Claude Code and Codex CLI both shipped classifier-driven auto-approval
modes. Expose them as a new unified "auto" permission mode, distinct
from the existing unrestricted bypassPermissions (now labeled
"Full Auto" in the UI).
Claude (Agent SDK >= 0.3.182):
- Map unified "auto" to permissionMode "auto" and let the SDK's
classifier-driven flow decide approvals; the PreToolUse hook yields
to the SDK in auto mode instead of forcing a manual prompt.
- Live-switch via query.setPermissionMode(); when the SDK rejects a
live switch, keep the previous mode instead of committing a state
the runtime refused.
- Entering/leaving Full Auto rewrites the runtime signature to a
rebuild sentinel because allowDangerouslySkipPermissions is frozen
at spawn; acquireRuntime then disposes and recreates the runtime.
- Guard setPermissionModePersistent with the runtime session epoch so
stale requests from dead tabs cannot mutate the live runtime.
Codex (SDK/CLI >= 0.146.0):
- Inject approvals_reviewer="auto_review" via CodexOptions.config
before constructing the Codex client, with approvalPolicy on-request
and sandboxMode workspace-write; external env overrides cannot
weaken the forced native-auto settings.
- Send approvals_reviewer="user" in every non-auto mode so resumed
threads do not inherit a previous auto_review configuration.
- Suppress the plugin's own approval bridge for item.started and
file_change events in auto mode; those events arrive after the
native reviewer has already decided.
- Probe the installed SDK version before enabling auto and surface a
clear error when it is below the verified floor.
Host layers:
- Normalize modes per provider in Java and webview (auto only for
claude/codex; legacy autoEdit migrates to acceptEdits, or default on
omp); reject unknown mode strings in SessionState.
- Gate the webview mode selector on the Codex SDK capability probe and
reset a persisted auto selection when the SDK is too old.
- Add "auto" to the Plan Approval dialog, status bar widget, and all
Java/webview locale bundles; rename the bypassPermissions label to
"Full Auto".
Known limitation: Claude's auto mode depends on the upstream API
serving a claude-sonnet model for the safety classifier. When no
sonnet model is available (e.g. third-party relay endpoints), tool
calls that require classification fail with a retryable error while
read-only operations keep working.
Design doc: docs/feat/native-auto-approval-mode.md
Gadfly