fix(runner): substitute acceptEdits for haiku's silent auto-mode downgrade, fail permission-denial-only runs

src/ClaudeDo.Worker/Runner/ClaudeArgsBuilder.cs

@@ -41,12 +41,8 @@ public sealed class ClaudeArgsBuilder
             "--verbose",
         };
 
-        var permissionMode = string.IsNullOrWhiteSpace(config.PermissionMode)
-            || config.PermissionMode.Equals("bypassPermissions", StringComparison.OrdinalIgnoreCase)
-            ? "auto"
-            : config.PermissionMode;
         args.Add("--permission-mode");
-        args.Add(permissionMode);
+        args.Add(PermissionModeResolver.Resolve(config.Model, config.PermissionMode));
 
         if (config.Model is not null)
         {

src/ClaudeDo.Worker/Runner/ClaudeProcess.cs

@@ -127,6 +127,7 @@ public sealed class ClaudeProcess : IClaudeProcess
                 ResultSubtype = streamResult.ResultSubtype,
                 TerminalReason = streamResult.TerminalReason,
                 Errors = streamResult.Errors,
+                PermissionDenials = streamResult.PermissionDenials,
             };
         }
 
@@ -150,6 +151,7 @@ public sealed class ClaudeProcess : IClaudeProcess
             ResultSubtype = streamResult.ResultSubtype,
             TerminalReason = streamResult.TerminalReason,
             Errors = streamResult.Errors,
+            PermissionDenials = streamResult.PermissionDenials,
         };
     }
 }

src/ClaudeDo.Worker/Runner/EffectiveRunConfigResolver.cs

@@ -47,7 +47,7 @@ public static class EffectiveRunConfigResolver
             maxTurns, maxTurnsSource, requestedMaxTurns, maxTurns < requestedMaxTurns,
             preset.Effort,
             agentPath, agentPathSource,
-            global.DefaultPermissionMode,
+            PermissionModeResolver.Resolve(model, global.DefaultPermissionMode),
             systemPromptSources.Count > 0, systemPromptSources);
     }
 }

src/ClaudeDo.Worker/Runner/PermissionModeResolver.cs

@@ -0,0 +1,28 @@
+using ClaudeDo.Data.Models;
+
+namespace ClaudeDo.Worker.Runner;
+
+/// <summary>Single source of truth for the permission mode actually started, shared by
+/// <see cref="ClaudeArgsBuilder"/>'s real dispatch and <see cref="EffectiveRunConfigResolver"/>'s
+/// read-only report — so the two can never drift apart.</summary>
+public static class PermissionModeResolver
+{
+    public static string Resolve(string? model, string? requestedPermissionMode)
+    {
+        var mode = string.IsNullOrWhiteSpace(requestedPermissionMode)
+            || requestedPermissionMode.Equals("bypassPermissions", StringComparison.OrdinalIgnoreCase)
+            ? "auto"
+            : requestedPermissionMode;
+
+        // claude-cli 2.1.220 silently downgrades "--permission-mode auto" to the interactive
+        // "default" mode when --model resolves to a haiku model (confirmed by capturing the
+        // stream-json `init` event for both models side by side; acceptEdits/bypassPermissions
+        // pass through unaffected). An unattended run then blocks forever on an edit confirmation
+        // that never arrives, so substitute the closest unattended-safe mode instead.
+        if (string.Equals(mode, "auto", StringComparison.OrdinalIgnoreCase)
+            && ModelRegistry.TryNormalizeAlias(model) == "haiku")
+            return "acceptEdits";
+
+        return mode;
+    }
+}

src/ClaudeDo.Worker/Runner/RunResult.cs

@@ -14,6 +14,7 @@ public sealed record RunResult
     public string? ResultSubtype { get; init; }
     public string? TerminalReason { get; init; }
     public IReadOnlyList<string> Errors { get; init; } = Array.Empty<string>();
+    public IReadOnlyList<string> PermissionDenials { get; init; } = Array.Empty<string>();
 
     public bool IsSuccess => ExitCode == 0 && ResultMarkdown is not null;
 }

src/ClaudeDo.Worker/Runner/StreamAnalyzer.cs

@@ -16,6 +16,7 @@ public sealed class StreamResult
     public string? ResultSubtype { get; set; }
     public string? TerminalReason { get; set; }
     public IReadOnlyList<string> Errors { get; set; } = Array.Empty<string>();
+    public IReadOnlyList<string> PermissionDenials { get; set; } = Array.Empty<string>();
 }
 
 public sealed class StreamAnalyzer
@@ -31,6 +32,7 @@ public sealed class StreamAnalyzer
     private string? _resultSubtype;
     private string? _terminalReason;
     private readonly List<string> _errors = new();
+    private readonly List<string> _permissionDenials = new();
     private const string BlockedPrefix = "CLAUDEDO_BLOCKED:";
 
     public void ProcessLine(string ndjsonLine)
@@ -65,6 +67,17 @@ public sealed class StreamAnalyzer
                                 && !string.IsNullOrEmpty(errorText))
                                 _errors.Add(errorText);
                     }
+                    // A CLI-level permission-mode failure (e.g. haiku silently downgrading
+                    // "auto" to the interactive "default") still reports is_error:false — the
+                    // denials only show up here, on the result event.
+                    if (root.TryGetProperty("permission_denials", out var denialsProp)
+                        && denialsProp.ValueKind == JsonValueKind.Array)
+                    {
+                        foreach (var denial in denialsProp.EnumerateArray())
+                            if (denial.TryGetProperty("tool_name", out var toolNameProp)
+                                && toolNameProp.GetString() is { } toolName && !string.IsNullOrEmpty(toolName))
+                                _permissionDenials.Add(toolName);
+                    }
                     // Authoritative token totals live on the result event.
                     if (root.TryGetProperty("usage", out var resultUsage))
                     {
@@ -107,6 +120,7 @@ public sealed class StreamAnalyzer
         ResultSubtype = _resultSubtype,
         TerminalReason = _terminalReason,
         Errors = _errors,
+        PermissionDenials = _permissionDenials,
     };
 
     private string? FallbackResult()

src/ClaudeDo.Worker/Runner/TaskRunner.cs

@@ -457,9 +457,10 @@ public sealed class TaskRunner
 
     private async Task HandleSuccess(TaskEntity task, ListEntity list, string slot, WorktreeContext? wtCtx, RunResult result, CancellationToken ct)
     {
+        var committed = false;
         if (wtCtx is not null)
         {
-            var committed = await _wtManager.CommitIfChangedAsync(wtCtx, task, list, ct);
+            committed = await _wtManager.CommitIfChangedAsync(wtCtx, task, list, ct);
             if (committed)
             {
                 await _broadcaster.WorkerLog($"Committed changes in \"{task.Title}\"", WorkerLogLevel.Info, DateTime.UtcNow);
@@ -467,6 +468,22 @@ public sealed class TaskRunner
             }
         }
 
+        // A run can report success (exit 0, non-null result text) while every write it
+        // attempted was denied by the permission gate — e.g. the claude-cli haiku/"auto"
+        // downgrade to interactive "default" (see PermissionModeResolver). Left alone this
+        // lands as a normal WaitingForReview with an empty diff, and a reviewer sees only
+        // that emptiness with no clue why. Surface it as a failure instead.
+        if (!committed && result.PermissionDenials.Count > 0)
+        {
+            var tools = string.Join(", ", result.PermissionDenials.Distinct());
+            await MarkFailed(
+                task.Id, task.Title, slot,
+                $"All edits were blocked by permission denials ({tools}) and nothing was changed. " +
+                "Check the run's permission mode (get_effective_run_config).",
+                result.TurnCount);
+            return;
+        }
+
         // Terminal DB write uses CancellationToken.None so the task status
         // is never left as 'running' because of a cancel that arrived
         // after the Claude run already succeeded.