fix(agent): restore remembered Claude exec approvals

Author: skoob13

packages/agent/README.md

@@ -78,8 +78,9 @@ Cloud provisioning can pass `--posthogExecPermissionRegex <regex>` to require
 one-time client approval for matching PostHog MCP `exec` sub-tools in every
 interactive Claude and Codex permission mode. Matching is case-insensitive
 against the delegated name in `call [--json] <sub-tool> ...`. These prompts do
-not offer an always-allow choice and are not remembered. Background runs keep
-their existing auto-approval behavior. The default is
+offer Claude users an always-allow choice remembered in local repository
+settings; Codex approvals remain one-time. Background runs keep their existing
+auto-approval behavior. The default is
 `(^|-)(partial-update|update|patch|delete|destroy)(-|$)`.
 
 ## ACP connection layer

packages/agent/src/adapters/claude/permissions/permission-handlers.test.ts

@@ -215,7 +215,7 @@ describe("canUseTool MCP approval enforcement", () => {
     "auto",
     "bypassPermissions",
   ] as const)(
-    "prompts for a configured PostHog exec match in %s mode without remembering",
+    "prompts for a configured PostHog exec match in %s mode with a remembered choice",
     async (permissionMode) => {
       setMcpToolApprovalStates({ mcp__posthog__exec: "approved" });
 
@@ -226,6 +226,8 @@ describe("canUseTool MCP approval enforcement", () => {
           posthogExecPermissionRegex,
           settingsManager: {
             getRepoRoot: vi.fn().mockReturnValue("/repo"),
+            hasPostHogExecApproval: vi.fn().mockReturnValue(false),
+            addPostHogExecApproval: vi.fn(),
           },
         },
       });
@@ -236,6 +238,7 @@ describe("canUseTool MCP approval enforcement", () => {
         expect.objectContaining({
           options: [
             expect.objectContaining({ kind: "allow_once" }),
+            expect.objectContaining({ kind: "allow_always" }),
             expect.objectContaining({ kind: "reject_once" }),
           ],
           toolCall: expect.objectContaining({
@@ -247,6 +250,54 @@ describe("canUseTool MCP approval enforcement", () => {
     },
   );
 
+  it("skips the prompt for a remembered PostHog exec sub-tool", async () => {
+    setMcpToolApprovalStates({ mcp__posthog__exec: "approved" });
+
+    const context = createContext("mcp__posthog__exec", {
+      toolInput: { command: "call experiment-update {}" },
+      session: {
+        permissionMode: "default",
+        posthogExecPermissionRegex,
+        settingsManager: {
+          getRepoRoot: vi.fn().mockReturnValue("/repo"),
+          hasPostHogExecApproval: vi.fn().mockReturnValue(true),
+          addPostHogExecApproval: vi.fn(),
+        },
+      },
+    });
+
+    const result = await canUseTool(context);
+
+    expect(result.behavior).toBe("allow");
+    expect(context.client.requestPermission).not.toHaveBeenCalled();
+  });
+
+  it("persists a PostHog exec sub-tool selected with allow always", async () => {
+    setMcpToolApprovalStates({ mcp__posthog__exec: "approved" });
+    const addPostHogExecApproval = vi.fn().mockResolvedValue(undefined);
+
+    const context = createContext("mcp__posthog__exec", {
+      toolInput: { command: "call notebooks-destroy {}" },
+      session: {
+        permissionMode: "default",
+        posthogExecPermissionRegex,
+        settingsManager: {
+          getRepoRoot: vi.fn().mockReturnValue("/repo"),
+          hasPostHogExecApproval: vi.fn().mockReturnValue(false),
+          addPostHogExecApproval,
+        },
+      },
+      client: createClient({
+        outcome: { outcome: "selected", optionId: "allow_always" },
+      }),
+    });
+
+    const result = await canUseTool(context);
+
+    expect(result.behavior).toBe("allow");
+    expect(addPostHogExecApproval).toHaveBeenCalledWith("notebooks-destroy");
+  });
+
   it("does not gate a nonmatching PostHog sub-tool", async () => {
     setMcpToolApprovalStates({ mcp__posthog__exec: "approved" });
 

packages/agent/src/adapters/claude/permissions/permission-handlers.ts

@@ -586,11 +586,16 @@ async function handlePostHogExecApprovalFlow(
   context: ToolHandlerContext,
   subTool: string,
 ): Promise<ToolPermissionResult> {
-  const { toolName, toolInput, toolUseID, sessionId } = context;
+  const { toolName, toolInput, toolUseID, sessionId, session } = context;
 
   const response = await requestPermissionFromClient(context, {
     options: [
       { kind: "allow_once", name: "Yes", optionId: "allow" },
+      {
+        kind: "allow_always",
+        name: "Yes, always allow",
+        optionId: "allow_always",
+      },
       {
         kind: "reject_once",
         name: "Type here to tell the agent what to do differently",
@@ -622,8 +627,19 @@ async function handlePostHogExecApprovalFlow(
 
   if (
     response.outcome?.outcome === "selected" &&
-    response.outcome.optionId === "allow"
+    (response.outcome.optionId === "allow" ||
+      response.outcome.optionId === "allow_always")
   ) {
+    if (response.outcome.optionId === "allow_always") {
+      try {
+        await session.settingsManager.addPostHogExecApproval(subTool);
+      } catch (error) {
+        context.logger.warn(
+          "[canUseTool] Failed to persist PostHog exec approval",
+          { error: error instanceof Error ? error.message : String(error) },
+        );
+      }
+    }
     return {
       behavior: "allow",
       updatedInput: toolInput as Record<string, unknown>,
@@ -754,6 +770,12 @@ export async function canUseTool(
           session.posthogExecPermissionRegex,
         )
       ) {
+        if (session.settingsManager.hasPostHogExecApproval(subTool)) {
+          return {
+            behavior: "allow",
+            updatedInput: toolInput as Record<string, unknown>,
+          };
+        }
         return handlePostHogExecApprovalFlow(context, subTool);
       }
     }

packages/agent/src/adapters/claude/session/settings.test.ts

@@ -127,6 +127,56 @@ describe("SettingsManager per-repo persistence", () => {
     expect(await fs.promises.readFile(filePath, "utf-8")).toBe(original);
   });
 
+  it("persists PostHog exec approvals and sees them across worktrees", async () => {
+    const writer = new SettingsManager(worktree);
+    await writer.initialize();
+    await writer.addPostHogExecApproval("experiment-update");
+
+    const filePath = path.join(mainRepo, ".claude", "settings.local.json");
+    const contents = JSON.parse(await fs.promises.readFile(filePath, "utf-8"));
+    expect(contents.posthogApprovedExecTools).toEqual(["experiment-update"]);
+
+    const sibling = path.join(tmpRoot, "wt-ph");
+    runGit(mainRepo, ["worktree", "add", "-b", "other-ph", sibling]);
+    const reader = new SettingsManager(sibling);
+    await reader.initialize();
+    expect(reader.hasPostHogExecApproval("experiment-update")).toBe(true);
+    expect(reader.hasPostHogExecApproval("experiment-delete")).toBe(false);
+  });
+
+  it("dedupes repeated PostHog exec approvals", async () => {
+    const manager = new SettingsManager(worktree);
+    await manager.initialize();
+
+    await manager.addPostHogExecApproval("foo-update");
+    await manager.addPostHogExecApproval("foo-update");
+    await manager.addPostHogExecApproval("bar-delete");
+
+    const filePath = path.join(mainRepo, ".claude", "settings.local.json");
+    const contents = JSON.parse(await fs.promises.readFile(filePath, "utf-8"));
+    expect(contents.posthogApprovedExecTools).toEqual([
+      "foo-update",
+      "bar-delete",
+    ]);
+  });
+
+  it("concurrent addPostHogExecApproval calls do not clobber each other", async () => {
+    const manager = new SettingsManager(worktree);
+    await manager.initialize();
+
+    await Promise.all([
+      manager.addPostHogExecApproval("a-update"),
+      manager.addPostHogExecApproval("b-delete"),
+      manager.addPostHogExecApproval("c-destroy"),
+    ]);
+
+    const filePath = path.join(mainRepo, ".claude", "settings.local.json");
+    const contents = JSON.parse(await fs.promises.readFile(filePath, "utf-8"));
+    expect(contents.posthogApprovedExecTools).toEqual(
+      expect.arrayContaining(["a-update", "b-delete", "c-destroy"]),
+    );
+  });
+
   it("concurrent addAllowRules calls do not clobber each other", async () => {
     const manager = new SettingsManager(worktree);
     await manager.initialize();

packages/agent/src/adapters/claude/session/settings.ts

@@ -197,6 +197,7 @@ export interface ClaudeCodeSettings {
   env?: Record<string, string>;
   model?: string;
   availableModels?: string[];
+  posthogApprovedExecTools?: string[];
 }
 
 type SettingsLayer = "user" | "project" | "local" | "enterprise";
@@ -317,6 +318,7 @@ export class SettingsManager {
       ask: [],
     };
     const merged: ClaudeCodeSettings = { permissions };
+    const posthogApprovedExecTools = new Set<string>();
 
     for (const { layer, settings } of allSettings) {
       if (settings.permissions) {
@@ -350,6 +352,15 @@ export class SettingsManager {
         settings.availableModels,
         layer,
       );
+      if (settings.posthogApprovedExecTools) {
+        for (const tool of settings.posthogApprovedExecTools) {
+          posthogApprovedExecTools.add(tool);
+        }
+      }
+    }
+
+    if (posthogApprovedExecTools.size > 0) {
+      merged.posthogApprovedExecTools = Array.from(posthogApprovedExecTools);
     }
 
     this.mergedSettings = merged;
@@ -432,6 +443,43 @@ export class SettingsManager {
     }
   }
 
+  hasPostHogExecApproval(subTool: string): boolean {
+    return (
+      this.mergedSettings.posthogApprovedExecTools?.includes(subTool) ?? false
+    );
+  }
+
+  /**
+   * Persists an approved PostHog MCP `exec` sub-tool (e.g. `experiment-update`)
+   * to the local settings file so future calls skip the prompt. Mirrors
+   * `addAllowRules` — serialised via `writeMutex`, atomic temp-file + rename.
+   */
+  async addPostHogExecApproval(subTool: string): Promise<void> {
+    if (!subTool) return;
+    if (!this.initialized) await this.initialize();
+    await this.writeMutex.acquire();
+    try {
+      const filePath = this.getLocalSettingsPath();
+      const existing = await readSettingsFileForUpdate(filePath);
+      const current = new Set(existing.posthogApprovedExecTools ?? []);
+      if (current.has(subTool)) {
+        return;
+      }
+      current.add(subTool);
+      const next: ClaudeCodeSettings = {
+        ...existing,
+        posthogApprovedExecTools: Array.from(current),
+      };
+      await fs.promises.mkdir(path.dirname(filePath), { recursive: true });
+      await writeFileAtomic(filePath, `${JSON.stringify(next, null, 2)}\n`);
+
+      this.localSettings = next;
+      this.mergeAllSettings();
+    } finally {
+      this.writeMutex.release();
+    }
+  }
+
   async setCwd(cwd: string): Promise<void> {
     if (this.cwd === cwd) return;
     if (this.initPromise) await this.initPromise;

packages/agent/src/server/agent-server.test.ts

@@ -1522,14 +1522,16 @@ describe("AgentServer HTTP Mode", () => {
         request: claudePosthogExecPermissionRequest(
           "call notebooks-destroy {}",
         ),
+        expectedKinds: ["allow_once", "allow_always", "reject_once"],
       },
       {
         adapter: "Codex",
         request: codexPosthogExecPermissionRequest("call notebooks-destroy {}"),
+        expectedKinds: ["allow_once", "reject_once"],
       },
     ])(
-      "relays a configured PostHog exec match from $adapter without an always-allow option",
-      async ({ request }) => {
+      "relays a configured PostHog exec match from $adapter with adapter-specific choices",
+      async ({ request, expectedKinds }) => {
         const testServer = exposeCloudClient(createServer());
         testServer.session = null;
         testServer.eventStreamSender = null;
@@ -1542,13 +1544,11 @@ describe("AgentServer HTTP Mode", () => {
         const { requestPermission } = testServer.createCloudClient(basePayload);
         const result = await requestPermission(request);
 
-        expect(relaySpy).toHaveBeenCalledWith(
-          expect.objectContaining({
-            options: [
-              expect.objectContaining({ kind: "allow_once" }),
-              expect.objectContaining({ kind: "reject_once" }),
-            ],
-          }),
+        const relayed = relaySpy.mock.calls[0]?.[0] as {
+          options: Array<{ kind: string }>;
+        };
+        expect(relayed.options.map((option) => option.kind)).toEqual(
+          expectedKinds,
         );
         expect(result.outcome).toEqual({
           outcome: "selected",

packages/agent/src/server/agent-server.ts

@@ -3735,17 +3735,22 @@ ${signedCommitInstructions}${prLinkInstructions}${shellEfficiencyInstructions}
         const posthogExecSubTool =
           this.matchesPostHogExecPermissionRequest(params);
         if (mode !== "background" && posthogExecSubTool) {
-          const promptOnceParams = {
+          const isClaudeCodeRequest = Boolean(
+            params.toolCall?._meta?.claudeCode,
+          );
+          const relayParams = {
             ...params,
-            options: params.options.filter(
-              (option) => option.kind !== "allow_always",
-            ),
+            options: isClaudeCodeRequest
+              ? params.options
+              : params.options.filter(
+                  (option) => option.kind !== "allow_always",
+                ),
           };
           this.logger.debug("Relaying configured PostHog exec permission", {
             subTool: posthogExecSubTool,
             sessionPermissionMode: this.getSessionPermissionMode(),
           });
-          return this.relayPermissionToClient(promptOnceParams);
+          return this.relayPermissionToClient(relayParams);
         }
 
         // Relay permission requests to the connected client when: