feat(fx): offer Full access where the installed fx supports it

apps/server/src/orchestration-v2/Adapters/FxAdapterV2.test.ts

@@ -53,7 +53,7 @@ const NAMED_MODEL = "anthropic/claude-sonnet-5.5";
 const CUSTOM_MODEL = "openai/gpt-6.1-sol";
 const CODEX_MODEL = "gpt-6.1-sol";
 const FX_0_0_13_MODES = ["code", "ask"];
-/** fx `main` after vercel-labs/fx#1189. */
+/** fx 0.0.14+, after vercel-labs/fx#1189. */
 const FX_MAIN_MODES = ["auto", "ask", "full-access"];
 
 type Frame = Record<string, unknown>;
@@ -112,11 +112,15 @@ const fxConfig = (input: {
 const fxSession = (input: {
   readonly model: string;
   readonly modes: ReadonlyArray<string>;
+  readonly mode?: string;
   readonly models?: ReadonlyArray<string>;
 }) => ({
   sessionId: SESSION_ID,
   configOptions: fxConfig(input),
-  modes: { currentModeId: "ask", availableModes: input.modes.map((id) => ({ id, name: id })) },
+  modes: {
+    currentModeId: input.mode ?? "ask",
+    availableModes: input.modes.map((id) => ({ id, name: id })),
+  },
 });
 
 const initialize: ReadonlyArray<Frame> = [
@@ -265,16 +269,22 @@ const openFxSession = Effect.fn("openFxSession")(function* (input: {
 });
 
 describe("FxAdapterV2", () => {
-  it.effect("runs Auto as fx's `code` mode on 0.0.13 and as `auto` where fx advertises it", () =>
+  it.effect("runs Auto as `code` on 0.0.13, and Auto and Full access as fx names them later", () =>
     Effect.forEach(
       [
-        { scenario: "auto-0-0-13", modes: FX_0_0_13_MODES, written: "code" },
-        { scenario: "auto-main", modes: FX_MAIN_MODES, written: "auto" },
-      ],
-      ({ scenario, modes, written }) =>
+        { scenario: "auto-0-0-13", runtimeMode: "auto", modes: FX_0_0_13_MODES, written: "code" },
+        { scenario: "auto-main", runtimeMode: "auto", modes: FX_MAIN_MODES, written: "auto" },
+        {
+          scenario: "full-access-main",
+          runtimeMode: "full-access",
+          modes: FX_MAIN_MODES,
+          written: "full-access",
+        },
+      ] as const,
+      ({ scenario, runtimeMode, modes, written }) =>
         openFxSession({
           scenario,
-          runtimeMode: "auto",
+          runtimeMode,
           frames: [
             ...initialize,
             outbound("session/new", { cwd: "<workspace>", mcpServers: "<any>" }),
@@ -290,6 +300,47 @@ describe("FxAdapterV2", () => {
     ).pipe(Effect.provide(testLayer), Effect.scoped),
   );
 
+  // A permission mode change restarts fx and loads the same session, which
+  // still reports the mode it last ran in.
+  it.effect("loads the same session into and out of Full access", () =>
+    Effect.forEach(
+      [
+        {
+          scenario: "into-full-access",
+          runtimeMode: "full-access",
+          from: "ask",
+          to: "full-access",
+        },
+        {
+          scenario: "out-of-full-access",
+          runtimeMode: "approval-required",
+          from: "full-access",
+          to: "ask",
+        },
+      ] as const,
+      ({ scenario, runtimeMode, from, to }) =>
+        openFxSession({
+          scenario,
+          runtimeMode,
+          loadSessionId: SESSION_ID,
+          frames: [
+            ...initialize,
+            outbound("session/load"),
+            answer(
+              "session/load",
+              fxSession({ model: FX_DEFAULT_MODEL, modes: FX_MAIN_MODES, mode: from }),
+            ),
+            ...setConfig(
+              "mode",
+              to,
+              fxConfig({ model: FX_DEFAULT_MODEL, modes: FX_MAIN_MODES, mode: to }),
+            ),
+          ],
+        }),
+      { discard: true },
+    ).pipe(Effect.provide(testLayer), Effect.scoped),
+  );
+
   it.effect("puts a loaded session that ran a named model back on fx's default for Default", () =>
     openFxSession({
       scenario: "default-model",

apps/server/src/orchestration-v2/RuntimePolicy.ts

@@ -88,7 +88,7 @@ export const layer: Layer.Layer<RuntimePolicyV2> = Layer.succeed(RuntimePolicyV2
   }),
 });
 
-function providerRuntimeMode(
+export function providerRuntimeMode(
   runtimeMode: RuntimeMode,
   supportedRuntimeModes: ReadonlyArray<RuntimeMode> | undefined,
 ): RuntimeMode {

apps/server/src/orchestration-v2/testkit/FxReplayFixtures.integration.test.ts

@@ -1,10 +1,27 @@
 import { describe } from "@effect/vitest";
+import { FX_SUPPORTED_RUNTIME_MODES } from "@t3tools/provider-fx/testing";
 
 import { FxOrchestratorReplayHarness } from "../Adapters/FxAdapterV2.testkit.ts";
+import { providerRuntimeMode } from "../RuntimePolicy.ts";
 import { itRunsReplayFixtures, runReplayFixture } from "./ProviderReplayFixtures.ts";
 
 describe("fx replay fixtures", () => {
+  // Recorded where fx's snapshot offers no Full access (0.0.13), so a thread
+  // set to it runs as RuntimePolicy resolves it there: Supervised.
   itRunsReplayFixtures("fx", (input) =>
-    runReplayFixture({ ...input, harness: FxOrchestratorReplayHarness }),
+    runReplayFixture({
+      ...input,
+      buildInput: () => {
+        const fixtureInput = input.buildInput();
+        return {
+          ...fixtureInput,
+          runtimeMode: providerRuntimeMode(
+            fixtureInput.runtimeMode ?? "full-access",
+            FX_SUPPORTED_RUNTIME_MODES,
+          ),
+        };
+      },
+      harness: FxOrchestratorReplayHarness,
+    }),
   );
 });

docs/user/permission-modes.md

@@ -34,8 +34,8 @@ to you for approval. On fx, prompts it still sends also come to you.
 Muse Code offers only **Supervised** and **Full access**. A Muse thread already set to another mode
 runs in **Supervised**.
 
-T3 Code offers no **Auto-accept edits** or **Full access** for fx. An fx thread already set to either runs in
-**Supervised**.
+T3 Code offers no **Auto-accept edits** for fx, and **Full access** only with fx 0.0.14 or later. An fx
+thread set to a mode its fx lacks runs in **Supervised**.
 
 Grok offers no **Auto-accept edits**. A Grok thread already set to it runs in **Supervised**. Grok
 file-change approvals offer **Allow all edits this session**. Its command approvals have no

docs/user/providers-fx.md

@@ -29,14 +29,15 @@ Type `$` in the composer to list the skills fx finds in its skill folders, in th
 
 ## Permission modes
 
-fx offers two composer modes.
+| Mode            | Behavior                                                                            |
+| --------------- | ----------------------------------------------------------------------------------- |
+| **Supervised**  | fx asks before it changes files or runs commands. Read requests run without asking. |
+| **Auto**        | fx handles routine actions itself. Anything it still asks about reaches you.        |
+| **Full access** | fx runs every action without asking. Needs fx 0.0.14 or later.                      |
 
-| Mode           | Behavior                                                                            |
-| -------------- | ----------------------------------------------------------------------------------- |
-| **Supervised** | fx asks before it changes files or runs commands. Read requests run without asking. |
-| **Auto**       | fx handles routine actions itself. Anything it still asks about reaches you.        |
+T3 Code offers **Full access** only when the server's fx reports it. After you upgrade fx, refresh the provider in **Settings → Providers** to see it. On an older fx, or before the provider check finishes, a thread set to **Full access** runs in **Supervised**.
 
-T3 Code does not offer **Full access** or **Auto-accept edits** for fx. A thread already set to one of those runs in **Supervised**. Changing the permission mode restarts the connection and reloads the same fx session.
+T3 Code does not offer **Auto-accept edits** for fx. A thread already set to it runs in **Supervised**. Changing the permission mode restarts the connection and reloads the same fx session.
 
 On fx versions after [vercel-labs/fx#1189](https://github.com/vercel-labs/fx/pull/1189), fx saves the mode T3 Code sets as its default permission mode. T3 Code sets it each time it opens an fx thread, so fx in the terminal then starts in that thread's mode.
 
@@ -50,7 +51,6 @@ fx doesn't pass on a sub-agent's permission requests, so a sub-agent that needs
 
 ## Not supported yet
 
-- **Full access**.
 - **Auto-accept edits**.
 - Commit messages, pull request text, branch names, and thread titles. Pick another provider for those.
 

packages/provider-fx/src/server/acpSupport.test.ts

@@ -3,7 +3,7 @@ import type * as EffectAcpSchema from "effect-acp/compat";
 
 import { ProviderAdapterV2RuntimePolicy } from "@t3tools/provider-core/server/ProviderAdapter";
 
-import { fxPermissionDisposition } from "./acpSupport.ts";
+import { fxPermissionDisposition, fxSessionModeForPolicy } from "./acpSupport.ts";
 
 const editRequest = {
   sessionId: "fx-session-01",
@@ -30,4 +30,33 @@ describe("fx permission prompts", () => {
       "ask",
     );
   });
+
+  it("answers Full access prompts itself unless an explicit policy confines them", () => {
+    const fullAccess = {
+      runtimeMode: "full-access",
+      interactionMode: "default",
+      cwd: "/work",
+    } as const;
+    assert.equal(
+      fxPermissionDisposition(ProviderAdapterV2RuntimePolicy.make(fullAccess), editRequest),
+      "allow",
+    );
+    // Runs fx's `ask`, so the policy decides what fx asks about.
+    assert.equal(
+      fxPermissionDisposition(
+        ProviderAdapterV2RuntimePolicy.make({ ...fullAccess, approvalPolicy: "on-request" }),
+        editRequest,
+      ),
+      "ask",
+    );
+    for (const confined of [
+      { approvalPolicy: "on-request" },
+      { sandboxPolicy: { type: "readOnly" } },
+    ] as const) {
+      assert.equal(
+        fxSessionModeForPolicy(ProviderAdapterV2RuntimePolicy.make({ ...fullAccess, ...confined })),
+        "ask",
+      );
+    }
+  });
 });

packages/provider-fx/src/server/acpSupport.ts

@@ -50,36 +50,51 @@ export const FX_EFFORT_OPTION_DESCRIPTOR: ProviderOptionDescriptor = {
   })),
 };
 
+/** Every fx offers these; the provider snapshot adds Full access where `fx status` lists `full-access`. */
 export const FX_SUPPORTED_RUNTIME_MODES = [
   "approval-required",
   "auto",
 ] as const satisfies ReadonlyArray<RuntimeMode>;
+/** fx 0.0.14+; fx 0.0.13 has no such mode. */
+export const FX_FULL_ACCESS_MODE_ID = "full-access";
 /** fx 0.0.13 answers a cancelled prompt with `stopReason: cancelled`. */
 export const FX_ACP_CANCEL_BEHAVIOR = "wait-for-prompt" as const;
 
 /**
- * Supervised runs fx's `ask` mode and Auto its automatic review. An explicit
- * approval or sandbox policy must not launch automatic review, which would
- * perform writes the policy meant to confine.
+ * Supervised runs fx's `ask` mode, Auto its automatic review and Full access
+ * its `full-access`. An explicit approval or sandbox policy runs `ask`, so it
+ * never launches a mode that performs writes the policy meant to confine.
  */
 export function fxSessionModeForPolicy(
   policy: ProviderAdapter.ProviderAdapterV2RuntimePolicy,
-): "ask" | "auto" {
-  return policy.runtimeMode === "auto" &&
-    policy.approvalPolicy === undefined &&
-    policy.sandboxPolicy === undefined
-    ? "auto"
-    : "ask";
+): "ask" | "auto" | typeof FX_FULL_ACCESS_MODE_ID {
+  if (policy.approvalPolicy !== undefined || policy.sandboxPolicy !== undefined) return "ask";
+  switch (policy.runtimeMode) {
+    case "auto":
+      return "auto";
+    case "full-access":
+      return FX_FULL_ACCESS_MODE_ID;
+    default:
+      return "ask";
+  }
 }
 
-/** In automatic review fx asks only about what it refused itself, so every prompt reaches the user. */
+/**
+ * In automatic review fx asks only about what it refused itself, so every
+ * prompt reaches the user. Full access answers by the shared ACP policy.
+ */
 export function fxPermissionDisposition(
   policy: ProviderAdapter.ProviderAdapterV2RuntimePolicy,
   request: EffectAcpSchema.RequestPermissionRequest,
 ): AcpPermissionDisposition {
-  return fxSessionModeForPolicy(policy) === "auto"
-    ? "ask"
-    : acpPermissionDisposition({ ...policy, runtimeMode: "approval-required" }, request);
+  switch (fxSessionModeForPolicy(policy)) {
+    case "auto":
+      return "ask";
+    case FX_FULL_ACCESS_MODE_ID:
+      return acpPermissionDisposition(policy, request);
+    case "ask":
+      return acpPermissionDisposition({ ...policy, runtimeMode: "approval-required" }, request);
+  }
 }
 
 /**
@@ -90,8 +105,8 @@ export function fxPermissionDisposition(
  */
 function fxModeId(requested: string, advertised: ReadonlyArray<string>): string | undefined {
   const candidates =
-    requested === "ask"
-      ? ["ask"]
+    requested === "ask" || requested === FX_FULL_ACCESS_MODE_ID
+      ? [requested]
       : requested === "auto" || requested === "code"
         ? ["auto", "code"]
         : [];

packages/provider-fx/src/server/status.test.ts

@@ -129,6 +129,37 @@ describe("checkFxProviderStatus", () => {
       // "Default" carries the model `fx status` reports, which the adapter selects for it.
       assert.deepEqual(signedIn.draft.models[0]?.aliases, ["anthropic/claude-opus-5.5"]);
       assert.isDefined(signedIn.draft.versionAdvisory);
+      // fx 0.0.13 lists no modes and has no full-access mode.
+      assert.deepEqual(signedIn.draft.supportedRuntimeModes, ["approval-required", "auto"]);
+
+      // fx 0.0.14 lists the ACP session modes (src/core/output/output_contracts.zig).
+      const withModes = yield* check(
+        JSON.stringify({
+          kind: "status",
+          model: "anthropic/claude-opus-5.5",
+          auth: "fx login",
+          permission_mode: "ask",
+          mode: "ask",
+          modes: [
+            {
+              id: "auto",
+              name: "Auto",
+              description: "Check actions with an automatic safety review instead of asking",
+            },
+            { id: "ask", name: "Ask", description: "Request permission before making any changes" },
+            {
+              id: "full-access",
+              name: "Full access",
+              description: "Run every action without asking, outside the sandbox",
+            },
+          ],
+        }),
+      );
+      assert.deepEqual(withModes.draft.supportedRuntimeModes, [
+        "approval-required",
+        "auto",
+        "full-access",
+      ]);
 
       const signedOut = yield* check(
         JSON.stringify({