fix(agent): address permission review feedback

Generated-By: PostHog Code
Task-Id: 1f1fe07c-6384-4d1e-8ab9-bad3700caa2e

Author: richardsolomou

packages/agent/src/adapters/codex-app-server/session-config.test.ts

@@ -7,6 +7,7 @@ import {
   DEFAULT_EFFORTS,
   modeApprovalPolicy,
   resolveInitialMode,
+  SessionConfigState,
   sandboxPolicyFor,
 } from "./session-config";
 
@@ -120,6 +121,21 @@ describe("resolveInitialMode", () => {
   });
 });
 
+describe("SessionConfigState", () => {
+  it("canonicalizes bypassPermissions during a live mode update", () => {
+    const config = new SessionConfigState("gpt-5.5");
+
+    config.setOption("mode", "bypassPermissions");
+
+    expect(config.mode).toBe("full-access");
+    expect(config.approvalPolicy()).toBe("never");
+    expect(config.sandboxPolicy()).toEqual({ type: "dangerFullAccess" });
+    expect(
+      config.options.find((option) => option.category === "mode")?.currentValue,
+    ).toBe("full-access");
+  });
+});
+
 describe("buildConfigOptions", () => {
   const byCategory = (
     opts: ReturnType<typeof buildConfigOptions>,

packages/agent/src/adapters/codex-app-server/session-config.ts

@@ -268,7 +268,7 @@ export class SessionConfigState {
       if (configId === "model") this._model = value;
       else if (configId === "effort") this._effort = value;
       else if (configId === "mode") {
-        this._mode = value;
+        this._mode = resolveInitialMode(value);
         modeChanged = true;
       }
     }

packages/core/src/sessions/sessionService.ts

@@ -4488,8 +4488,10 @@ export class SessionService {
   ): () => void {
     const taskRunId = runId;
     const persistedConfigOptions = this.d.getPersistedConfigOptions(taskRunId);
+    const persistedAdapter = this.d.adapterStore.getAdapter(taskRunId);
     const buildInitialConfigOptions = (
       mode: string | undefined,
+      configAdapter: Adapter | undefined = persistedAdapter,
     ): SessionConfigOption[] => {
       const defaults = addMissingCloudRuntimeConfigOptions(
         buildCloudDefaultConfigOptions(mode, adapter),
@@ -4498,6 +4500,7 @@ export class SessionService {
         initialReasoningEffort,
       );
       if (!persistedConfigOptions?.length) return defaults;
+      if (configAdapter && configAdapter !== adapter) return defaults;
 
       const defaultIds = new Set(defaults.map((option) => option.id));
       const completeOptions = [
@@ -4510,6 +4513,7 @@ export class SessionService {
     };
 
     if (this.supersededRunIds.has(runId)) return () => {};
+    this.d.adapterStore.setAdapter(taskRunId, adapter);
 
     const existingWatcher = this.cloudTaskWatchers.get(taskId);
 
@@ -4537,7 +4541,10 @@ export class SessionService {
         if (shouldRefreshConfigOptions) {
           this.d.store.updateSession(existing.taskRunId, {
             adapter,
-            configOptions: buildInitialConfigOptions(currentMode),
+            configOptions: buildInitialConfigOptions(
+              currentMode,
+              existing.adapter,
+            ),
           });
         } else {
           const configOptions = addMissingCloudRuntimeConfigOptions(
@@ -4633,7 +4640,10 @@ export class SessionService {
       session.status = "disconnected";
       session.isCloud = true;
       session.adapter = adapter;
-      session.configOptions = buildInitialConfigOptions(initialMode);
+      session.configOptions = buildInitialConfigOptions(
+        initialMode,
+        existing?.taskRunId === taskRunId ? existing.adapter : persistedAdapter,
+      );
       this.d.store.setSession(session);
       // Optimistic seeding for the initial task description is deferred
       // until `hydrateCloudTaskSessionFromLogs` confirms there's no prior
@@ -4651,7 +4661,10 @@ export class SessionService {
         )?.currentValue;
         const currentMode =
           typeof existingMode === "string" ? existingMode : initialMode;
-        updates.configOptions = buildInitialConfigOptions(currentMode);
+        updates.configOptions = buildInitialConfigOptions(
+          currentMode,
+          existing.adapter,
+        );
       } else {
         const configOptions = addMissingCloudRuntimeConfigOptions(
           existing.configOptions,

packages/ui/src/features/sessions/sessionServiceHost.test.ts

@@ -432,6 +432,8 @@ describe("SessionService", () => {
     mockGetConfigOptionByCategory.mockReturnValue(undefined);
     mockBuildAuthenticatedClient.mockReturnValue(mockAuthenticatedClient);
     mockAuthenticatedClient.getTaskRunSessionLogs.mockResolvedValue([]);
+    mockSessionConfigStore.getPersistedConfigOptions.mockReturnValue(undefined);
+    mockAdapterFns.getAdapter.mockReturnValue(undefined);
     mockSessionStoreSetters.getSessionByTaskId.mockReturnValue(undefined);
     mockSessionStoreSetters.getSessions.mockReturnValue({});
     mockAuth.fetchAuthState.mockResolvedValue({
@@ -1072,6 +1074,85 @@ describe("SessionService", () => {
       mockSessionConfigStore.setPersistedConfigOptions.mockReset();
     });
 
+    it("drops persisted options when the cloud adapter changes", () => {
+      const service = getSessionService();
+      mockAdapterFns.getAdapter.mockReturnValue("claude");
+      mockSessionConfigStore.getPersistedConfigOptions.mockReturnValue([
+        {
+          id: "mode",
+          name: "Mode",
+          type: "select",
+          category: "mode",
+          currentValue: "acceptEdits",
+          options: [],
+        },
+        {
+          id: "model",
+          name: "Model",
+          type: "select",
+          category: "model",
+          currentValue: "claude-opus-4-8",
+          options: [],
+        },
+        {
+          id: "effort",
+          name: "Effort",
+          type: "select",
+          category: "thought_level",
+          currentValue: "high",
+          options: [],
+        },
+      ]);
+
+      service.watchCloudTask(
+        "task-adapter-change",
+        "run-adapter-change",
+        "https://api.example.com",
+        123,
+        undefined,
+        undefined,
+        "auto",
+        "codex",
+        "gpt-5.5",
+        undefined,
+        undefined,
+        undefined,
+        "max",
+      );
+
+      expect(mockSessionStoreSetters.setSession).toHaveBeenCalledWith(
+        expect.objectContaining({
+          adapter: "codex",
+          configOptions: expect.arrayContaining([
+            expect.objectContaining({
+              category: "mode",
+              currentValue: "auto",
+            }),
+            expect.objectContaining({
+              category: "model",
+              currentValue: "gpt-5.5",
+            }),
+            expect.objectContaining({
+              category: "thought_level",
+              currentValue: "max",
+            }),
+          ]),
+        }),
+      );
+      const session = mockSessionStoreSetters.setSession.mock.calls.at(-1)?.[0];
+      expect(session?.configOptions).not.toEqual(
+        expect.arrayContaining([
+          expect.objectContaining({ currentValue: "acceptEdits" }),
+          expect.objectContaining({ currentValue: "claude-opus-4-8" }),
+          expect.objectContaining({ id: "effort" }),
+        ]),
+      );
+      expect(mockAdapterFns.setAdapter).toHaveBeenCalledWith(
+        "run-adapter-change",
+        "codex",
+      );
+    });
+
     it("shows the selected cloud model and reasoning before preview config loads", () => {
       const service = getSessionService();