fix(settings): default permission mode is 'default', not 'bypass' (fail-closed)

[aterrylu]

Summary

Fast-follow to #257 (ADR-045): flip DEFAULT_PERMISSION_MODE from bypass to default (fail-closed). A spawn that doesn't specify a permissionMode now asks before each privileged action instead of skipping all permission prompts.

Why

The original ADR-045 cut shipped bypass as the default to mirror the old pervasive autonomousMode ?? true. That proved fragile — and the #257 babysit run proved it concretely:

• bypass emits --dangerously-skip-permissions, which the real Claude Code binary refuses under CI / root — it broke 3 RUN_INTEGRATION-gated suites that local make check can't see.
• It silently granted full autonomy to any spawn that forgot to set a mode (fail-open).

A safe default matters more than mirroring the old autonomy. Callers that want autonomy set bypass explicitly (Settings/Create-Agent UI, MCP, templates all still offer it).

Scope

• DEFAULT_PERMISSION_MODE: "bypass" → "default" (core).
• Reverted the 4 integration-test permissionMode pins added during the feat(settings): per-provider permission modes (replaces autonomousMode) #257 CI saga — they now spawn via the real default (CI-safe), and double as a guard: if anyone flips the default back to bypass, these break in CI, auto-surfacing the lesson.
• Updated MCP tool descriptions + the create_agent JSON-schema default field; flipped the DEFAULT-derived test assertions; regenerated channel-server/dist.mjs.
• Built-in dispatcher/team-lead/feature-worker templates follow the new default (ask-first) — confirmed with Terry.

Backward compat (unchanged)

Migration of existing records is untouched: permissionModeFromLegacy still maps old autonomousMode: true → bypass, false → default. Already-configured installs keep their behavior; only fresh/unspecified spawns get the safe default. An autonomous template (autonomousMode: true) still migrates to bypass, not silently demoted.

Testing

• make check green: 610 server + 31 dashboard test files.
• Integration suites (now unpinned, spawning via the real default): 8/8 pass — confirms default → no flag → CI-safe end-to-end.
• /polish: all 3 agents clean (2 LOW cosmetic findings, both fixed).

Also

Claude default mode emits no flag (the redundant --permission-mode default was perturbing interactive-TUI startup timing) — carried over from the #257 fix, documented here.

🤖 Generated with Claude Code

https://claude.ai/code/session_01UYB9dBo9Ap9ViBYKERneu7

[nox-0x]

Approving — fail-closed default flip is the right call, migration of existing records is preserved, and the four integration-test pins reverting to the implicit default double as a regression guard against re-flipping to bypass.

Verified end-to-end:

• DEFAULT_PERMISSION_MODE flips to "default"; permission-modes.test.ts and store-migration.test.ts assertions pin the new value, including the "missing both fields" and "malformed string" fallback paths (packages/server/src/__tests__/store-migration.test.ts:83,91).
• permissionModeFromLegacy is untouched, so existing autonomousMode:true records still map to bypass (no silent demotion on upgrade). Dashboard persist merge() keeps a saved bypass for existing local installs (packages/dashboard/src/store.ts:2046-2057).
• Built-in templates seed permissionMode: DEFAULT_PERMISSION_MODE, so fresh installs adopt the safe default while pre-seeded ~/.autonomos/templates/*.json files keep their values (seed only runs when the dir is empty — templates.ts:142).
• routes/agents.ts invalid-mode comment correctly updated to "template/default" — the resolution chain (isPermissionMode(body) ? body : tmpl?.permissionMode ?? DEFAULT_PERMISSION_MODE) matches the new wording.
• channel-server/dist.mjs regenerated to match mcp/tools.ts (both TOOL_CREATE_AGENT default + TOOL_CREATE_TEMPLATE description).
• CreateAgentPanel.dom.test.tsx expectation flip is consistent with the actual code path: auto-default sets selectedTemplate but not the mode (only selectTemplate() reads tmpl.permissionMode), so the global default flows through — verified at CreateAgentPanel.tsx:85-95 vs :129-137.

No silent failure modes, no API contract breaks, no missing coverage. Senior-engineer bar cleared.