#90 feat: use claude --auto permissions mode for Team/Enterprise members

[Anonymous]

Originally created by: kumaakh

Summary

Claude Code ships with an --auto flag that enables classifier-based automatic permission approval. This is only available on Team and Enterprise plans — Personal plan members do not have access to it.

Current Behavior

compose_permissions is always used to generate and deliver a provider-native permissions config before every dispatch. This works universally but requires the PM to explicitly compose and deliver permissions for each role change.

Desired Behavior

• When dispatching to a Claude member: detect whether the member's Claude account is on a Team or Enterprise plan
• If yes: pass --auto to the claude CLI invocation instead of delivering a pre-composed permissions file
• If the plan tier cannot be determined (unknown, API error, Personal): fall back to the existing compose_permissions approach
• The fallback must be silent — no warnings or errors visible to the PM if detection is unavailable

Notes

• --auto uses a classifier to approve/deny tool calls automatically, reducing the need for explicit permission lists
• Detection heuristic TBD — may need to probe via claude --version, account API, or config inspection
• This is a quality-of-life improvement; the compose_permissions path must remain fully functional as the fallback

Acceptance Criteria

• [ ] Member dispatch uses --auto when the member is on a Team/Enterprise Claude plan
• [ ] Falls back to compose_permissions when plan cannot be determined or is Personal
• [ ] No breaking change to the compose_permissions API or PM workflow
• [ ] Documented in skills/fleet/permissions.md

[Anonymous]

Originally posted by: kumaakh

Technical direction: Add an unattended field to register_member/update_member and map it to the Claude --auto flag at dispatch time. This overlaps significantly with issue [#54] (remove dangerously_skip_permissions from execute_prompt) — consider implementing both together.

Approach:

• Add unattended enum to the Agent type in src/types.ts: 'auto' | 'dangerous' | false
• Add the field to registerMemberSchema (src/tools/register-member.ts) and updateMemberSchema (src/tools/update-member.ts)
• In src/providers/claude.ts, in the method that builds the CLI invocation: if agent.unattended === 'auto', append --permission-mode auto (not --auto — verify current Claude Code flag name); if 'dangerous', append --dangerously-skip-permissions; otherwise use the compose_permissions path as today
• The Team/Enterprise plan detection is not reliable via CLI — skip the detection heuristic and make unattended an explicit registration choice by the user instead

Key files:

• src/types.ts — add unattended field to Agent
• src/tools/register-member.ts, src/tools/update-member.ts — schema
• src/providers/claude.ts — CLI invocation
• src/tools/execute-prompt.ts — remove dangerously_skip_permissions param (aligns with [#54])
• skills/fleet/permissions.md — document the new field