Cover persisted yolo default edge cases

Author: TheGreatAxios

CHANGELOG.md

@@ -11,6 +11,14 @@ matching `## [X.Y.Z]` section (plus install instructions). Do not maintain
 parallel copies under `docs/` or `scripts/notes/`. At cut time: rename
 `## [Unreleased]` to `## [X.Y.Z] - YYYY-MM-DD`, then run the release script.
 
+## [Unreleased]
+
+### Changed
+
+- **`/yolo` persists as the user-global skip-permissions default.** Exec
+  inherits it; `--dangerously-skip-permissions` still forces the current
+  process. Secret-guard and authz still apply.
+
 ## [0.2.99] - 2026-08-21
 
 Skywalker is the primary orchestrator over a closed director fleet: product write tools stay off the primary, and you cannot spawn Skywalker as a task leaf. Workers are not done until they return the four-heading report. First-party action skills ship as slashes; eval runners require an explicit provider/model pair; the style skill no longer refuses non-git folders.

docs/IMPLEMENTATION.md

@@ -166,7 +166,7 @@ Intent defaults: implement/explore/plan → same-named director; review → crit
 
 ### Auto Mode
 
-Auto mode defaults **on** (`config.auto = true` from `loadConfig`; pass `--no-auto` to start off, or `--auto` to force on). It is toggled only via those CLI flags — there is currently no in-session key bound to it. The permission gate reads the flag (`getAuto`/`setAuto` in `src/permission/gate.ts`) on the next tool call. `--dangerously-skip-permissions` still forces this process. `/yolo [on|off|toggle]` (bare `/yolo` also toggles) persists as the user-global default and wires `getSkipPermissions`/`setSkipPermissions` so the gate and pre-gate sandboxes honor the change on the next tool call without rebuilding plugins. Secret-guard and authz still apply.
+Auto mode defaults **on** (`config.auto = true` from `loadConfig`; pass `--no-auto` to start off, or `--auto` to force on). It is toggled only via those CLI flags — there is currently no in-session key bound to it. The permission gate reads the flag (`getAuto`/`setAuto` in `src/permission/gate.ts`) on the next tool call. `--dangerously-skip-permissions` still forces this process. `/yolo [on|off|toggle]` (bare `/yolo` also toggles) persists as the user-global default and wires `getSkipPermissions`/`setSkipPermissions` so the gate and pre-gate sandboxes honor the change on the next tool call without rebuilding plugins. `/yolo` writes the same `config.globalSettingsPath` target as the other `/settings`-style toggles, including a `--config` override. Secret-guard and authz still apply.
 
 When auto is on, the gate auto-allows workspace file tools in `AUTO_ALLOWED_TOOLS` and any `run_shell` that does not match the auto-shell policy. The policy (`autoShellRuleForCall` / `AUTO_SHELL_RULES` in `src/permission/auto-shell-policy.ts`) peels wrappers via `expandShellSubjects` (`bash`/`sh`/`zsh -c`, `xargs`, transparent prefixes), then applies:
 

docs/PRODUCT.md

@@ -67,7 +67,7 @@ $ corbits exec "Add JWT auth to the API"
 $ corbits run "Add JWT auth to the API"
 ```
 
-Same directors, tools, permissions, MCP, plugins, and hooks as the TUI — without the OpenTUI shell. The exec bootstrap is a deliberate fork of the TUI path (not a shared factory yet); see `docs/ARCHITECTURE.md` “Exec Runner” for intentional deltas (no workflow controller; single primary send; non-interactive permission gate). Compaction continuation matches TUI so long runs do not stall after compact. Streams assistant text to stdout for scripts and CI. Non-interactive by default: actions that need operator approval are denied unless `--dangerously-skip-permissions` is set (or auto mode covers them). In the TUI, `/yolo` persists as the user-global default; `--dangerously-skip-permissions` still forces this process; secret-guard and authz still apply. `ask_operator` reads a single line from stdin when available.
+Same directors, tools, permissions, MCP, plugins, and hooks as the TUI — without the OpenTUI shell. The exec bootstrap is a deliberate fork of the TUI path (not a shared factory yet); see `docs/ARCHITECTURE.md` “Exec Runner” for intentional deltas (no workflow controller; single primary send; non-interactive permission gate). Compaction continuation matches TUI so long runs do not stall after compact. Streams assistant text to stdout for scripts and CI. Non-interactive by default: actions that need operator approval are denied unless `--dangerously-skip-permissions` is set, a persisted `/yolo` default is on, or auto mode covers them. `--dangerously-skip-permissions` still forces this process; secret-guard and authz still apply. `ask_operator` reads a single line from stdin when available.
 
 Local multi-model capability checks use this path (`bun run eval:capability`); see `evals/capability/README.md`.
 

src/config.test.ts

@@ -479,6 +479,33 @@ describe("loadConfig", () => {
     }
   });
 
+  test("settings dangerouslySkipPermissions false without the CLI flag stays false", async () => {
+    const cwd = await emptyCwd();
+    try {
+      const globalPath = join(cwd, "global.json");
+      await writeFile(
+        globalPath,
+        JSON.stringify({
+          defaultProvider: "fireworks",
+          providers: {
+            fireworks: {
+              baseURL: "https://api.fireworks.ai/inference",
+              apiKey: "test-key",
+              models: ["accounts/fireworks/routers/kimi-k2p6-turbo"],
+            },
+          },
+          dangerouslySkipPermissions: false,
+        }),
+      );
+      const config = await loadConfig(["--cwd", cwd, "do something"], {
+        globalSettingsPath: globalPath,
+      });
+      expect(config.dangerouslySkipPermissions).toBe(false);
+    } finally {
+      await rm(cwd, { recursive: true, force: true });
+    }
+  });
+
   test("CLI --dangerously-skip-permissions still wins over settings false", async () => {
     const cwd = await emptyCwd();
     try {

src/config/settings.ts

@@ -1016,6 +1016,18 @@ export async function saveGlobalSettings(path: string, settings: Settings): Prom
   await rename(tmp, path);
 }
 
+// Silent helper: callers log or notice. Skips when the write base is null so a
+// corrupt settings file is never replaced with a one-key rewrite.
+export async function persistSkipPermissionsDefault(
+  path: string,
+  value: boolean,
+): Promise<"ok" | "skipped"> {
+  const base = await loadGlobalSettingsWriteBase(path);
+  if (base === null) return "skipped";
+  await saveGlobalSettings(path, { ...base, dangerouslySkipPermissions: value });
+  return "ok";
+}
+
 // Stamp the global `onboarded` flag. Reads the on-disk global settings fresh
 // (never an in-memory Settings that may carry injected OAuth provider entries
 // with short-lived access tokens) and re-saves with onboarded set. When the

src/settings.test.ts

@@ -1,5 +1,5 @@
 import { describe, test, expect } from "bun:test";
-import { chmod, mkdtemp, mkdir, writeFile, rm } from "node:fs/promises";
+import { chmod, mkdtemp, mkdir, readFile, writeFile, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join, dirname } from "node:path";
 
@@ -24,6 +24,7 @@ import {
   validateTaskMaxTurns,
   toolWatchdogFromSettings,
   loadGlobalSettingsWriteBase,
+  persistSkipPermissionsDefault,
   markLastChangelogVersion,
   pushRecentModel,
   toggleFavoriteModel,
@@ -739,6 +740,56 @@ describe("loaders", () => {
   });
 });
 
+describe("persistSkipPermissionsDefault", () => {
+  test("writes true", async () => {
+    const dir = await mkdtemp(join(tmpdir(), "ic-settings-"));
+    try {
+      const path = join(dir, "settings.json");
+      await saveGlobalSettings(path, firepass);
+      expect(await persistSkipPermissionsDefault(path, true)).toBe("ok");
+      expect(await loadSettings(path)).toEqual({
+        ...firepass,
+        dangerouslySkipPermissions: true,
+      });
+    } finally {
+      await rm(dir, { recursive: true, force: true });
+    }
+  });
+
+  test("writes false", async () => {
+    const dir = await mkdtemp(join(tmpdir(), "ic-settings-"));
+    try {
+      const path = join(dir, "settings.json");
+      await saveGlobalSettings(path, { ...firepass, dangerouslySkipPermissions: true });
+      expect(await persistSkipPermissionsDefault(path, false)).toBe("ok");
+      expect(await loadSettings(path)).toEqual({
+        ...firepass,
+        dangerouslySkipPermissions: false,
+      });
+    } finally {
+      await rm(dir, { recursive: true, force: true });
+    }
+  });
+
+  test("skips invalid or unreadable settings and leaves the file unchanged", async () => {
+    const dir = await mkdtemp(join(tmpdir(), "ic-settings-"));
+    try {
+      const path = join(dir, "settings.json");
+      const garbage = "{ not json";
+      await writeFile(path, garbage);
+      expect(await persistSkipPermissionsDefault(path, true)).toBe("skipped");
+      expect(await readFile(path, "utf8")).toBe(garbage);
+
+      const wrongShape = JSON.stringify({ providers: "wrong-shape" });
+      await writeFile(path, wrongShape);
+      expect(await persistSkipPermissionsDefault(path, true)).toBe("skipped");
+      expect(await readFile(path, "utf8")).toBe(wrongShape);
+    } finally {
+      await rm(dir, { recursive: true, force: true });
+    }
+  });
+});
+
 describe("sessionMode", () => {
   test("loadSettings drops legacy single sessionMode", async () => {
     const dir = await mkdtemp(join(tmpdir(), "ic-settings-"));
@@ -791,6 +842,8 @@ test("loadSettings round-trips dangerouslySkipPermissions", async () => {
     const path = join(dir, ".corbits", "settings.json");
     await saveGlobalSettings(path, { ...firepass, dangerouslySkipPermissions: true });
     expect(await loadSettings(path)).toEqual({ ...firepass, dangerouslySkipPermissions: true });
+    await saveGlobalSettings(path, { ...firepass, dangerouslySkipPermissions: false });
+    expect(await loadSettings(path)).toEqual({ ...firepass, dangerouslySkipPermissions: false });
   } finally {
     await rm(dir, { recursive: true, force: true });
   }

src/tui/commands/built-in.test.ts

@@ -83,17 +83,17 @@ describe("/yolo command", () => {
     };
     expect(getCommand("yolo")!.handler("", ctx)).toEqual({
       type: "message",
-      text: "Yolo mode on — permission prompts skipped.",
+      text: "Yolo mode on — permission prompts skipped. Saved as the default.",
     });
     expect(skip).toBe(true);
     expect(getCommand("yolo")!.handler("", ctx)).toEqual({
       type: "message",
-      text: "Yolo mode off — permission prompts restored.",
+      text: "Yolo mode off — permission prompts restored. Saved as the default.",
     });
     expect(skip).toBe(false);
     expect(getCommand("yolo")!.handler("toggle", ctx)).toEqual({
       type: "message",
-      text: "Yolo mode on — permission prompts skipped.",
+      text: "Yolo mode on — permission prompts skipped. Saved as the default.",
     });
     expect(skip).toBe(true);
   });
@@ -109,12 +109,12 @@ describe("/yolo command", () => {
     };
     expect(getCommand("yolo")!.handler("on", ctx)).toEqual({
       type: "message",
-      text: "Yolo mode on — permission prompts skipped.",
+      text: "Yolo mode on — permission prompts skipped. Saved as the default.",
     });
     expect(skip).toBe(true);
     expect(getCommand("yolo")!.handler("off", ctx)).toEqual({
       type: "message",
-      text: "Yolo mode off — permission prompts restored.",
+      text: "Yolo mode off — permission prompts restored. Saved as the default.",
     });
     expect(skip).toBe(false);
   });

src/tui/commands/built-in.ts

@@ -217,10 +217,13 @@ export function registerBuiltInCommands(): void {
       if (next) {
         return {
           type: "message",
-          text: "Yolo mode on — permission prompts skipped.",
+          text: "Yolo mode on — permission prompts skipped. Saved as the default.",
         };
       }
-      return { type: "message", text: "Yolo mode off — permission prompts restored." };
+      return {
+        type: "message",
+        text: "Yolo mode off — permission prompts restored. Saved as the default.",
+      };
     },
   });
 

src/tui/commands/registry.ts

@@ -25,7 +25,7 @@ export type CommandContext = {
   beginFeedbackCapture?: () => void;
   /** Whether skip-permissions (yolo) is active for this session. */
   getSkipPermissions?: () => boolean;
-  /** Toggle skip-permissions for the rest of the session (`/yolo`). */
+  /** Live-flip skip-permissions and persist `/yolo` as the user-global default. */
   setSkipPermissions?: (value: boolean) => void;
 };
 

src/tui/runner.ts

@@ -28,6 +28,7 @@ import {
   loadSettings,
   localSettingsPath,
   markTelemetryNoticeShown,
+  persistSkipPermissionsDefault,
   pushRecentModel,
   saveGlobalSettings,
   saveLocalSettings,
@@ -1846,38 +1847,47 @@ export async function runTUI(initialConfig: Config): Promise<number> {
     });
   }
 
+  // One tail for every RMW of config.globalSettingsPath from this runner so
+  // /yolo and /settings toggles cannot stale-RMW each other.
+  let persistTail = Promise.resolve();
+  const enqueueGlobalPersist = <T>(job: () => Promise<T>): Promise<T> => {
+    const run = persistTail.then(job);
+    persistTail = run.then(() => undefined, () => undefined);
+    return run;
+  };
+
   // Absent file → fresh base; unreadable/invalid → skip the write rather than
-  // clobber a corrupt settings file with a minimal shell. Returns false when
-  // the write is skipped so `/yolo` can notice that the live flip did not persist.
-  const persistGlobalSettings = async (
+  // clobber a corrupt settings file with a minimal shell.
+  const persistGlobalSettings = (
     what: string,
     apply: (base: Settings) => Settings,
-  ): Promise<boolean> => {
-    const base = await loadGlobalSettingsWriteBase(config.globalSettingsPath);
-    if (base === null) {
-      tuiLogger.warn("Skipping {what} write: unreadable global settings at {path}", {
-        what,
-        path: config.globalSettingsPath,
-      });
-      return false;
-    }
-    await saveGlobalSettings(config.globalSettingsPath, apply(base));
-    return true;
-  };
+  ): Promise<boolean> =>
+    enqueueGlobalPersist(async () => {
+      const base = await loadGlobalSettingsWriteBase(config.globalSettingsPath);
+      if (base === null) {
+        tuiLogger.warn("Skipping {what} write: unreadable global settings at {path}", {
+          what,
+          path: config.globalSettingsPath,
+        });
+        return false;
+      }
+      await saveGlobalSettings(config.globalSettingsPath, apply(base));
+      return true;
+    });
 
   const commandContext: CommandContext = {
     signalClear: newSession,
     getSkipPermissions: () => permissionGate.getSkipPermissions(),
     setSkipPermissions: (value: boolean) => {
       permissionGate.setSkipPermissions(value);
       config.dangerouslySkipPermissions = value;
-      void (async () => {
+      void enqueueGlobalPersist(async () => {
         try {
-          const written = await persistGlobalSettings("skip-permissions default", (base) => ({
-            ...base,
-            dangerouslySkipPermissions: value,
-          }));
-          if (!written) {
+          const result = await persistSkipPermissionsDefault(
+            config.globalSettingsPath,
+            value,
+          );
+          if (result === "skipped") {
             systemNotice(
               "Yolo flipped for this session, but the default did not stick.",
             );
@@ -1887,7 +1897,7 @@ export async function runTUI(initialConfig: Config): Promise<number> {
             "Yolo flipped for this session, but the default did not stick.",
           );
         }
-      })();
+      });
     },
     getCostSummary: (): CostSummary => {
       const usage = runSink.getTokenUsage();