fix(server): Claude asks before commands in Auto-accept edits

[juliusmarminge]

On V2, a Claude thread in Auto-accept edits never asks about anything. Commands and other non-edit tools run without approval, the same as Full access. The permission modes guide says Auto-accept edits "approves file edits automatically; other actions can still require approval".

I saw this with a Claude Sonnet 5 thread that I switched to Auto-accept edits. node -e "console.log(7*6)" and rm -f auto.txt both ran, and orchestration_v2_projection_runtime_requests had no new rows. The provider log shows the query opened with permissionMode: "acceptEdits" and a canUseTool callback.

Cause

Claude's acceptEdits mode approves edits on its own and sends every other tool through canUseTool. The adapter's callback decides whether to ask with requiresClaudeApproval, which reads installPermissionCallback. That flag was true only for approval-required. In auto-accept-edits, the callback therefore answered allow for every tool without raising a request. The V1 Claude adapter asked in every mode except Full access.

Fix

Set installPermissionCallback for auto-accept-edits as well. Edits still pass without a prompt because Claude approves them before the callback runs. Commands and other tools now raise a normal approval request. Supervised, Auto, and Full access are unchanged, and so are explicit approvalPolicy overrides.

Verification

• New test ClaudeAdapterV2 Auto-accept edits › asks before a command instead of allowing it. It opens a session in Auto-accept edits, calls the adapter's canUseTool for a Bash command, and checks that a command runtime request comes before any decision. Approving the request then allows the command.
  • Without the fix it fails: the command ran without asking: expected 'decision' to equal 'request'.
  • With the fix it passes.
• vp test run src/orchestration-v2/Adapters/ClaudeAdapterV2.test.ts: 119/119 pass.
• vp test run src/orchestration-v2/testkit/ClaudeReplayFixtures.integration.test.ts: 3/3 pass.
• vp test run src/orchestration-v2/testkit/OrchestratorReplayFixtures.integration.test.ts -t claude: 26 pass.
• vp exec tsc --noEmit -p . in apps/server: no error TS or warning TS.
• vp lint on the touched files: no new findings. The existing no-unused-vars warning on layer is on the base too.
• knip --workspace apps/server --exports: clean.
• Not run: the full server suite. I did not re-check the web flow against the fixed build.

Model: Claude Opus 5.5 (Claude Code)

🤖 Generated with Claude Code

---

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

ℹ️ No successful main baseline artifact is available yet. This run establishes the initial measurement.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	—	4.9 KiB	—	6.8 KiB	✅
Codex	Thread snapshot wire	—	3.7 KiB	—	4.9 KiB	✅
Codex	Live turn WebSocket wire	—	1.1 KiB	—	2.0 KiB	✅
Codex	Live turn WebSocket decoded	—	20.4 KiB	—	29.3 KiB	✅
Codex	Live turn messages	—	1	—	8	✅
Claude	Total thread wire	—	4.9 KiB	—	6.8 KiB	✅
Claude	Thread snapshot wire	—	3.7 KiB	—	4.9 KiB	✅
Claude	Live turn WebSocket wire	—	1.2 KiB	—	2.0 KiB	✅
Claude	Live turn WebSocket decoded	—	20.7 KiB	—	29.3 KiB	✅
Claude	Live turn messages	—	1	—	8	✅

Baseline: unavailable · PR result: bcf55ea · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 106.1 KiB
• Claude decoded thread snapshot: 106.4 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — The production adapter changes command and tool authorization behavior in Claude’s Auto-accept edits mode, with a focused regression test covering the intended prompt flow. Because this is security-sensitive command-permission logic, human review is warranted.

^{You can add or adjust custom eligibility rules. Learn more.}