feat(tui): full-auto permission mode, and classify local dev servers separately

internal/acp/agent.go

@@ -365,13 +365,19 @@ func (a *Agent) handleSetMode(_ context.Context, params json.RawMessage) (any, e
 	}
 	sess.turnMu.Lock()
 	defer sess.turnMu.Unlock()
-	mode := agent.PermissionMode(p.ModeID)
+	// Normalized before the switch, for the same reason the TUI normalizes at its
+	// own boundary: the mode arrives as data, so the accepted legacy "unsafe"
+	// spelling reaches this switch unrewritten and falls through to default. The
+	// client that asks for the disallowed mode by its documented old name is then
+	// told it does not exist, which reads as "try another spelling" rather than
+	// "this door is closed over ACP".
+	mode := agent.NormalizePermissionMode(agent.PermissionMode(p.ModeID))
 	switch mode {
 	case agent.PermissionModeAuto, agent.PermissionModeAsk, agent.PermissionModePlan:
 		sess.setMode(mode)
 		(&notifier{conn: a.conn, sessionID: sess.id}).currentMode(string(mode))
 		return SetSessionModeResult{}, nil
-	case agent.PermissionModeUnsafe:
+	case agent.PermissionModeFullAuto:
 		// Unsafe = run every tool with no prompt. The TUI gates this behind an
 		// explicit --skip-permissions-unsafe operator flag; an editor client must
 		// not be able to grant itself unconfined, no-prompt access over the wire.
@@ -401,12 +407,15 @@ func (a *Agent) handleSetConfigOption(_ context.Context, params json.RawMessage)
 		// set_mode and set_config_option) serialize mode flips consistently.
 		sess.turnMu.Lock()
 		defer sess.turnMu.Unlock()
-		mode := agent.PermissionMode(p.Value)
+		// Normalized like handleSetMode above: this is the second advertised mode
+		// door, and an alias that only one of them rewrites is a difference
+		// between two paths that are meant to be the same contract.
+		mode := agent.NormalizePermissionMode(agent.PermissionMode(p.Value))
 		switch mode {
 		case agent.PermissionModeAuto, agent.PermissionModeAsk, agent.PermissionModePlan:
 			sess.setMode(mode)
 			(&notifier{conn: a.conn, sessionID: sess.id}).currentMode(string(mode))
-		case agent.PermissionModeUnsafe:
+		case agent.PermissionModeFullAuto:
 			return nil, RPCError(codeInvalidParams, "mode not permitted over ACP: "+p.Value)
 		default:
 			return nil, RPCError(codeInvalidParams, "unknown mode: "+p.Value)

internal/acp/agent_test.go

@@ -142,8 +142,8 @@ func TestACPEndToEndPrompt(t *testing.T) {
 	if len(newRes.ConfigOptions) != 2 || newRes.ConfigOptions[0].ID != configIDModel || newRes.ConfigOptions[0].CurrentValue != "fake-model" {
 		t.Fatalf("model config option = %+v, want fake-model fallback", newRes.ConfigOptions)
 	}
-	if newRes.ConfigOptions[1].ID != configIDMode || newRes.ConfigOptions[1].CurrentValue != string(agent.PermissionModeAuto) {
-		t.Fatalf("mode config option = %+v", newRes.ConfigOptions[1])
+	if mode := configOptionByID(t, newRes.ConfigOptions, configIDMode); mode.CurrentValue != string(agent.PermissionModeAuto) {
+		t.Fatalf("mode config option = %+v", mode)
 	}
 
 	// session/prompt
@@ -222,7 +222,7 @@ func TestACPModelConfigOptionsCatalogSelectionAndLoad(t *testing.T) {
 	if len(loaded.ConfigOptions) != 2 || loaded.ConfigOptions[0].CurrentValue != "gpt-5.4-mini" {
 		t.Fatalf("load model option = %+v", loaded.ConfigOptions)
 	}
-	if loaded.ConfigOptions[1].CurrentValue != string(agent.PermissionModeAuto) {
+	if mode := configOptionByID(t, loaded.ConfigOptions, configIDMode); mode.CurrentValue != string(agent.PermissionModeAuto) {
 		t.Fatalf("load mode option = %+v", loaded.ConfigOptions[1])
 	}
 }
@@ -420,7 +420,7 @@ func TestACPSetModeUpdatesSession(t *testing.T) {
 		t.Fatalf("config mode options missing plan: %#v", planConfigured.ConfigOptions[1].Options)
 	}
 	// Unsafe must be rejected over ACP — a client can't self-grant no-prompt host access.
-	if err := h.client.Call(ctx, MethodSessionSetMode, SetSessionModeParams{SessionID: newRes.SessionID, ModeID: string(agent.PermissionModeUnsafe)}, &SetSessionModeResult{}); err == nil {
+	if err := h.client.Call(ctx, MethodSessionSetMode, SetSessionModeParams{SessionID: newRes.SessionID, ModeID: string(agent.PermissionModeFullAuto)}, &SetSessionModeResult{}); err == nil {
 		t.Fatal("expected Unsafe mode to be rejected over ACP")
 	}
 	// An unknown mode must be rejected.
@@ -429,6 +429,70 @@ func TestACPSetModeUpdatesSession(t *testing.T) {
 	}
 }
 
+// The legacy "unsafe" spelling has to reach the full-auto arm of both mode
+// doors, not fall through to "unknown mode".
+//
+// It is an accepted alias everywhere else in the tree, so a client that sends it
+// is naming the mode ACP deliberately refuses. Unnormalized, both handlers
+// answered "unknown mode: unsafe" — the mode was still refused, so nothing
+// escalated, but the client was told the wrong thing about why: that the mode
+// does not exist, rather than that this transport will not grant it. That
+// invites retrying under another spelling instead of stopping.
+//
+// Both doors are checked because they are two entry points onto one contract,
+// and the previous round of this bug was exactly one layer normalizing while
+// another did not.
+func TestACPRejectsLegacyUnsafeAliasAsDisallowedNotUnknown(t *testing.T) {
+	h := newHarness(t, testDeps(t))
+	defer h.stop()
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	var newRes NewSessionResult
+	if err := h.client.Call(ctx, MethodSessionNew, NewSessionParams{Cwd: t.TempDir(), McpServers: []McpServer{}}, &newRes); err != nil {
+		t.Fatalf("session/new: %v", err)
+	}
+
+	assertDisallowed := func(door string, err error) {
+		t.Helper()
+		if err == nil {
+			t.Fatalf("%s: legacy unsafe alias was accepted over ACP", door)
+		}
+		if !strings.Contains(err.Error(), "mode not permitted over ACP") {
+			t.Errorf("%s: error = %q, want the disallowed-mode message", door, err)
+		}
+		if strings.Contains(err.Error(), "unknown mode") {
+			t.Errorf("%s: error = %q, want the alias resolved instead of reported as unknown", door, err)
+		}
+	}
+
+	// Spelled literally on purpose: this is the value that travels over the wire,
+	// and the Go alias for it is the canonical string, not the legacy one.
+	const legacyModeID = "unsafe"
+	assertDisallowed("set_mode", h.client.Call(ctx, MethodSessionSetMode,
+		SetSessionModeParams{SessionID: newRes.SessionID, ModeID: legacyModeID}, &SetSessionModeResult{}))
+	assertDisallowed("set_config_option", h.client.Call(ctx, MethodSessionSetConfigOption,
+		SetSessionConfigOptionParams{SessionID: newRes.SessionID, ConfigID: configIDMode, Value: legacyModeID}, &SetSessionConfigOptionResult{}))
+
+	// Refusing must leave the session where it was, not in a half-applied state.
+	var configured SetSessionConfigOptionResult
+	if err := h.client.Call(ctx, MethodSessionSetConfigOption, SetSessionConfigOptionParams{
+		SessionID: newRes.SessionID, ConfigID: configIDMode, Value: string(agent.PermissionModeAsk),
+	}, &configured); err != nil {
+		t.Fatalf("set_config_option ask: %v", err)
+	}
+	if got := configured.ConfigOptions[1].CurrentValue; got != string(agent.PermissionModeAsk) {
+		t.Fatalf("mode after the refusals = %q, want ask", got)
+	}
+
+	// A genuinely unknown mode must still say so, or the assertions above would
+	// hold for a handler that answered "not permitted" to everything.
+	err := h.client.Call(ctx, MethodSessionSetMode, SetSessionModeParams{SessionID: newRes.SessionID, ModeID: "bogus"}, &SetSessionModeResult{})
+	if err == nil || !strings.Contains(err.Error(), "unknown mode") {
+		t.Fatalf("set_mode bogus = %v, want an unknown-mode error", err)
+	}
+}
+
 // TestACPPlanModeWiresPermissionModeIntoAgentOptions confirms selecting "plan"
 // over ACP actually reaches agent.Options.PermissionMode for the next turn —
 // the same gap this test's TUI counterpart covers for /plan on.
@@ -599,3 +663,19 @@ func drainTextUntil(t *testing.T, ch <-chan string, done func(string) bool) stri
 		}
 	}
 }
+
+// configOptionByID finds an advertised option by its identity rather than by
+// position. Asserting on ConfigOptions[1] made every one of these tests depend
+// on the ORDER the options are advertised in: reordering them would move the
+// assertion onto a different option, or panic, instead of failing with a
+// message about the option it means.
+func configOptionByID(t *testing.T, options []SessionConfigOption, id string) SessionConfigOption {
+	t.Helper()
+	for _, option := range options {
+		if option.ID == id {
+			return option
+		}
+	}
+	t.Fatalf("no config option %q was advertised; got %+v", id, options)
+	return SessionConfigOption{}
+}

internal/agent/compaction_test.go

@@ -344,7 +344,7 @@ func TestRunProactiveCompactionTriggers(t *testing.T) {
 
 	result, err := Run(context.Background(), strings.Repeat("y", 8000), provider, Options{
 		Registry:               registry,
-		PermissionMode:         PermissionModeUnsafe,
+		PermissionMode:         PermissionModeFullAuto,
 		ContextWindow:          1000, // ~250 token 80% threshold; easily exceeded
 		CompactionPreserveLast: 2,
 	})
@@ -372,7 +372,7 @@ func TestRunNoCompactionWhenContextWindowZero(t *testing.T) {
 
 	_, err := Run(context.Background(), strings.Repeat("y", 8000), provider, Options{
 		Registry:       registry,
-		PermissionMode: PermissionModeUnsafe,
+		PermissionMode: PermissionModeFullAuto,
 		ContextWindow:  0, // disabled
 	})
 	if err != nil {
@@ -513,7 +513,7 @@ func TestRunReactiveCompactionRecovers(t *testing.T) {
 	// only the reactive path can save the run.
 	result, err := Run(context.Background(), strings.Repeat("z", 6000), provider, Options{
 		Registry:               registry,
-		PermissionMode:         PermissionModeUnsafe,
+		PermissionMode:         PermissionModeFullAuto,
 		ContextWindow:          10_000_000,
 		CompactionPreserveLast: 2,
 		Trace:                  recorder,
@@ -599,7 +599,7 @@ func TestRunReactiveRetryDoesNotDoubleEmitText(t *testing.T) {
 	var deltas []string
 	result, err := Run(context.Background(), strings.Repeat("z", 6000), provider, Options{
 		Registry:               registry,
-		PermissionMode:         PermissionModeUnsafe,
+		PermissionMode:         PermissionModeFullAuto,
 		ContextWindow:          10_000_000,
 		CompactionPreserveLast: 2,
 		OnText:                 func(delta string) { deltas = append(deltas, delta) },

internal/agent/loop.go

@@ -182,7 +182,11 @@ func Run(ctx context.Context, prompt string, provider Provider, options Options)
 		registry = tools.NewRegistry()
 	}
 
-	permissionMode := options.PermissionMode
+	// Normalized once, here, because this is the single place the run's mode is
+	// read off Options; every comparison downstream takes it as a parameter from
+	// this local. Normalizing at the individual comparison sites instead would
+	// leave the next one added to be found by whoever it breaks.
+	permissionMode := NormalizePermissionMode(options.PermissionMode)
 	if permissionMode == "" {
 		permissionMode = PermissionModeAuto
 	}
@@ -1195,7 +1199,7 @@ func executeToolCall(ctx context.Context, registry *tools.Registry, call ToolCal
 		return executeRequestPermissions(ctx, call, args, permissionMode, options)
 	}
 
-	permissionGranted := permissionMode == PermissionModeUnsafe
+	permissionGranted := permissionMode == PermissionModeFullAuto
 	if toolFound && effectivePermission(tool, args) == tools.PermissionAllow {
 		permissionGranted = true
 	}
@@ -1516,10 +1520,10 @@ func maybeRetryUnsandboxedAfterSandboxRestriction(ctx context.Context, registry
 	}
 	requestEvent := sandboxRestrictionRetryEvent(call, tool, args, permissionMode, options, result)
 	request := permissionRequestFromEvent(requestEvent, args, options)
-	if permissionMode == PermissionModeUnsafe {
+	if permissionMode == PermissionModeFullAuto {
 		retryArgs := unsandboxedRetryArgs(args)
 		retry := runToolForUnsandboxedRetry(ctx, registry, call.Name, call.ID, retryArgs, permissionMode, options, progressCallback)
-		return retry, nil, true, PermissionDecisionAllow, "unsafe permission mode permits unsandboxed retry", nil, nil
+		return retry, nil, true, PermissionDecisionAllow, "full-auto permission mode permits unsandboxed retry", nil, nil
 	}
 	decision, err := requestPermission(ctx, request, options)
 	if err != nil {
@@ -1570,9 +1574,9 @@ func maybeRetryWithNetworkAfterSandboxDenial(ctx context.Context, registry *tool
 	}
 	requestEvent := sandboxDeniedNetworkRetryEvent(call, tool, args, permissionMode, options, result)
 	request := permissionRequestFromEvent(requestEvent, args, options)
-	if permissionMode == PermissionModeUnsafe {
+	if permissionMode == PermissionModeFullAuto {
 		retry := runToolForNetworkRetry(ctx, registry, call.Name, call.ID, args, permissionMode, options, progressCallback)
-		return retry, nil, true, PermissionDecisionAllow, "unsafe permission mode permits sandbox network retry", nil
+		return retry, nil, true, PermissionDecisionAllow, "full-auto permission mode permits sandbox network retry", nil
 	}
 	decision, err := requestPermission(ctx, request, options)
 	if err != nil {

internal/agent/loop_test.go

@@ -2720,7 +2720,7 @@ func TestRunGrantsPromptToolInUnsafeMode(t *testing.T) {
 
 	result, err := Run(context.Background(), "write notes", provider, Options{
 		Registry:       registry,
-		PermissionMode: PermissionModeUnsafe,
+		PermissionMode: PermissionModeFullAuto,
 		OnPermission: func(event PermissionEvent) {
 			permissionEvents = append(permissionEvents, event)
 		},
@@ -2746,7 +2746,7 @@ func TestRunGrantsPromptToolInUnsafeMode(t *testing.T) {
 	if event.Action != PermissionActionAllow || !event.PermissionGranted {
 		t.Fatalf("expected unsafe approval permission event, got %#v", event)
 	}
-	if event.ToolName != "write_file" || event.PermissionMode != PermissionModeUnsafe {
+	if event.ToolName != "write_file" || event.PermissionMode != PermissionModeFullAuto {
 		t.Fatalf("unexpected unsafe approval metadata: %#v", event)
 	}
 }
@@ -2951,7 +2951,7 @@ func TestRunAppliesSandboxEvenInUnsafeMode(t *testing.T) {
 
 	result, err := Run(context.Background(), "write outside", provider, Options{
 		Registry:       registry,
-		PermissionMode: PermissionModeUnsafe,
+		PermissionMode: PermissionModeFullAuto,
 		Autonomy:       "high",
 		Sandbox: sandbox.NewEngine(sandbox.EngineOptions{
 			WorkspaceRoot: root,

internal/agent/types.go

@@ -2,6 +2,7 @@ package agent
 
 import (
 	"context"
+	"strings"
 
 	"github.com/Gitlawb/zero/internal/execution"
 	"github.com/Gitlawb/zero/internal/hooks"
@@ -22,10 +23,24 @@ type PermissionAction string
 type PermissionDecisionAction string
 
 const (
-	PermissionModeAuto      PermissionMode = "auto"
-	PermissionModeAsk       PermissionMode = "ask"
-	PermissionModeUnsafe    PermissionMode = "unsafe"
-	PermissionModeSpecDraft PermissionMode = "spec-draft"
+	PermissionModeAuto     PermissionMode = "auto"
+	PermissionModeAsk      PermissionMode = "ask"
+	PermissionModeFullAuto PermissionMode = "full-auto"
+	// PermissionModeUnsafe is the former name of PermissionModeFullAuto.
+	//
+	// Kept as an alias rather than deleted because this constant is referenced
+	// across packages and by code that lands independently of this branch, so
+	// removing it turns an ordinary merge into a compile failure for whoever
+	// merges second. It is the same value, so behaviour is identical either way.
+	//
+	// Deprecated: use PermissionModeFullAuto.
+	PermissionModeUnsafe = PermissionModeFullAuto
+	// legacyFullAutoPermissionMode is the raw string full-auto used to be. The
+	// Go alias above keeps SOURCE compatible, but a value that arrives as data
+	// rather than as an identifier is unaffected by it, so it still needs
+	// mapping. See NormalizePermissionMode.
+	legacyFullAutoPermissionMode PermissionMode = "unsafe"
+	PermissionModeSpecDraft      PermissionMode = "spec-draft"
 	// PermissionModePlan is an interactive, read-only planning mode. It applies
 	// to the CURRENT session (unlike spec-draft, which drafts in a separate
 	// session): the agent may inspect the workspace and shape the plan with
@@ -496,3 +511,24 @@ func (result Result) TruncationNotice() string {
 		return "Response ended early (" + result.FinishReason + ") and may be incomplete."
 	}
 }
+
+// NormalizePermissionMode maps a permission mode that arrived as data onto its
+// canonical value.
+//
+// full-auto was renamed from "unsafe", and a Go alias only covers callers that
+// name the constant. A value that travels as a string does not go through the
+// alias: it comes off a command line, out of a swarm member spec, or across a
+// protocol, and after the rename "unsafe" stops matching the comparisons the
+// loop makes against PermissionModeFullAuto. The mode then reads as unrecognized
+// and the run silently behaves as though full-auto was never requested.
+//
+// Only the legacy spelling is rewritten. Unknown values are returned unchanged
+// rather than folded to a default, because this package has modes the sandbox
+// layer does not know about (spec-draft, member-auto) and quietly rewriting one
+// of those would be a worse bug than the one being fixed.
+func NormalizePermissionMode(mode PermissionMode) PermissionMode {
+	if PermissionMode(strings.ToLower(strings.TrimSpace(string(mode)))) == legacyFullAutoPermissionMode {
+		return PermissionModeFullAuto
+	}
+	return mode
+}