Surface persisted skip-permissions default at startup

Author: TheGreatAxios

docs/IMPLEMENTATION.md

@@ -166,7 +166,7 @@ Intent defaults: implement/explore/plan → same-named director; review → crit
 
 ### Auto Mode
 
-Auto mode defaults **on** (`config.auto = true` from `loadConfig`; pass `--no-auto` to start off, or `--auto` to force on). It is toggled only via those CLI flags — there is currently no in-session key bound to it. The permission gate reads the flag (`getAuto`/`setAuto` in `src/permission/gate.ts`) on the next tool call. `--dangerously-skip-permissions` still forces this process. `/yolo [on|off|toggle]` (bare `/yolo` also toggles) persists as the user-global default and wires `getSkipPermissions`/`setSkipPermissions` so the gate and pre-gate sandboxes honor the change on the next tool call without rebuilding plugins. `/yolo` writes the same `config.globalSettingsPath` target as the other `/settings`-style toggles, including a `--config` override. Secret-guard and authz still apply.
+Auto mode defaults **on** (`config.auto = true` from `loadConfig`; pass `--no-auto` to start off, or `--auto` to force on). It is toggled only via those CLI flags — there is currently no in-session key bound to it. The permission gate reads the flag (`getAuto`/`setAuto` in `src/permission/gate.ts`) on the next tool call. `--dangerously-skip-permissions` still forces this process. `/yolo [on|off|toggle]` (bare `/yolo` also toggles) persists as the user-global default and wires `getSkipPermissions`/`setSkipPermissions` so the gate and pre-gate sandboxes honor the change on the next tool call without rebuilding plugins. `/yolo` writes the same `config.globalSettingsPath` target as the other `/settings`-style toggles, including a `--config` override. Secret-guard and authz still apply. `loadConfig` tracks `skipPermissionsFromSettings` (true only when the effective value came from persisted settings, not the CLI flag) so `runTUI` can show a startup notice and `exec` can print an equivalent stderr warning for the otherwise-silent persisted default.
 
 When auto is on, the gate auto-allows workspace file tools in `AUTO_ALLOWED_TOOLS` and any `run_shell` that does not match the auto-shell policy. The policy (`autoShellRuleForCall` / `AUTO_SHELL_RULES` in `src/permission/auto-shell-policy.ts`) peels wrappers via `expandShellSubjects` (`bash`/`sh`/`zsh -c`, `xargs`, transparent prefixes), then applies:
 

docs/PRODUCT.md

@@ -97,7 +97,7 @@ is the direct, explicit resume path.
 
 ## Slash Commands (TUI)
 
-The TUI has an extensible slash-command framework. Built-ins include `/help` (shortcut + command overlay), `/model` (models-only picker for connected accounts; **Alt+A** adds a provider), `/settings`, `/permissions`, `/plugins`, `/clear`, `/new`, `/mcp`, and `/yolo` (persists as the user-global skip-permissions default; `--dangerously-skip-permissions` still forces this process; secret-guard and authz still apply; `/yolo [on|off|toggle]`, bare `/yolo` toggles), plus a `/<name>` command per available workflow. Plugins can register additional commands.
+The TUI has an extensible slash-command framework. Built-ins include `/help` (shortcut + command overlay), `/model` (models-only picker for connected accounts; **Alt+A** adds a provider), `/settings`, `/permissions`, `/plugins`, `/clear`, `/new`, `/mcp`, and `/yolo` (persists as the user-global skip-permissions default; `--dangerously-skip-permissions` still forces this process; secret-guard and authz still apply; `/yolo [on|off|toggle]`, bare `/yolo` toggles), plus a `/<name>` command per available workflow. When a session starts with the persisted default already on, the TUI shows a startup notice ("Permission prompts are disabled by your saved default…") so the silent machine-wide default is never invisible; `corbits exec` prints the equivalent warning to stderr. Plugins can register additional commands.
 
 **Default skills** exist out of the gate as first-party slash **actions**, not director names: `/implement`, `/plan`, `/refactor`, `/review`, `/pull-request-review`, `/create-issue`, `/scribe`, `/interview`, `/ast-grep`. Each one is a Skywalker recipe — the slash sends the skill body to the primary, which then `task(agent="<director>")`. `/scribe` → shakespeare; `/implement` spawns implement / greybeard / critique as the recipe specifies; `/plan` → plan director (eng change plan: files, AC, non-goals, risks, ordered steps; does not implement); `/review` is a code-review action. `/create-issue` remains the tracker command: Linear MCP when available; otherwise it `ask_operator`s for the platform (GitHub etc.) and persists `Preferred issue tracker` in `.corbits/MEMORY.md` (GitHub via `gh issue create`). Dispatch is not a default slash — it stays `use_skill` only, along with git-rebase, linear-issue-workflow, style, philosophy, typescript, and opsh (`user-invocable: false`). Draper and emil are not slashes; they remain closed directors via `task(agent=…)`. There is no catch-all worker. Slash names are also available to the model via `use_skill`. Disable the catalog in `/plugins` (`corbits-skills`) if you want them gone.
 

src/config.test.ts

@@ -433,6 +433,7 @@ describe("loadConfig", () => {
         globalSettingsPath: globalPath,
       });
       expect(config.dangerouslySkipPermissions).toBe(false);
+      expect(config.skipPermissionsFromSettings).toBe(false);
     } finally {
       await rm(cwd, { recursive: true, force: true });
     }
@@ -447,6 +448,8 @@ describe("loadConfig", () => {
         { globalSettingsPath: globalPath },
       );
       expect(config.dangerouslySkipPermissions).toBe(true);
+      // Came from the CLI flag, not the persisted default — no startup notice.
+      expect(config.skipPermissionsFromSettings).toBe(false);
     } finally {
       await rm(cwd, { recursive: true, force: true });
     }
@@ -474,6 +477,9 @@ describe("loadConfig", () => {
         globalSettingsPath: globalPath,
       });
       expect(config.dangerouslySkipPermissions).toBe(true);
+      // Origin is the persisted default, not this invocation's flag — the
+      // startup notice should fire.
+      expect(config.skipPermissionsFromSettings).toBe(true);
     } finally {
       await rm(cwd, { recursive: true, force: true });
     }
@@ -501,6 +507,7 @@ describe("loadConfig", () => {
         globalSettingsPath: globalPath,
       });
       expect(config.dangerouslySkipPermissions).toBe(false);
+      expect(config.skipPermissionsFromSettings).toBe(false);
     } finally {
       await rm(cwd, { recursive: true, force: true });
     }
@@ -529,6 +536,8 @@ describe("loadConfig", () => {
         { globalSettingsPath: globalPath },
       );
       expect(config.dangerouslySkipPermissions).toBe(true);
+      // CLI flag wins over settings — no notice is warranted here.
+      expect(config.skipPermissionsFromSettings).toBe(false);
     } finally {
       await rm(cwd, { recursive: true, force: true });
     }
@@ -558,11 +567,46 @@ describe("loadConfig", () => {
       assertConfigured(config);
       expect(config.command).toBe("exec");
       expect(config.dangerouslySkipPermissions).toBe(true);
+      expect(config.skipPermissionsFromSettings).toBe(true);
     } finally {
       await rm(cwd, { recursive: true, force: true });
     }
   });
 
+  test("persisted skip-permissions default applies regardless of cwd (machine-wide scope)", async () => {
+    // The global settings file is machine-wide: a session opened against a
+    // completely different cwd still inherits the same default. This is the
+    // exact silent-everywhere behavior the startup notice exists to surface.
+    const globalCwd = await emptyCwd();
+    const otherCwd = await emptyCwd();
+    try {
+      const globalPath = join(globalCwd, "global.json");
+      await writeFile(
+        globalPath,
+        JSON.stringify({
+          defaultProvider: "fireworks",
+          providers: {
+            fireworks: {
+              baseURL: "https://api.fireworks.ai/inference",
+              apiKey: "test-key",
+              models: ["accounts/fireworks/routers/kimi-k2p6-turbo"],
+            },
+          },
+          dangerouslySkipPermissions: true,
+        }),
+      );
+      const config = await loadConfig(["--cwd", otherCwd, "do something"], {
+        globalSettingsPath: globalPath,
+      });
+      expect(config.cwd).toBe(otherCwd);
+      expect(config.dangerouslySkipPermissions).toBe(true);
+      expect(config.skipPermissionsFromSettings).toBe(true);
+    } finally {
+      await rm(globalCwd, { recursive: true, force: true });
+      await rm(otherCwd, { recursive: true, force: true });
+    }
+  });
+
   test("reads provider and model from a --config settings file", async () => {
     const cwd = await emptyCwd();
     try {

src/config/index.ts

@@ -277,6 +277,10 @@ export type Config = {
   task: string;
   force: boolean;
   dangerouslySkipPermissions: boolean;
+  // True when dangerouslySkipPermissions came from the persisted global
+  // default rather than this invocation's CLI flag. Entry points use this to
+  // surface a startup notice since the persisted default is otherwise silent.
+  skipPermissionsFromSettings: boolean;
   auto: boolean;
   /**
    * Entry mode. `"tui"` is the interactive Ink shell; `"exec"` is the non-TUI
@@ -341,6 +345,7 @@ export type UnconfiguredConfig = {
   task: string;
   force: boolean;
   dangerouslySkipPermissions: boolean;
+  skipPermissionsFromSettings: boolean;
   auto: boolean;
   command: "tui" | "exec";
   // Path where the onboarding flow should write the new settings.
@@ -378,6 +383,9 @@ Flags:
   --resume                    interactive session picker
   --force                     override an existing run state
   --dangerously-skip-permissions
+                               skip permission prompts for this run only;
+                               /yolo in the TUI instead persists the default
+                               machine-wide in ~/.corbits/settings.json
   --auto / --no-auto          auto mode on/off
   --help, -h                  show this help
 `;
@@ -567,6 +575,11 @@ export async function loadConfig(
         })
       : await loadSettings(options.globalSettingsPath ?? globalSettingsPath());
 
+  // Track whether the effective value came from the persisted global default
+  // rather than this invocation's --dangerously-skip-permissions flag, so the
+  // TUI/exec entry points can surface a startup notice for the silent case.
+  const skipPermissionsFromSettings =
+    !dangerouslySkipPermissions && settings?.dangerouslySkipPermissions === true;
   dangerouslySkipPermissions =
     dangerouslySkipPermissions || settings?.dangerouslySkipPermissions === true;
 
@@ -634,6 +647,7 @@ export async function loadConfig(
       task,
       force,
       dangerouslySkipPermissions,
+      skipPermissionsFromSettings,
       auto,
       command,
       globalSettingsPath: effectiveSettingsPath,
@@ -685,6 +699,7 @@ export async function loadConfig(
     task: resumeTask,
     force,
     dangerouslySkipPermissions,
+    skipPermissionsFromSettings,
     auto,
     command,
     globalSettingsPath: effectiveSettingsPath,

src/exec/runner.ts

@@ -321,6 +321,12 @@ export async function runExec(config: Config): Promise<ExecResult> {
 
     const interactive = input.isTTY === true && output.isTTY === true;
 
+    if (config.skipPermissionsFromSettings) {
+      stderr.write(
+        "Warning: permission prompts are disabled by your saved default (/yolo off to re-enable).\n",
+      );
+    }
+
     const permissionGate = createPermissionGate({
       approvals: seededApprovals,
       telemetry: liveTelemetry,

src/tui/runner.ts

@@ -2585,6 +2585,16 @@ export async function runTUI(initialConfig: Config): Promise<number> {
   paintPluginAttention = (needs) => setPluginNeedsAttention(host.shell, needs);
   paintPluginAttention(standingPluginWarnings.length > 0);
 
+  // The persisted /yolo default is otherwise silent: nothing on screen would
+  // otherwise tell the operator that permission prompts are off for a repo
+  // they never ran --dangerously-skip-permissions or /yolo in.
+  if (config.skipPermissionsFromSettings) {
+    surfaceSystemNotice(
+      host.shell,
+      "Permission prompts are disabled by your saved default (/yolo off to re-enable).",
+    );
+  }
+
   // Soft upgrade check: never blocks startup; offline / rate-limit is a quiet skip.
   // surfaceSystemNotice keeps the landing hero up and flushes into the transcript
   // once a session row ends the landing (same path as MCP startup chatter).