fix(server): Full access Claude threads no longer ask for every tool call#22888

Approvability

Verdict: Needs Human Approval

Macroscope's review found this PR requires human approval — This is a targeted fix for Full access Claude sessions that are unexpectedly downgraded to repeated tool approvals, with tests covering accepted and rejected restores. Because it changes the effective permission boundary for tool execution, human review is warranted.

^{You can add or adjust custom eligibility rules. Learn more.}

Review in Change Stack →

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

please merge if possible. i get the approval messages all the time. thank you!

@fixfon, thanks for identifying the initial CLI downgrade and preserving the settings-policy and explicit launch-mode boundaries. I kept your commits, merged current main, and pushed ad878ed499fc119bd881f09f036c5079c1756292 to this branch.

The first-init fiber could race the first can_use_tool callback. The replacement initializes bypass in the real SDK query runner and awaits its acknowledgement before exposing the prompt queue. It requires both effective bypassPermissions and allowDangerouslySkipPermissions; rejection stays nonfatal. Main's init/status tracking remains authoritative, so later downgrades are not overwritten. The final diff is 9 production lines plus 5 cases in the existing query-runner test file. I compared it with your diff: the init fiber and its mutable mode updates were removed, and the accepted/rejected restore and policy/launch guards moved to the query-runner boundary.

Verification:

• Against current main, the accepted/rejected initialization regressions failed; both guard cases passed.
• 287 adapter, query-runner, and Claude replay tests passed.
• Blacksmith vp run check:changed HEAD passed formatting, lint, both knip passes, GraphQL generation check, server/scripts typechecks, and adjacent tests.
• Real Claude Code 2.1.310 with the installed SDK acknowledged setPermissionMode("bypassPermissions") immediately after query(), before any prompt or explicit initializationResult() call.
• Independent source reviews found no blocking findings. The first CI/review round passed all 28 checks. CodeRabbit identified an unbounded startup wait; the follow-up caps it at 10 seconds and adds a failing-then-passing stall regression. The final follow-up passed check:changed (250 adjacent tests), and both source reviewers approved it. All 27 checks on the final head are green, including CodeRabbit. No blocking source-review findings remain.

Unverified: authenticated tool execution through the real client. This VM's client disables Claude because the CLI has no login. No client rendering changed, so I have no appearance captures to present as permission-behavior proof. @fixfon, an authenticated first-tool run would close that evidence gap. Maria's human permission-boundary review remains necessary.

Red/green checks and real CLI control transcript

Verified in a real dev environment

verification result: unverifiable for the changed claude behavior.

• installed and ran github/main (afc233492d8322ee61ce3f210af4aa3cf89c2cc6) in a separate worktree, then stopped its captured server pid before installing and running the exact pr head ad878ed499fc119bd881f09f036c5079c1756292. both used isolated empty state, with no mocks, fixtures, or replay turns.
• drove the actual web client with repo playwright and /usr/bin/google-chrome. added a project pointing at a real git repository through the app.
• on main, a real codex gpt-6.1-sol full-access turn ran shell commands, created verification.txt, and read it back. on the pr, a first turn read the same file and checked its bytes; a second turn appended a line, read it back, and ran a diff. both pr turns completed without approval prompts. checked the resulting file on disk. these are neighboring codex checks, not proof of claude bypass restoration.
• both clients report claude 2.1.312 as not authenticated. main disables claude in the model picker. claude auth status confirms loggedIn: false and authMethod: none. the original bug could not be reproduced on main.
• the pr client briefly reported a 47-second host freeze during startup with cpu overload. it recovered and both turns completed. no turn stalled for 10 minutes.
• git.cafe reports 28 successful check contexts, including skipped jobs. github confirms no failing or pending checks. no code changes, commits, or pushes were made in this verification pass.

main authentication blocker:

main: claude is not authenticated

exact pr head authentication blocker:

pr: claude is not authenticated

real codex second-turn shell/write/diff, shown as neighboring behavior only:

pr: real codex second-turn execution

short runtime transcript

Not verified

• the changed path is exclusively claude sdk startup: setPermissionMode("bypassPermissions") before first prompt delivery. this vm has working codex proxy access but no authenticated claude provider. codex never reaches this code.
• claude first-tool execution, query reuse, bypass-policy restrictions, explicit default-mode launch arguments, rejection, and timeout fallback remain unverified through the real client/provider path. authenticating claude and running the same first-turn tool scenario on main and this head is still required.
• native ios/android, electron shell, macos/windows, remote/relay, and tunnel behavior were not exercised on this linux vm.

media inspection: uploaded images load and the uploaded video plays and seeks in the t3 browser. git.cafe renders these external media references as links; the destinations were inspected.

model: gpt-6.1-sol; harness: codex through t3 code.

Ran the tests on Linux (x64) at head ad878ed499fc:

With only ClaudeAdapterV2.ts reset to the merge-base version (d6fb62ac3f2a) and this PR's tests kept, ClaudeAgentSdkQueryRunner.test.ts gives 3 failed | 11 passed. The failures are "initializes permission mode before prompts" for 'bypassPermissions' and the expected 'open' to equal 'restore' case.

I also sent a bare setPermissionMode("bypassPermissions") control request through the real SDK (0.3.276) to a real Claude Code CLI (2.1.309) before any prompt. It was acknowledged in 339 ms. This only shows the CLI accepts the request. It does not compare behavior before and after this change.

Not checked: a real authenticated Claude session running a first tool call, with and without this change. The box's claude auth status reports loggedIn: false, so I couldn't run it.