Env-level toggle for --dangerously-skip-permissions

Gate the blunt permission-bypass flag behind a per-environment
setting so local/ssh envs don't default to "Claude can run anything."

Defaults:
  daemon envs                → bypass ON  (throwaway VM, bounded blast radius)
  local / ssh / coder envs   → bypass OFF (your own hardware)

When bypass is OFF, autonomous tasks run with `--permission-mode
acceptEdits` instead. That silences file edits but will pause on
bash prompts / unknown MCP trust — the user answers from the task
terminal's input field (already always-visible).

- schema.ts: new `autonomous_bypass_permissions` boolean column
  (default false). Migration 0005.
- POST /environments: defaults daemon=true, everything else=false;
  overridable via explicit body field.
- PATCH /environments/:id: accepts updates to the flag.
- agent.ts: picks --dangerously-skip-permissions vs --permission-mode
  acceptEdits based on env.autonomousBypassPermissions.
- SettingsPanel: checkbox on each env card with a warning blurb
  explaining what "bypass" means for non-daemon envs (confirms via
  `confirm()` dialog before enabling on a local/ssh env).
- SETUP.md: documents the one-time `claude` interactive approval
  needed on strict envs so the Supabase MCP trust prompt doesn't
  block autonomous runs. Chose not to commit `.claude/settings.json`
  — keeping the trust decision explicit per machine.

Full backend suite: 81/81 green.

Author: Gilbert09

apps/desktop/src/renderer/components/panels/SettingsPanel.tsx

@@ -29,7 +29,12 @@ import {
   Copy,
   LogOut,
 } from 'lucide-react';
-import type { BacklogSource, BacklogItem, MarkdownFileBacklogConfig } from '@fastowl/shared';
+import type {
+  BacklogSource,
+  BacklogItem,
+  Environment,
+  MarkdownFileBacklogConfig,
+} from '@fastowl/shared';
 import { api, GitHubStatus, GitHubUser, GitHubRepo, WatchedRepo } from '../../lib/api';
 import { cn } from '../../lib/utils';
 import { Button } from '../ui/button';
@@ -648,10 +653,11 @@ function IntegrationsSettings() {
 }
 
 function EnvironmentsSettings() {
-  const { environments } = useWorkspaceStore();
+  const { environments, setEnvironments } = useWorkspaceStore();
   const { deleteEnvironment, testConnection } = useEnvironmentActions();
   const [showAddModal, setShowAddModal] = useState(false);
   const [testing, setTesting] = useState<string | null>(null);
+  const [togglingBypass, setTogglingBypass] = useState<string | null>(null);
 
   const handleTest = async (envId: string) => {
     setTesting(envId);
@@ -668,6 +674,30 @@ function EnvironmentsSettings() {
     }
   };
 
+  const handleToggleBypass = async (env: Environment, next: boolean) => {
+    // Extra friction for flipping a LOCAL env into "bypass everything"
+    // mode — that's the your-whole-machine-is-at-stake branch.
+    if (next && env.type !== 'daemon') {
+      const ok = confirm(
+        `Allow unattended Claude runs on "${env.name}" to bypass all permission prompts?\n\n` +
+        `This environment is type "${env.type}" — autonomous tasks will be able to run any shell command, ` +
+        `edit any file, and call any MCP tool WITHOUT asking you first. Use only if you trust the tasks ` +
+        `that will run here (e.g., your own backlog against your own repo).\n\n` +
+        `Recommended: keep this OFF for local / ssh envs; only enable for disposable daemon VMs.`
+      );
+      if (!ok) return;
+    }
+    setTogglingBypass(env.id);
+    try {
+      const updated = await api.environments.update(env.id, {
+        autonomousBypassPermissions: next,
+      } as unknown as Partial<Environment>);
+      setEnvironments(environments.map((e) => (e.id === env.id ? updated : e)));
+    } finally {
+      setTogglingBypass(null);
+    }
+  };
+
   return (
     <div className="space-y-6">
       <div className="flex items-center justify-between">
@@ -754,6 +784,27 @@ function EnvironmentsSettings() {
                       {env.error}
                     </div>
                   )}
+                  <label className="flex items-start gap-2 mt-3 cursor-pointer">
+                    <input
+                      type="checkbox"
+                      checked={env.autonomousBypassPermissions}
+                      disabled={togglingBypass === env.id}
+                      onChange={(e) => void handleToggleBypass(env, e.target.checked)}
+                      className="mt-0.5"
+                    />
+                    <div className="flex-1">
+                      <div className="text-sm font-medium">
+                        Allow unattended Claude runs to bypass permission prompts
+                      </div>
+                      <p className="text-xs text-muted-foreground mt-0.5">
+                        {env.type === 'daemon'
+                          ? 'Recommended for throwaway daemon VMs — the blast radius is bounded to this machine.'
+                          : env.autonomousBypassPermissions
+                            ? 'Enabled on a non-daemon env: Claude can run any shell command and edit any file on this machine during autonomous tasks.'
+                            : 'Off (recommended for non-daemon envs). Autonomous tasks use acceptEdits mode; they may pause on bash / MCP trust prompts — you can answer from the task terminal input below.'}
+                      </p>
+                    </div>
+                  </label>
                 </div>
                 <div className="flex items-center gap-2">
                   <Button

docs/SETUP.md

@@ -34,6 +34,20 @@ FastOwl spawns `claude` (interactive mode) via node-pty on the chosen environmen
 
 Verify by running `claude --version` as the shell user FastOwl will use.
 
+**One-time MCP trust approval** (only if you run autonomous tasks in **strict** mode on this environment — i.e., the env's "Allow unattended Claude runs to bypass permission prompts" toggle is OFF):
+
+FastOwl's repo root ships a `.mcp.json` registering the Supabase MCP server. On first encounter, Claude Code prompts you to trust it. Autonomous runs can't answer that prompt, so do it once interactively:
+
+```bash
+cd ~/path/to/fastowl    # or wherever the clone lives on this env
+claude                  # opens the TUI
+# → prompted: "New MCP server found in .mcp.json: supabase — use this?"
+# → pick "Use this and all future MCP servers in this project"
+# → Ctrl-D to exit
+```
+
+The approval lands in your user-level Claude config and sticks. You don't need to do this on daemon envs that have "bypass permissions" enabled — they skip all prompts by design.
+
 ### 3. GitHub OAuth app (already scaffolded in backend)
 
 Used by Phase 6 integration (connect GitHub → PR monitoring, PR actions, repo listing).

packages/backend/src/db/migrations/0005_env_bypass_permissions.sql

@@ -0,0 +1 @@
+ALTER TABLE "environments" ADD COLUMN "autonomous_bypass_permissions" boolean DEFAULT false NOT NULL;