[brennanb2025]

ELI5

#26116 (merged, not in a release yet) gave Claude and Codex chats their own permission setting: "ask me before running commands" (Ask for approval) or "just run them" (Full access). It also added a default for new chats, under Settings → Chat → Permissions. The first time someone runs a build with #26116, Orca fills that default in once, from how they already had Orca set up.

That one-time fill-in looked at the wrong thing, so many people who never had approval prompts in chat would land on Ask for approval. Their new chats would then stop before every command. A user already reported this from the chat side (STA-10345: "every single command needs manual confirmation").

This PR fills the default from Claude's and Codex's existing arguments. If both already bypassed approvals, new chats start with Full access; otherwise they start with Ask for approval.

What Changed

Terms used below

• Skip flag: the launch argument that tells an agent not to ask before acting. For Claude it's --dangerously-skip-permissions; for Codex it's --dangerously-bypass-approvals-and-sandbox. Orca stores each agent's launch arguments in Settings → Agents.
• Agent Permissions toggle (Yolo / Manual): the switch in Settings → Agents. It has no saved value of its own. It's computed from the arguments of all ~35 agents Orca can launch: Yolo adds each agent's skip flag, Manual removes it.

Who gets what as the new-chat default

Your setup	Before this PR	After this PR
Untouched (Orca's shipped defaults)	Full access	Full access
You chose Manual	Ask	Ask
Claude still has its skip flag but you added another argument, e.g. --dangerously-skip-permissions --model opus	Ask (your chats start prompting)	Full access (same as your chats did before)
Some other agent's arguments customised (e.g. Gemini without --yolo), Claude and Codex untouched	Ask	Full access
Claude's or Codex's skip flag removed	Ask	Ask

Before: the fill-in gave Full access only when all ~35 agents' arguments were exactly their skip flag. Any difference anywhere counted as "mixed" and gave Ask, even though Claude and Codex chats themselves had been running without prompts.

After: Full access when Claude's and Codex's own arguments contain their skip flag, otherwise Ask. Other agents' arguments are ignored, because only Claude and Codex chats use this setting. Before #26116, this was exactly the check each Claude or Codex chat made when it started.

Unchanged:

• The fill-in still happens once, only when the setting doesn't exist yet. A value you've saved is never changed.
• Terminal launches, the Agent Permissions toggle and other agents' chats are untouched.

Mechanism: loadedChatPermissionSetting (runs when settings load) now asks resolvedTuiAgentArgsBypassPermissions('claude' | 'codex', …). That's the existing helper that tokenizes the arguments the way the launch does, so a flag inside a quoted prompt or after -- doesn't count. A brand-new profile's default is written directly as Full access, because Orca's shipped Claude and Codex arguments carry their skip flags. A test checks the two stay in agreement.

Why

The default should preserve Full access when both chat agents already used it and avoid granting it when either did not. It reads the same two argument values the chats themselves read before they had their own permission setting.

Alternatives considered:

• Follow the Yolo/Manual toggle as it's displayed. The toggle shows Yolo for any "mixed" setup. Clicking Manual only clears agents whose arguments are empty or exactly the flag, so someone with custom arguments on any agent still sees Yolo after choosing Manual. Following it would grant those people Full access they turned down.
• Keep "exactly Yolo on every agent" (the current rule). This is the regression in the table above.
• Give the toggle a real saved value. That's the clean long-term fix, but it also changes terminal launches and is a bigger change. It's a possible follow-up, not needed to ship feat(native-chat): each Claude/Codex chat gets its own permission mode #26116 safely.

If Claude and Codex disagree (one has its skip flag, the other doesn't), the result is Ask, because there's a single default for both. That's rare and errs toward asking.

Companion PR: #28099 makes chats created before #26116 use this same default, instead of Ask. Each PR stands on its own.

Linked Issue

STA-10345 (user feedback). Follow-up to #26116, which hasn't shipped in a release yet.

Visual Proof

Both screenshots use the same profile, created on a build from just before #26116 with Claude's arguments set to --dangerously-skip-permissions --model opus (Agent Permissions still shows Yolo). Each build opened its own copy of that profile.

Before (main): Settings → Chat → Permissions for new chats comes out as Ask for approval, although Claude still launches with the skip flag.

After (this PR): the same profile comes out as Full access.

Testing

• src/shared/agent-chat-permission-mode.test.ts:

  • Yolo → Full access, Manual → Ask
  • the flag among other arguments → Full access
  • other agents' arguments are ignored
  • Claude or Codex without the flag → Ask
  • Manual with another agent's custom arguments kept → Ask
  • a new profile gets Full access
  • a saved value wins

• normalize-loaded-global-settings.test.ts passes.

• Manual (macOS, hidden dev builds over CDP): upgraded the profile described under Visual Proof on main and on this branch, and read Settings → Chat and the saved value (ask on main, full-access here).

• I manually tested these changes locally

• Automated tests added/updated, or explained why not below

Notes

• SSH/remote: the fill-in runs wherever settings load, from that host's own arguments, as before.
• Windows: arguments are read with the user's configured Windows shell, as the launch reads them.
• Older builds: feat(native-chat): each Claude/Codex chat gets its own permission mode #26116 isn't in a release yet, so no user has a saved value. Anyone who ran a build from main since feat(native-chat): each Claude/Codex chat gets its own permission mode #26116 keeps whatever was saved and can change it in Settings → Chat.

[brennanb2025]

New chats could start asking for approvals even when Claude and Codex both still bypassed them: the one-time default required every agent's arguments to exactly match its skip flag. This PR instead reads the existing Claude and Codex argument checks. Both bypass → Full access; otherwise → Ask for approval. Saved choices win.

Review completed at 726f870. The independent architecture, correctness, readiness and performance passes found no P0/P1 issue. Keep the design. No source changes were needed during this review; two description sentences were corrected to avoid promising unchanged behavior when Claude and Codex disagree.

Verified:

• 95 targeted permission, settings-load and argument-resolution tests passed; node and renderer typechecks passed.
• 304 seed cases, 304 settings-normalization cases, 3,040 saved/invalid-value checks and six legacy-override cases passed across simulated platform/shell branches. These do not establish native Windows execution.
• Six rendered Settings → Chat checks passed on M4Air using hidden builds and opencode over CDP: both custom bypass arguments give Full access; either missing flag gives Ask; Manual with unrelated custom arguments gives Ask; explicit Ask stays Ask; and selecting Ask survives restart. The coordinator inspected the six screenshots. These used synthetic legacy profiles, not a new before/after run of the old binary.
• GitHub CI was green: 14 passing, 18 skipped checks. Local static checks passed 22/23; the sole failure was the known Bun wrapper error, “Script not found check.” Separate node/web typechecks passed. The performance pass found no material regression from source bounds; runtime performance was not measured.

Deferred P2 — R28100-READY-01: the raw Windows shell value passed during loading can now fail settings loading when an older profile has a non-string shell value, such as 7, and no saved chat permission mode. The real bundled loader succeeds on main and throws “shell?.trim is not a function” here under simulated Windows. Normal shell controls do not produce this malformed value. Repairing/removing the invalid shell value is a practical workaround; malformed-profile hardening remains deferred.

Windows rendered QA is BLOCKED: both remote Codex supervisors stopped at sign-in, and an authenticated local operator then confirmed opencode was absent on Windows high spec. All three permitted model commands failed before driver creation. No Windows app/UI result is claimed. Live SSH, paired web/mobile, mixed-version binaries, folder-workspace sessions and real Claude/Codex commands were not exercised; their relevant settings paths were inspected.

Mac test apps/profiles and its QA worktree are cleaned up. The Windows operator shell exited; the two earlier sign-in sessions and their worktrees are preserved because orchestration did not retain ownership needed to release them safely. No merge or auto-merge was performed.

Original M4Air captures at the reviewed head:

Both bypass flags among model arguments → Full access.

Selecting Ask, then restarting the same profile → Ask remains saved.