+ * @param {'manual' | 'auto_edit' | 'full_auto'} mode
+ */
+function updatePermissionModeUI(mode) {
+  permissionMode = PERMISSION_MODE_META[mode] ? mode : 'full_auto';
+  const meta = PERMISSION_MODE_META[permissionMode];
+  for (const toggle of [els.settingsPermissionMode, els.overviewPermissionMode]) {
+    if (!toggle) continue;
+    toggle.querySelectorAll('.source-btn').forEach((btn) => {
+      const active = btn.dataset.mode === permissionMode;
+      btn.classList.toggle('active', active);
+      btn.setAttribute('aria-pressed', active ? 'true' : 'false');
+    });
+  }
+  if (els.settingsPermissionModeHint) els.settingsPermissionModeHint.textContent = meta.hint;
+  if (els.overviewPermissionModeHint) els.overviewPermissionModeHint.textContent = meta.hint;
+}
+
+/** @param {'manual' | 'auto_edit' | 'full_auto'} next */
+async function savePermissionMode(next) {
+  const mode = PERMISSION_MODE_META[next] ? next : 'full_auto';
+  const prev = permissionMode;
+  updatePermissionModeUI(mode);
+  try {
+    const res = await fetch('/api/config', {
+      method: 'PATCH',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ permissionMode: mode }),
+    });
+    const data = await readJson(res);
+    if (!res.ok) {
+      updatePermissionModeUI(prev);
+      const msg = data.error || `Update failed (HTTP ${res.status})`;
+      if (els.overviewPermissionModeFeedback) {
+        els.overviewPermissionModeFeedback.textContent = msg;
+        els.overviewPermissionModeFeedback.className = 'feedback error';
+        els.overviewPermissionModeFeedback.classList.remove('hidden');
+      }
+      setSettingsFeedback(msg, 'error');
+      return;
+    }
+    appConfig = { ...appConfig, ...data };
+  } catch (err) {
+    updatePermissionModeUI(prev);
+    if (els.overviewPermissionModeFeedback) {
+      els.overviewPermissionModeFeedback.textContent = err.message || 'Update failed';
+      els.overviewPermissionModeFeedback.className = 'feedback error';
+      els.overviewPermissionModeFeedback.classList.remove('hidden');
+    }
+  }
+}
+
 function updateTimeoutMsHint(minutes) {
   if (!els.settingsTimeoutMs) return;
   const m = Number(minutes);
@@ -4834,6 +5061,7 @@ function applyConfigSnapshot(data) {
     data?.llmProvider === 'openrouter' ? 'openrouter' : 'claude',
     data || appConfig
   );
+  updatePermissionModeUI(data?.permissionMode || 'full_auto');
   if (els.repoName) {
     els.repoName.textContent = data?.repoName || 'local repo';
   }
@@ -5245,6 +5473,18 @@ function handleLlmProviderToggleClick(e) {
 els.settingsLlmProvider?.addEventListener('click', handleLlmProviderToggleClick);
 els.overviewLlmProvider?.addEventListener('click', handleLlmProviderToggleClick);
 
+function handlePermissionModeToggleClick(e) {
+  const btn = e.target.closest('.source-btn');
+  if (!btn?.dataset.mode) return;
+  const next = PERMISSION_MODE_META[btn.dataset.mode] ? btn.dataset.mode : 'full_auto';
+  if (next === permissionMode) return;
+  e.stopPropagation();
+  void savePermissionMode(next);
+}
+
+els.settingsPermissionMode?.addEventListener('click', handlePermissionModeToggleClick);
+els.overviewPermissionMode?.addEventListener('click', handlePermissionModeToggleClick);
+
 els.enqueueJiraSettingsLink?.addEventListener('click', (e) => {
   e.preventDefault();
   setView('settings');

package/public/index.html

@@ -238,6 +238,26 @@
               </div>
             </section>
 
+            <section>
+              <div class="card permission-mode-card">
+                <div class="permission-mode-card-header">
+                  <div class="field-label">Agent permissions</div>
+                  <div
+                    class="source-toggle source-toggle--compact"
+                    id="overview-permission-mode"
+                    role="group"
+                    aria-label="Agent permission mode"
+                  >
+                    <button type="button" class="source-btn" data-mode="manual">Manual review</button>
+                    <button type="button" class="source-btn" data-mode="auto_edit">Auto-accept edits</button>
+                    <button type="button" class="source-btn active" data-mode="full_auto">Full auto</button>
+                  </div>
+                </div>
+                <p class="field-hint" id="overview-permission-mode-hint"></p>
+                <p id="overview-permission-mode-feedback" class="feedback hidden" role="status"></p>
+              </div>
+            </section>
+
             <section class="stats-grid" id="stats-grid"></section>
 
             <section>
@@ -246,6 +266,12 @@
               <p id="overview-running-empty" class="empty-inline hidden">Nothing running.</p>
             </section>
 
+            <section>
+              <div class="section-label">Needs your permission — waiting on you</div>
+              <div id="overview-permission" class="item-stack"></div>
+              <p id="overview-permission-empty" class="empty-inline hidden">No pending permission requests.</p>
+            </section>
+
             <section>
               <div class="section-label">Ready for review — waiting on you</div>
               <div id="overview-review" class="item-stack"></div>
@@ -694,6 +720,15 @@
                     </div>
                     <p class="field-hint" id="settings-llm-provider-hint">Claude uses the Claude Agent SDK. OpenRouter uses <code>@openrouter/agent</code> with the same coding tools (any catalog model). A provider stays disabled until it is configured and authenticated.</p>
                   </div>
+                  <div class="settings-field settings-field-full">
+                    <div class="field-label">Permission mode</div>
+                    <div class="source-toggle" id="settings-permission-mode" role="group" aria-label="Agent permission mode">
+                      <button type="button" class="source-btn" data-mode="manual">Manual review</button>
+                      <button type="button" class="source-btn" data-mode="auto_edit">Auto-accept edits</button>
+                      <button type="button" class="source-btn active" data-mode="full_auto">Full auto</button>
+                    </div>
+                    <p class="field-hint" id="settings-permission-mode-hint"></p>
+                  </div>
                   <div class="settings-grid">
                     <div class="settings-field">
                       <label class="field-label" for="settings-base-branch">Base branch</label>

package/public/styles.css

@@ -1021,6 +1021,11 @@ a { color: var(--primary); text-underline-offset: 3px; }
   color: var(--primary);
 }
 
+.status-pill.awaiting_permission {
+  background: var(--amber-100);
+  color: var(--amber-800);
+}
+
 .status-pill.pr_opened {
   background: var(--green-100);
   color: var(--green-800);
@@ -1307,9 +1312,17 @@ a { color: var(--primary); text-underline-offset: 3px; }
   display: flex;
   align-items: center;
   gap: 8px;
+  min-width: 0;
 }
 
-.run-now-label { color: var(--text-muted); }
+.run-now-label { color: var(--text-muted); flex: none; }
+
+.run-now .mono {
+  min-width: 0;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
 
 .run-log-preview {
   background: var(--surface-2);
@@ -1323,6 +1336,12 @@ a { color: var(--primary); text-underline-offset: 3px; }
   overflow: auto;
 }
 
+.run-log-preview-line {
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
 .run-detail {
   display: flex;
   flex-direction: column;
@@ -2182,6 +2201,52 @@ body.diff-fs-open {
   font-size: 13px;
 }
 
+.permission-card {
+  display: flex;
+  flex-direction: column;
+  gap: 10px;
+  padding: 12px 14px;
+  background: var(--amber-100);
+  color: var(--amber-800);
+  border-radius: 8px;
+  font-size: 13px;
+}
+
+.permission-card-header {
+  display: flex;
+  align-items: flex-start;
+  gap: 10px;
+}
+
+.permission-card-icon {
+  flex: none;
+  font-size: 16px;
+  line-height: 1.4;
+}
+
+.permission-card-title { font-weight: 600; }
+
+.permission-card-sub {
+  font-size: 12px;
+  color: color-mix(in srgb, var(--amber-800) 80%, var(--text-muted));
+  margin-top: 2px;
+}
+
+.permission-card-input {
+  margin: 0;
+  padding: 8px 10px;
+  background: var(--bg);
+  color: var(--text);
+  border: 1px solid var(--border-soft);
+  border-radius: 6px;
+  font-family: "JetBrains Mono", ui-monospace, monospace;
+  font-size: 12px;
+  white-space: pre-wrap;
+  word-break: break-word;
+  max-height: 160px;
+  overflow: auto;
+}
+
 /* —— Scrollbars —— */
 .amcp-scroll::-webkit-scrollbar { width: 8px; height: 8px; }
 .amcp-scroll::-webkit-scrollbar-thumb {
@@ -2565,7 +2630,7 @@ body.diff-fs-open {
   color: var(--text-muted);
   cursor: pointer;
   white-space: nowrap;
-  transition: background 0.12s ease, color 0.12s ease, box-shadow 0.12s ease;
+  transition: background 0.15s ease, color 0.15s ease, border-color 0.15s ease, box-shadow 0.15s ease;
 }
 
 .source-toggle--compact .source-btn {
@@ -2587,6 +2652,20 @@ body.diff-fs-open {
   box-shadow: var(--shadow-sm);
 }
 
+/* Agent permission mode: selected button uses the theme's primary color. */
+#settings-permission-mode .source-btn.active,
+#overview-permission-mode .source-btn.active {
+  background: var(--primary);
+  color: var(--btn-on-primary);
+  border-color: var(--primary);
+}
+
+#settings-permission-mode .source-btn.active:hover:not(:disabled),
+#overview-permission-mode .source-btn.active:hover:not(:disabled) {
+  background: var(--primary-hover);
+  border-color: var(--primary-hover);
+}
+
 .source-btn:disabled {
   opacity: 0.45;
   cursor: not-allowed;

package/src/agent.js

@@ -429,9 +429,17 @@ export function mergeAgentResult(current, incoming) {
  *   config: object,
  *   onEvent: (message: unknown) => void,
  *   queryFn?: typeof query,
+ *   requestApproval?: (toolName: string, input: unknown) => Promise<{ allowed: boolean, message?: string }>,
  * }} params
  */
-async function runAgentQuery({ prompt, worktreePath, config, onEvent, queryFn = query }) {
+async function runAgentQuery({
+  prompt,
+  worktreePath,
+  config,
+  onEvent,
+  queryFn = query,
+  requestApproval,
+}) {
   const timeoutMs = config.agentTimeoutMs ?? 900_000;
   let lastMessage = null;
   let resultMessage = null;
@@ -441,6 +449,18 @@ async function runAgentQuery({ prompt, worktreePath, config, onEvent, queryFn =
   // instructions unless attribution is cleared via Claude settings.
   ensureNoAiAttributionSettings(worktreePath);
 
+  // Only override the SDK's own permission handling when a gate is wired up
+  // (permissionMode !== 'full_auto'). Otherwise keep the exact prior
+  // behavior: 'acceptEdits' with no canUseTool callback.
+  const canUseTool = requestApproval
+    ? async (toolName, input) => {
+        const decision = await requestApproval(toolName, input);
+        return decision.allowed
+          ? { behavior: 'allow', updatedInput: input }
+          : { behavior: 'deny', message: decision.message || `${toolName} was denied.` };
+      }
+    : undefined;
+
   const runLoop = async () => {
     try {
       for await (const message of queryFn({
@@ -450,13 +470,14 @@ async function runAgentQuery({ prompt, worktreePath, config, onEvent, queryFn =
           cwd: worktreePath,
           allowedTools: config.allowedTools,
           disallowedTools: DISALLOWED_AGENT_TOOLS,
-          permissionMode: 'acceptEdits',
+          permissionMode: canUseTool ? 'default' : 'acceptEdits',
           maxTurns: config.maxAgentTurns,
           model: config.model || 'claude-sonnet-5',
           // Load only local settings so our empty attribution wins without
           // pulling in unrelated user settings.
           settingSources: ['local'],
           abortController,
+          ...(canUseTool ? { canUseTool } : {}),
         },
       })) {
         onEvent(message);
@@ -513,6 +534,7 @@ async function runAgentQuery({ prompt, worktreePath, config, onEvent, queryFn =
  *   onEvent: (message: unknown) => void,
  *   queryFn?: typeof query,
  *   callModelFn?: (args: object) => object,
+ *   requestApproval?: (toolName: string, input: unknown) => Promise<{ allowed: boolean, message?: string }>,
  * }} params
  */
 async function runConfiguredQuery({
@@ -522,6 +544,7 @@ async function runConfiguredQuery({
   onEvent,
   queryFn,
   callModelFn,
+  requestApproval,
 }) {
   if (config.llmProvider === 'openrouter') {
     const out = await runOpenRouterQuery({
@@ -530,6 +553,7 @@ async function runConfiguredQuery({
       config,
       onEvent,
       callModelFn,
+      requestApproval,
     });
     return {
       resultText: out.resultText,
@@ -537,7 +561,7 @@ async function runConfiguredQuery({
       usage: out.usage,
     };
   }
-  return runAgentQuery({ prompt, worktreePath, config, onEvent, queryFn });
+  return runAgentQuery({ prompt, worktreePath, config, onEvent, queryFn, requestApproval });
 }
 
 function stubAgentResult(onEvent, title, body) {
@@ -591,6 +615,7 @@ function stubAgentResult(onEvent, title, body) {
  *   userPrompt?: string,
  *   queryFn?: typeof query,
  *   callModelFn?: (args: object) => object,
+ *   requestApproval?: (toolName: string, input: unknown) => Promise<{ allowed: boolean, message?: string }>,
  * }} params
  */
 export async function runAgentOnIssue({
@@ -607,6 +632,7 @@ export async function runAgentOnIssue({
   userPrompt,
   queryFn = query,
   callModelFn,
+  requestApproval,
 }) {
   if (stub) {
     await new Promise((resolve) => setTimeout(resolve, 2000));
@@ -634,6 +660,7 @@ export async function runAgentOnIssue({
     onEvent,
     queryFn,
     callModelFn,
+    requestApproval,
   });
 
   if (meta) {
@@ -667,6 +694,7 @@ export async function runAgentOnIssue({
  *   jiraKey?: string,
  *   queryFn?: typeof query,
  *   callModelFn?: (args: object) => object,
+ *   requestApproval?: (toolName: string, input: unknown) => Promise<{ allowed: boolean, message?: string }>,
  * }} params
  */
 export async function runAgentOnReviewFeedback({
@@ -683,6 +711,7 @@ export async function runAgentOnReviewFeedback({
   jiraKey,
   queryFn = query,
   callModelFn,
+  requestApproval,
 }) {
   if (stub) {
     await new Promise((resolve) => setTimeout(resolve, 500));
@@ -712,6 +741,7 @@ export async function runAgentOnReviewFeedback({
     onEvent,
     queryFn,
     callModelFn,
+    requestApproval,
   });
 
   if (meta) {

package/src/config.js

@@ -17,6 +17,9 @@ import {
   OPENROUTER_MODEL_OPTIONS,
 } from './models.js';
 import { dataDir } from './paths.js';
+import { PERMISSION_MODES, DEFAULT_PERMISSION_MODE, normalizePermissionMode } from './permissions.js';
+
+export { PERMISSION_MODES, normalizePermissionMode };
 
 export { DEFAULT_MODEL, CLAUDE_MODEL_OPTIONS, MODEL_OPTIONS, NO_MODEL } from './models.js';
 
@@ -48,6 +51,7 @@ const ALLOWED_TOOLS_SET = new Set(KNOWN_TOOLS);
 const ALLOWED_TICKET_SOURCES = new Set(TICKET_SOURCES);
 const ALLOWED_LLM_PROVIDERS = new Set(LLM_PROVIDERS);
 const ALLOWED_AFTER_PR_ACTIONS = new Set(AFTER_PR_ACTIONS);
+const ALLOWED_PERMISSION_MODES = new Set(PERMISSION_MODES);
 
 /** @typedef {'none' | 'set_status' | 'add_label' | 'close_issue'} AfterPrAction */
 
@@ -81,6 +85,7 @@ const DEFAULTS = {
   jiraPrLinkPhrase: 'Relates to',
   jiraRules: structuredClone(DEFAULT_JIRA_RULES),
   githubRules: structuredClone(DEFAULT_GITHUB_RULES),
+  permissionMode: DEFAULT_PERMISSION_MODE,
 };
 
 /**
@@ -342,6 +347,7 @@ function persistable(config) {
     jiraPrLinkPhrase: config.jiraPrLinkPhrase || 'Relates to',
     jiraRules: normalizeJiraRules(config.jiraRules),
     githubRules: normalizeGithubRules(config.githubRules),
+    permissionMode: normalizePermissionMode(config.permissionMode),
   };
 }
 
@@ -445,6 +451,10 @@ export function loadConfig(repoRoot) {
     config.jiraPrLinkPhrase = 'Relates to';
   }
 
+  if (!ALLOWED_PERMISSION_MODES.has(config.permissionMode)) {
+    config.permissionMode = DEFAULT_PERMISSION_MODE;
+  }
+
   if (needsSave) {
     saveConfig(repoRoot, persistable(config));
   }
@@ -566,6 +576,15 @@ export function updateConfig(repoRoot, config, patch) {
     config.jiraPrLinkPhrase = patch.jiraPrLinkPhrase.trim();
   }
 
+  if (patch.permissionMode !== undefined) {
+    if (!ALLOWED_PERMISSION_MODES.has(patch.permissionMode)) {
+      throw new Error(
+        `Invalid permissionMode "${patch.permissionMode}". Allowed: ${PERMISSION_MODES.join(', ')}`
+      );
+    }
+    config.permissionMode = patch.permissionMode;
+  }
+
   if (patch.jiraRules !== undefined) {
     config.jiraRules = normalizeJiraRules(patch.jiraRules, { throwOnInvalid: true });
   }
@@ -653,6 +672,8 @@ export function publicConfig(config, opts = {}) {
     jiraPrLinkPhrase: config.jiraPrLinkPhrase || 'Relates to',
     jiraRules: normalizeJiraRules(config.jiraRules),
     githubRules: normalizeGithubRules(config.githubRules),
+    permissionMode: normalizePermissionMode(config.permissionMode),
+    permissionModes: PERMISSION_MODES,
     jiraEmail: jiraEmail || null,
     jiraApiTokenSet: tokenMask.set,
     jiraApiTokenMasked: tokenMask.masked,

package/src/openrouter-agent.js

@@ -31,6 +31,7 @@ function toolUseEvent(call) {
  *   config: object,
  *   onEvent: (message: unknown) => void,
  *   callModelFn?: (args: object) => object,
+ *   requestApproval?: (toolName: string, input: unknown) => Promise<{ allowed: boolean, message?: string }>,
  * }} params
  */
 export async function runOpenRouterQuery({
@@ -39,6 +40,7 @@ export async function runOpenRouterQuery({
   config,
   onEvent,
   callModelFn,
+  requestApproval,
 }) {
   const auth = checkOpenRouterAuth();
   if (!auth.ok && !callModelFn) {
@@ -54,7 +56,9 @@ export async function runOpenRouterQuery({
     throw new Error('No OpenRouter model selected');
   }
 
-  const tools = buildOpenRouterCodingTools(worktreePath, config.allowedTools || []);
+  const tools = buildOpenRouterCodingTools(worktreePath, config.allowedTools || [], {
+    requestApproval,
+  });
   const abortController = new AbortController();
   const started = Date.now();
 

package/src/openrouter-tools.js

@@ -98,13 +98,33 @@ function relToRoot(root, abs) {
 /**
  * @param {string} worktreePath
  * @param {string[]} allowedTools
+ * @param {{
+ *   requestApproval?: (toolName: string, input: unknown) => Promise<{ allowed: boolean, message?: string }>,
+ * }} [opts]
  */
-export function buildOpenRouterCodingTools(worktreePath, allowedTools) {
+export function buildOpenRouterCodingTools(worktreePath, allowedTools, opts = {}) {
+  const { requestApproval } = opts;
   const allowed = new Set(allowedTools || []);
   const root = path.resolve(worktreePath);
   /** @type {ReturnType<typeof tool>[]} */
   const tools = [];
 
+  /**
+   * Gate a tool's execute function behind the configured permission mode.
+   * @param {string} name
+   * @param {(input: any) => Promise<string>} executeFn
+   */
+  const guard = (name, executeFn) => {
+    if (!requestApproval) return executeFn;
+    return async (input) => {
+      const decision = await requestApproval(name, input);
+      if (!decision.allowed) {
+        throw new Error(decision.message || `${name} was denied by user review.`);
+      }
+      return executeFn(input);
+    };
+  };
+
   if (allowed.has('Read')) {
     tools.push(
       tool({
@@ -115,7 +135,7 @@ export function buildOpenRouterCodingTools(worktreePath, allowedTools) {
           offset: z.number().int().positive().optional(),
           limit: z.number().int().positive().optional(),
         }),
-        execute: async ({ path: rel, offset, limit }) => {
+        execute: guard('Read', async ({ path: rel, offset, limit }) => {
           const full = resolveInWorktree(root, rel);
           const text = fs.readFileSync(full, 'utf8');
           const lines = text.split('\n');
@@ -123,7 +143,7 @@ export function buildOpenRouterCodingTools(worktreePath, allowedTools) {
           const slice = limit ? lines.slice(start, start + limit) : lines.slice(start);
           const numbered = slice.map((line, i) => `${String(start + i + 1).padStart(6)}\t${line}`);
           return numbered.join('\n') || '(empty file)';
-        },
+        }),
       })
     );
   }
@@ -137,12 +157,12 @@ export function buildOpenRouterCodingTools(worktreePath, allowedTools) {
           path: z.string().describe('Path relative to the worktree root'),
           content: z.string().describe('Full file contents'),
         }),
-        execute: async ({ path: rel, content }) => {
+        execute: guard('Write', async ({ path: rel, content }) => {
           const full = resolveInWorktree(root, rel);
           fs.mkdirSync(path.dirname(full), { recursive: true });
           fs.writeFileSync(full, content, 'utf8');
           return `Wrote ${relToRoot(root, full)} (${Buffer.byteLength(content, 'utf8')} bytes)`;
-        },
+        }),
       })
     );
   }
@@ -159,7 +179,7 @@ export function buildOpenRouterCodingTools(worktreePath, allowedTools) {
           new_string: z.string(),
           replace_all: z.boolean().optional(),
         }),
-        execute: async ({ path: rel, old_string, new_string, replace_all }) => {
+        execute: guard('Edit', async ({ path: rel, old_string, new_string, replace_all }) => {
           const full = resolveInWorktree(root, rel);
           const before = fs.readFileSync(full, 'utf8');
           const count = before.split(old_string).length - 1;
@@ -176,7 +196,7 @@ export function buildOpenRouterCodingTools(worktreePath, allowedTools) {
             : before.replace(old_string, new_string);
           fs.writeFileSync(full, after, 'utf8');
           return `Edited ${relToRoot(root, full)} (${count} replacement${count === 1 ? '' : 's'})`;
-        },
+        }),
       })
     );
   }
@@ -190,14 +210,14 @@ export function buildOpenRouterCodingTools(worktreePath, allowedTools) {
           pattern: z.string(),
           path: z.string().optional().describe('Subdirectory to search from'),
         }),
-        execute: async ({ pattern, path: sub }) => {
+        execute: guard('Glob', async ({ pattern, path: sub }) => {
           const re = globToRegExp(pattern);
           const files = listWorktreeFiles(root, sub)
             .map((abs) => relToRoot(root, abs))
             .filter((rel) => re.test(rel) || re.test(rel.split('/').pop() || rel));
           if (files.length === 0) return '(no matches)';
           return files.sort().join('\n');
-        },
+        }),
       })
     );
   }
@@ -212,7 +232,7 @@ export function buildOpenRouterCodingTools(worktreePath, allowedTools) {
           path: z.string().optional(),
           glob: z.string().optional(),
         }),
-        execute: async ({ pattern, path: sub, glob }) => {
+        execute: guard('Grep', async ({ pattern, path: sub, glob }) => {
           let re;
           try {
             re = new RegExp(pattern);
@@ -243,7 +263,7 @@ export function buildOpenRouterCodingTools(worktreePath, allowedTools) {
             }
           }
           return hits.length ? hits.join('\n') : '(no matches)';
-        },
+        }),
       })
     );
   }
@@ -256,7 +276,7 @@ export function buildOpenRouterCodingTools(worktreePath, allowedTools) {
         inputSchema: z.object({
           command: z.string(),
         }),
-        execute: async ({ command }) => {
+        execute: guard('Bash', async ({ command }) => {
           const cmd = String(command || '').trim();
           if (!cmd) throw new Error('command is required');
           const shell = process.env.SHELL || '/bin/bash';
@@ -282,7 +302,7 @@ export function buildOpenRouterCodingTools(worktreePath, allowedTools) {
               .filter(Boolean);
             throw new Error(bits.join('\n') || 'Command failed');
           }
-        },
+        }),
       })
     );
   }

package/src/permissions.js

@@ -0,0 +1,158 @@
+/**
+ * Permission modes controlling how much autonomy the agent has over tool
+ * calls (Read/Glob/Grep/Edit/Write/Bash), mirroring Claude Code's own
+ * permission modes:
+ * - `full_auto`   — never asks (Claude Code's "bypass permissions").
+ * - `auto_edit`   — file reads/edits proceed automatically; anything else
+ *                   (Bash, and any tool outside the known read/edit set)
+ *                   pauses for a human decision (Claude Code's "accept edits").
+ * - `manual`      — every tool call pauses for a human decision
+ *                   (Claude Code's default interactive mode).
+ */
+export const PERMISSION_MODES = /** @type {const} */ (['manual', 'auto_edit', 'full_auto']);
+export const DEFAULT_PERMISSION_MODE = 'full_auto';
+
+const ALLOWED_PERMISSION_MODES = new Set(PERMISSION_MODES);
+
+/** Tools that only read state — safe to auto-approve outside `manual`. */
+const READ_ONLY_TOOLS = new Set(['Read', 'Glob', 'Grep']);
+/** Tools that edit files in the worktree — auto-approved under `auto_edit`. */
+const FILE_EDIT_TOOLS = new Set(['Edit', 'Write']);
+
+/**
+ * @param {unknown} value
+ * @returns {'manual' | 'auto_edit' | 'full_auto'}
+ */
+export function normalizePermissionMode(value) {
+  return ALLOWED_PERMISSION_MODES.has(value) ? value : DEFAULT_PERMISSION_MODE;
+}
+
+/**
+ * True when a tool call must pause for human approval under `permissionMode`.
+ * @param {string} toolName
+ * @param {string} permissionMode
+ */
+export function toolNeedsApproval(toolName, permissionMode) {
+  const mode = normalizePermissionMode(permissionMode);
+  if (mode === 'full_auto') return false;
+  if (mode === 'manual') return true;
+  return !(READ_ONLY_TOOLS.has(toolName) || FILE_EDIT_TOOLS.has(toolName));
+}
+
+/**
+ * Bridges agent tool calls to human approval via the job store. Only one job
+ * runs at a time (see `processQueue` in server.js), so a single
+ * pending-request-per-job map is sufficient.
+ */
+export class PermissionController {
+  /**
+   * @param {{
+   *   store: import('./store.js').Store,
+   *   onEvent: (jobId: string, event: object) => void,
+   * }} deps
+   */
+  constructor({ store, onEvent }) {
+    this.store = store;
+    this.onEvent = onEvent;
+    /** @type {Map<string, { requestId: string, resolve: (r: { allowed: boolean, message?: string }) => void }>} */
+    this.pending = new Map();
+  }
+
+  /** @param {string} jobId */
+  hasPending(jobId) {
+    return this.pending.has(jobId);
+  }
+
+  /**
+   * Request approval for a tool call. Resolves immediately when the
+   * configured mode auto-allows the tool; otherwise pauses the job (status →
+   * `awaiting_permission`) until `resolve()` is called from the API, or
+   * `cancel()` is called because the job ended some other way.
+   * @param {{ jobId: string, toolName: string, input: unknown, permissionMode: string }} args
+   * @returns {Promise<{ allowed: boolean, message?: string }>}
+   */
+  requestApproval({ jobId, toolName, input, permissionMode }) {
+    if (!toolNeedsApproval(toolName, permissionMode)) {
+      return Promise.resolve({ allowed: true });
+    }
+
+    const job = this.store.getJob(jobId);
+    if (!job) return Promise.resolve({ allowed: true });
+
+    const requestId = `perm_${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 8)}`;
+    const request = {
+      id: requestId,
+      tool: toolName,
+      input,
+      requestedAt: new Date().toISOString(),
+    };
+    const event = { ts: request.requestedAt, type: 'permission_request', payload: request };
+
+    const updated = this.store.updateJob(jobId, {
+      status: 'awaiting_permission',
+      pendingPermission: request,
+      permissionPrevStatus: job.status,
+      logs: [...(job.logs || []), event],
+    });
+    this.onEvent(jobId, event);
+    void updated;
+
+    return new Promise((resolve) => {
+      this.pending.set(jobId, { requestId, resolve });
+    });
+  }
+
+  /**
+   * Resolve a pending request from the API.
+   * @param {string} jobId
+   * @param {string} requestId
+   * @param {'allow' | 'deny'} decision
+   * @returns {{ ok: true, job: object } | { ok: false, error: string }}
+   */
+  resolve(jobId, requestId, decision) {
+    const pending = this.pending.get(jobId);
+    if (!pending || pending.requestId !== requestId) {
+      return { ok: false, error: 'No matching pending permission request for this job.' };
+    }
+    this.pending.delete(jobId);
+
+    const job = this.store.getJob(jobId);
+    if (!job) {
+      return { ok: false, error: 'Job not found.' };
+    }
+    const prevStatus = job.permissionPrevStatus || 'running';
+    const tool = job.pendingPermission?.tool;
+    const event = {
+      ts: new Date().toISOString(),
+      type: 'permission_decision',
+      payload: { tool, decision },
+    };
+    this.store.updateJob(jobId, {
+      status: prevStatus,
+      pendingPermission: undefined,
+      permissionPrevStatus: undefined,
+      logs: [...(job.logs || []), event],
+    });
+    this.onEvent(jobId, event);
+
+    pending.resolve({
+      allowed: decision === 'allow',
+      message: decision === 'allow' ? undefined : `${tool || 'Tool call'} was denied by user.`,
+    });
+
+    return { ok: true, job: this.store.getJob(jobId) };
+  }
+
+  /**
+   * Drop a stale pending request without waiting (job ended some other way,
+   * e.g. it timed out while paused). No-op if nothing is pending.
+   * @param {string} jobId
+   * @param {string} [message]
+   */
+  cancel(jobId, message = 'Job ended before the permission request was answered.') {
+    const pending = this.pending.get(jobId);
+    if (!pending) return;
+    this.pending.delete(jobId);
+    pending.resolve({ allowed: false, message });
+  }
+}

package/src/server.js

@@ -48,6 +48,7 @@ import { checkGhAuth, originRemoteInfo } from './gh-auth.js';
 import { checkClaudeAuth } from './claude-auth.js';
 import { checkOpenRouterAuth } from './openrouter-auth.js';
 import { isValidModelId, isNoModel, NO_MODEL, isModelIdForProvider } from './models.js';
+import { PermissionController, normalizePermissionMode } from './permissions.js';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 
@@ -57,6 +58,7 @@ const IN_FLIGHT_STATUSES = new Set([
   'syncing',
   'preparing_worktree',
   'applying_feedback',
+  'awaiting_permission',
 ]);
 
 /** Statuses allowed for DELETE /api/jobs/:id */
@@ -329,6 +331,27 @@ export function createServer({ repoRoot, config, store, useStubAgent = false, de
     }
   }
 
+  const permissionController = new PermissionController({ store, onEvent: emitEvent });
+
+  /**
+   * Build a per-job tool-approval bridge for the agent SDKs. Returns
+   * `undefined` in `full_auto` mode so behavior is byte-for-byte identical
+   * to before this feature existed.
+   * @param {string} jobId
+   */
+  function requestApprovalForJob(jobId) {
+    if (normalizePermissionMode(config.permissionMode) === 'full_auto') {
+      return undefined;
+    }
+    return (toolName, input) =>
+      permissionController.requestApproval({
+        jobId,
+        toolName,
+        input,
+        permissionMode: config.permissionMode,
+      });
+  }
+
   function appendLog(job, type, payload) {
     const event = {
       ts: new Date().toISOString(),
@@ -475,6 +498,7 @@ export function createServer({ repoRoot, config, store, useStubAgent = false, de
         jiraKey: job.jiraKey,
         jiraIssue,
         userPrompt: job.userPrompt,
+        requestApproval: requestApprovalForJob(jobId),
       });
 
       if (!store.getJob(jobId)) return;
@@ -493,6 +517,7 @@ export function createServer({ repoRoot, config, store, useStubAgent = false, de
       if (usage) patch.usage = tagUsageProvider(usage, config.llmProvider);
       setStatus(jobId, 'awaiting_review', patch);
     } catch (err) {
+      permissionController.cancel(jobId);
       const message = formatAgentJobError(err);
       const current = store.getJob(jobId);
       if (!current) return;
@@ -579,6 +604,7 @@ export function createServer({ repoRoot, config, store, useStubAgent = false, de
         issueNumber: job.issueNumber,
         ticketSource: job.ticketSource === 'jira' || job.jiraKey ? 'jira' : 'github',
         jiraKey: job.jiraKey,
+        requestApproval: requestApprovalForJob(jobId),
       });
 
       if (!store.getJob(jobId)) return;
@@ -597,6 +623,7 @@ export function createServer({ repoRoot, config, store, useStubAgent = false, de
       if (usage) patch.usage = tagUsageProvider(usage, config.llmProvider);
       setStatus(jobId, 'awaiting_review', patch);
     } catch (err) {
+      permissionController.cancel(jobId);
       const message = formatAgentJobError(err);
       const current = store.getJob(jobId);
       if (!current) return;
@@ -1306,6 +1333,37 @@ export function createServer({ repoRoot, config, store, useStubAgent = false, de
     }
   });
 
+  app.post('/api/jobs/:id/permission', (req, res) => {
+    try {
+      const job = store.getJob(req.params.id);
+      if (!job) {
+        return res.status(404).json({ error: 'Job not found' });
+      }
+      if (job.status !== 'awaiting_permission') {
+        return res.status(400).json({
+          error: `Job is not awaiting a permission decision (status: ${job.status})`,
+        });
+      }
+
+      const requestId = String(req.body?.requestId || '');
+      const decision = req.body?.decision;
+      if (!requestId) {
+        return res.status(400).json({ error: 'requestId is required' });
+      }
+      if (decision !== 'allow' && decision !== 'deny') {
+        return res.status(400).json({ error: 'decision must be "allow" or "deny"' });
+      }
+
+      const result = permissionController.resolve(job.id, requestId, decision);
+      if (!result.ok) {
+        return res.status(409).json({ error: result.error });
+      }
+      res.json(result.job);
+    } catch (err) {
+      res.status(500).json({ error: err.message });
+    }
+  });
+
   // Unknown /api/* must return JSON — never Express HTML or the SPA shell.
   app.use('/api', (req, res) => {
     res.status(404).json({ error: `Cannot ${req.method} ${req.originalUrl}` });

package/src/store.js

@@ -8,6 +8,7 @@ const IN_FLIGHT_STATUSES = new Set([
   'preparing_worktree',
   'running',
   'applying_feedback',
+  'awaiting_permission',
 ]);
 
 export class Store {