fix(claude): map 'auto' runtime mode to 'default' permission mode

[caddydove]

Fix #4495

The Claude CLI binary v2.1.146 rejects PermissionMode value 'auto' when called via setPermissionMode(), causing an immediate 'turn/setPermissionMode failed' error.

Changes

• ClaudeAdapter.ts: Changed 'auto' → 'default' in runtimeModeToPermission, added missing 'approval-required' → 'default' mapping
• ClaudeAdapter.test.ts: Updated assertions for 'auto' and 'approval-required' runtime modes to expect 'default'

Why 'default'

The 'default' permission mode is what the SDK uses when no explicit permission mode is set, and it is already confirmed working by the 'approval-required' runtime mode.

---

Note

Medium Risk
Claude permission mapping affects every auto/approval-required session; wrong mode could change approval behavior. Auth policy change only applies when Tailscale serve is enabled but shifts bootstrap expectations on loopback.

Overview
Fixes Claude Agent SDK sessions failing on newer CLI builds by mapping auto and approval-required runtime modes to SDK permission mode default instead of auto, which recent Claude Code rejects via setPermissionMode. full-access and auto-accept-edits mappings are unchanged.

Separately, when tailscaleServeEnabled is on, loopback web hosts (e.g. 127.0.0.1) are treated as remote-reachable for auth so bootstrap uses one-time-token rather than loopback-browser-only behavior—covered by a new EnvironmentAuthPolicy test.

^{Reviewed by Cursor Bugbot for commit 1cc3020. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Map 'auto' and 'approval-required' runtime modes to 'default' Claude permission mode

• In ClaudeAdapter.ts, the runtimeMode to permissionMode mapping now sends 'default' instead of 'auto' for 'auto' mode, and explicitly sends 'default' instead of undefined for 'approval-required' mode.
• Also updates EnvironmentAuthPolicy.ts to treat the server as remotely reachable when tailscaleServeEnabled is true, even on loopback hosts.
• Behavioral Change: Sessions with runtimeMode 'auto' or 'approval-required' will now pass permissionMode: 'default' to Claude instead of 'auto' or omitting the field entirely.

^{Macroscope summarized 1cc3020.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 8e8dc003-2809-469c-8d76-96c42da6b15d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want fixes drafted automatically? Bugbot Autofix can create code changes for findings. A team admin can enable Autofix in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 1cc3020. Configure here.}

[cursor]

Auto mode mapped away

High Severity

Mapping Claude runtime mode auto to SDK permissionMode default removes Claude Code’s native Auto mode (AI-reviewed approvals) for every session. Issue #4495 is specifically a turn/setPermissionMode failure when restoring auto after plan mode, but this change also rewrites session-start query() options, so auto becomes identical to approval-required while Codex still keeps distinct auto_review behavior.

Additional Locations (1)

• apps/server/src/provider/Layers/ClaudeAdapter.test.ts#L358-L376

 

^{Reviewed by Cursor Bugbot for commit 1cc3020. Configure here.}

[macroscopeapp]

Approvability

Verdict: Needs human review

This PR modifies runtime permission mode mapping for Claude sessions, which is a significant behavioral change. Additionally, there is an unresolved high-severity review comment questioning whether this approach removes intended 'auto' mode functionality.

^{You can customize Macroscope's approvability policy. Learn more.}