[danshapiro]

What users see

• In a Freshclaude pane, when Claude asks to use a tool and offers to remember the answer, the approval card has a third button, "Allow and don't ask again". Above it, one plain line per rule says what will be remembered and where it is kept. For example: "Always allow Bash(npm test *) in this project (saved to .claude/settings.local.json)" or "Auto-accept file edits for the rest of this conversation". Claude itself then enforces that narrow rule. Before this change, Freshclaude's "Always allow Bash" let every Bash command through, and it was forgotten when the page reloaded.
• When Claude finishes planning, the pane shows a "Plan ready for review" card instead of raw JSON. The card shows the plan as formatted text, the file the plan is saved in, and four choices: "Approve plan", "Approve and auto-accept edits", "Approve and stop asking for permission", and "Keep planning". "Keep planning" has an optional "What should change?" note. While a note is typed, the three Approve buttons are disabled and a line says the note is sent only with Keep planning, so the note cannot be lost by approving.
• After a plan is approved, the pane's permission mode follows the mode Claude actually moved to, including after a restart and resume.
• Freshcodex keeps its own "Always allow". It is now labelled "Always allow in this pane", with the tooltip "Until this pane reloads".

What changed

1. Contract test against the pinned Claude CLI (D0). test/integration/providers/claude-permission-contract.{mjs,test.ts} runs the production sidecar against the local fake endpoint. It pins the CLI's permission suggestions, sending them back in both directions, and plan approvals in every mode.
2. Rust check of Claude's permission updates (D2, D4). The new file is crates/freshell-freshagent/src/claude_permission_update.rs.
   • The suggestions Claude sends are cleaned to the documented shapes before they reach a client.
   • An approval whose updatedPermissions Claude would not accept is refused with INVALID_APPROVAL_DECISION. Nothing is sent to Claude, and the request stays open so the user can answer again.
   • The refusal names the bad update by its position and type only, so rule text such as a Bash command never reaches the log.
3. Open approvals in the session snapshot now carry Claude's suggestions, and the shared client/server contract describes them (D3).
4. The permission mode Claude moves to is saved with the session, so a resume after a restart starts in that mode (D5). The live mode tracking itself, D1, D6 and D7, had already landed in feat(freshclaude): live transcript — streamed text, tool rows, retries, notices and subagent activity while a turn runs #871 and is unchanged.
5. Client side (D8, D9, D10).
   • Every approval answer is built in one place, src/lib/fresh-agent-permission-updates.ts, which also writes the plain-language rule lines.
   • The approval card gains Claude's own "Allow and don't ask again".
   • There is a new FreshAgentPlanApprovalCard.
   • Freshclaude's browser-only bypass is removed. Freshcodex keeps its own.
6. The deck's approve button sends the same shared allow answer (D11).
7. Browser tests (D12). The new freshclaude-approvals-rust.spec.ts drives the real sidecar against the CLI simulator. The live-transcript plan case now approves through the plan card.
8. README (D13): one sentence about the new approvals and the plan card.

Tests (exact results)

• cargo test -p freshell-freshagent --lib: 1510 passed.
• cargo test -p freshell-ws --test freshagent_claude_approvals --test freshagent_claude_lifecycle --test freshagent_claude_live_rendering --test freshagent_control_reply: 2 + 12 + 2 + 17 passed. After the last fixes, freshagent_claude_approvals was rerun: 2 passed.
• cargo clippy -p freshell-freshagent --all-targets -- -D warnings and cargo fmt --all -- --check: both clean.
• pnpm run test:vitest run test/unit/client/components/fresh-agent test/unit/client/lib/fresh-agent-permission-updates.test.ts test/unit/client/lib/fresh-agent-ws.test.ts test/unit/client/deck test/unit/shared/fresh-agent-contract.test.ts test/unit/claude-sidecar --config config/vitest/vitest.config.ts: 1481 passed.
• pnpm run test:vitest run test/integration/providers/claude-permission-contract.test.ts --config config/vitest/vitest.config.ts (pinned CLI, local fake endpoint): 9 passed.
• pnpm run typecheck:client: clean.
• Cloud browser tests, pnpm run test:e2e test/e2e-browser/specs/freshclaude-approvals-rust.spec.ts test/e2e-browser/specs/fresh-agent-control-rust.spec.ts test/e2e-browser/specs/freshclaude-live-transcript-rust.spec.ts --project=chromium (cloud backend, commit f1c95da): 40 passed.

Follow-ups

1. Existing bug: addPermissionRequest in src/store/freshAgentSlice.ts throws when a permission request arrives for a session the client has no record of.
2. Already on main: eslint reports 5 errors in src/components/fresh-agent/FreshAgentView.tsx, none on lines this PR changed.
3. The CLI simulator does not model a remembered rule stopping the next prompt. Only the real-CLI contract test (D0) covers that.
4. A refused approval shows as the generic pane error banner. A dedicated message on the card would be clearer.
5. docs/index.html (the static mock) does not show the plan card yet.
6. Unrelated to this PR: freshell-session-host's provider_config_codex_linked_skills_and_discovery_survive_repeated_resume fails on any machine with a stray /tmp/node_modules folder, because its fixture lives under /tmp and node_modules folders above a resource are copied. Someone ran npm install ws in /tmp today. The local pre-push passed with FRESHELL_TEST_EXECUTABLE_TMP_DIR pointed at /var/tmp, and all 169 tests in that crate passed.

🤖 Generated with Claude Code