clay-server 4.2.0-beta.1 → 4.2.0-beta.2

package/lib/public/modules/split-view.js

@@ -8,13 +8,15 @@ import { detachTuiView } from './session-tui-view.js';
 import { formatTokens } from './app-panels.js';
 import { VENDOR_AVATARS, VENDOR_NAMES } from './app-rendering.js';
 import { groupedSessionIds, findSplitGroup, isConfiguredWorker } from './split-group-helpers.js';
-import { showConfirm } from './app-misc.js';
 import { syncPairChrome } from './split-pair-ui.js';
 import { presentMarkdownEdit } from './filebrowser.js';
 import { autoStartLoginIfNeeded } from './vendor-login.js';
 import { isCurrentProjectSessionReady } from './split-session-boundary.js';
 import { splitPanesMatchProject, hasCurrentSplitGroup, reconcileRestoredSplit } from './project-activation.js';
 import { handlePaneIssueMessage } from './pane-issue-bridge.js';
+import { handlePaneFileMessage, revealFilesPanel } from './pane-file-bridge.js';
+import { openFile } from './filebrowser.js';
+import { bindPermissionControl, createPermissionControl, renderPermissionControl } from './permission-control.js';
 
 var host = null;
 var nativeApp = null;
@@ -161,25 +163,28 @@ export function syncPaneTitles() {
   syncPairChrome(host, split);
 }
 
-function updatePaneFullAccessButton(button, session) {
-  if (!button) return;
+function panePermissionControlState(session) {
   var mode = session && (session.runtimeMode || session.mode || "gui");
   var worker = !!session && isConfiguredWorker(store.get('splitGroups'), session.id);
-  // Permission policy belongs to the Driver. A configured Worker inherits it
-  // server-side and must not present a second, misleading control.
-  var visible = !!session && !worker && !store.get('skipPermsEnabled') && mode === "gui";
-  var enabled = visible && session.permissionMode === "bypassPermissions";
-  button.classList.toggle("hidden", !visible);
-  button.classList.toggle("active", enabled);
-  button.setAttribute("aria-checked", enabled ? "true" : "false");
-  button.title = enabled ? "Skip Permissions is on — click to restore permission prompts" : "Skip Permissions is off — permission prompts are on";
+  return {
+    projectSlug: store.get('currentSlug'),
+    sessionId: session && session.id,
+    vendor: session && session.vendor || store.get('currentVendor') || "claude",
+    permissionMode: session && session.permissionMode || "default",
+    effectivePermissionMode: session && session.effectivePermissionMode || null,
+    permissionCapabilities: session && session.permissionCapabilities || { auto: false, mcpOverride: false },
+    connected: store.get('connected'),
+    globalPermissionModeForced: store.get('skipPermsEnabled') === true,
+    visible: !!session && !worker && mode === "gui",
+    locked: worker,
+  };
 }
 
-function setPaneFullAccess(sessionId, enabled) {
-  var ws = getWs();
-  if (ws && ws.readyState === 1) {
-    ws.send(JSON.stringify({ type: "set_session_full_access", id: sessionId, enabled: enabled }));
-  }
+function updatePaneFullAccessButton(button, session) {
+  if (!button) return;
+  // Permission policy belongs to the Driver. A configured Worker inherits it
+  // server-side and must not present a second, misleading control.
+  renderPermissionControl(button, panePermissionControlState(session));
 }
 
 function createPane(pane, index) {
@@ -208,6 +213,8 @@ function createPane(pane, index) {
 
   var frame = document.createElement("iframe");
   frame.className = "split-pane-frame";
+  frame.dataset.projectSlug = pane.slug;
+  frame.dataset.sessionId = String(pane.sessionId);
   frame.src = paneUrl(pane);
   frame.title = pane.title;
 
@@ -225,21 +232,11 @@ function createPane(pane, index) {
   });
   header.appendChild(ctxChip);
 
-  var fullAccess = document.createElement("button");
-  fullAccess.type = "button";
-  fullAccess.className = "session-full-access split-pane-full-access hidden";
-  fullAccess.setAttribute("role", "switch");
-  fullAccess.innerHTML = '<span class="session-full-access-label">Skip Permissions</span><span class="session-full-access-track" aria-hidden="true"><span></span></span>';
+  var fullAccess = createPermissionControl("split-pane-full-access hidden", "Driver session permission mode");
   updatePaneFullAccessButton(fullAccess, session);
-  fullAccess.addEventListener("click", function () {
+  bindPermissionControl(fullAccess, function() {
     var current = sessionById(pane.sessionId);
-    if (current && current.permissionMode === "bypassPermissions") {
-      setPaneFullAccess(pane.sessionId, false);
-      return;
-    }
-    showConfirm("Skip permission prompts for this session? Tool requests will be approved automatically.", function () {
-      setPaneFullAccess(pane.sessionId, true);
-    }, "Skip Permissions", true);
+    return panePermissionControlState(current);
   });
   header.appendChild(fullAccess);
   // Permission state belongs to the session identity on the left. Keep it
@@ -293,6 +290,7 @@ function handlePaneMessage(event) {
     return;
   }
   if (handlePaneIssueMessage(event, host)) return;
+  if (handlePaneFileMessage(event, host, openFile, revealFilesPanel)) return;
   if (msg.type !== "clay-pane-context") return;
   var frames = host.querySelectorAll(".split-pane-frame");
   for (var i = 0; i < frames.length; i++) {
@@ -527,6 +525,8 @@ export function initSplitView() {
   document.addEventListener("click", handleSidebarSessionClick, true);
   store.subscribe(function (state, prev) {
     if (state.splitPanes !== prev.splitPanes) renderSplit(state.splitPanes);
+    if (state.permissionModePendingByTarget !== prev.permissionModePendingByTarget || state.connected !== prev.connected ||
+        state.skipPermsEnabled !== prev.skipPermsEnabled) syncPaneTitles();
     // Switching to a session outside the open split (new_session, palette,
     // notification click) closes the split UI; the group itself persists.
     if (state.activeSessionId !== prev.activeSessionId && state.splitPanes && state.splitPanes.panes) {

package/lib/sdk-bridge.js

@@ -788,61 +788,61 @@ function createSDKBridge(opts) {
     return null; // Not whitelisted
   }
 
-  function handleCanUseTool(session, toolName, input, opts) {
+  function resolveSessionPermissionMode(session) {
+    var mode = session.permissionMode || sm.currentPermissionMode;
+    var router = getWorkerPermissionRouter();
+    if (router && typeof router.inheritedPermissionMode === "function") {
+      var inherited = router.inheritedPermissionMode(session);
+      if (inherited) mode = inherited;
+    }
+    return mode;
+  }
+
+  function handlePreToolUsePolicy(session, toolName, input) {
     var debateDecision = homeDebateToolPolicy.initialToolDecision(session, toolName, input);
-    if (debateDecision) return Promise.resolve(debateDecision);
+    if (debateDecision) return debateDecision;
     // The dynamic proposal tool is bound to this exact query session. It only
     // posts the inline proposal; starting the debate still requires the user.
     if (session.homeDebatePlanning === true && toolName === "propose_debate") {
-      return Promise.resolve({ behavior: "allow", updatedInput: input });
+      return { behavior: "allow", updatedInput: input };
     }
     // Mate creation proposals only present the exact-session approval card;
     // creating the Mate still requires the user's explicit action there.
     if (session.mateCreationMode === true && toolName === "propose_mate") {
-      return Promise.resolve({ behavior: "allow", updatedInput: input });
-    }
-    // Full-auto mode: auto-approve everything except AskUserQuestion
-    // (which still needs to go through the user interaction flow).
-    var clayPermissionMode = session.permissionMode || sm.currentPermissionMode;
-    // A configured Split Worker is Driver-operated, so it runs under its
-    // Driver's permission mode, re-resolved from the live pair on every single
-    // decision. Nothing is copied at creation and the Worker's own persisted
-    // setting is never written, so toggling skip permissions on the Driver
-    // applies to the Worker's next call in either direction, mid-turn included.
-    var _wpMode = getWorkerPermissionRouter();
-    if (_wpMode && typeof _wpMode.inheritedPermissionMode === "function") {
-      var inherited = _wpMode.inheritedPermissionMode(session);
-      if (inherited) clayPermissionMode = inherited;
-    }
-    // AskUserQuestion is genuine user input, not an authorization, so it is
-    // excluded here exactly as it always was: a Driver in skip mode still
-    // cannot silently answer a question addressed to the person.
-    if (clayPermissionMode === "bypassPermissions" && toolName !== "AskUserQuestion") {
-      return Promise.resolve({ behavior: "allow", updatedInput: input });
+      return { behavior: "allow", updatedInput: input };
     }
-
     // Ralph Loop execution: auto-approve all tools, deny interactive ones.
     // Crafting sessions are interactive — user and Claude collaborate to build PROMPT.md / JUDGE.md.
     if (session.loop && session.loop.active && session.loop.role !== "crafting") {
       if (toolName === "AskUserQuestion") {
-        return Promise.resolve({ behavior: "deny", message: "Autonomous mode. Make your own decision." });
+        return { behavior: "deny", message: "Autonomous mode. Make your own decision." };
       }
       if (toolName === "EnterPlanMode") {
-        return Promise.resolve({ behavior: "deny", message: "Do not enter plan mode. Execute directly." });
+        return { behavior: "deny", message: "Do not enter plan mode. Execute directly." };
       }
-      return Promise.resolve({ behavior: "allow", updatedInput: input });
+      return { behavior: "allow", updatedInput: input };
     }
 
     // Check shared whitelist (read-only tools, safe browser tools, safe bash commands)
     var whitelisted = checkToolWhitelist(toolName, input);
     if (whitelisted) {
-      return Promise.resolve(whitelisted);
+      return whitelisted;
     }
 
+    return null;
+  }
+
+  function handleCanUseTool(session, toolName, input, opts) {
+    var initialDecision = handlePreToolUsePolicy(session, toolName, input);
+    if (initialDecision) return Promise.resolve(initialDecision);
+    // Skip permissions removes only the remaining Clay prompt. The SDK's
+    // deny/ask rules and Auto classifier have already run before this callback.
+    var skipRemainingPermissions = resolveSessionPermissionMode(session) === "bypassPermissions" && toolName !== "AskUserQuestion";
+
+    if (skipRemainingPermissions) return Promise.resolve({ behavior: "allow", updatedInput: input });
+
     // Auto-approve if tool was previously allowed for session
-    if (session.allowedTools && session.allowedTools[toolName]) {
-      return Promise.resolve({ behavior: "allow", updatedInput: input });
-    }
+    if (session.allowedTools && session.allowedTools[toolName]) return Promise.resolve({ behavior: "allow", updatedInput: input });
 
     // A visible Split Worker's remaining prompts belong to its paired Driver,
     // not to the Worker pane. This sits below every auto-decision above, so
@@ -988,12 +988,32 @@ function createSDKBridge(opts) {
     }
   }
 
+  function ownsQueryRuntime(session, queryInstance, queryGeneration) {
+    return session.queryInstance === queryInstance
+      && Number(session._sdkQueryGeneration || 0) === Number(queryGeneration)
+      && (!sm.sessions || typeof sm.sessions.get !== "function" || sm.sessions.get(session.localId) === session);
+  }
+
+  function recordRuntimeEffectivePermissionMode(session, queryInstance, queryGeneration, message) {
+    if (!message || (message.yokeType !== "init" && message.yokeType !== "status") || !message.permissionMode) return false;
+    if (!ownsQueryRuntime(session, queryInstance, queryGeneration)) return false;
+    session.effectivePermissionMode = message.permissionMode;
+    session.permissionModeFallbackReason = null;
+    sm.saveSessionFile(session);
+    sendToSession(session, { type: "config_state", sessionId: session.localId, vendor: session.vendor || "claude",
+      mode: session.permissionMode || sm.currentPermissionMode || "default", effectivePermissionMode: message.permissionMode,
+      permissionCapabilities: session.permissionCapabilities || { auto: false, mcpOverride: false },
+      mcpPermissionModeOverrides: session.mcpPermissionModeOverrides || {} });
+    return true;
+  }
+
   async function processQueryStream(session, codexCatalogCandidate) {
     // Capture references at start so we only clean up OUR resources in finally,
     // not resources from a newer query that may have been created after an abort.
     var myQueryInstance = session.queryInstance;
     var myAbortController = session.abortController;
     var myMessageQueue = session.messageQueue;
+    var myQueryGeneration = Number(session._sdkQueryGeneration || 0);
     console.log("[sdk-bridge] processQueryStream: starting for-await loop, vendor=" + (session.vendor || adapter.vendor));
     try {
       for await (var msg of myQueryInstance) {
@@ -1023,8 +1043,10 @@ function createSDKBridge(opts) {
               sendToSession(session, { type: "config_state", model: session.model || defaultModelForVendor(session.vendor || "claude"), vendor: session.vendor || "claude", sessionId: session.localId, mode: session.permissionMode || sm.currentPermissionMode || "default", effort: session.effort, betas: sm.currentBetas || [] });
               break;
             case "permission_mode_changed":
-              sm.currentPermissionMode = metaData.mode;
-              sendToSession(session, { type: "config_state", model: session.model || defaultModelForVendor(session.vendor || "claude"), vendor: session.vendor || "claude", sessionId: session.localId, mode: session.permissionMode || sm.currentPermissionMode, effort: session.effort || sm.currentEffort || "medium", betas: sm.currentBetas || [] });
+              // Setter notifications are acknowledgements, not a new project
+              // default and not proof of the runtime-effective mode. Only an
+              // init/status event below may confirm effectivePermissionMode.
+              sendToSession(session, { type: "config_state", model: session.model || defaultModelForVendor(session.vendor || "claude"), vendor: session.vendor || "claude", sessionId: session.localId, mode: session.permissionMode || sm.currentPermissionMode || "default", effectivePermissionMode: session.effectivePermissionMode || null, permissionCapabilities: session.permissionCapabilities || { auto: false, mcpOverride: false }, mcpPermissionModeOverrides: session.mcpPermissionModeOverrides || {}, effort: session.effort || sm.currentEffort || "medium", betas: sm.currentBetas || [] });
               break;
             case "worker_error":
               send({ type: "error", text: metaData.error });
@@ -1033,6 +1055,10 @@ function createSDKBridge(opts) {
           continue;
         }
         processSDKMessage(session, msg);
+        // SDK init/status events are the only authority for runtime-effective
+        // permission state. Setter acknowledgement deliberately does not
+        // change this field.
+        recordRuntimeEffectivePermissionMode(session, myQueryInstance, myQueryGeneration, msg);
         if (codexCatalogCandidate && msg && msg.yokeType === "session_started" && msg.sessionId
             && session.queryInstance === myQueryInstance
             && Number(session._sdkQueryGeneration || 0) === codexCatalogCandidate.generation
@@ -1843,12 +1869,20 @@ function createSDKBridge(opts) {
       abortController: linuxUser ? undefined : session.abortController,
       canUseTool: function(toolName, input, toolOpts) {
         var nativeQuestionError = toolName === "AskUserQuestion" ? scheduleQuestionError(input) : null;
-        if (nativeQuestionError) return Promise.resolve({ behavior: "deny", message: nativeQuestionError });
+        if (nativeQuestionError) return { behavior: "deny", message: nativeQuestionError };
         var permissionName = toolName;
         var permissionToolDef = findSessionToolDef(toolName);
         if (permissionToolDef && permissionToolDef.permissionName) permissionName = permissionToolDef.permissionName;
         return handleCanUseTool(session, permissionName, input, toolOpts);
       },
+      preToolUsePolicy: function(toolName, input) {
+        var nativeQuestionError = toolName === "AskUserQuestion" ? scheduleQuestionError(input) : null;
+        if (nativeQuestionError) return Promise.resolve({ behavior: "deny", message: nativeQuestionError });
+        var permissionName = toolName;
+        var permissionToolDef = findSessionToolDef(toolName);
+        if (permissionToolDef && permissionToolDef.permissionName) permissionName = permissionToolDef.permissionName;
+        return handlePreToolUsePolicy(session, permissionName, input);
+      },
       onUserInputRequest: function(request, respond) {
         return sessionUserInputHandler(request, respond);
       },
@@ -1948,6 +1982,24 @@ function createSDKBridge(opts) {
 
     // Store QueryHandle on session for iteration and control.
     session.queryInstance = handle;
+    // Capabilities come from the installed query handle, never a model-name
+    // table. `acceptEdits` and MCP overrides are Claude SDK semantics; a
+    // vendor may expose the generic setter without implementing either.
+    session.permissionCapabilities = require("./session-permission-mode").capabilities(session, sm.defaultVendor);
+    session.permissionCapabilities.mcpOverride = sessionAdapter.vendor === "claude" && typeof handle.setMcpPermissionModeOverride === "function";
+    session.effectivePermissionMode = null;
+    sm.saveSessionFile(session);
+    sendToSession(session, { type: "config_state", model: session.model || defaultModelForVendor(session.vendor || "claude"), vendor: session.vendor || "claude", sessionId: session.localId, mode: session.permissionMode || sm.currentPermissionMode || "default", effectivePermissionMode: null, permissionCapabilities: session.permissionCapabilities, mcpPermissionModeOverrides: session.mcpPermissionModeOverrides || {}, effort: session.effort || sm.currentEffort || "medium", betas: sm.currentBetas || [] });
+
+    if (session.permissionMode === "auto" && session.permissionCapabilities.mcpOverride) {
+      var overrideNames = Object.keys(session.mcpPermissionModeOverrides || {});
+      for (var oi = 0; oi < overrideNames.length; oi++) {
+        try { await handle.setMcpPermissionModeOverride(overrideNames[oi], session.mcpPermissionModeOverrides[overrideNames[oi]]); }
+        catch (overrideError) {
+          sendToSession(session, { type: "error", text: "Failed to restore the AI review policy for " + overrideNames[oi] + ": " + (overrideError.message || overrideError) });
+        }
+      }
+    }
 
     if (typeof beforePush === "function" && beforePush() !== true) {
       try { handle.close(); } catch (e) {}
@@ -2358,17 +2410,15 @@ function createSDKBridge(opts) {
   async function setPermissionMode(session, mode) {
     if (!session.queryInstance) {
       // No active query — just store the mode for next startQuery
-      sm.currentPermissionMode = mode;
-      sendToSession(session, { type: "config_state", model: session.model || defaultModelForVendor(session.vendor || "claude"), vendor: session.vendor || "claude", sessionId: session.localId, mode: sm.currentPermissionMode, effort: session.effort || sm.currentEffort || "medium", betas: sm.currentBetas || [] });
-      return;
+      return { ok: true, effectiveMode: mode };
     }
     try {
       // Route through QueryHandle (works for both in-process and worker paths)
       await session.queryInstance.setPermissionMode(mode);
-      sm.currentPermissionMode = mode;
-      sendToSession(session, { type: "config_state", model: session.model || defaultModelForVendor(session.vendor || "claude"), vendor: session.vendor || "claude", sessionId: session.localId, mode: sm.currentPermissionMode, effort: session.effort || sm.currentEffort || "medium", betas: sm.currentBetas || [] });
+      return { ok: true, effectiveMode: mode };
     } catch (e) {
       sendToSession(session, { type: "error", text: "Failed to set permission mode: " + (e.message || e) });
+      return { ok: false, error: e.message || String(e) };
     }
   }
 
@@ -2404,12 +2454,14 @@ function createSDKBridge(opts) {
 
   // Override the permission mode for one MCP server on the active query.
   async function setMcpPermissionModeOverride(session, serverName, mode) {
-    if (!session || !session.queryInstance) return;
+    if (!session || !session.queryInstance || typeof session.queryInstance.setMcpPermissionModeOverride !== "function") return { ok: false, error: "MCP permission controls are unavailable for this session." };
     try {
       // Route through QueryHandle (works for both in-process and worker paths)
       await session.queryInstance.setMcpPermissionModeOverride(serverName, mode);
+      return { ok: true };
     } catch (e) {
       send({ type: "error", text: "Failed to set MCP permission mode: " + (e.message || e) });
+      return { ok: false, error: e.message || String(e) };
     }
   }
 
@@ -2583,6 +2635,9 @@ function createSDKBridge(opts) {
     createMessageQueue: createMessageQueue,
     processSDKMessage: processSDKMessage,
     checkToolWhitelist: checkToolWhitelist,
+    handlePreToolUsePolicy: handlePreToolUsePolicy,
+    ownsQueryRuntime: ownsQueryRuntime,
+    recordRuntimeEffectivePermissionMode: recordRuntimeEffectivePermissionMode,
     handleCanUseTool: handleCanUseTool,
     handleElicitation: handleElicitation,
     processQueryStream: processQueryStream,

package/lib/session-permission-mode.js

@@ -0,0 +1,42 @@
+// Canonical, server-owned permission selection validation. The requested mode
+// is persisted separately from the SDK mode because Clay keeps the final
+// canUseTool decision for GUI sessions.
+
+function normalize(mode) {
+  if (mode === "default" || mode === "auto" || mode === "plan" || mode === "acceptEdits" || mode === "bypassPermissions") return mode;
+  return null;
+}
+
+function capabilities(session, defaultVendor) {
+  var vendor = session && session.vendor || defaultVendor || "claude";
+  return {
+    auto: vendor === "claude",
+    mcpOverride: vendor === "claude" && !!(session && session.queryInstance &&
+      typeof session.queryInstance.setMcpPermissionModeOverride === "function"),
+  };
+}
+
+function supportsAuto(session, defaultVendor) {
+  return capabilities(session, defaultVendor).auto;
+}
+
+function validate(session, mode, defaultVendor) {
+  var requested = normalize(mode);
+  if (!requested) return { ok: false, error: "Unknown permission mode." };
+  if (requested === "auto" && !supportsAuto(session, defaultVendor)) {
+    return { ok: false, error: "Auto permissions are not available for this session." };
+  }
+  return { ok: true, mode: requested };
+}
+
+function clientState(session, fallback, defaultVendor) {
+  var requested = session && session.permissionMode || fallback || "default";
+  return {
+    requestedPermissionMode: requested,
+    effectivePermissionMode: session && session.effectivePermissionMode || null,
+    permissionCapabilities: capabilities(session, defaultVendor),
+    mcpPermissionModeOverrides: session && session.mcpPermissionModeOverrides || {},
+  };
+}
+
+module.exports = { validate: validate, clientState: clientState, supportsAuto: supportsAuto, capabilities: capabilities };

package/lib/sessions.js

@@ -177,6 +177,7 @@ function createSessionManager(opts) {
       // so lazy-resume (`claude --resume`) re-spawns with the same flag.
       if (session.dangerouslySkipPermissions) metaObj.dangerouslySkipPermissions = true;
       if (session.permissionMode) metaObj.permissionMode = session.permissionMode;
+      if (session.mcpPermissionModeOverrides) metaObj.mcpPermissionModeOverrides = session.mcpPermissionModeOverrides;
       if (session.permissionModeBeforeFullAccess) metaObj.permissionModeBeforeFullAccess = session.permissionModeBeforeFullAccess;
       if (session.autonomousRun) metaObj.autonomousRun = session.autonomousRun;
       if (session.loopInterviewBrief) metaObj.loopInterviewBrief = session.loopInterviewBrief;
@@ -348,6 +349,10 @@ function createSessionManager(opts) {
       // Clay's own per-session permission mode.
       session.dangerouslySkipPermissions = session.mode === "tui" && !!m.dangerouslySkipPermissions;
       session.permissionMode = m.permissionMode || (session.mode === "gui" && m.dangerouslySkipPermissions ? "bypassPermissions" : null);
+      // Runtime-effective state is observed from the live SDK only. A daemon
+      // restore has no active runtime to confirm the old value.
+      session.effectivePermissionMode = null;
+      session.mcpPermissionModeOverrides = m.mcpPermissionModeOverrides && typeof m.mcpPermissionModeOverrides === "object" ? m.mcpPermissionModeOverrides : {};
       session.permissionModeBeforeFullAccess = m.permissionModeBeforeFullAccess || null;
       session.autonomousRun = restoreStoredRun(m.autonomousRun);
       session.loopInterviewBrief = m.loopInterviewBrief && typeof m.loopInterviewBrief === "object" ? m.loopInterviewBrief : null;
@@ -587,6 +592,9 @@ function createSessionManager(opts) {
       runtimeTerminalId: typeof s.runtimeTerminalId === "number" ? s.runtimeTerminalId : null,
       dangerouslySkipPermissions: !!s.dangerouslySkipPermissions,
       permissionMode: s.permissionMode || null,
+      effectivePermissionMode: s.effectivePermissionMode || null,
+      permissionCapabilities: require("./session-permission-mode").capabilities(s, defaultVendor),
+      mcpPermissionModeOverrides: s.mcpPermissionModeOverrides || {},
       autonomousRun: s.autonomousRun ? {
         id: s.autonomousRun.id,
         state: s.autonomousRun.state,
@@ -676,6 +684,8 @@ function createSessionManager(opts) {
       mode: (sessionOpts && sessionOpts.mode === "tui") ? "tui" : "gui",
       dangerouslySkipPermissions: !!(sessionOpts && sessionOpts.mode === "tui" && sessionOpts.dangerouslySkipPermissions),
       permissionMode: (sessionOpts && sessionOpts.permissionMode) || null,
+      effectivePermissionMode: null,
+      mcpPermissionModeOverrides: {},
       permissionModeBeforeFullAccess: null,
       autonomousRun: null,
       loopInterviewBrief: null,
@@ -725,6 +735,8 @@ function createSessionManager(opts) {
       mode: (sessionOpts && sessionOpts.mode === "tui") ? "tui" : "gui",
       dangerouslySkipPermissions: !!(sessionOpts && sessionOpts.mode === "tui" && sessionOpts.dangerouslySkipPermissions),
       permissionMode: (sessionOpts && sessionOpts.permissionMode) || null,
+      effectivePermissionMode: null,
+      mcpPermissionModeOverrides: {},
       permissionModeBeforeFullAccess: null,
       autonomousRun: null,
       loopInterviewBrief: null,
@@ -826,7 +838,8 @@ function createSessionManager(opts) {
     var _capsByVendor = capabilitiesByVendor || {};
     var _sessionVendor = session.vendor || defaultVendor || "claude";
     var _vendorCaps = _capsByVendor[_sessionVendor] || {};
-    _send({ type: "session_switched", id: localId, cliSessionId: session.cliSessionId || null, loop: session.loop || null, vendor: session.vendor || null, model: session.model || null, effort: session.effort || null, hasHistory: (session.history && session.history.length > 0), capabilities: _vendorCaps, isProcessing: !!session.isProcessing, mode: session.mode || "gui", terminalId: typeof session.terminalId === "number" ? session.terminalId : null, runtimeMode: session.runtimeMode || null, runtimeTerminalId: typeof session.runtimeTerminalId === "number" ? session.runtimeTerminalId : null, tuiSuspended: !!session.tuiSuspended, dangerouslySkipPermissions: !!session.dangerouslySkipPermissions, permissionMode: session.permissionMode || null, autonomousRun: projectAutonomousRun(session.autonomousRun), loopInterviewBrief: session.loopInterviewBrief || null, loopInterviewHandoff: session.loopInterviewHandoff || null, scheduledTaskDraft: session.scheduledTaskDraft || null });
+    var _permissionState = require("./session-permission-mode").clientState(session, "default", defaultVendor);
+    _send({ type: "session_switched", id: localId, cliSessionId: session.cliSessionId || null, loop: session.loop || null, vendor: session.vendor || null, model: session.model || null, effort: session.effort || null, hasHistory: (session.history && session.history.length > 0), capabilities: _vendorCaps, isProcessing: !!session.isProcessing, mode: session.mode || "gui", terminalId: typeof session.terminalId === "number" ? session.terminalId : null, runtimeMode: session.runtimeMode || null, runtimeTerminalId: typeof session.runtimeTerminalId === "number" ? session.runtimeTerminalId : null, tuiSuspended: !!session.tuiSuspended, dangerouslySkipPermissions: !!session.dangerouslySkipPermissions, permissionMode: _permissionState.requestedPermissionMode, effectivePermissionMode: _permissionState.effectivePermissionMode, permissionCapabilities: _permissionState.permissionCapabilities, mcpPermissionModeOverrides: _permissionState.mcpPermissionModeOverrides, autonomousRun: projectAutonomousRun(session.autonomousRun), loopInterviewBrief: session.loopInterviewBrief || null, loopInterviewHandoff: session.loopInterviewHandoff || null, scheduledTaskDraft: session.scheduledTaskDraft || null });
     // Send vendor-specific slash commands
     var _vendorCmds = (session.slashCommandsByVendor && session.slashCommandsByVendor[_sessionVendor])
       || session.slashCommands

package/lib/ws-schema.js

@@ -252,6 +252,7 @@ var schema = {
   "set_server_default_model": { direction: "c2s", handler: "lib/project-sessions.js", description: "Set the server-wide default model" },
   "set_project_default_model": { direction: "c2s", handler: "lib/project-sessions.js", description: "Set the project default model" },
   "set_permission_mode":      { direction: "c2s", handler: "lib/project-sessions.js", description: "Set permission mode for the current session" },
+  "permission_mode_result":   { direction: "s2c", handler: "lib/public/modules/permission-control.js", description: "Correlated result for an exact project/session permission mode change" },
   "set_session_full_access":  { direction: "c2s", handler: "lib/project-sessions.js", description: "Toggle Clay-managed permission skipping for a GUI session" },
   "session_full_access_changed": { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "A session's full-access state changed" },
   "session_full_access_result": { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Result of toggling session full access" },
@@ -269,6 +270,7 @@ var schema = {
   "autonomous_run_state":      { direction: "s2c", handler: "lib/public/modules/autonomous-run.js", description: "Synchronized Until complete run state" },
   "reload_skills":            { direction: "c2s", handler: "lib/project-sessions.js", description: "Hot-reload skills/MCP/agents on the active query without a restart" },
   "set_mcp_permission_mode_override": { direction: "c2s", handler: "lib/project-sessions.js", description: "Override permission mode (default/auto/null) for one MCP server" },
+  "mcp_permission_mode_result": { direction: "s2c", handler: "lib/public/modules/mcp-ui.js", description: "Correlated result for one session MCP AI review policy change" },
   "set_server_default_mode":  { direction: "c2s", handler: "lib/project-sessions.js", description: "Set the server-wide default permission mode" },
   "set_project_default_mode": { direction: "c2s", handler: "lib/project-sessions.js", description: "Set the project default permission mode" },
   "set_effort":               { direction: "c2s", handler: "lib/project-sessions.js", description: "Set effort level for the current session" },

package/lib/yoke/adapters/claude-worker-policy.js

@@ -0,0 +1,67 @@
+// Bounded fail-closed lifecycle for worker PreToolUse policy IPC requests.
+
+function denied(message) {
+  return { behavior: "deny", message: message };
+}
+
+function createPolicyBroker(options) {
+  options = options || {};
+  var send = options.send;
+  var timeoutMs = Number(options.timeoutMs) > 0 ? Number(options.timeoutMs) : 10000;
+  var pending = {};
+
+  function settle(requestId, result) {
+    var record = pending[requestId];
+    if (!record) return false;
+    delete pending[requestId];
+    clearTimeout(record.timer);
+    if (record.signal && record.onAbort && typeof record.signal.removeEventListener === "function") {
+      record.signal.removeEventListener("abort", record.onAbort);
+    }
+    record.resolve(result);
+    return true;
+  }
+
+  function request(message, signal) {
+    return new Promise(function(resolve) {
+      if (signal && signal.aborted) {
+        resolve(denied("Permission policy cancelled."));
+        return;
+      }
+      var requestId = message.requestId;
+      var record = { resolve: resolve, signal: signal || null, onAbort: null, timer: null };
+      pending[requestId] = record;
+      record.onAbort = function() {
+        settle(requestId, denied("Permission policy cancelled."));
+      };
+      if (signal && typeof signal.addEventListener === "function") {
+        signal.addEventListener("abort", record.onAbort, { once: true });
+      }
+      record.timer = setTimeout(function() {
+        settle(requestId, denied("Permission policy timed out."));
+      }, timeoutMs);
+      var sent = false;
+      try { sent = send(message) === true; }
+      catch (error) { sent = false; }
+      if (!sent) settle(requestId, denied("Permission policy IPC is unavailable."));
+    });
+  }
+
+  function respond(message) {
+    var result = message.error ? denied(message.error) : message.result;
+    return settle(message.requestId, result || null);
+  }
+
+  function clear(message) {
+    var ids = Object.keys(pending);
+    for (var i = 0; i < ids.length; i++) settle(ids[i], denied(message || "Permission policy IPC closed."));
+  }
+
+  function pendingCount() {
+    return Object.keys(pending).length;
+  }
+
+  return { request: request, respond: respond, clear: clear, pendingCount: pendingCount };
+}
+
+module.exports = { createPolicyBroker: createPolicyBroker };