agent-yes 1.246.5 → 1.247.0

package/dist/SUPPORTED_CLIS-B1DPQLRV.js

@@ -0,0 +1,11 @@
+import "./logger-CDIsZ-Pp.js";
+import "./versionChecker-Du1qdZR9.js";
+import "./ts-rCPxI3aR.js";
+import "./todoAutomation-Buo457VO.js";
+import "./JsonlStore-CPGIR0Wy.js";
+import "./globalPidIndex-D9DOSd-c.js";
+import "./pidStore-vnX0bgra.js";
+import "./messageLog-C-YIzhRj.js";
+import { t as SUPPORTED_CLIS } from "./SUPPORTED_CLIS-DUALQTec.js";
+
+export { SUPPORTED_CLIS };

package/dist/{SUPPORTED_CLIS-ia9b-P1k.js → SUPPORTED_CLIS-DUALQTec.js}

@@ -1,8 +1,8 @@
-import { t as CLIS_CONFIG } from "./ts-B51ZLoJC.js";
+import { t as CLIS_CONFIG } from "./ts-rCPxI3aR.js";
 
 //#region ts/SUPPORTED_CLIS.ts
 const SUPPORTED_CLIS = Object.keys(CLIS_CONFIG);
 
 //#endregion
 export { SUPPORTED_CLIS as t };
-//# sourceMappingURL=SUPPORTED_CLIS-ia9b-P1k.js.map
+//# sourceMappingURL=SUPPORTED_CLIS-DUALQTec.js.map

package/dist/{agentShare-BazKWNQQ.js → agentShare-Clx5QcyE.js}

@@ -3,7 +3,7 @@ import "./globalPidIndex-D9DOSd-c.js";
 import "./messageLog-C-YIzhRj.js";
 import "./e2e-CEIdJGZ7.js";
 import "./configShared-IBbnn9b8.js";
-import { P as resolveOne } from "./subcommands-BL_SWFDC.js";
+import { P as resolveOne } from "./subcommands-DeHlaNOY.js";
 import "./webrtcLink-BMYneHbu.js";
 import "./remotes-BxQnNxQv.js";
 import { a as startShare } from "./share-BGl3wutJ.js";
@@ -229,4 +229,4 @@ function transformEvent(rawEvent, agentId, forwarded) {
 
 //#endregion
 export { createScopedShare, listShares, revokeAllShares, revokeShare };
-//# sourceMappingURL=agentShare-BazKWNQQ.js.map
+//# sourceMappingURL=agentShare-Clx5QcyE.js.map

package/dist/{callback-Csr8_-FG.js → callback-BPAlieXe.js}

@@ -3,10 +3,10 @@ import "./globalPidIndex-D9DOSd-c.js";
 import "./messageLog-C-YIzhRj.js";
 import "./e2e-CEIdJGZ7.js";
 import "./configShared-IBbnn9b8.js";
-import "./subcommands-BL_SWFDC.js";
+import "./subcommands-DeHlaNOY.js";
 import "./webrtcLink-BMYneHbu.js";
 import "./remotes-BxQnNxQv.js";
 import "./callbackCore-Dd28_cBM.js";
-import { i as loadOrCreateCallbackSecret, n as isCallbackRevoked, r as loadCallbackSecretReadOnly, t as cmdCallback } from "./callback-DyyjF-fr.js";
+import { i as loadOrCreateCallbackSecret, n as isCallbackRevoked, r as loadCallbackSecretReadOnly, t as cmdCallback } from "./callback-DPd9PJQA.js";
 
 export { cmdCallback };

package/dist/{callback-DyyjF-fr.js → callback-DPd9PJQA.js}

@@ -1,5 +1,5 @@
 import { t as agentYesHome } from "./agentYesHome-CtmsY6I-.js";
-import { P as resolveOne } from "./subcommands-BL_SWFDC.js";
+import { P as resolveOne } from "./subcommands-DeHlaNOY.js";
 import { a as mintCapability, o as parseExpires } from "./callbackCore-Dd28_cBM.js";
 import { randomBytes } from "node:crypto";
 import { chmodSync, readFileSync, renameSync, writeFileSync } from "node:fs";
@@ -72,7 +72,7 @@ async function resolveBase(flag) {
 	if (flag) return flag;
 	if (process.env.AGENT_YES_CALLBACK_BASE) return process.env.AGENT_YES_CALLBACK_BASE;
 	try {
-		const { resolveLocalServeUrl } = await import("./serve-DyZpvp4C.js");
+		const { resolveLocalServeUrl } = await import("./serve-D_DP0VBy.js");
 		const url = await resolveLocalServeUrl();
 		if (url) return url;
 	} catch {}
@@ -187,4 +187,4 @@ async function cmdCallback(rest) {
 
 //#endregion
 export { loadOrCreateCallbackSecret as i, isCallbackRevoked as n, loadCallbackSecretReadOnly as r, cmdCallback as t };
-//# sourceMappingURL=callback-DyyjF-fr.js.map
+//# sourceMappingURL=callback-DPd9PJQA.js.map

package/dist/cli.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env bun
 import { t as invokedCliName } from "./invokedCli-uqM2YYA7.js";
 import { n as logger } from "./logger-CDIsZ-Pp.js";
-import { i as versionString, n as displayVersion, t as checkAndAutoUpdate } from "./versionChecker-D5ir842c.js";
-import { n as getRustBinary } from "./rustBinary-DuwxRidk.js";
+import { i as versionString, n as displayVersion, t as checkAndAutoUpdate } from "./versionChecker-Du1qdZR9.js";
+import { n as getRustBinary } from "./rustBinary-BU3E3uMi.js";
 import { argv } from "process";
 import { spawn } from "child_process";
 import ms from "ms";
@@ -285,7 +285,7 @@ function buildRustArgs(argv, cliFromScript, supportedClis) {
 	const rawArg = process.argv[2];
 	const managerCommands = !invokedCliName(process.argv);
 	const isHelpFlag = rawArg === "-h" || rawArg === "--help";
-	const { isSubcommand, runSubcommand, cmdHelp, isUnknownManagerToken } = await import("./subcommands-CdWAGc4C.js");
+	const { isSubcommand, runSubcommand, cmdHelp, isUnknownManagerToken } = await import("./subcommands-WJz-UHyC.js");
 	if (isHelpFlag && process.argv.length === 3) {
 		await cmdHelp(managerCommands);
 		process.exit(0);
@@ -295,7 +295,7 @@ function buildRustArgs(argv, cliFromScript, supportedClis) {
 		process.exit(code ?? 0);
 	}
 	{
-		const { SUPPORTED_CLIS } = await import("./SUPPORTED_CLIS-D3b_1q8z.js");
+		const { SUPPORTED_CLIS } = await import("./SUPPORTED_CLIS-B1DPQLRV.js");
 		if (isUnknownManagerToken(rawArg, managerCommands, SUPPORTED_CLIS)) {
 			process.stderr.write(`ay: unknown subcommand or CLI '${rawArg}'.\n    See 'ay help' for subcommands. To run an agent, name a CLI:\n    'ay <cli> …' (e.g. 'ay claude …') or 'ay --cli <cli> …'.\n`);
 			process.exit(1);
@@ -323,7 +323,7 @@ if (config.tray) {
 	ensureTray();
 }
 if (!config.showVersion && !config.appendPrompt && !config.tray) {
-	const { waitForSpawnCapacity } = await import("./spawnGate-Dc3odVqo.js");
+	const { waitForSpawnCapacity } = await import("./spawnGate-Djr4KlF5.js");
 	await waitForSpawnCapacity({
 		onWait: (reason, waitedMs) => {
 			if (config.verbose || waitedMs === 0) console.error(`[agent-yes] spawn gate: ${reason} — waiting…`);
@@ -346,7 +346,7 @@ if (config.useRust) {
 		}
 	}
 	if (rustBinary) {
-		const { SUPPORTED_CLIS } = await import("./SUPPORTED_CLIS-D3b_1q8z.js");
+		const { SUPPORTED_CLIS } = await import("./SUPPORTED_CLIS-B1DPQLRV.js");
 		const rustArgs = buildRustArgs(process.argv, config.cli, SUPPORTED_CLIS);
 		if (config.verbose) {
 			console.log(`[rust] Using binary: ${rustBinary}`);
@@ -411,7 +411,7 @@ if (config.showVersion) {
 	process.exit(0);
 }
 if (config.appendPrompt) {
-	const { PidStore } = await import("./pidStore-bCVS2Ldt.js");
+	const { PidStore } = await import("./pidStore-Bg7wdjxY.js");
 	const ipcPath = await PidStore.findActiveFifo(process.cwd());
 	if (!ipcPath) {
 		console.error("No active agent with IPC found in current directory.");

package/dist/index.js

@@ -1,10 +1,10 @@
 import "./logger-CDIsZ-Pp.js";
-import "./versionChecker-D5ir842c.js";
-import { a as hasTodoStore, c as AgentContext, i as answerAsk, n as agentYes, o as listAsks, r as config, s as listAsksForProject, t as CLIS_CONFIG } from "./ts-B51ZLoJC.js";
+import "./versionChecker-Du1qdZR9.js";
+import { a as hasTodoStore, i as answerAsk, l as AgentContext, n as agentYes, o as listAsks, r as config, s as listAsksForProject, t as CLIS_CONFIG } from "./ts-rCPxI3aR.js";
 import { _ as isKnownKind, a as renderTree, b as statesOf, c as monitorHint, d as openStore, f as DONE_STATE, g as initialState, h as canTransition, i as renderDigest, l as CycleError, m as ORPHANED_STATE, o as unblockedTasks, p as LIFECYCLES, r as openBlockers, s as describeBlock, t as reconcileTodos, u as TodoStore, v as nextStates, x as removeControlCharacters, y as requiredGate } from "./todoAutomation-Buo457VO.js";
 import "./JsonlStore-CPGIR0Wy.js";
 import "./globalPidIndex-D9DOSd-c.js";
-import "./pidStore-6EZd5DUv.js";
+import "./pidStore-vnX0bgra.js";
 import "./messageLog-C-YIzhRj.js";
 
 export { AgentContext, CLIS_CONFIG, CycleError, DONE_STATE, LIFECYCLES, ORPHANED_STATE, TodoStore, answerAsk, canTransition, config, agentYes as default, describeBlock, hasTodoStore, initialState, isKnownKind, listAsks, listAsksForProject, monitorHint, nextStates, openBlockers, openStore, reconcileTodos, removeControlCharacters, renderDigest, renderTree, requiredGate, statesOf, unblockedTasks };

package/dist/{notifyDaemon-DDPfMGlw.js → notifyDaemon-CAML5u0d.js}

@@ -3,7 +3,7 @@ import "./globalPidIndex-D9DOSd-c.js";
 import "./messageLog-C-YIzhRj.js";
 import "./e2e-CEIdJGZ7.js";
 import "./configShared-IBbnn9b8.js";
-import { $ as shouldStealLock, C as listRecords, J as hostId, K as appendEvent, Q as readInbox, X as listInboxParents, Z as liveWatchers, _ as isPidAlive, c as deriveLiveState, et as daemonLockDir, j as renderLogTailLines, nt as notifyDir, q as gcInboxes, tt as daemonLockOwnerPath } from "./subcommands-BL_SWFDC.js";
+import { $ as shouldStealLock, C as listRecords, J as hostId, K as appendEvent, Q as readInbox, X as listInboxParents, Z as liveWatchers, _ as isPidAlive, c as deriveLiveState, et as daemonLockDir, j as renderLogTailLines, nt as notifyDir, q as gcInboxes, tt as daemonLockOwnerPath } from "./subcommands-DeHlaNOY.js";
 import "./webrtcLink-BMYneHbu.js";
 import "./remotes-BxQnNxQv.js";
 import { mkdir, readFile, rename, rm, stat, writeFile } from "fs/promises";
@@ -589,4 +589,4 @@ async function ensureDaemon() {
 
 //#endregion
 export { daemonStatus, ensureDaemon, requestDaemonStop, runDaemon };
-//# sourceMappingURL=notifyDaemon-DDPfMGlw.js.map
+//# sourceMappingURL=notifyDaemon-CAML5u0d.js.map

package/dist/{pidStore-bCVS2Ldt.js → pidStore-Bg7wdjxY.js}

@@ -1,6 +1,6 @@
 import "./logger-CDIsZ-Pp.js";
 import "./JsonlStore-CPGIR0Wy.js";
 import "./globalPidIndex-D9DOSd-c.js";
-import { t as PidStore } from "./pidStore-6EZd5DUv.js";
+import { t as PidStore } from "./pidStore-vnX0bgra.js";
 
 export { PidStore };

package/dist/{pidStore-6EZd5DUv.js → pidStore-vnX0bgra.js}

@@ -24,7 +24,7 @@ var PidStore = class PidStore {
 			logger.warn("[pidStore] Failed to initialize:", error);
 		}
 	}
-	async registerProcess({ pid, cli, args, prompt, cwd, wrapperPid, parentPid }) {
+	async registerProcess({ pid, cli, args, prompt, cwd, wrapperPid, parentPid, permissions }) {
 		const now = Date.now();
 		const argsJson = JSON.stringify(args);
 		const logFile = this.getRawLogPath(pid);
@@ -36,6 +36,7 @@ var PidStore = class PidStore {
 			pid,
 			cli,
 			args: argsJson,
+			permissions,
 			prompt,
 			cwd,
 			logFile,
@@ -67,7 +68,8 @@ var PidStore = class PidStore {
 			started_at: now,
 			wrapper_pid: wrapperPid ?? null,
 			parent_pid: parentPid ?? null,
-			agent_id: agentId
+			agent_id: agentId,
+			permissions: permissions ?? null
 		}).then(() => maybeCompactGlobalPids()).catch(() => null);
 		return result;
 	}
@@ -188,4 +190,4 @@ pid-db/
 
 //#endregion
 export { PidStore as t };
-//# sourceMappingURL=pidStore-6EZd5DUv.js.map
+//# sourceMappingURL=pidStore-vnX0bgra.js.map

package/dist/{rustBinary-DuwxRidk.js → rustBinary-BU3E3uMi.js}

@@ -1,4 +1,4 @@
-import { r as getInstalledPackage } from "./versionChecker-D5ir842c.js";
+import { r as getInstalledPackage } from "./versionChecker-Du1qdZR9.js";
 import { execFileSync } from "child_process";
 import { existsSync, mkdirSync, unlinkSync } from "fs";
 import { chmod, copyFile } from "fs/promises";
@@ -225,4 +225,4 @@ async function getRustBinary(options = {}) {
 
 //#endregion
 export { getRustBinary as n, findSpawnHiddenLauncher as t };
-//# sourceMappingURL=rustBinary-DuwxRidk.js.map
+//# sourceMappingURL=rustBinary-BU3E3uMi.js.map

package/dist/{schedule-CWBHxQxk.js → schedule-C8wzhq0y.js}

@@ -1,13 +1,13 @@
 import "./logger-CDIsZ-Pp.js";
-import "./versionChecker-D5ir842c.js";
-import "./ts-B51ZLoJC.js";
+import "./versionChecker-Du1qdZR9.js";
+import "./ts-rCPxI3aR.js";
 import "./todoAutomation-Buo457VO.js";
 import "./JsonlStore-CPGIR0Wy.js";
 import "./globalPidIndex-D9DOSd-c.js";
-import "./pidStore-6EZd5DUv.js";
+import "./pidStore-vnX0bgra.js";
 import "./messageLog-C-YIzhRj.js";
-import { t as SUPPORTED_CLIS } from "./SUPPORTED_CLIS-ia9b-P1k.js";
-import { d as resolveSpawnCwd } from "./workspaceConfig-DOHygA2x.js";
+import { t as SUPPORTED_CLIS } from "./SUPPORTED_CLIS-DUALQTec.js";
+import { f as resolveSpawnCwd } from "./workspaceConfig-CpilQzMY.js";
 import { n as liveEnv, t as ensureNodeRuntime } from "./nodeRuntime-BtL6Oo1o.js";
 import { createHash } from "node:crypto";
 
@@ -153,4 +153,4 @@ async function cmdSchedule(rest) {
 
 //#endregion
 export { cmdSchedule };
-//# sourceMappingURL=schedule-CWBHxQxk.js.map
+//# sourceMappingURL=schedule-C8wzhq0y.js.map

package/dist/{serve-DyZpvp4C.js → serve-D_DP0VBy.js}

@@ -1,25 +1,25 @@
 import "./logger-CDIsZ-Pp.js";
-import { r as getInstalledPackage } from "./versionChecker-D5ir842c.js";
-import { t as findSpawnHiddenLauncher } from "./rustBinary-DuwxRidk.js";
-import { i as answerAsk, l as CLAUDE_SESSION_PIN_ENV, o as listAsks } from "./ts-B51ZLoJC.js";
+import { r as getInstalledPackage } from "./versionChecker-Du1qdZR9.js";
+import { t as findSpawnHiddenLauncher } from "./rustBinary-BU3E3uMi.js";
+import { c as permissionBadge, i as answerAsk, o as listAsks, u as CLAUDE_SESSION_PIN_ENV } from "./ts-rCPxI3aR.js";
 import { t as agentYesHome$1 } from "./agentYesHome-CtmsY6I-.js";
 import { x as removeControlCharacters } from "./todoAutomation-Buo457VO.js";
 import "./JsonlStore-CPGIR0Wy.js";
 import { a as updateGlobalPidStatus } from "./globalPidIndex-D9DOSd-c.js";
-import "./pidStore-6EZd5DUv.js";
+import "./pidStore-vnX0bgra.js";
 import { r as recordInbox } from "./messageLog-C-YIzhRj.js";
 import { t as pgidForWrapper } from "./reaper-DP49VCKx.js";
 import "./e2e-CEIdJGZ7.js";
 import "./configShared-IBbnn9b8.js";
-import { t as SUPPORTED_CLIS } from "./SUPPORTED_CLIS-ia9b-P1k.js";
-import { A as recentReadEdges, C as listRecords, D as readNotes, G as writeToIpc, M as renderRawLog, N as renderRawLogLines, O as readPtysize, P as resolveOne, Y as isTransientLockMkdirError, f as extractNeedsInput, j as renderLogTailLines, k as recentMessageEdges, l as deriveLiveStatus, o as controlCodeFromName, p as extractTaskCounts, rt as TYPING_BADGE, u as extractBadges, x as isUserTyping, z as snapshotStatus } from "./subcommands-BL_SWFDC.js";
+import { t as SUPPORTED_CLIS } from "./SUPPORTED_CLIS-DUALQTec.js";
+import { A as recentReadEdges, C as listRecords, D as readNotes, G as writeToIpc, M as renderRawLog, N as renderRawLogLines, O as readPtysize, P as resolveOne, Y as isTransientLockMkdirError, f as extractNeedsInput, j as renderLogTailLines, k as recentMessageEdges, l as deriveLiveStatus, o as controlCodeFromName, p as extractTaskCounts, rt as TYPING_BADGE, u as extractBadges, x as isUserTyping, z as snapshotStatus } from "./subcommands-DeHlaNOY.js";
 import "./webrtcLink-BMYneHbu.js";
 import "./remotes-BxQnNxQv.js";
 import { i as frameVisitorMessage, s as verifyCapability, t as MAX_CALLBACK_MSG_BYTES } from "./callbackCore-Dd28_cBM.js";
-import { n as isCallbackRevoked, r as loadCallbackSecretReadOnly } from "./callback-DyyjF-fr.js";
-import { a as getSpawnHook, c as hasProvisionHook, d as resolveSpawnCwd, i as getProvisionRoot, l as hasSpawnHook, r as getProvisionHook, u as isProvisionAllowed } from "./workspaceConfig-DOHygA2x.js";
+import { n as isCallbackRevoked, r as loadCallbackSecretReadOnly } from "./callback-DPd9PJQA.js";
+import { a as getProvisionRoot, d as isProvisionAllowed, f as resolveSpawnCwd, i as getProvisionHook, l as hasProvisionHook, o as getSpawnHook, t as allowsSkipPermissions, u as hasSpawnHook } from "./workspaceConfig-CpilQzMY.js";
 import { n as liveEnv, t as ensureNodeRuntime } from "./nodeRuntime-BtL6Oo1o.js";
-import { r as spawnRejectionReason } from "./spawnGate-BxgS_GlF.js";
+import { r as spawnRejectionReason } from "./spawnGate-BFJPdHCQ.js";
 import yargs from "yargs";
 import { appendFile, mkdir, open, readFile, readdir, rename, rm, stat, unlink, writeFile } from "fs/promises";
 import { arch, cpus, freemem, homedir, hostname, loadavg, platform, totalmem, uptime, userInfo } from "os";
@@ -2151,7 +2151,11 @@ Options:
 				size: await sizeOf(r.pid),
 				inputs: [textIn, envIn],
 				outputs: [textOut],
-				renderHints: await hintsOf(r)
+				renderHints: await hintsOf(r),
+				configPublic: {
+					permissions: r.permissions ?? null,
+					permissionBadge: permissionBadge(r.permissions)
+				}
 			})));
 			nodes.push({
 				id: envNodeId,
@@ -2181,7 +2185,8 @@ Options:
 						kill: true,
 						spawn: true,
 						spawnHook: hasSpawnHook(),
-						provision: hasProvisionHook()
+						provision: hasProvisionHook(),
+						skipPermissions: allowsSkipPermissions()
 					}
 				}
 			});
@@ -2296,11 +2301,12 @@ Options:
 				kill: true,
 				spawn: true,
 				spawnHook: hasSpawnHook(),
-				provision: hasProvisionHook()
+				provision: hasProvisionHook(),
+				skipPermissions: allowsSkipPermissions()
 			}
 		});
 		if (req.method === "GET" && p === "/api/ws") {
-			const ws = await import("./ws-C6gfqPHM.js");
+			const ws = await import("./ws-1vGWz9c9.js");
 			try {
 				await ws.loadProvision();
 			} catch (e) {
@@ -2320,7 +2326,7 @@ Options:
 		if (req.method === "GET" && p === "/api/ws/status") {
 			const dirRaw = url.searchParams.get("path");
 			if (!dirRaw) return new Response("missing ?path=<workspace dir>", { status: 400 });
-			const ws = await import("./ws-C6gfqPHM.js");
+			const ws = await import("./ws-1vGWz9c9.js");
 			let prov;
 			try {
 				prov = await ws.loadProvision();
@@ -2888,6 +2894,8 @@ Options:
 			const cli = String(body.cli ?? "claude");
 			if (!SUPPORTED_CLIS.includes(cli)) return new Response(`unsupported cli: ${cli}`, { status: 400 });
 			const prompt = String(body.prompt ?? "");
+			const wantsSkipPermissions = body.yes === true;
+			if (wantsSkipPermissions && !allowsSkipPermissions()) return new Response("this environment does not permit skip-permissions agents (caps.skipPermissions=false) — spawn without `yes`, or set \"allowSkipPermissions\": true in ~/.agent-yes/config.json (or AGENT_YES_ALLOW_SKIP_PERMISSIONS=1) on the host", { status: 403 });
 			const reject = await spawnRejectionReason();
 			if (reject) return new Response(reject, { status: 429 });
 			let cwd;
@@ -2983,6 +2991,7 @@ Options:
 			const ayBin = Bun.which("ay") ?? process.argv[1];
 			const agentArgv = [
 				...process.platform === "win32" && ayBin.toLowerCase().endsWith(".exe") ? [ayBin] : [process.execPath, ayBin],
+				...wantsSkipPermissions ? ["-y"] : [],
 				cli,
 				...prompt ? ["--", prompt] : []
 			];
@@ -3070,7 +3079,7 @@ Options:
 			const perm = body.perm ?? "r";
 			if (perm !== "r" && perm !== "rw") return new Response(`invalid perm ${perm} (want r or rw)`, { status: 400 });
 			try {
-				const { createScopedShare } = await import("./agentShare-BazKWNQQ.js");
+				const { createScopedShare } = await import("./agentShare-Clx5QcyE.js");
 				const share = await createScopedShare({
 					agent: body.agent,
 					perm,
@@ -3085,12 +3094,12 @@ Options:
 			}
 		}
 		if (req.method === "GET" && p === "/api/shares") {
-			const { listShares } = await import("./agentShare-BazKWNQQ.js");
+			const { listShares } = await import("./agentShare-Clx5QcyE.js");
 			return Response.json(listShares());
 		}
 		const revokeM = /^\/api\/share\/([^/]+)$/.exec(p);
 		if (req.method === "DELETE" && revokeM) {
-			const { revokeShare } = await import("./agentShare-BazKWNQQ.js");
+			const { revokeShare } = await import("./agentShare-Clx5QcyE.js");
 			const ok = revokeShare(decodeURIComponent(revokeM[1]));
 			return new Response(ok ? "revoked" : "no such share", { status: ok ? 200 : 404 });
 		}
@@ -3392,7 +3401,7 @@ Options:
 	const shutdown = (resolve) => {
 		if (heartbeat) clearInterval(heartbeat);
 		closeShare?.();
-		import("./agentShare-BazKWNQQ.js").then((m) => m.revokeAllShares()).catch(() => {});
+		import("./agentShare-Clx5QcyE.js").then((m) => m.revokeAllShares()).catch(() => {});
 		server?.stop();
 		Promise.resolve(releaseHostLock?.()).catch(() => {}).then(resolve);
 	};
@@ -3405,4 +3414,4 @@ Options:
 
 //#endregion
 export { cmdServe, loadTokenReadOnly, mintScopedTermToken, resolveDaemonHttpBase, resolveLocalServeUrl };
-//# sourceMappingURL=serve-DyZpvp4C.js.map
+//# sourceMappingURL=serve-D_DP0VBy.js.map

package/dist/{setup-JqletyDD.js → setup-DIa8Y-lx.js}

@@ -1,4 +1,4 @@
-import { f as setWorkspaceRoot, s as getWorkspaceRoot } from "./workspaceConfig-DOHygA2x.js";
+import { c as getWorkspaceRoot, p as setWorkspaceRoot } from "./workspaceConfig-CpilQzMY.js";
 import { existsSync } from "node:fs";
 import { stdin, stdout } from "node:process";
 import { createInterface } from "node:readline/promises";
@@ -32,7 +32,7 @@ async function cmdSetup(rest) {
 	if (!existsSync(abs)) process.stderr.write(`  note: that directory doesn't exist yet — create it, or agents spawned there will fail\n`);
 	if (noShare) return 0;
 	process.stdout.write(`\nsharing this machine to agent-yes.com…\n`);
-	const { cmdServe } = await import("./serve-DyZpvp4C.js");
+	const { cmdServe } = await import("./serve-D_DP0VBy.js");
 	return cmdServe([
 		"install",
 		"--share",
@@ -42,4 +42,4 @@ async function cmdSetup(rest) {
 
 //#endregion
 export { cmdSetup };
-//# sourceMappingURL=setup-JqletyDD.js.map
+//# sourceMappingURL=setup-DIa8Y-lx.js.map

package/dist/{spawnGate-BxgS_GlF.js → spawnGate-BFJPdHCQ.js}

@@ -1,5 +1,5 @@
 import { i as readGlobalPids } from "./globalPidIndex-D9DOSd-c.js";
-import { n as getMinFreeMb, o as getSpawnWaitMs, t as getMaxAgents } from "./workspaceConfig-DOHygA2x.js";
+import { n as getMaxAgents, r as getMinFreeMb, s as getSpawnWaitMs } from "./workspaceConfig-CpilQzMY.js";
 import { readFile } from "fs/promises";
 
 //#region ts/spawnGate.ts
@@ -104,4 +104,4 @@ async function waitForSpawnCapacity(opts) {
 
 //#endregion
 export { waitForSpawnCapacity as i, spawnGateEnabled as n, spawnRejectionReason as r, memAvailableMb as t };
-//# sourceMappingURL=spawnGate-BxgS_GlF.js.map
+//# sourceMappingURL=spawnGate-BFJPdHCQ.js.map

package/dist/{spawnGate-Dc3odVqo.js → spawnGate-Djr4KlF5.js}

@@ -1,5 +1,5 @@
 import "./logger-CDIsZ-Pp.js";
 import "./globalPidIndex-D9DOSd-c.js";
-import { i as waitForSpawnCapacity, n as spawnGateEnabled, r as spawnRejectionReason, t as memAvailableMb } from "./spawnGate-BxgS_GlF.js";
+import { i as waitForSpawnCapacity, n as spawnGateEnabled, r as spawnRejectionReason, t as memAvailableMb } from "./spawnGate-BFJPdHCQ.js";
 
 export { waitForSpawnCapacity };

package/dist/{subcommands-BL_SWFDC.js → subcommands-DeHlaNOY.js}

@@ -1267,31 +1267,31 @@ async function runSubcommand(argv) {
 				return cmdCh(rest);
 			}
 			case "term": {
-				const { cmdTerm } = await import("./terminal-BFq0mWdQ.js");
+				const { cmdTerm } = await import("./terminal-MnictO_E.js");
 				return cmdTerm(rest);
 			}
 			case "widget": {
-				const { cmdWidget } = await import("./widget-BXlREJHQ.js");
+				const { cmdWidget } = await import("./widget-U6HkHQcz.js");
 				return cmdWidget(rest);
 			}
 			case "mint": {
-				const { cmdMint } = await import("./widget-BXlREJHQ.js");
+				const { cmdMint } = await import("./widget-U6HkHQcz.js");
 				return cmdMint(rest);
 			}
 			case "serve": {
-				const { cmdServe } = await import("./serve-DyZpvp4C.js");
+				const { cmdServe } = await import("./serve-D_DP0VBy.js");
 				return cmdServe(rest);
 			}
 			case "setup": {
-				const { cmdSetup } = await import("./setup-JqletyDD.js");
+				const { cmdSetup } = await import("./setup-DIa8Y-lx.js");
 				return cmdSetup(rest);
 			}
 			case "ws": {
-				const { cmdWs } = await import("./ws-C6gfqPHM.js");
+				const { cmdWs } = await import("./ws-1vGWz9c9.js");
 				return cmdWs(rest);
 			}
 			case "schedule": {
-				const { cmdSchedule } = await import("./schedule-CWBHxQxk.js");
+				const { cmdSchedule } = await import("./schedule-C8wzhq0y.js");
 				return cmdSchedule(rest);
 			}
 			case "remote": {
@@ -1303,7 +1303,7 @@ async function runSubcommand(argv) {
 				return cmdExpose(rest);
 			}
 			case "callback": {
-				const { cmdCallback } = await import("./callback-Csr8_-FG.js");
+				const { cmdCallback } = await import("./callback-BPAlieXe.js");
 				return cmdCallback(rest);
 			}
 			case "reap":
@@ -3706,7 +3706,7 @@ async function cmdAttach(rest) {
 	const winsizeDir = path.join(ayHome, "winsize");
 	await mkdir(winsizeDir, { recursive: true });
 	const winsizePath = path.join(winsizeDir, String(record.pid));
-	const { resolveDaemonHttpBase, loadTokenReadOnly } = await import("./serve-DyZpvp4C.js");
+	const { resolveDaemonHttpBase, loadTokenReadOnly } = await import("./serve-D_DP0VBy.js");
 	const daemonBase = await resolveDaemonHttpBase().catch(() => null);
 	const daemonToken = daemonBase ? await loadTokenReadOnly().catch(() => null) ?? "" : "";
 	const capViewer = `attach:${process.pid}`;
@@ -4403,7 +4403,7 @@ async function cmdNotify(rest) {
 	}
 	const ensure = async () => {
 		if (!argv["ensure-daemon"]) return;
-		const { ensureDaemon } = await import("./notifyDaemon-DDPfMGlw.js");
+		const { ensureDaemon } = await import("./notifyDaemon-CAML5u0d.js");
 		await ensureDaemon().catch(() => null);
 	};
 	await heartbeatWatcher(parent, selfStartedAt);
@@ -4477,7 +4477,7 @@ async function cmdNotifyCursor(args) {
 }
 async function cmdNotifyd(rest) {
 	const sub = rest[0] ?? "status";
-	const daemon = await import("./notifyDaemon-DDPfMGlw.js");
+	const daemon = await import("./notifyDaemon-CAML5u0d.js");
 	switch (sub) {
 		case "run": return daemon.runDaemon();
 		case "once": return daemon.runDaemon({ once: true });
@@ -4504,4 +4504,4 @@ async function cmdNotifyd(rest) {
 
 //#endregion
 export { shouldStealLock as $, recentReadEdges as A, stdinActivityPath as B, listRecords as C, readNotes as D, readAgentPtysize as E, resolveReadWindow as F, writeToIpc as G, submitAndConfirm as H, resolveResumeArgs as I, hostId as J, appendEvent as K, restartHintLines as L, renderRawLog as M, renderRawLogLines as N, readPtysize as O, resolveOne as P, readInbox as Q, runSubcommand as R, lastStdinAt as S, menuSelectKeys as T, waitForLogQuiet as U, stopTipForCli as V, writeKeysPaced as W, listInboxParents as X, isTransientLockMkdirError as Y, liveWatchers as Z, isPidAlive as _, cmdHelp as a, isUnknownManagerToken as b, deriveLiveState as c, extractMenu as d, daemonLockDir as et, extractNeedsInput as f, isExitRequest as g, isAgentStuck as h, backoffWhileTyping as i, renderLogTailLines as j, recentMessageEdges as k, deriveLiveStatus as l, finalizedLines as m, READ_PAGE_DEFAULT as n, notifyDir as nt, controlCodeFromName as o, extractTaskCounts as p, gcInboxes as q, TYPING_WINDOW_MS as r, TYPING_BADGE as rt, cursorAbs as s, GRACEFUL_EXIT_COMMANDS as t, daemonLockOwnerPath as tt, extractBadges as u, isSlashCommand as v, matchKeyword as w, isUserTyping as x, isSubcommand as y, snapshotStatus as z };
-//# sourceMappingURL=subcommands-BL_SWFDC.js.map
+//# sourceMappingURL=subcommands-DeHlaNOY.js.map

package/dist/{subcommands-CdWAGc4C.js → subcommands-WJz-UHyC.js}

@@ -3,7 +3,7 @@ import "./globalPidIndex-D9DOSd-c.js";
 import "./messageLog-C-YIzhRj.js";
 import "./e2e-CEIdJGZ7.js";
 import "./configShared-IBbnn9b8.js";
-import { A as recentReadEdges, B as stdinActivityPath, C as listRecords, D as readNotes, E as readAgentPtysize, F as resolveReadWindow, G as writeToIpc, H as submitAndConfirm, I as resolveResumeArgs, L as restartHintLines, M as renderRawLog, N as renderRawLogLines, O as readPtysize, P as resolveOne, R as runSubcommand, S as lastStdinAt, T as menuSelectKeys, U as waitForLogQuiet, V as stopTipForCli, W as writeKeysPaced, _ as isPidAlive, a as cmdHelp, b as isUnknownManagerToken, c as deriveLiveState, d as extractMenu, f as extractNeedsInput, g as isExitRequest, h as isAgentStuck, i as backoffWhileTyping, j as renderLogTailLines, k as recentMessageEdges, l as deriveLiveStatus, m as finalizedLines, n as READ_PAGE_DEFAULT, o as controlCodeFromName, p as extractTaskCounts, r as TYPING_WINDOW_MS, s as cursorAbs, t as GRACEFUL_EXIT_COMMANDS, u as extractBadges, v as isSlashCommand, w as matchKeyword, x as isUserTyping, y as isSubcommand, z as snapshotStatus } from "./subcommands-BL_SWFDC.js";
+import { A as recentReadEdges, B as stdinActivityPath, C as listRecords, D as readNotes, E as readAgentPtysize, F as resolveReadWindow, G as writeToIpc, H as submitAndConfirm, I as resolveResumeArgs, L as restartHintLines, M as renderRawLog, N as renderRawLogLines, O as readPtysize, P as resolveOne, R as runSubcommand, S as lastStdinAt, T as menuSelectKeys, U as waitForLogQuiet, V as stopTipForCli, W as writeKeysPaced, _ as isPidAlive, a as cmdHelp, b as isUnknownManagerToken, c as deriveLiveState, d as extractMenu, f as extractNeedsInput, g as isExitRequest, h as isAgentStuck, i as backoffWhileTyping, j as renderLogTailLines, k as recentMessageEdges, l as deriveLiveStatus, m as finalizedLines, n as READ_PAGE_DEFAULT, o as controlCodeFromName, p as extractTaskCounts, r as TYPING_WINDOW_MS, s as cursorAbs, t as GRACEFUL_EXIT_COMMANDS, u as extractBadges, v as isSlashCommand, w as matchKeyword, x as isUserTyping, y as isSubcommand, z as snapshotStatus } from "./subcommands-DeHlaNOY.js";
 import "./webrtcLink-BMYneHbu.js";
 import "./remotes-BxQnNxQv.js";
 

package/dist/{terminal-BFq0mWdQ.js → terminal-MnictO_E.js}

@@ -98,7 +98,7 @@ async function cmdTermMint(args) {
 	if (flags.ro && flags.interactive) throw new Error("--ro and --interactive are mutually exclusive");
 	const ttlSec = parseTtlSec(typeof flags.ttl === "string" ? flags.ttl : "15m");
 	const canSend = flags.interactive === true;
-	const { mintScopedTermToken } = await import("./serve-DyZpvp4C.js");
+	const { mintScopedTermToken } = await import("./serve-D_DP0VBy.js");
 	const r = await mintScopedTermToken(pid, {
 		ttlSec,
 		canSend
@@ -135,4 +135,4 @@ async function cmdTerm(args) {
 
 //#endregion
 export { cmdTerm };
-//# sourceMappingURL=terminal-BFq0mWdQ.js.map
+//# sourceMappingURL=terminal-MnictO_E.js.map

package/dist/{ts-B51ZLoJC.js → ts-rCPxI3aR.js}

@@ -1,11 +1,11 @@
 import { n as __esmMin, r as __exportAll } from "./chunk-cZBX9HZv.js";
 import { n as logger, t as addTransport } from "./logger-CDIsZ-Pp.js";
-import { r as getInstalledPackage } from "./versionChecker-D5ir842c.js";
+import { r as getInstalledPackage } from "./versionChecker-Du1qdZR9.js";
 import { t as agentYesHome } from "./agentYesHome-CtmsY6I-.js";
 import { d as openStore, p as LIFECYCLES, x as removeControlCharacters } from "./todoAutomation-Buo457VO.js";
 import { i as shouldUseLock, r as releaseLock, t as acquireLock } from "./runningLock-DBoONoM-.js";
 import { i as readGlobalPids } from "./globalPidIndex-D9DOSd-c.js";
-import { t as PidStore } from "./pidStore-6EZd5DUv.js";
+import { t as PidStore } from "./pidStore-vnX0bgra.js";
 import { r as recordInbox } from "./messageLog-C-YIzhRj.js";
 import { n as register, r as sweep } from "./reaper-DP49VCKx.js";
 import { arch, platform } from "process";
@@ -1252,6 +1252,49 @@ async function notifyWebhook(status, details, cwd = process.cwd()) {
 	}
 }
 
+//#endregion
+//#region ts/agentPermissions.ts
+/**
+* Flags that disable a CLI's confirmation gate, recognised regardless of what
+* `yesArgs` the config declares.
+*
+* The configured `yesArgs` are the flags `-y` APPENDS; a user is free to pass
+* the same flag directly, and a config that omits `yesArgs` entirely (some CLIs
+* deliberately have none) must not make a genuinely dangerous flag invisible.
+* So the check is the union: configured flags OR any of these.
+*/
+const DANGEROUS_FLAGS = new Set([
+	"--dangerously-skip-permissions",
+	"--dangerously-bypass-approvals-and-sandbox",
+	"--yolo",
+	"--full-auto"
+]);
+/** `--flag=value` and `--flag value` must compare equal — match on the flag part. */
+function flagName(arg) {
+	const eq = arg.indexOf("=");
+	return eq === -1 ? arg : arg.slice(0, eq);
+}
+function derivePermissions(opts) {
+	const configured = new Set((opts.yesArgs ?? []).map(flagName).filter(Boolean));
+	return {
+		skip_permissions: opts.cliArgs.some((a) => {
+			const name = flagName(a);
+			return configured.has(name) || DANGEROUS_FLAGS.has(name);
+		}),
+		robust: Boolean(opts.robust),
+		auto_continue: Boolean(opts.autoContinue)
+	};
+}
+/**
+* One-word posture for a badge. `skip` is the only one that changes what the
+* agent is ALLOWED to do; the wrapper flags change only how it recovers, so
+* they never soften the label.
+*/
+function permissionBadge(p) {
+	if (!p) return null;
+	return p.skip_permissions ? "skip" : "prompt";
+}
+
 //#endregion
 //#region ts/askApi.ts
 /**
@@ -1548,7 +1591,13 @@ async function agentYes({ cli, cliArgs = [], skipPermissions = false, prompt, ro
 			prompt,
 			cwd: workingDir,
 			wrapperPid: process.pid,
-			parentPid
+			parentPid,
+			permissions: derivePermissions({
+				cliArgs,
+				yesArgs: cliConf.yesArgs,
+				robust,
+				autoContinue: Boolean(robust && cliConf.restoreArgs?.length)
+			})
 		});
 	} catch (error) {
 		logger.warn(`[pidStore] Failed to register process ${shell.pid}:`, error);
@@ -2105,5 +2154,5 @@ function sleep(ms) {
 }
 
 //#endregion
-export { hasTodoStore as a, AgentContext as c, answerAsk as i, CLAUDE_SESSION_PIN_ENV as l, agentYes as n, listAsks as o, config as r, listAsksForProject as s, CLIS_CONFIG as t };
-//# sourceMappingURL=ts-B51ZLoJC.js.map
+export { hasTodoStore as a, permissionBadge as c, answerAsk as i, AgentContext as l, agentYes as n, listAsks as o, config as r, listAsksForProject as s, CLIS_CONFIG as t, CLAUDE_SESSION_PIN_ENV as u };
+//# sourceMappingURL=ts-rCPxI3aR.js.map

package/dist/{versionChecker-D5ir842c.js → versionChecker-Du1qdZR9.js}

@@ -7,7 +7,7 @@ import { fileURLToPath } from "url";
 
 //#region package.json
 var name = "agent-yes";
-var version = "1.246.5";
+var version = "1.247.0";
 
 //#endregion
 //#region ts/versionChecker.ts
@@ -215,4 +215,4 @@ async function displayVersion() {
 
 //#endregion
 export { versionString as i, displayVersion as n, getInstalledPackage as r, checkAndAutoUpdate as t };
-//# sourceMappingURL=versionChecker-D5ir842c.js.map
+//# sourceMappingURL=versionChecker-Du1qdZR9.js.map

package/dist/{widget-BXlREJHQ.js → widget-U6HkHQcz.js}

@@ -28,7 +28,7 @@ function parseFlags(args, known) {
 }
 /** Resolve the local daemon base URL + token (flags override discovery). */
 async function daemonTarget(flags) {
-	const { resolveDaemonHttpBase, loadTokenReadOnly } = await import("./serve-DyZpvp4C.js");
+	const { resolveDaemonHttpBase, loadTokenReadOnly } = await import("./serve-D_DP0VBy.js");
 	const base = typeof flags.base === "string" ? flags.base : await resolveDaemonHttpBase();
 	if (!base) throw new Error("no running ay serve daemon found — start `ay serve` or pass --base <url> (e.g. http://127.0.0.1:PORT)");
 	const token = typeof flags.token === "string" ? flags.token : await loadTokenReadOnly() ?? "";
@@ -186,7 +186,7 @@ async function cmdMint(args) {
 	const bad = caps.filter((c) => !KNOWN_CAPS.has(c));
 	if (bad.length) throw new Error(`unknown cap(s): ${bad.join(", ")} (valid: ${[...KNOWN_CAPS].join(", ")})`);
 	const ttlSec = parseTtlSec(typeof flags.ttl === "string" ? flags.ttl : "15m");
-	const { mintScopedTermToken } = await import("./serve-DyZpvp4C.js");
+	const { mintScopedTermToken } = await import("./serve-D_DP0VBy.js");
 	const r = await mintScopedTermToken(target, {
 		ttlSec,
 		caps
@@ -202,4 +202,4 @@ async function cmdMint(args) {
 
 //#endregion
 export { cmdMint, cmdWidget };
-//# sourceMappingURL=widget-BXlREJHQ.js.map
+//# sourceMappingURL=widget-U6HkHQcz.js.map

package/dist/{workspaceConfig-DOHygA2x.js → workspaceConfig-CpilQzMY.js}

@@ -190,7 +190,29 @@ function resolveSpawnCwd(input) {
 	if (v.includes("/") || v.includes("\\") || path.isAbsolute(v)) return path.resolve(v);
 	return path.join(root, v);
 }
+/**
+* Whether this environment permits spawning agents that skip the CLI's own
+* permission gate (`-y` / `--dangerously-skip-permissions` and equivalents).
+*
+* This is an ENVIRONMENT capability, not a per-request preference: a restricted
+* host publishes `caps.skipPermissions: false` on its env node and `/api/spawn`
+* refuses such a request, host-enforced the way agentShare's default-deny is.
+* A client can't talk its way past it by asking differently.
+*
+* Defaults to TRUE so nothing changes for an existing host — restricting is an
+* explicit opt-in, via `~/.agent-yes/config.json` (`"allowSkipPermissions": false`)
+* or env `AGENT_YES_ALLOW_SKIP_PERMISSIONS=0`. Only an explicit falsy value
+* restricts; anything unset or unparseable leaves the environment permissive
+* rather than silently locking spawns out.
+*
+* Issue #236.
+*/
+function allowsSkipPermissions() {
+	const raw = process.env.AGENT_YES_ALLOW_SKIP_PERMISSIONS?.trim();
+	if (raw !== void 0 && raw !== "") return !/^(0|false|no|off)$/i.test(raw);
+	return readConfig().allowSkipPermissions !== false;
+}
 
 //#endregion
-export { getSpawnHook as a, hasProvisionHook as c, resolveSpawnCwd as d, setWorkspaceRoot as f, getProvisionRoot as i, hasSpawnHook as l, getMinFreeMb as n, getSpawnWaitMs as o, getProvisionHook as r, getWorkspaceRoot as s, getMaxAgents as t, isProvisionAllowed as u };
-//# sourceMappingURL=workspaceConfig-DOHygA2x.js.map
+export { getProvisionRoot as a, getWorkspaceRoot as c, isProvisionAllowed as d, resolveSpawnCwd as f, getProvisionHook as i, hasProvisionHook as l, getMaxAgents as n, getSpawnHook as o, setWorkspaceRoot as p, getMinFreeMb as r, getSpawnWaitMs as s, allowsSkipPermissions as t, hasSpawnHook as u };
+//# sourceMappingURL=workspaceConfig-CpilQzMY.js.map

package/dist/{ws-C6gfqPHM.js → ws-1vGWz9c9.js}

@@ -3,10 +3,10 @@ import "./globalPidIndex-D9DOSd-c.js";
 import "./messageLog-C-YIzhRj.js";
 import "./e2e-CEIdJGZ7.js";
 import "./configShared-IBbnn9b8.js";
-import { C as listRecords } from "./subcommands-BL_SWFDC.js";
+import { C as listRecords } from "./subcommands-DeHlaNOY.js";
 import "./webrtcLink-BMYneHbu.js";
 import "./remotes-BxQnNxQv.js";
-import { i as getProvisionRoot } from "./workspaceConfig-DOHygA2x.js";
+import { a as getProvisionRoot } from "./workspaceConfig-CpilQzMY.js";
 import { existsSync } from "fs";
 import { lstat, opendir } from "fs/promises";
 import path from "path";
@@ -418,4 +418,4 @@ async function cmdWs(args) {
 
 //#endregion
 export { WS_JSON_SCHEMA, cmdWs, collectWorkspaces, isPathInside, loadProvision, workspaceStatus };
-//# sourceMappingURL=ws-C6gfqPHM.js.map
+//# sourceMappingURL=ws-1vGWz9c9.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-yes",
-  "version": "1.246.5",
+  "version": "1.247.0",
   "description": "A wrapper tool that automates interactions with various AI CLI tools by automatically handling common prompts and responses.",
   "keywords": [
     "ai",

package/ts/agentPermissions.spec.ts

@@ -0,0 +1,117 @@
+import { afterEach, describe, expect, it } from "vitest";
+import { derivePermissions, permissionBadge } from "./agentPermissions.ts";
+import { allowsSkipPermissions } from "./workspaceConfig.ts";
+
+// Issue #236. The pid record is the only place the answer to "was this agent
+// allowed to act without confirmation?" survives — the global index carries no
+// argv, and the wrapper's own flags never reach the CLI's args at all.
+
+describe("derivePermissions", () => {
+  const YES = ["--dangerously-skip-permissions"];
+
+  it("detects the configured yolo flag", () => {
+    expect(
+      derivePermissions({ cliArgs: ["--print", ...YES], yesArgs: YES }).skip_permissions,
+    ).toBe(true);
+  });
+
+  it("detects a dangerous flag the config never declared", () => {
+    // A CLI with no yesArgs must still not hide a flag that disables its gate —
+    // the check is the union of configured and known-dangerous, not just config.
+    expect(derivePermissions({ cliArgs: ["--yolo"] }).skip_permissions).toBe(true);
+    expect(
+      derivePermissions({ cliArgs: ["--dangerously-bypass-approvals-and-sandbox"] })
+        .skip_permissions,
+    ).toBe(true);
+  });
+
+  it("matches the flag part of an --flag=value form", () => {
+    expect(derivePermissions({ cliArgs: ["--full-auto=true"] }).skip_permissions).toBe(true);
+  });
+
+  it("does not flag ordinary args", () => {
+    expect(
+      derivePermissions({ cliArgs: ["--model", "opus", "--continue"], yesArgs: YES })
+        .skip_permissions,
+    ).toBe(false);
+    expect(derivePermissions({ cliArgs: [] }).skip_permissions).toBe(false);
+  });
+
+  it("records the wrapper flags independently of the CLI's", () => {
+    const p = derivePermissions({ cliArgs: [], robust: true, autoContinue: true });
+    expect(p).toEqual({ skip_permissions: false, robust: true, auto_continue: true });
+  });
+
+  it("defaults every flag to false rather than undefined", () => {
+    // The record is serialized to JSON and read by both runtimes; an absent
+    // boolean would read as "unknown" where we mean "no".
+    expect(derivePermissions({ cliArgs: [] })).toEqual({
+      skip_permissions: false,
+      robust: false,
+      auto_continue: false,
+    });
+  });
+
+  it("ignores an empty yesArgs entry rather than matching everything", () => {
+    // A config with a stray "" must not make every arg look like a yolo flag.
+    expect(derivePermissions({ cliArgs: ["--model"], yesArgs: [""] }).skip_permissions).toBe(false);
+  });
+});
+
+describe("permissionBadge", () => {
+  it("reports skip only when the CLI gate is off", () => {
+    expect(permissionBadge({ skip_permissions: true, robust: false, auto_continue: false })).toBe(
+      "skip",
+    );
+    expect(permissionBadge({ skip_permissions: false, robust: false, auto_continue: false })).toBe(
+      "prompt",
+    );
+  });
+
+  it("never lets the wrapper flags soften the label", () => {
+    // robust/auto_continue change how the agent RECOVERS, not what it may do.
+    expect(permissionBadge({ skip_permissions: true, robust: true, auto_continue: true })).toBe(
+      "skip",
+    );
+  });
+
+  it("has nothing to show for a record with no stamp (pre-#236 agent)", () => {
+    expect(permissionBadge(null)).toBeNull();
+    expect(permissionBadge(undefined)).toBeNull();
+  });
+});
+
+describe("allowsSkipPermissions", () => {
+  const original = process.env.AGENT_YES_ALLOW_SKIP_PERMISSIONS;
+  afterEach(() => {
+    if (original === undefined) delete process.env.AGENT_YES_ALLOW_SKIP_PERMISSIONS;
+    else process.env.AGENT_YES_ALLOW_SKIP_PERMISSIONS = original;
+  });
+
+  it("is permissive by default — restricting is an opt-in", () => {
+    delete process.env.AGENT_YES_ALLOW_SKIP_PERMISSIONS;
+    expect(allowsSkipPermissions()).toBe(true);
+  });
+
+  it("is restricted by an explicit falsy env value", () => {
+    for (const v of ["0", "false", "no", "off", "FALSE"]) {
+      process.env.AGENT_YES_ALLOW_SKIP_PERMISSIONS = v;
+      expect(allowsSkipPermissions()).toBe(false);
+    }
+  });
+
+  it("stays permissive for any other value, including garbage", () => {
+    // Failing closed here would lock spawns out of a host over a typo; the
+    // enforcement point is an explicit opt-in, so an unparseable value must not
+    // silently become a restriction.
+    for (const v of ["1", "true", "yes", "on", "banana"]) {
+      process.env.AGENT_YES_ALLOW_SKIP_PERMISSIONS = v;
+      expect(allowsSkipPermissions()).toBe(true);
+    }
+  });
+
+  it("treats an empty env value as unset (falls through to config)", () => {
+    process.env.AGENT_YES_ALLOW_SKIP_PERMISSIONS = "   ";
+    expect(allowsSkipPermissions()).toBe(true);
+  });
+});

package/ts/agentPermissions.ts

@@ -0,0 +1,80 @@
+/**
+ * The permission posture an agent was actually spawned with — derived once at
+ * registration and stamped into the pid record so it can be audited later.
+ *
+ * Why record it rather than re-derive on read: the global index carries no argv,
+ * and the wrapper's own flags (`--robust`, auto-continue) never appear in the
+ * CLI's args at all. Without stamping, "was this agent running with permission
+ * checks disabled?" is unanswerable after the fact — which is precisely the
+ * question an operator looking at a fleet of agents needs answered.
+ *
+ * Mirrored by `derive_permissions` in rs/src/agentPermissions.rs — keep in sync.
+ *
+ * Issue #236.
+ */
+
+export interface AgentPermissions {
+  /**
+   * The wrapped CLI got its "yolo" flag — the per-CLI `yesArgs` appended by
+   * `-y`/`--yes`, or the same flag passed through directly. This is the one that
+   * matters for audit: it disables the CLI's own confirmation gate, so the agent
+   * can edit files and run commands with no human in the loop.
+   */
+  skip_permissions: boolean;
+  /** agent-yes `--robust`: restart the CLI automatically when it crashes. */
+  robust: boolean;
+  /** agent-yes auto-continue: resume the prior session on restart. */
+  auto_continue: boolean;
+}
+
+/**
+ * Flags that disable a CLI's confirmation gate, recognised regardless of what
+ * `yesArgs` the config declares.
+ *
+ * The configured `yesArgs` are the flags `-y` APPENDS; a user is free to pass
+ * the same flag directly, and a config that omits `yesArgs` entirely (some CLIs
+ * deliberately have none) must not make a genuinely dangerous flag invisible.
+ * So the check is the union: configured flags OR any of these.
+ */
+const DANGEROUS_FLAGS = new Set([
+  "--dangerously-skip-permissions",
+  "--dangerously-bypass-approvals-and-sandbox",
+  "--yolo",
+  "--full-auto",
+]);
+
+/** `--flag=value` and `--flag value` must compare equal — match on the flag part. */
+function flagName(arg: string): string {
+  const eq = arg.indexOf("=");
+  return eq === -1 ? arg : arg.slice(0, eq);
+}
+
+export function derivePermissions(opts: {
+  /** The args handed to the wrapped CLI (after yesArgs were appended). */
+  cliArgs: readonly string[];
+  /** The CLI's configured "yolo" flags, if it declares any. */
+  yesArgs?: readonly string[];
+  robust?: boolean;
+  autoContinue?: boolean;
+}): AgentPermissions {
+  const configured = new Set((opts.yesArgs ?? []).map(flagName).filter(Boolean));
+  const skip = opts.cliArgs.some((a) => {
+    const name = flagName(a);
+    return configured.has(name) || DANGEROUS_FLAGS.has(name);
+  });
+  return {
+    skip_permissions: skip,
+    robust: Boolean(opts.robust),
+    auto_continue: Boolean(opts.autoContinue),
+  };
+}
+
+/**
+ * One-word posture for a badge. `skip` is the only one that changes what the
+ * agent is ALLOWED to do; the wrapper flags change only how it recovers, so
+ * they never soften the label.
+ */
+export function permissionBadge(p: AgentPermissions | null | undefined): "skip" | "prompt" | null {
+  if (!p) return null;
+  return p.skip_permissions ? "skip" : "prompt";
+}

package/ts/globalPidIndex.ts

@@ -1,5 +1,6 @@
 import { appendFile, mkdir, readFile, rename, unlink, writeFile } from "fs/promises";
 import { homedir } from "os";
+import type { AgentPermissions } from "./agentPermissions.ts";
 import path from "path";
 import { lock } from "proper-lockfile";
 import { logger } from "./logger.ts";
@@ -57,6 +58,13 @@ export interface GlobalPidRecord {
   // (snake_case). Currently per-process; cross-restart re-binding is a follow-up
   // (see docs/agent-sharing.md). Preserved verbatim through merges/compaction.
   agent_id?: string | null;
+  // The permission posture this agent was SPAWNED with — whether the wrapped CLI
+  // got its "yolo" flag, plus the wrapper's own robust/auto-continue flags. The
+  // index carries no argv and the wrapper flags never reach the CLI's args at
+  // all, so without stamping this at registration "was this agent running with
+  // permission checks off?" is unanswerable after the fact. See
+  // ts/agentPermissions.ts (mirrored in rs/src/agent_permissions.rs).
+  permissions?: AgentPermissions | null;
 }
 
 /**

package/ts/index.ts

@@ -44,6 +44,7 @@ import { globalAgentRegistry } from "./agentRegistry.ts";
 import { notifyWebhook } from "./webhookNotifier.ts";
 import { readGlobalPids } from "./globalPidIndex.ts";
 import * as reaper from "./reaper.ts";
+import { derivePermissions } from "./agentPermissions.ts";
 
 export { removeControlCharacters };
 export { AgentContext };
@@ -510,6 +511,15 @@ export default async function agentYes({
       wrapperPid: process.pid,
       // The parent agent's wrapper pid (inherited AGENT_YES_PID), for the tree.
       parentPid,
+      // Audit trail: what this agent is actually allowed to do. `auto_continue`
+      // is robust AND a CLI that declares restoreArgs — robust alone only
+      // restarts, it resumes nothing.
+      permissions: derivePermissions({
+        cliArgs,
+        yesArgs: cliConf.yesArgs,
+        robust,
+        autoContinue: Boolean(robust && cliConf.restoreArgs?.length),
+      }),
     });
   } catch (error) {
     logger.warn(`[pidStore] Failed to register process ${shell.pid}:`, error);

package/ts/pidStore.ts

@@ -4,6 +4,7 @@ import path from "path";
 import { logger } from "./logger.ts";
 import { JsonlStore } from "./JsonlStore.ts";
 import { agentYesHome } from "./agentYesHome.ts";
+import type { AgentPermissions } from "./agentPermissions.ts";
 import {
   appendGlobalPid,
   maybeCompactGlobalPids,
@@ -26,6 +27,8 @@ export interface PidRecord {
   startedAt: number;
   // Stable id minted at registration; mirrored to the global index as `agent_id`.
   agentId?: string;
+  /** Permission posture at spawn time; mirrored to the global index. */
+  permissions?: AgentPermissions;
 }
 
 export class PidStore {
@@ -59,6 +62,7 @@ export class PidStore {
     cwd,
     wrapperPid,
     parentPid,
+    permissions,
   }: {
     pid: number;
     cli: string;
@@ -67,6 +71,7 @@ export class PidStore {
     cwd: string;
     wrapperPid?: number;
     parentPid?: number;
+    permissions?: AgentPermissions;
   }): Promise<PidRecord> {
     const now = Date.now();
     const argsJson = JSON.stringify(args);
@@ -91,6 +96,7 @@ export class PidStore {
       pid,
       cli,
       args: argsJson,
+      permissions,
       prompt,
       cwd,
       logFile,
@@ -133,6 +139,7 @@ export class PidStore {
       wrapper_pid: wrapperPid ?? null,
       parent_pid: parentPid ?? null,
       agent_id: agentId,
+      permissions: permissions ?? null,
     })
       .then(() => maybeCompactGlobalPids())
       .catch(() => null);

package/ts/serve.ts

@@ -38,6 +38,7 @@ import {
   type CommonOpts,
 } from "./subcommands.ts";
 import { answerAsk, listAsks } from "./askApi.ts";
+import { permissionBadge } from "./agentPermissions.ts";
 import { TYPING_BADGE } from "./badges.ts";
 import { isTermToken, mintTermToken, verifyTermToken, type TermScope } from "./termToken.ts";
 import { isCallbackRevoked, loadCallbackSecretReadOnly } from "./callback.ts";
@@ -65,6 +66,7 @@ import {
   hasSpawnHook,
   isProvisionAllowed,
   resolveSpawnCwd,
+  allowsSkipPermissions,
 } from "./workspaceConfig.ts";
 
 const DEFAULT_PORT = 0;
@@ -2749,6 +2751,16 @@ export async function cmdServe(rest: string[]): Promise<number> {
             inputs: [textIn, envIn],
             outputs: [textOut],
             renderHints: await hintsOf(r),
+            // What this agent is actually permitted to do, stamped at spawn (see
+            // ts/agentPermissions.ts). Carried on the node so the viewer can badge
+            // the env edge — "skip" means the CLI's confirmation gate is off, i.e.
+            // this agent edits and executes with no human in the loop. Null for
+            // agents registered before the stamp existed, which the viewer renders
+            // as "unknown" rather than as safe.
+            configPublic: {
+              permissions: r.permissions ?? null,
+              permissionBadge: permissionBadge(r.permissions),
+            },
           })),
         );
         // The host environment node: identity + capability flags only (no cwd,
@@ -2776,6 +2788,7 @@ export async function cmdServe(rest: string[]): Promise<number> {
               spawn: true,
               spawnHook: hasSpawnHook(),
               provision: hasProvisionHook(),
+              skipPermissions: allowsSkipPermissions(),
             },
           },
         } as unknown as (typeof nodes)[number]); // configPublic is envelope-legal but absent from the agent-node literal type
@@ -2919,6 +2932,10 @@ export async function cmdServe(rest: string[]): Promise<number> {
           spawn: true, // /api/spawn is always on; hooks below shape it
           spawnHook: hasSpawnHook(),
           provision: hasProvisionHook(),
+          // Whether this environment permits spawning agents with the CLI's own
+          // permission gate disabled. Host-enforced in /api/spawn — a client
+          // that asks anyway gets a 403, not a downgrade.
+          skipPermissions: allowsSkipPermissions(),
         },
       });
     }
@@ -3739,6 +3756,7 @@ export async function cmdServe(rest: string[]): Promise<number> {
         cwd?: string;
         from?: string;
         prompt?: string;
+        yes?: boolean;
         fork?: { fromCwd?: string; branch?: string };
       };
       try {
@@ -3751,6 +3769,26 @@ export async function cmdServe(rest: string[]): Promise<number> {
         return new Response(`unsupported cli: ${cli}`, { status: 400 });
       const prompt = String(body.prompt ?? "");
 
+      // Capability enforcement, BEFORE admission control and any provisioning: a
+      // request that this environment will never honour must fail immediately,
+      // not after cloning a repo. `yes` appends the CLI's own "yolo" flag, which
+      // disables its confirmation gate — so a restricted environment refuses it
+      // outright rather than silently downgrading to a safe spawn (which would
+      // hand back an agent that looks like what was asked for and isn't). The
+      // environment declares the cap on its env node / GET /api/host, and it is
+      // enforced HERE, host-side, the way agentShare's default-deny is: a client
+      // cannot ask its way past it. Issue #236.
+      const wantsSkipPermissions = body.yes === true;
+      if (wantsSkipPermissions && !allowsSkipPermissions()) {
+        return new Response(
+          `this environment does not permit skip-permissions agents ` +
+            `(caps.skipPermissions=false) — spawn without \`yes\`, or set ` +
+            `"allowSkipPermissions": true in ~/.agent-yes/config.json ` +
+            `(or AGENT_YES_ALLOW_SKIP_PERMISSIONS=1) on the host`,
+          { status: 403 },
+        );
+      }
+
       // Admission control BEFORE any provisioning (clone/worktree) so a capped
       // request fails fast without doing expensive work. Enforces the optional
       // concurrency cap + memory floor that keep a fan-out of agents from
@@ -3946,7 +3984,15 @@ export async function cmdServe(rest: string[]): Promise<number> {
         process.platform === "win32" && ayBin.toLowerCase().endsWith(".exe")
           ? [ayBin]
           : [process.execPath, ayBin];
-      const agentArgv = [...ayCmd, cli, ...(prompt ? ["--", prompt] : [])];
+      // `-y` goes BEFORE the prompt separator so it is parsed as an agent-yes
+      // flag (global flags precede the CLI's own args), and only after the
+      // capability check above has allowed it.
+      const agentArgv = [
+        ...ayCmd,
+        ...(wantsSkipPermissions ? ["-y"] : []),
+        cli,
+        ...(prompt ? ["--", prompt] : []),
+      ];
       // don't leak our Claude Code session into the agent
       const agentEnv = freshAgentEnv();
       // Correlation id: the spawn response returns the `ay` LAUNCHER pid, which is

package/ts/workspaceConfig.ts

@@ -34,6 +34,13 @@ interface Config {
    * so it is intentionally NOT settable over the network.
    */
   provisionHook?: string;
+  /**
+   * Whether this environment permits spawning agents with the CLI's permission
+   * gate disabled (`-y` / `--dangerously-skip-permissions` and friends).
+   * Defaults to TRUE — the historical behaviour — so a host opts IN to being
+   * restricted. See {@link allowsSkipPermissions}.
+   */
+  allowSkipPermissions?: boolean;
   /**
    * Max number of concurrently-live agents the daemon will admit via
    * `/api/spawn`. `0`/unset = unlimited (current behavior). See {@link getMaxAgents}.
@@ -263,3 +270,26 @@ export function resolveSpawnCwd(input?: string): string {
   if (v.includes("/") || v.includes("\\") || path.isAbsolute(v)) return path.resolve(v);
   return path.join(root, v);
 }
+
+/**
+ * Whether this environment permits spawning agents that skip the CLI's own
+ * permission gate (`-y` / `--dangerously-skip-permissions` and equivalents).
+ *
+ * This is an ENVIRONMENT capability, not a per-request preference: a restricted
+ * host publishes `caps.skipPermissions: false` on its env node and `/api/spawn`
+ * refuses such a request, host-enforced the way agentShare's default-deny is.
+ * A client can't talk its way past it by asking differently.
+ *
+ * Defaults to TRUE so nothing changes for an existing host — restricting is an
+ * explicit opt-in, via `~/.agent-yes/config.json` (`"allowSkipPermissions": false`)
+ * or env `AGENT_YES_ALLOW_SKIP_PERMISSIONS=0`. Only an explicit falsy value
+ * restricts; anything unset or unparseable leaves the environment permissive
+ * rather than silently locking spawns out.
+ *
+ * Issue #236.
+ */
+export function allowsSkipPermissions(): boolean {
+  const raw = process.env.AGENT_YES_ALLOW_SKIP_PERMISSIONS?.trim();
+  if (raw !== undefined && raw !== "") return !/^(0|false|no|off)$/i.test(raw);
+  return readConfig().allowSkipPermissions !== false;
+}

package/dist/SUPPORTED_CLIS-D3b_1q8z.js

@@ -1,11 +0,0 @@
-import "./logger-CDIsZ-Pp.js";
-import "./versionChecker-D5ir842c.js";
-import "./ts-B51ZLoJC.js";
-import "./todoAutomation-Buo457VO.js";
-import "./JsonlStore-CPGIR0Wy.js";
-import "./globalPidIndex-D9DOSd-c.js";
-import "./pidStore-6EZd5DUv.js";
-import "./messageLog-C-YIzhRj.js";
-import { t as SUPPORTED_CLIS } from "./SUPPORTED_CLIS-ia9b-P1k.js";
-
-export { SUPPORTED_CLIS };