Use safer automatic approval modes by default (#2213)

* feat(providers): default to safer automatic approvals

* fix(providers): preserve defaults on older Codex versions

* test(providers): cover Claude automatic approval default

* fix(providers): preserve Claude defaults on cloud transports

* fix(providers): resolve defaults from launch capabilities

packages/app/src/provider-selection/resolve-agent-form.test.ts

@@ -575,6 +575,25 @@ describe("resolveFormState", () => {
     expect(resolved.modeId).toBe("workspace-write");
   });
 
+  it("falls back when the provider cannot advertise its preferred default mode", () => {
+    const providerMap = makeProviderMap({
+      ...TEST_CODEX_DEFINITION,
+      defaultModeId: "auto-review",
+      modes: TEST_CODEX_DEFINITION.modes,
+    });
+
+    const resolved = resolveFormState(
+      undefined,
+      { provider: "codex" },
+      CODEX_MODELS,
+      INITIAL_USER_MODIFIED,
+      makeState({ provider: "codex" }).form,
+      providerMap,
+    );
+
+    expect(resolved.modeId).toBe("auto");
+  });
+
   it("ignores disabled ready providers when resolving selectable defaults", () => {
     const entries: ProviderSnapshotEntry[] = [
       {

packages/app/src/provider-selection/resolve-agent-form.ts

@@ -171,7 +171,12 @@ function resolvePreferredModeId(input: {
   const preferredModeId = normalizeSelectedModeId(input.preferredModeId);
   if (preferredModeId) return preferredModeId;
 
-  return input.providerDef?.defaultModeId ?? input.providerDef?.modes[0]?.id ?? "";
+  const defaultModeId = input.providerDef?.defaultModeId;
+  const modes = input.providerDef?.modes ?? [];
+  if (defaultModeId && (modes.length === 0 || modes.some((mode) => mode.id === defaultModeId))) {
+    return defaultModeId;
+  }
+  return modes[0]?.id ?? "";
 }
 
 export function mergeSelectedComposerPreferences(args: {