Support --permission-mode auto for Claude Code's autonomous mode

[sontixyou]

Problem

Currently, when autonomous mode is enabled (the default), Kanban passes --dangerously-skip-permissions to Claude Code (agent-session-adapters.ts:624-629). This disables all safety checks, including protection against prompt injection attacks.

Claude Code offers a safer alternative: --permission-mode auto. This mode uses a background classifier model to verify the safety of each action while still eliminating confirmation prompts. The user experience is equivalent, but security is significantly better.

Proposal

1. Add a new autonomous mode option for Claude Code: Allow users to choose between bypass (--dangerously-skip-permissions) and auto (--permission-mode auto).
2. Change the default to auto: Since most users never change the default settings, the default should be the safest option that preserves the same UX.
3. Extend the config model: The current agentAutonomousModeEnabled: boolean could be extended to support per-agent mode selection where applicable.

Affected areas

• agent-catalog.ts — extend autonomousArgs or add mode variants
• agent-session-adapters.ts — update Claude adapter to select the appropriate flag
• runtime-config.ts — add config option for autonomous mode type
• Settings UI — add mode selector for Claude Code

Why this matters

• The current default (--dangerously-skip-permissions) is not a safe default
• Most Kanban users run with the default settings unchanged
• --permission-mode auto is stable and production-ready in Claude Code
• This is a low-effort change with a meaningful security improvement

[armorer-labs]

A useful middle ground might be to separate "autonomous" from "unrestricted."

For coding agents, the permission mode could be a runtime policy object rather than a boolean:

• allowed read/write roots
• allowed shell commands
• MCP tools visible to this run
• actions that require approval
• max wall time/tool calls
• persisted action receipt

That still lets an agent work without constant prompting, but keeps the run legible and recoverable afterward.