fix(server): Claude Full access falls back to Auto when settings disable bypass mode

apps/mobile/src/features/threads/thread-settings-options.ts

@@ -1,4 +1,8 @@
-import type { ProviderOptionDescriptor, RuntimeMode } from "@t3tools/contracts";
+import {
+  type ProviderOptionDescriptor,
+  type RuntimeMode,
+  unsupportedRuntimeModeFallback,
+} from "@t3tools/contracts";
 
 /**
  * Desktop-oriented effort keywords that don't belong in the phone picker.
@@ -50,7 +54,11 @@ export function compatibleRuntimeModeForChoices(
 ): RuntimeMode {
   return choices.some((choice) => choice.mode === runtimeMode)
     ? runtimeMode
-    : (choices[0]?.mode ?? runtimeMode);
+    : unsupportedRuntimeModeFallback(
+        runtimeMode,
+        choices.map((choice) => choice.mode),
+        choices[0]?.mode ?? runtimeMode,
+      );
 }
 
 export function selectableChoices(

apps/server/src/orchestration-v2/RuntimePolicy.test.ts

@@ -61,11 +61,13 @@ function makeThread(input: {
   };
 }
 
-// Grok's instance offers no Auto-accept edits; the Codex instance advertises no
-// restriction.
+// Grok's instance offers no Auto-accept edits; the Claude instance has bypass
+// mode disabled by settings; the Codex instance advertises no restriction.
 const grokInstanceId = ProviderInstanceId.make("grok");
+const claudeInstanceId = ProviderInstanceId.make("claude");
 const supportedRuntimeModesByInstance = new Map<ProviderInstanceId, ReadonlyArray<RuntimeMode>>([
   [grokInstanceId, ["approval-required", "auto", "full-access"]],
+  [claudeInstanceId, ["approval-required", "auto-accept-edits", "auto"]],
 ]);
 const providerInstanceFor = (instanceId: ProviderInstanceId) =>
   ({
@@ -149,6 +151,8 @@ it.layer(layerTest)("RuntimePolicyV2", (it) => {
       assert.equal(yield* modeFor(grokInstanceId, "auto-accept-edits"), "approval-required");
       assert.equal(yield* modeFor(grokInstanceId, "auto"), "auto");
       assert.equal(yield* modeFor(grokInstanceId, "full-access"), "full-access");
+      // Full access steps down to Auto rather than Supervised where Auto is offered.
+      assert.equal(yield* modeFor(claudeInstanceId, "full-access"), "auto");
       // A provider that advertises no restriction runs every mode as stored.
       assert.equal(yield* modeFor(providerInstanceId, "auto-accept-edits"), "auto-accept-edits");
     }),

apps/server/src/orchestration-v2/RuntimePolicy.ts

@@ -4,6 +4,7 @@ import {
   ProjectId,
   ProviderInstanceId,
   type RuntimeMode,
+  unsupportedRuntimeModeFallback,
 } from "@t3tools/contracts";
 import * as Context from "effect/Context";
 import * as Effect from "effect/Effect";
@@ -74,7 +75,8 @@ export const layer: Layer.Layer<RuntimePolicyV2> = Layer.succeed(RuntimePolicyV2
 /**
  * The mode a provider runs a thread in. A mode the provider does not offer
  * (a thread set before it stopped offering it, or a stale client) runs in
- * Supervised rather than having T3 imitate it.
+ * Supervised rather than having T3 imitate it, except Full access, which
+ * steps down to Auto where the provider offers it.
  */
 function providerRuntimeMode(
   runtimeMode: RuntimeMode,
@@ -84,7 +86,7 @@ function providerRuntimeMode(
     supportedRuntimeModes.length === 0 ||
     supportedRuntimeModes.includes(runtimeMode)
     ? runtimeMode
-    : "approval-required";
+    : unsupportedRuntimeModeFallback(runtimeMode, supportedRuntimeModes, "approval-required");
 }
 
 export const layerFromProjectStore: Layer.Layer<

apps/server/src/provider/ClaudeCapabilitiesProbe.test.ts

@@ -291,6 +291,7 @@ it.layer(NodeServices.layer)("Claude capability probe SDK boundary", (it) => {
           rate_limits_available: true,
           rate_limits: { five_hour: { utilization: 12, resets_at: "2026-07-18T14:39:00Z" } },
         },
+        bypassPermissionsAvailable: true,
       });
 
       // @effect-diagnostics-next-line preferSchemaOverJson:off
@@ -307,6 +308,7 @@ it.layer(NodeServices.layer)("Claude capability probe SDK boundary", (it) => {
       assert.equal(invocation.mcpConfig, undefined);
 
       assert.equal(invocation.args.includes("--setting-sources=user,project,local"), true);
+      assert.equal(invocation.args.includes("--allow-dangerously-skip-permissions"), true);
 
       const settingsFlagIndex = invocation.args.indexOf("--settings");
       assert.notEqual(settingsFlagIndex, -1);
@@ -317,6 +319,31 @@ it.layer(NodeServices.layer)("Claude capability probe SDK boundary", (it) => {
       assert.equal(flagSettings.disableAllHooks, true);
     }).pipe(Effect.scoped),
   );
+
+  it.effect("reports bypassPermissions as unavailable when Claude refuses it", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const tempDir = yield* fs.makeTempDirectoryScoped({ prefix: "t3-claude-probe-bypass-" });
+      const executablePath = yield* path.fromFileUrl(
+        new URL("./testing/ClaudeCapabilitiesProbe.fixture.mjs", import.meta.url),
+      );
+
+      const capabilities = yield* probeClaudeCapabilities(
+        decodeClaudeSettings({ binaryPath: executablePath }),
+        {
+          ...process.env,
+          T3_PROBE_INVOCATION_PATH: path.join(tempDir, "invocation.json"),
+          T3_PROBE_BYPASS_DISABLED: "1",
+        },
+        undefined,
+        false,
+      );
+
+      assert.equal(capabilities?.email, "dev@example.com");
+      assert.equal(capabilities?.bypassPermissionsAvailable, false);
+    }).pipe(Effect.scoped),
+  );
 });
 
 it.effect("preserves initialized capabilities when optional usage times out", () =>

apps/server/src/provider/ClaudeProvider.ts

@@ -60,6 +60,12 @@ const CLAUDE_PRESENTATION = {
   showInteractionModeToggle: true,
   reportsContextWindow: true,
 } as const;
+// Settings such as a managed `permissions.disableBypassPermissionsMode` stop
+// Claude from entering bypassPermissions, so Full access is not offered.
+const CLAUDE_BYPASS_DISABLED_PRESENTATION = {
+  ...CLAUDE_PRESENTATION,
+  supportedRuntimeModes: ["approval-required", "auto-accept-edits", "auto"],
+} as const;
 function toTitleCaseWords(value: string): string {
   const parts: Array<string> = [];
   for (const part of value.split(/[\s_-]+/g)) {
@@ -201,6 +207,9 @@ export function buildClaudeCapabilitiesProbeQueryOptions(input: {
     // SessionStart hooks would run on every health check.
     settings: { disableAllHooks: true },
     allowedTools: [],
+    // Lets the probe ask for bypassPermissions, which Claude refuses when
+    // settings disable it. The probe never sends a prompt, so no tool runs.
+    allowDangerouslySkipPermissions: true,
     // Ignore MCP definitions from every filesystem setting source above. The
     // SDK combines this empty explicit map with --strict-mcp-config.
     mcpServers: {},
@@ -244,6 +253,11 @@ type ClaudeCapabilitiesProbe = {
    * otherwise successful response mean the account has none (API key).
    */
   readonly usage?: Pick<SDKControlGetUsageResponse, "rate_limits_available" | "rate_limits">;
+  /**
+   * Whether Claude accepted a switch to bypassPermissions, or `undefined`
+   * when the request timed out.
+   */
+  readonly bypassPermissionsAvailable?: boolean;
 };
 
 function parseClaudeInitializationCommands(
@@ -381,6 +395,13 @@ const probeClaudeCapabilities = (
                 rate_limits: usageResult.success.rate_limits,
               }
             : undefined;
+        const bypassPermissionsAvailable = yield* Effect.tryPromise(() =>
+          q.setPermissionMode("bypassPermissions"),
+        ).pipe(
+          Effect.as(true),
+          Effect.orElseSucceed(() => false),
+          Effect.timeoutOption(DEFAULT_TIMEOUT_MS),
+        );
         const account = init.account as
           | {
               readonly email?: string;
@@ -396,6 +417,9 @@ const probeClaudeCapabilities = (
           apiProvider: account?.apiProvider,
           slashCommands: parseClaudeInitializationCommands(init.commands),
           ...(usage ? { usage } : {}),
+          ...(Option.isSome(bypassPermissionsAvailable)
+            ? { bypassPermissionsAvailable: bypassPermissionsAvailable.value }
+            : {}),
         } satisfies ClaudeCapabilitiesProbe;
       }),
     ),
@@ -608,7 +632,10 @@ export const checkClaudeProviderStatus = Effect.fn("checkClaudeProviderStatus")(
       ? yield* resolveResetCredits(parsedVersion)
       : undefined;
   return buildServerProvider({
-    presentation: CLAUDE_PRESENTATION,
+    presentation:
+      capabilities.bypassPermissionsAvailable === false
+        ? CLAUDE_BYPASS_DISABLED_PRESENTATION
+        : CLAUDE_PRESENTATION,
     enabled: claudeSettings.enabled,
     checkedAt,
     models,

apps/server/src/provider/ProviderRegistry.test.ts

@@ -151,6 +151,7 @@ type TestClaudeCapabilities = {
   readonly tokenSource: string | undefined;
   readonly apiProvider: string | undefined;
   readonly slashCommands: ReadonlyArray<ServerProviderSlashCommand>;
+  readonly bypassPermissionsAvailable?: boolean;
 };
 
 function claudeCapabilities(overrides: Partial<TestClaudeCapabilities> = {}) {
@@ -3004,6 +3005,35 @@ it.layer(
       ),
     );
 
+    it.effect("stops offering Full access when Claude refuses bypassPermissions", () =>
+      Effect.gen(function* () {
+        const claudeVersionSpawner = layerMockSpawner((args) => {
+          const joined = args.join(" ");
+          if (joined === "--version") return { stdout: "1.0.0\n", stderr: "", code: 0 };
+          throw new Error(`Unexpected args: ${joined}`);
+        });
+        const refused = yield* checkClaudeProviderStatus(
+          defaultClaudeSettings,
+          claudeCapabilities({ bypassPermissionsAvailable: false }),
+        ).pipe(Effect.provide(claudeVersionSpawner));
+        assert.deepStrictEqual(refused.supportedRuntimeModes, [
+          "approval-required",
+          "auto-accept-edits",
+          "auto",
+        ]);
+        // Accepted, or unknown because the request timed out, offers every mode.
+        for (const bypassPermissionsAvailable of [true, undefined]) {
+          const status = yield* checkClaudeProviderStatus(
+            defaultClaudeSettings,
+            claudeCapabilities(
+              bypassPermissionsAvailable === undefined ? {} : { bypassPermissionsAvailable },
+            ),
+          ).pipe(Effect.provide(claudeVersionSpawner));
+          assert.strictEqual(status.supportedRuntimeModes, undefined);
+        }
+      }),
+    );
+
     it.effect("returns ready and labels Bedrock-backed Claude as authenticated", () =>
       Effect.gen(function* () {
         // Bedrock authenticates via external AWS credentials, so the SDK init

apps/server/src/provider/testing/ClaudeCapabilitiesProbe.fixture.mjs

@@ -45,6 +45,24 @@ lines.on("line", (line) => {
       account: { email: "dev@example.com", subscriptionType: "pro", tokenSource: "oauth" },
     });
   }
+  // The probe asks for bypassPermissions to learn whether settings disable it.
+  if (message.request?.subtype === "set_permission_mode") {
+    if (process.env.T3_PROBE_BYPASS_DISABLED === "1") {
+      process.stdout.write(
+        JSON.stringify({
+          type: "control_response",
+          response: {
+            subtype: "error",
+            request_id: message.request_id,
+            error:
+              "Cannot set permission mode to bypassPermissions because it is disabled by settings or configuration",
+          },
+        }) + "\n",
+      );
+    } else {
+      reply({});
+    }
+  }
   // The probe follows initialize with get_usage on the same process.
   if (message.request?.subtype === "get_usage") {
     reply({

apps/web/src/components/chat/ChatComposer.tsx

@@ -43,6 +43,7 @@ import {
   PROVIDER_SEND_TURN_MAX_ATTACHMENTS,
   PROVIDER_SEND_TURN_MAX_IMAGE_BYTES,
   PROVIDER_SEND_TURN_MAX_INPUT_CHARS,
+  unsupportedRuntimeModeFallback,
 } from "@t3tools/contracts";
 import type { EnvironmentConnectionPresentation } from "@t3tools/client-runtime/connection";
 import {
@@ -2136,13 +2137,18 @@ export const ChatComposer = memo(function ChatComposer(props: ChatComposerProps)
       ? runtimeModeOptions.filter((option) => supportedRuntimeModes.includes(option.mode))
       : runtimeModeOptions;
   // Older threads can contain a mode their current provider no longer offers.
-  // Display the provider's first supported mode, which is also its safe legacy
-  // fallback, without mutating persisted state until the user makes a choice.
+  // Display the mode the server will run (Auto for Full access where offered,
+  // otherwise the provider's first supported mode) without mutating persisted
+  // state until the user makes a choice.
   const compatibleRuntimeMode = compatibleRuntimeModeOptions.some(
     (option) => option.mode === runtimeMode,
   )
     ? runtimeMode
-    : (compatibleRuntimeModeOptions[0]?.mode ?? runtimeMode);
+    : unsupportedRuntimeModeFallback(
+        runtimeMode,
+        compatibleRuntimeModeOptions.map((option) => option.mode),
+        compatibleRuntimeModeOptions[0]?.mode ?? runtimeMode,
+      );
 
   const { modelOptions: composerModelOptions, selectedModel } = useEffectiveComposerModelState({
     threadRef: composerDraftTarget,

docs/user/permission-modes.md

@@ -29,6 +29,9 @@ Grok offers no **Auto-accept edits**. A Grok thread already set to it runs in **
 file-change approvals offer **Allow all edits this session**. Its command approvals have no
 session-wide choice, because Grok would remember that command for the whole project.
 
+When Claude settings disable bypass permissions mode, as an organization's managed policy can,
+Claude offers no **Full access**. A Claude thread already set to it runs in **Auto**.
+
 ACP Registry agents run their own tools in their own mode; T3 Code answers their approval requests
 by the permission mode. See [ACP Registry permissions](./providers-acp.md#permissions-and-terminals).
 

packages/contracts/src/providerPolicy.ts

@@ -31,6 +31,21 @@ export const RuntimeMode = Schema.Literals([
 export type RuntimeMode = typeof RuntimeMode.Type;
 export const DEFAULT_RUNTIME_MODE: RuntimeMode = "full-access";
 
+/**
+ * The mode to use when a provider does not offer `runtimeMode`. Full access
+ * steps down to Auto where the provider offers it (Claude when settings
+ * disable bypass mode); every other case uses the caller's `fallback`.
+ */
+export function unsupportedRuntimeModeFallback(
+  runtimeMode: RuntimeMode,
+  supportedRuntimeModes: ReadonlyArray<RuntimeMode>,
+  fallback: RuntimeMode,
+): RuntimeMode {
+  return runtimeMode === "full-access" && supportedRuntimeModes.includes("auto")
+    ? "auto"
+    : fallback;
+}
+
 export const ProviderInteractionMode = Schema.Literals(["default", "plan"]);
 export type ProviderInteractionMode = typeof ProviderInteractionMode.Type;
 export const DEFAULT_PROVIDER_INTERACTION_MODE: ProviderInteractionMode = "default";