Add yolo mode: auto-approve tool-call permission requests

[vanzue]

Summary

Adds "yolo mode" (auto-approve tool-call permission requests) for the agent pane.

Two independent, additive enable paths, both gated by the AllowYoloMode GPO policy:

1. Global Settings toggle — Settings → AI Agents → "Auto-approve tool calls". Applies to every new agent pane helper via a --auto-approve-tools flag.
2. /yolo slash command — scoped to the current session only. Does not persist across /new (fresh session_id) and is cleared on /restart.

Two enforcement layers

1. Agent-native (preferred, when available) — permission_select.rs detects whether the connected ACP agent advertises a per-session config_options entry (category: "permissions", id: "allow_all") in its session/new response. Verified live against Copilot CLI (copilot --acp --stdio): calling session/set_config_option(configId: "allow_all", value: "on") makes the agent stop sending session/request_permission entirely for that session — a real protocol-native, per-session auto-approve, with zero permission round-trips observed. This is applied automatically whenever a session is (or becomes) in yolo mode, at every session-creation call site, plus retroactively via a new MasterExtRequest::SetSessionAllowAll when /yolo is typed on an already-live session.
2. Client-side interception (fallback) — implemented at the ACP client layer (WtaClient::request_permission in tools/wta/src/protocol/acp/client.rs), so it applies uniformly across Copilot, Claude, Gemini, and Codex regardless of whether the agent supports the native option. When active, it skips the permission UI prompt and picks the best "allow" option (preferring allow_always over allow_once).

Agents that don't advertise the native config (Claude/Gemini/Codex ACP adapters today, as far as tested) transparently fall back to layer 2 — no behavior change for them.

Changes

• C++: AgentPolicy.h (AllowYoloMode policy), MTSMSettings.h / GlobalAppSettings.idl/.h/.cpp (AgentPaneYoloMode setting), TerminalPage.cpp (helper cmdline passthrough), Settings UI (AIAgentsViewModel, AIAgents.xaml).
• Rust (wta): shared yolo_sessions state between App and WtaClient, /yolo command, auto-approve logic in request_permission, session cleanup on /new and /restart, new permission_select.rs module for agent-native allow-all detection/application, MasterExtRequest::SetSessionAllowAll round-trip.
• Tests: new C++ policy unit tests (CustomAgentAndPolicyTests.cpp) and Rust unit tests (mock_agent_tests.rs, permission_select.rs).
• Localization: new strings added to en-US.yml and translated across all other locale files.
• Docs: new "Yolo mode" section in doc/specs/Multi-window-agent-pane.md.

Testing

• cargo test --manifest-path tools/wta/Cargo.toml — 1183 passed, 0 failed.
• C++ TerminalSettingsModel, TerminalSettingsEditor (and previously TerminalApp, UnitTests_SettingsModel) built successfully with 0 errors.
• Manual live ACP protocol probe against copilot --acp --stdio confirming session/set_config_option(allow_all, on) suppresses session/request_permission for that session only (fresh sessions default to off, no cross-session leakage).

Closes #326

[Copilot]

Pull request overview

This PR adds “yolo mode” for the agent pane, enabling automatic approval of tool-call permission requests at the ACP client layer, with two enable paths (global setting + per-session /yolo) and enforcement via the new AllowYoloMode admin policy (GPO).

Changes:

• Adds a new global setting (agentPane.yoloMode) and Settings UI toggle to launch helpers with --auto-approve-tools, gated by AllowYoloMode.
• Adds a per-session /yolo slash command and shared yolo_sessions state so auto-approve can be enabled for a single ACP session.
• Adds policy plumbing + unit tests, plus localized strings and spec documentation for yolo mode.

Reviewed changes

Copilot reviewed 109 out of 109 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
tools/wta/src/protocol/acp/client.rs	Implements yolo-mode auto-approval selection logic in request_permission and threads yolo state into the ACP client.
tools/wta/src/protocol/acp/mock_agent_tests.rs	Adds unit tests covering global/per-session yolo behavior and allow-always preference.
tools/wta/src/main.rs	Adds hidden helper flags (--auto-approve-tools, --yolo-command-blocked) and wires shared yolo session state into the app/client.
tools/wta/src/commands.rs	Registers /yolo slash command and help summary key.
tools/wta/src/app.rs	Stores global/per-session yolo mode state, adds /yolo handler, and clears yolo state on /new + /restart.
tools/wta/src/app_events.rs	Adds handling for a new session-scoped system message event type.
tools/wta/src/app_tests.rs	Updates test harness app construction for new yolo-related App fields.
tools/wta/locales/*.yml	Adds localized strings for yolo mode and /yolo command summary across locales.
src/cascadia/inc/AgentPolicy.h	Adds AllowYoloMode policy reading + query helpers.
src/cascadia/TerminalSettingsModel/MTSMSettings.h	Adds AgentPaneYoloMode setting definition (agentPane.yoloMode).
src/cascadia/TerminalSettingsModel/GlobalAppSettings.idl	Exposes AgentPaneYoloMode, EffectiveAgentPaneYoloMode, and IsYoloModePolicyLocked.
src/cascadia/TerminalSettingsModel/GlobalAppSettings.h	Declares new effective accessor + policy lock accessor.
src/cascadia/TerminalSettingsModel/GlobalAppSettings.cpp	Implements effective yolo-mode gating and lock-state query.
src/cascadia/TerminalSettingsEditor/Resources/en-US/Resources.resw	Adds UI strings for the global “Auto-approve tool calls (Yolo mode)” toggle and help text.
src/cascadia/TerminalSettingsEditor/AIAgentsViewModel.idl	Adds viewmodel properties for yolo mode and its policy lock indicator.
src/cascadia/TerminalSettingsEditor/AIAgentsViewModel.h	Adds corresponding C++/WinRT viewmodel method declarations.
src/cascadia/TerminalSettingsEditor/AIAgentsViewModel.cpp	Implements yolo-mode property get/set with policy lock guarding and change notifications.
src/cascadia/TerminalSettingsEditor/AIAgents.xaml	Adds the yolo-mode toggle UI and disables it when policy-locked.
src/cascadia/TerminalApp/TerminalPage.cpp	Plumbs global yolo setting and policy lock into helper command line (--auto-approve-tools, --yolo-command-blocked).
src/cascadia/UnitTests_SettingsModel/CustomAgentAndPolicyTests.cpp	Adds SettingsModel unit tests for yolo-mode roundtripping and policy gating behavior.
doc/specs/Multi-window-agent-pane.md	Documents yolo mode behavior, enable paths, policy gating, and lifecycle semantics.

[Copilot]

Pull request overview

Copilot reviewed 111 out of 111 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (4)

tools/wta/src/protocol/acp/client.rs:1621

• In yolo mode the code immediately selects an allow option, but it doesn't emit any user-visible signal (despite adding AppEvent::SessionSystemMessage and localized system.yolo_auto_approved). This makes the new event variant and locale strings unused and contradicts the documented behavior of posting a passive approval message.
  tools/wta/src/app.rs:5918
• /yolo currently enables the session override but stays silent. This leaves the localized system.yolo_enabled string unused and provides no confirmation to the user that auto-approval is now active for the session.
  tools/wta/src/protocol/acp/mock_agent_tests.rs:1893
• These yolo-mode tests assert that auto-approval emits no events at all, but the feature adds AppEvent::SessionSystemMessage + system.yolo_auto_approved specifically to inform the user what was auto-approved. Once the client emits that message, these assertions should be updated to expect a SessionSystemMessage (and still ensure no PermissionRequest UI prompt is raised).
  tools/wta/src/protocol/acp/mock_agent_tests.rs:1914
• This test also assumes yolo auto-approval produces no events. If yolo mode emits a SessionSystemMessage for the auto-approved request, consume/assert that message before continuing to the normal interactive flow for the non-yolo session.

[Copilot]

Pull request overview

Copilot reviewed 110 out of 110 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (1)

tools/wta/src/protocol/acp/permission_select.rs:59

• The selector match is too broad: category == "permissions" || id == "allow_all" can select an unrelated permissions-category Select option (if an agent adds more permission-related config options), and WTA would then call session/set_config_option with the wrong config_id. Prefer matching the stable id == "allow_all" (optionally validating the category when present) and require Select.

[Copilot]

Pull request overview

Copilot reviewed 110 out of 110 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

doc/specs/Multi-window-agent-pane.md:949

• This spec claims yolo-mode auto-approval posts an AppEvent::SessionSystemMessage so the user can see what was approved, but the current implementation (and tests) intentionally keep yolo auto-approval silent (no extra events/messages). The spec should match the shipped behavior.

skips the blocking `PermissionRequest` UI event entirely, picks the best
"allow" option (`allow_always` preferred over `allow_once` — see
`pick_allow_option`), responds immediately, and posts a passive
`AppEvent::SessionSystemMessage` to that session's tab chat so the user
still sees what was approved.

[Copilot]

Pull request overview

Copilot reviewed 110 out of 110 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 110 out of 110 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (3)

tools/wta/src/protocol/acp/permission_select.rs:59

• allow_all_option_id currently matches any Select option in category permissions even if its id is not allow_all. If an agent ever advertises multiple permission-related config options, this could toggle the wrong setting when yolo mode is enabled. It’s safer to key detection exclusively off the well-known id (allow_all) and treat category as informational only.
  tools/wta/src/protocol/acp/client.rs:1600
• This comment refers to allow_always/allow_once, but the code (and PermOption.kind) uses the ACP enum debug renderings like AllowAlways/AllowOnce. Updating the comment avoids confusion when reading the selection logic.
  tools/wta/src/protocol/acp/permission_select.rs:46
• The doc comment for allow_all_option_id says it matches by category permissions OR id allow_all. Since matching on category alone is risky (it may match unrelated permission config options), the comment should align with the safer id-based detection.

This issue also appears on line 55 of the same file.

[Copilot]

Pull request overview

Copilot reviewed 111 out of 111 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (2)

tools/wta/src/protocol/acp/permission_select.rs:59

• allow_all_option_id currently treats any Select config option in category permissions as the native allow-all toggle. If an agent advertises multiple permission-related config options, this can pick the wrong id and then attempt to session/set_config_option(..., "on") against an unrelated setting. Since the ACP schema always requires an id, this should primarily key off the id (optionally normalizing it), not the free-form category string.
  tools/wta/src/app.rs:2158
• This field comment says entries are removed when a session ends or is replaced (including session/load), but the current implementation only removes on /new (cmd_new) and clears on /restart. The SessionAttached handler overwrites tab.session_id without removing the previous id from yolo_sessions (see tools/wta/src/app_events.rs SessionAttached arm), so stale ids can linger and could unexpectedly re-enable yolo if an agent ever reuses a session_id. Consider removing the prior session_id from yolo_sessions whenever a tab is re-bound to a new session_id (and on session end), or update the comment to match the actual cleanup semantics.

[Copilot]

Pull request overview

Copilot reviewed 119 out of 119 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

tools/wta/src/protocol/acp/permission_select.rs:62

• allow_all_option_id will treat any configOptions entry with category permissions as the allow-all selector, even if its id is not allow_all. That means a future agent that adds additional permissions-related config options could cause WTA to record the wrong config id and call session/set_config_option on an unrelated option.