clay-server 4.2.0-beta.1 → 4.2.0-beta.3

package/lib/public/modules/permission-control.js

@@ -0,0 +1,187 @@
+// Shared session permission selector for standalone and split Driver headers.
+
+import { store } from './store.js';
+import { getWs } from './ws-ref.js';
+import { showToast } from './utils.js';
+
+var REQUEST_TIMEOUT_MS = 10000;
+var requestTimers = {};
+
+function targetKey(projectSlug, sessionId) {
+  return String(projectSlug || "") + ":" + String(sessionId || "");
+}
+
+function pendingMap() {
+  return store.get('permissionModePendingByTarget') || {};
+}
+
+export function permissionPendingFor(projectSlug, sessionId) {
+  return pendingMap()[targetKey(projectSlug, sessionId)] || null;
+}
+
+function replacePending(key, value) {
+  var next = Object.assign({}, pendingMap());
+  if (value) next[key] = value;
+  else delete next[key];
+  store.set({ permissionModePendingByTarget: next });
+}
+
+function clearRequest(requestId, key) {
+  if (requestTimers[requestId]) clearTimeout(requestTimers[requestId]);
+  delete requestTimers[requestId];
+  var pending = pendingMap()[key];
+  if (pending && pending.requestId === requestId) replacePending(key, null);
+}
+
+export function clearPermissionModePending() {
+  var ids = Object.keys(requestTimers);
+  for (var i = 0; i < ids.length; i++) clearTimeout(requestTimers[ids[i]]);
+  requestTimers = {};
+  store.set({ permissionModePendingByTarget: {} });
+}
+
+export function createPermissionControl(className, ariaLabel) {
+  var control = document.createElement("div");
+  control.className = "session-permission-control " + (className || "");
+  control.setAttribute("role", "group");
+  control.setAttribute("aria-label", ariaLabel || "Session permission mode");
+  control.innerHTML = '<div class="session-permission-segmented">' +
+    '<button type="button" data-permission-mode="default">Ask</button>' +
+    '<button type="button" data-permission-mode="auto">Auto</button>' +
+    '<button type="button" data-permission-mode="bypassPermissions" aria-label="Skip permissions"><span class="permission-label-long">Skip permissions</span><span class="permission-label-short" aria-hidden="true">Skip</span></button>' +
+    '</div><span class="session-permission-status" aria-live="polite"></span>';
+  return control;
+}
+
+function modeLabel(mode) {
+  var labels = { default: "Ask", plan: "Plan", acceptEdits: "Auto-accept edits", dontAsk: "Don't ask",
+    bypassPermissions: "Skip permissions", auto: "Auto" };
+  return labels[mode] || mode;
+}
+
+export function permissionStatusText(state, pending, autoSupported, autoVisible) {
+  if (state.globalPermissionModeForced) return "Skip permissions forced by the server setting";
+  if (pending) return "Applying…";
+  if (state.permissionMode === "plan") return "Plan workflow";
+  if (state.permissionMode === "acceptEdits") return "Auto-accept edits workflow";
+  if (state.permissionMode === "dontAsk") return "Don't ask workflow";
+  if (autoVisible && !autoSupported) return "Auto unavailable for this Claude session";
+  if (state.permissionMode === "auto" && !state.effectivePermissionMode) return "Auto selected · waiting for runtime";
+  if (state.permissionMode === "auto" && state.effectivePermissionMode !== "auto") {
+    return "Auto unavailable at runtime · using " + modeLabel(state.effectivePermissionMode);
+  }
+  return "";
+}
+
+function compactPermissionStatusText(state, pending, autoSupported, autoVisible, fullText) {
+  if (state.globalPermissionModeForced) return "Forced Skip";
+  if (pending) return "Applying…";
+  if (state.permissionMode === "plan") return "Plan";
+  if (state.permissionMode === "acceptEdits") return "Auto-accept";
+  if (state.permissionMode === "dontAsk") return "Don't ask";
+  if (autoVisible && !autoSupported) return "Auto unavailable";
+  if (state.permissionMode === "auto" && !state.effectivePermissionMode) return "Waiting for Auto";
+  if (state.permissionMode === "auto" && state.effectivePermissionMode !== "auto") return "Using " + modeLabel(state.effectivePermissionMode);
+  return fullText;
+}
+
+export function renderPermissionControl(control, state) {
+  if (!control) return;
+  var projectSlug = state.projectSlug || "";
+  var sessionId = state.sessionId || null;
+  var pending = permissionPendingFor(projectSlug, sessionId);
+  var autoVisible = state.vendor === "claude";
+  var autoSupported = !!(state.permissionCapabilities && state.permissionCapabilities.auto === true);
+  var globallyForced = state.globalPermissionModeForced === true;
+  var connected = state.connected !== false && !!getWs() && getWs().readyState === 1;
+  control.classList.toggle("hidden", state.visible === false);
+  control.classList.toggle("permission-pending", !!pending);
+  control.classList.toggle("permission-auto-unsupported", autoVisible && !autoSupported);
+  control.classList.toggle("permission-globally-forced", globallyForced);
+  control.classList.toggle("permission-runtime-fallback", state.permissionMode === "auto" && !!state.effectivePermissionMode && state.effectivePermissionMode !== "auto");
+  var buttons = control.querySelectorAll("[data-permission-mode]");
+  for (var i = 0; i < buttons.length; i++) {
+    var mode = buttons[i].dataset.permissionMode;
+    var unsupported = mode === "auto" && autoVisible && !autoSupported;
+    buttons[i].hidden = mode === "auto" && !autoVisible;
+    var selected = globallyForced ? mode === "bypassPermissions" : mode === state.permissionMode;
+    buttons[i].disabled = globallyForced || unsupported || !!pending || !connected || state.locked === true;
+    buttons[i].classList.toggle("active", selected);
+    buttons[i].setAttribute("aria-pressed", selected ? "true" : "false");
+    if (unsupported) buttons[i].title = "Auto permissions are unavailable for this Claude session.";
+    else buttons[i].removeAttribute("title");
+  }
+  var status = control.querySelector(".session-permission-status");
+  if (status) {
+    var fullStatus = permissionStatusText(state, pending, autoSupported, autoVisible);
+    var compact = control.classList.contains("split-pane-full-access");
+    status.textContent = compact ? compactPermissionStatusText(state, pending, autoSupported, autoVisible, fullStatus) : fullStatus;
+    status.classList.toggle("hidden", !status.textContent);
+    if (fullStatus) status.title = fullStatus;
+    else status.removeAttribute("title");
+  }
+}
+
+export function bindPermissionControl(control, getState) {
+  if (!control || control.dataset.permissionBound === "true") return;
+  control.dataset.permissionBound = "true";
+  control.addEventListener("click", function(event) {
+    var button = event.target.closest("[data-permission-mode]");
+    if (!button || button.disabled) return;
+    var state = getState() || {};
+    var mode = button.dataset.permissionMode;
+    var autoSupported = !!(state.permissionCapabilities && state.permissionCapabilities.auto === true);
+    if (state.visible === false || state.locked === true || state.globalPermissionModeForced === true || state.connected === false || store.get('connected') === false) return;
+    if (!state.projectSlug || state.projectSlug !== store.get('currentSlug') || !state.sessionId) return;
+    if (mode === "auto" && (state.vendor !== "claude" || !autoSupported)) return;
+    sendPermissionMode(state.projectSlug, state.sessionId, mode);
+  });
+}
+
+export function sendPermissionMode(projectSlug, sessionId, mode) {
+  var ws = getWs();
+  if (store.get('skipPermsEnabled') === true) {
+    showToast("Skip permissions is forced by the server setting.", "error");
+    return false;
+  }
+  if (!projectSlug || !sessionId || !ws || ws.readyState !== 1) {
+    showToast("Permission mode could not be changed while disconnected.", "error");
+    return false;
+  }
+  var key = targetKey(projectSlug, sessionId);
+  if (permissionPendingFor(projectSlug, sessionId)) return false;
+  var requestId = typeof crypto !== "undefined" && crypto.randomUUID ? crypto.randomUUID() : String(Date.now()) + ":" + String(sessionId);
+  replacePending(key, { requestId: requestId, projectSlug: projectSlug, sessionId: sessionId, mode: mode });
+  requestTimers[requestId] = setTimeout(function() {
+    clearRequest(requestId, key);
+    showToast("Permission mode change timed out. The previous mode is still shown.", "error");
+  }, REQUEST_TIMEOUT_MS);
+  try {
+    var sendResult = ws.send(JSON.stringify({ type: "set_permission_mode", projectSlug: projectSlug, sessionId: sessionId, mode: mode, requestId: requestId }));
+    if (sendResult === false) throw new Error("The permission transport declined the request.");
+  } catch (error) {
+    clearRequest(requestId, key);
+    showToast("Permission mode could not be sent: " + (error.message || error), "error");
+    return false;
+  }
+  return true;
+}
+
+export function handlePermissionModeResult(msg) {
+  var key = targetKey(msg.projectSlug, msg.sessionId);
+  var pending = pendingMap()[key];
+  if (!pending || pending.requestId !== msg.requestId) return;
+  clearRequest(msg.requestId, key);
+  if (!msg.ok) {
+    showToast(msg.error || "Permission mode could not be changed.", "error");
+    return;
+  }
+  if (msg.projectSlug === store.get('currentSlug') && msg.sessionId === store.get('activeSessionId')) {
+    store.set({
+      currentMode: msg.mode || "default",
+      effectivePermissionMode: Object.prototype.hasOwnProperty.call(msg, 'effectivePermissionMode') ? msg.effectivePermissionMode : null,
+      permissionCapabilities: msg.permissionCapabilities || store.get('permissionCapabilities'),
+      mcpPermissionModeOverrides: msg.mcpPermissionModeOverrides || {},
+    });
+  }
+}

package/lib/public/modules/split-view.js

@@ -8,13 +8,15 @@ import { detachTuiView } from './session-tui-view.js';
 import { formatTokens } from './app-panels.js';
 import { VENDOR_AVATARS, VENDOR_NAMES } from './app-rendering.js';
 import { groupedSessionIds, findSplitGroup, isConfiguredWorker } from './split-group-helpers.js';
-import { showConfirm } from './app-misc.js';
 import { syncPairChrome } from './split-pair-ui.js';
 import { presentMarkdownEdit } from './filebrowser.js';
 import { autoStartLoginIfNeeded } from './vendor-login.js';
 import { isCurrentProjectSessionReady } from './split-session-boundary.js';
 import { splitPanesMatchProject, hasCurrentSplitGroup, reconcileRestoredSplit } from './project-activation.js';
 import { handlePaneIssueMessage } from './pane-issue-bridge.js';
+import { handlePaneFileMessage, revealFilesPanel } from './pane-file-bridge.js';
+import { openFile } from './filebrowser.js';
+import { bindPermissionControl, createPermissionControl, renderPermissionControl } from './permission-control.js';
 
 var host = null;
 var nativeApp = null;
@@ -161,25 +163,28 @@ export function syncPaneTitles() {
   syncPairChrome(host, split);
 }
 
-function updatePaneFullAccessButton(button, session) {
-  if (!button) return;
+function panePermissionControlState(session) {
   var mode = session && (session.runtimeMode || session.mode || "gui");
   var worker = !!session && isConfiguredWorker(store.get('splitGroups'), session.id);
-  // Permission policy belongs to the Driver. A configured Worker inherits it
-  // server-side and must not present a second, misleading control.
-  var visible = !!session && !worker && !store.get('skipPermsEnabled') && mode === "gui";
-  var enabled = visible && session.permissionMode === "bypassPermissions";
-  button.classList.toggle("hidden", !visible);
-  button.classList.toggle("active", enabled);
-  button.setAttribute("aria-checked", enabled ? "true" : "false");
-  button.title = enabled ? "Skip Permissions is on — click to restore permission prompts" : "Skip Permissions is off — permission prompts are on";
+  return {
+    projectSlug: store.get('currentSlug'),
+    sessionId: session && session.id,
+    vendor: session && session.vendor || store.get('currentVendor') || "claude",
+    permissionMode: session && session.permissionMode || "default",
+    effectivePermissionMode: session && session.effectivePermissionMode || null,
+    permissionCapabilities: session && session.permissionCapabilities || { auto: false, mcpOverride: false },
+    connected: store.get('connected'),
+    globalPermissionModeForced: store.get('skipPermsEnabled') === true,
+    visible: !!session && !worker && mode === "gui",
+    locked: worker,
+  };
 }
 
-function setPaneFullAccess(sessionId, enabled) {
-  var ws = getWs();
-  if (ws && ws.readyState === 1) {
-    ws.send(JSON.stringify({ type: "set_session_full_access", id: sessionId, enabled: enabled }));
-  }
+function updatePaneFullAccessButton(button, session) {
+  if (!button) return;
+  // Permission policy belongs to the Driver. A configured Worker inherits it
+  // server-side and must not present a second, misleading control.
+  renderPermissionControl(button, panePermissionControlState(session));
 }
 
 function createPane(pane, index) {
@@ -208,6 +213,8 @@ function createPane(pane, index) {
 
   var frame = document.createElement("iframe");
   frame.className = "split-pane-frame";
+  frame.dataset.projectSlug = pane.slug;
+  frame.dataset.sessionId = String(pane.sessionId);
   frame.src = paneUrl(pane);
   frame.title = pane.title;
 
@@ -225,21 +232,11 @@ function createPane(pane, index) {
   });
   header.appendChild(ctxChip);
 
-  var fullAccess = document.createElement("button");
-  fullAccess.type = "button";
-  fullAccess.className = "session-full-access split-pane-full-access hidden";
-  fullAccess.setAttribute("role", "switch");
-  fullAccess.innerHTML = '<span class="session-full-access-label">Skip Permissions</span><span class="session-full-access-track" aria-hidden="true"><span></span></span>';
+  var fullAccess = createPermissionControl("split-pane-full-access hidden", "Driver session permission mode");
   updatePaneFullAccessButton(fullAccess, session);
-  fullAccess.addEventListener("click", function () {
+  bindPermissionControl(fullAccess, function() {
     var current = sessionById(pane.sessionId);
-    if (current && current.permissionMode === "bypassPermissions") {
-      setPaneFullAccess(pane.sessionId, false);
-      return;
-    }
-    showConfirm("Skip permission prompts for this session? Tool requests will be approved automatically.", function () {
-      setPaneFullAccess(pane.sessionId, true);
-    }, "Skip Permissions", true);
+    return panePermissionControlState(current);
   });
   header.appendChild(fullAccess);
   // Permission state belongs to the session identity on the left. Keep it
@@ -293,6 +290,7 @@ function handlePaneMessage(event) {
     return;
   }
   if (handlePaneIssueMessage(event, host)) return;
+  if (handlePaneFileMessage(event, host, openFile, revealFilesPanel)) return;
   if (msg.type !== "clay-pane-context") return;
   var frames = host.querySelectorAll(".split-pane-frame");
   for (var i = 0; i < frames.length; i++) {
@@ -527,6 +525,8 @@ export function initSplitView() {
   document.addEventListener("click", handleSidebarSessionClick, true);
   store.subscribe(function (state, prev) {
     if (state.splitPanes !== prev.splitPanes) renderSplit(state.splitPanes);
+    if (state.permissionModePendingByTarget !== prev.permissionModePendingByTarget || state.connected !== prev.connected ||
+        state.skipPermsEnabled !== prev.skipPermsEnabled) syncPaneTitles();
     // Switching to a session outside the open split (new_session, palette,
     // notification click) closes the split UI; the group itself persists.
     if (state.activeSessionId !== prev.activeSessionId && state.splitPanes && state.splitPanes.panes) {

package/lib/sdk-bridge.js

@@ -788,61 +788,61 @@ function createSDKBridge(opts) {
     return null; // Not whitelisted
   }
 
-  function handleCanUseTool(session, toolName, input, opts) {
+  function resolveSessionPermissionMode(session) {
+    var mode = session.permissionMode || sm.currentPermissionMode;
+    var router = getWorkerPermissionRouter();
+    if (router && typeof router.inheritedPermissionMode === "function") {
+      var inherited = router.inheritedPermissionMode(session);
+      if (inherited) mode = inherited;
+    }
+    return mode;
+  }
+
+  function handlePreToolUsePolicy(session, toolName, input) {
     var debateDecision = homeDebateToolPolicy.initialToolDecision(session, toolName, input);
-    if (debateDecision) return Promise.resolve(debateDecision);
+    if (debateDecision) return debateDecision;
     // The dynamic proposal tool is bound to this exact query session. It only
     // posts the inline proposal; starting the debate still requires the user.
     if (session.homeDebatePlanning === true && toolName === "propose_debate") {
-      return Promise.resolve({ behavior: "allow", updatedInput: input });
+      return { behavior: "allow", updatedInput: input };
     }
     // Mate creation proposals only present the exact-session approval card;
     // creating the Mate still requires the user's explicit action there.
     if (session.mateCreationMode === true && toolName === "propose_mate") {
-      return Promise.resolve({ behavior: "allow", updatedInput: input });
-    }
-    // Full-auto mode: auto-approve everything except AskUserQuestion
-    // (which still needs to go through the user interaction flow).
-    var clayPermissionMode = session.permissionMode || sm.currentPermissionMode;
-    // A configured Split Worker is Driver-operated, so it runs under its
-    // Driver's permission mode, re-resolved from the live pair on every single
-    // decision. Nothing is copied at creation and the Worker's own persisted
-    // setting is never written, so toggling skip permissions on the Driver
-    // applies to the Worker's next call in either direction, mid-turn included.
-    var _wpMode = getWorkerPermissionRouter();
-    if (_wpMode && typeof _wpMode.inheritedPermissionMode === "function") {
-      var inherited = _wpMode.inheritedPermissionMode(session);
-      if (inherited) clayPermissionMode = inherited;
-    }
-    // AskUserQuestion is genuine user input, not an authorization, so it is
-    // excluded here exactly as it always was: a Driver in skip mode still
-    // cannot silently answer a question addressed to the person.
-    if (clayPermissionMode === "bypassPermissions" && toolName !== "AskUserQuestion") {
-      return Promise.resolve({ behavior: "allow", updatedInput: input });
+      return { behavior: "allow", updatedInput: input };
     }
-
     // Ralph Loop execution: auto-approve all tools, deny interactive ones.
     // Crafting sessions are interactive — user and Claude collaborate to build PROMPT.md / JUDGE.md.
     if (session.loop && session.loop.active && session.loop.role !== "crafting") {
       if (toolName === "AskUserQuestion") {
-        return Promise.resolve({ behavior: "deny", message: "Autonomous mode. Make your own decision." });
+        return { behavior: "deny", message: "Autonomous mode. Make your own decision." };
       }
       if (toolName === "EnterPlanMode") {
-        return Promise.resolve({ behavior: "deny", message: "Do not enter plan mode. Execute directly." });
+        return { behavior: "deny", message: "Do not enter plan mode. Execute directly." };
       }
-      return Promise.resolve({ behavior: "allow", updatedInput: input });
+      return { behavior: "allow", updatedInput: input };
     }
 
     // Check shared whitelist (read-only tools, safe browser tools, safe bash commands)
     var whitelisted = checkToolWhitelist(toolName, input);
     if (whitelisted) {
-      return Promise.resolve(whitelisted);
+      return whitelisted;
     }
 
+    return null;
+  }
+
+  function handleCanUseTool(session, toolName, input, opts) {
+    var initialDecision = handlePreToolUsePolicy(session, toolName, input);
+    if (initialDecision) return Promise.resolve(initialDecision);
+    // Skip permissions removes only the remaining Clay prompt. The SDK's
+    // deny/ask rules and Auto classifier have already run before this callback.
+    var skipRemainingPermissions = resolveSessionPermissionMode(session) === "bypassPermissions" && toolName !== "AskUserQuestion";
+
+    if (skipRemainingPermissions) return Promise.resolve({ behavior: "allow", updatedInput: input });
+
     // Auto-approve if tool was previously allowed for session
-    if (session.allowedTools && session.allowedTools[toolName]) {
-      return Promise.resolve({ behavior: "allow", updatedInput: input });
-    }
+    if (session.allowedTools && session.allowedTools[toolName]) return Promise.resolve({ behavior: "allow", updatedInput: input });
 
     // A visible Split Worker's remaining prompts belong to its paired Driver,
     // not to the Worker pane. This sits below every auto-decision above, so
@@ -988,12 +988,32 @@ function createSDKBridge(opts) {
     }
   }
 
+  function ownsQueryRuntime(session, queryInstance, queryGeneration) {
+    return session.queryInstance === queryInstance
+      && Number(session._sdkQueryGeneration || 0) === Number(queryGeneration)
+      && (!sm.sessions || typeof sm.sessions.get !== "function" || sm.sessions.get(session.localId) === session);
+  }
+
+  function recordRuntimeEffectivePermissionMode(session, queryInstance, queryGeneration, message) {
+    if (!message || (message.yokeType !== "init" && message.yokeType !== "status") || !message.permissionMode) return false;
+    if (!ownsQueryRuntime(session, queryInstance, queryGeneration)) return false;
+    session.effectivePermissionMode = message.permissionMode;
+    session.permissionModeFallbackReason = null;
+    sm.saveSessionFile(session);
+    sendToSession(session, { type: "config_state", sessionId: session.localId, vendor: session.vendor || "claude",
+      mode: session.permissionMode || sm.currentPermissionMode || "default", effectivePermissionMode: message.permissionMode,
+      permissionCapabilities: session.permissionCapabilities || { auto: false, mcpOverride: false },
+      mcpPermissionModeOverrides: session.mcpPermissionModeOverrides || {} });
+    return true;
+  }
+
   async function processQueryStream(session, codexCatalogCandidate) {
     // Capture references at start so we only clean up OUR resources in finally,
     // not resources from a newer query that may have been created after an abort.
     var myQueryInstance = session.queryInstance;
     var myAbortController = session.abortController;
     var myMessageQueue = session.messageQueue;
+    var myQueryGeneration = Number(session._sdkQueryGeneration || 0);
     console.log("[sdk-bridge] processQueryStream: starting for-await loop, vendor=" + (session.vendor || adapter.vendor));
     try {
       for await (var msg of myQueryInstance) {
@@ -1023,8 +1043,10 @@ function createSDKBridge(opts) {
               sendToSession(session, { type: "config_state", model: session.model || defaultModelForVendor(session.vendor || "claude"), vendor: session.vendor || "claude", sessionId: session.localId, mode: session.permissionMode || sm.currentPermissionMode || "default", effort: session.effort, betas: sm.currentBetas || [] });
               break;
             case "permission_mode_changed":
-              sm.currentPermissionMode = metaData.mode;
-              sendToSession(session, { type: "config_state", model: session.model || defaultModelForVendor(session.vendor || "claude"), vendor: session.vendor || "claude", sessionId: session.localId, mode: session.permissionMode || sm.currentPermissionMode, effort: session.effort || sm.currentEffort || "medium", betas: sm.currentBetas || [] });
+              // Setter notifications are acknowledgements, not a new project
+              // default and not proof of the runtime-effective mode. Only an
+              // init/status event below may confirm effectivePermissionMode.
+              sendToSession(session, { type: "config_state", model: session.model || defaultModelForVendor(session.vendor || "claude"), vendor: session.vendor || "claude", sessionId: session.localId, mode: session.permissionMode || sm.currentPermissionMode || "default", effectivePermissionMode: session.effectivePermissionMode || null, permissionCapabilities: session.permissionCapabilities || { auto: false, mcpOverride: false }, mcpPermissionModeOverrides: session.mcpPermissionModeOverrides || {}, effort: session.effort || sm.currentEffort || "medium", betas: sm.currentBetas || [] });
               break;
             case "worker_error":
               send({ type: "error", text: metaData.error });
@@ -1033,6 +1055,10 @@ function createSDKBridge(opts) {
           continue;
         }
         processSDKMessage(session, msg);
+        // SDK init/status events are the only authority for runtime-effective
+        // permission state. Setter acknowledgement deliberately does not
+        // change this field.
+        recordRuntimeEffectivePermissionMode(session, myQueryInstance, myQueryGeneration, msg);
         if (codexCatalogCandidate && msg && msg.yokeType === "session_started" && msg.sessionId
             && session.queryInstance === myQueryInstance
             && Number(session._sdkQueryGeneration || 0) === codexCatalogCandidate.generation
@@ -1843,12 +1869,20 @@ function createSDKBridge(opts) {
       abortController: linuxUser ? undefined : session.abortController,
       canUseTool: function(toolName, input, toolOpts) {
         var nativeQuestionError = toolName === "AskUserQuestion" ? scheduleQuestionError(input) : null;
-        if (nativeQuestionError) return Promise.resolve({ behavior: "deny", message: nativeQuestionError });
+        if (nativeQuestionError) return { behavior: "deny", message: nativeQuestionError };
         var permissionName = toolName;
         var permissionToolDef = findSessionToolDef(toolName);
         if (permissionToolDef && permissionToolDef.permissionName) permissionName = permissionToolDef.permissionName;
         return handleCanUseTool(session, permissionName, input, toolOpts);
       },
+      preToolUsePolicy: function(toolName, input) {
+        var nativeQuestionError = toolName === "AskUserQuestion" ? scheduleQuestionError(input) : null;
+        if (nativeQuestionError) return Promise.resolve({ behavior: "deny", message: nativeQuestionError });
+        var permissionName = toolName;
+        var permissionToolDef = findSessionToolDef(toolName);
+        if (permissionToolDef && permissionToolDef.permissionName) permissionName = permissionToolDef.permissionName;
+        return handlePreToolUsePolicy(session, permissionName, input);
+      },
       onUserInputRequest: function(request, respond) {
         return sessionUserInputHandler(request, respond);
       },
@@ -1948,6 +1982,24 @@ function createSDKBridge(opts) {
 
     // Store QueryHandle on session for iteration and control.
     session.queryInstance = handle;
+    // Capabilities come from the installed query handle, never a model-name
+    // table. `acceptEdits` and MCP overrides are Claude SDK semantics; a
+    // vendor may expose the generic setter without implementing either.
+    session.permissionCapabilities = require("./session-permission-mode").capabilities(session, sm.defaultVendor);
+    session.permissionCapabilities.mcpOverride = sessionAdapter.vendor === "claude" && typeof handle.setMcpPermissionModeOverride === "function";
+    session.effectivePermissionMode = null;
+    sm.saveSessionFile(session);
+    sendToSession(session, { type: "config_state", model: session.model || defaultModelForVendor(session.vendor || "claude"), vendor: session.vendor || "claude", sessionId: session.localId, mode: session.permissionMode || sm.currentPermissionMode || "default", effectivePermissionMode: null, permissionCapabilities: session.permissionCapabilities, mcpPermissionModeOverrides: session.mcpPermissionModeOverrides || {}, effort: session.effort || sm.currentEffort || "medium", betas: sm.currentBetas || [] });
+
+    if (session.permissionMode === "auto" && session.permissionCapabilities.mcpOverride) {
+      var overrideNames = Object.keys(session.mcpPermissionModeOverrides || {});
+      for (var oi = 0; oi < overrideNames.length; oi++) {
+        try { await handle.setMcpPermissionModeOverride(overrideNames[oi], session.mcpPermissionModeOverrides[overrideNames[oi]]); }
+        catch (overrideError) {
+          sendToSession(session, { type: "error", text: "Failed to restore the AI review policy for " + overrideNames[oi] + ": " + (overrideError.message || overrideError) });
+        }
+      }
+    }
 
     if (typeof beforePush === "function" && beforePush() !== true) {
       try { handle.close(); } catch (e) {}
@@ -2358,17 +2410,15 @@ function createSDKBridge(opts) {
   async function setPermissionMode(session, mode) {
     if (!session.queryInstance) {
       // No active query — just store the mode for next startQuery
-      sm.currentPermissionMode = mode;
-      sendToSession(session, { type: "config_state", model: session.model || defaultModelForVendor(session.vendor || "claude"), vendor: session.vendor || "claude", sessionId: session.localId, mode: sm.currentPermissionMode, effort: session.effort || sm.currentEffort || "medium", betas: sm.currentBetas || [] });
-      return;
+      return { ok: true, effectiveMode: mode };
     }
     try {
       // Route through QueryHandle (works for both in-process and worker paths)
       await session.queryInstance.setPermissionMode(mode);
-      sm.currentPermissionMode = mode;
-      sendToSession(session, { type: "config_state", model: session.model || defaultModelForVendor(session.vendor || "claude"), vendor: session.vendor || "claude", sessionId: session.localId, mode: sm.currentPermissionMode, effort: session.effort || sm.currentEffort || "medium", betas: sm.currentBetas || [] });
+      return { ok: true, effectiveMode: mode };
     } catch (e) {
       sendToSession(session, { type: "error", text: "Failed to set permission mode: " + (e.message || e) });
+      return { ok: false, error: e.message || String(e) };
     }
   }
 
@@ -2404,12 +2454,14 @@ function createSDKBridge(opts) {
 
   // Override the permission mode for one MCP server on the active query.
   async function setMcpPermissionModeOverride(session, serverName, mode) {
-    if (!session || !session.queryInstance) return;
+    if (!session || !session.queryInstance || typeof session.queryInstance.setMcpPermissionModeOverride !== "function") return { ok: false, error: "MCP permission controls are unavailable for this session." };
     try {
       // Route through QueryHandle (works for both in-process and worker paths)
       await session.queryInstance.setMcpPermissionModeOverride(serverName, mode);
+      return { ok: true };
     } catch (e) {
       send({ type: "error", text: "Failed to set MCP permission mode: " + (e.message || e) });
+      return { ok: false, error: e.message || String(e) };
     }
   }
 
@@ -2583,6 +2635,9 @@ function createSDKBridge(opts) {
     createMessageQueue: createMessageQueue,
     processSDKMessage: processSDKMessage,
     checkToolWhitelist: checkToolWhitelist,
+    handlePreToolUsePolicy: handlePreToolUsePolicy,
+    ownsQueryRuntime: ownsQueryRuntime,
+    recordRuntimeEffectivePermissionMode: recordRuntimeEffectivePermissionMode,
     handleCanUseTool: handleCanUseTool,
     handleElicitation: handleElicitation,
     processQueryStream: processQueryStream,

package/lib/session-permission-mode.js

@@ -0,0 +1,42 @@
+// Canonical, server-owned permission selection validation. The requested mode
+// is persisted separately from the SDK mode because Clay keeps the final
+// canUseTool decision for GUI sessions.
+
+function normalize(mode) {
+  if (mode === "default" || mode === "auto" || mode === "plan" || mode === "acceptEdits" || mode === "bypassPermissions") return mode;
+  return null;
+}
+
+function capabilities(session, defaultVendor) {
+  var vendor = session && session.vendor || defaultVendor || "claude";
+  return {
+    auto: vendor === "claude",
+    mcpOverride: vendor === "claude" && !!(session && session.queryInstance &&
+      typeof session.queryInstance.setMcpPermissionModeOverride === "function"),
+  };
+}
+
+function supportsAuto(session, defaultVendor) {
+  return capabilities(session, defaultVendor).auto;
+}
+
+function validate(session, mode, defaultVendor) {
+  var requested = normalize(mode);
+  if (!requested) return { ok: false, error: "Unknown permission mode." };
+  if (requested === "auto" && !supportsAuto(session, defaultVendor)) {
+    return { ok: false, error: "Auto permissions are not available for this session." };
+  }
+  return { ok: true, mode: requested };
+}
+
+function clientState(session, fallback, defaultVendor) {
+  var requested = session && session.permissionMode || fallback || "default";
+  return {
+    requestedPermissionMode: requested,
+    effectivePermissionMode: session && session.effectivePermissionMode || null,
+    permissionCapabilities: capabilities(session, defaultVendor),
+    mcpPermissionModeOverrides: session && session.mcpPermissionModeOverrides || {},
+  };
+}
+
+module.exports = { validate: validate, clientState: clientState, supportsAuto: supportsAuto, capabilities: capabilities };

package/lib/sessions.js

@@ -177,6 +177,7 @@ function createSessionManager(opts) {
       // so lazy-resume (`claude --resume`) re-spawns with the same flag.
       if (session.dangerouslySkipPermissions) metaObj.dangerouslySkipPermissions = true;
       if (session.permissionMode) metaObj.permissionMode = session.permissionMode;
+      if (session.mcpPermissionModeOverrides) metaObj.mcpPermissionModeOverrides = session.mcpPermissionModeOverrides;
       if (session.permissionModeBeforeFullAccess) metaObj.permissionModeBeforeFullAccess = session.permissionModeBeforeFullAccess;
       if (session.autonomousRun) metaObj.autonomousRun = session.autonomousRun;
       if (session.loopInterviewBrief) metaObj.loopInterviewBrief = session.loopInterviewBrief;
@@ -348,6 +349,10 @@ function createSessionManager(opts) {
       // Clay's own per-session permission mode.
       session.dangerouslySkipPermissions = session.mode === "tui" && !!m.dangerouslySkipPermissions;
       session.permissionMode = m.permissionMode || (session.mode === "gui" && m.dangerouslySkipPermissions ? "bypassPermissions" : null);
+      // Runtime-effective state is observed from the live SDK only. A daemon
+      // restore has no active runtime to confirm the old value.
+      session.effectivePermissionMode = null;
+      session.mcpPermissionModeOverrides = m.mcpPermissionModeOverrides && typeof m.mcpPermissionModeOverrides === "object" ? m.mcpPermissionModeOverrides : {};
       session.permissionModeBeforeFullAccess = m.permissionModeBeforeFullAccess || null;
       session.autonomousRun = restoreStoredRun(m.autonomousRun);
       session.loopInterviewBrief = m.loopInterviewBrief && typeof m.loopInterviewBrief === "object" ? m.loopInterviewBrief : null;
@@ -587,6 +592,9 @@ function createSessionManager(opts) {
       runtimeTerminalId: typeof s.runtimeTerminalId === "number" ? s.runtimeTerminalId : null,
       dangerouslySkipPermissions: !!s.dangerouslySkipPermissions,
       permissionMode: s.permissionMode || null,
+      effectivePermissionMode: s.effectivePermissionMode || null,
+      permissionCapabilities: require("./session-permission-mode").capabilities(s, defaultVendor),
+      mcpPermissionModeOverrides: s.mcpPermissionModeOverrides || {},
       autonomousRun: s.autonomousRun ? {
         id: s.autonomousRun.id,
         state: s.autonomousRun.state,
@@ -676,6 +684,8 @@ function createSessionManager(opts) {
       mode: (sessionOpts && sessionOpts.mode === "tui") ? "tui" : "gui",
       dangerouslySkipPermissions: !!(sessionOpts && sessionOpts.mode === "tui" && sessionOpts.dangerouslySkipPermissions),
       permissionMode: (sessionOpts && sessionOpts.permissionMode) || null,
+      effectivePermissionMode: null,
+      mcpPermissionModeOverrides: {},
       permissionModeBeforeFullAccess: null,
       autonomousRun: null,
       loopInterviewBrief: null,
@@ -725,6 +735,8 @@ function createSessionManager(opts) {
       mode: (sessionOpts && sessionOpts.mode === "tui") ? "tui" : "gui",
       dangerouslySkipPermissions: !!(sessionOpts && sessionOpts.mode === "tui" && sessionOpts.dangerouslySkipPermissions),
       permissionMode: (sessionOpts && sessionOpts.permissionMode) || null,
+      effectivePermissionMode: null,
+      mcpPermissionModeOverrides: {},
       permissionModeBeforeFullAccess: null,
       autonomousRun: null,
       loopInterviewBrief: null,
@@ -826,7 +838,8 @@ function createSessionManager(opts) {
     var _capsByVendor = capabilitiesByVendor || {};
     var _sessionVendor = session.vendor || defaultVendor || "claude";
     var _vendorCaps = _capsByVendor[_sessionVendor] || {};
-    _send({ type: "session_switched", id: localId, cliSessionId: session.cliSessionId || null, loop: session.loop || null, vendor: session.vendor || null, model: session.model || null, effort: session.effort || null, hasHistory: (session.history && session.history.length > 0), capabilities: _vendorCaps, isProcessing: !!session.isProcessing, mode: session.mode || "gui", terminalId: typeof session.terminalId === "number" ? session.terminalId : null, runtimeMode: session.runtimeMode || null, runtimeTerminalId: typeof session.runtimeTerminalId === "number" ? session.runtimeTerminalId : null, tuiSuspended: !!session.tuiSuspended, dangerouslySkipPermissions: !!session.dangerouslySkipPermissions, permissionMode: session.permissionMode || null, autonomousRun: projectAutonomousRun(session.autonomousRun), loopInterviewBrief: session.loopInterviewBrief || null, loopInterviewHandoff: session.loopInterviewHandoff || null, scheduledTaskDraft: session.scheduledTaskDraft || null });
+    var _permissionState = require("./session-permission-mode").clientState(session, "default", defaultVendor);
+    _send({ type: "session_switched", id: localId, cliSessionId: session.cliSessionId || null, loop: session.loop || null, vendor: session.vendor || null, model: session.model || null, effort: session.effort || null, hasHistory: (session.history && session.history.length > 0), capabilities: _vendorCaps, isProcessing: !!session.isProcessing, mode: session.mode || "gui", terminalId: typeof session.terminalId === "number" ? session.terminalId : null, runtimeMode: session.runtimeMode || null, runtimeTerminalId: typeof session.runtimeTerminalId === "number" ? session.runtimeTerminalId : null, tuiSuspended: !!session.tuiSuspended, dangerouslySkipPermissions: !!session.dangerouslySkipPermissions, permissionMode: _permissionState.requestedPermissionMode, effectivePermissionMode: _permissionState.effectivePermissionMode, permissionCapabilities: _permissionState.permissionCapabilities, mcpPermissionModeOverrides: _permissionState.mcpPermissionModeOverrides, autonomousRun: projectAutonomousRun(session.autonomousRun), loopInterviewBrief: session.loopInterviewBrief || null, loopInterviewHandoff: session.loopInterviewHandoff || null, scheduledTaskDraft: session.scheduledTaskDraft || null });
     // Send vendor-specific slash commands
     var _vendorCmds = (session.slashCommandsByVendor && session.slashCommandsByVendor[_sessionVendor])
       || session.slashCommands