fix(engine): grant Read tool and acceptEdits permission mode to Claude (#895)

The Claude spawn only granted Bash, Write, and Edit via --allowed-tools
and never passed --permission-mode, so Claude defaulted to interactive
permission mode. Detection artifacts live under
/tmp/gh-aw/threat-detection/, outside Claude's working directory, so
Read requests there were denied with no user available to grant
consent. Sonnet-class models silently recover via `Bash cat`, masking
the bug, but Haiku (the default `detection` model alias) exhausts its
retries and never records a verdict.

Add --permission-mode acceptEdits and grant Read, Read(/tmp/*), and
Read(/tmp/gh-aw/*) alongside the existing tools, matching gh-aw's own
Claude engine invocation.

Co-authored-by: GitHub Ace <githubnext@users.noreply.github.com>
Co-authored-by: David Slater <12449447+davidslater@users.noreply.github.com>

Author: davidslater

pkg/engine/engine.go

@@ -331,13 +331,28 @@ func copilotHarnessAwfConfigEnvAt(harnessDefaultPath string) []string {
 // or a --reason argument — the exact shell-expansion surface the file transport
 // exists to remove — so the tool grant and the prompt must stay in step.
 //
-// This grants no capability beyond Bash, which can already write files.
-var resultToolClaudeTools = []string{"Bash", "Write", "Edit"}
+// Read, Read(/tmp/*), and Read(/tmp/gh-aw/*) let the model load the artifact
+// files the prompt tells it to analyze (workflow prompt file, agent output,
+// patch/bundle, comment memory) directly, without falling back to `Bash cat`.
+// Those artifacts live under /tmp/gh-aw/threat-detection/, outside the
+// process's working directory, so plain "Read" alone is not always sufficient
+// under Claude's workingDir sandbox; the path-scoped grants cover that case.
+//
+// This grants no capability beyond Bash, which can already read and write files.
+var resultToolClaudeTools = []string{"Bash", "Write", "Edit", "Read", "Read(/tmp/*)", "Read(/tmp/gh-aw/*)"}
+
+// claudePermissionMode is passed via --permission-mode when the result-tool
+// grant is active. Claude Code defaults to interactive permission prompting,
+// which has no user to respond in a CI run and denies tool use (including
+// Read outside the working directory) after a few attempts. acceptEdits
+// makes --allowed-tools the effective boundary instead, matching gh-aw's own
+// Claude engine invocation (pkg/workflow/claude_engine.go).
+const claudePermissionMode = "acceptEdits"
 
 func claudeArgs(model string, allowResultTool bool) []string {
 	args := []string{"--print", "--verbose", "--output-format", "stream-json"}
 	if allowResultTool {
-		args = append(args, "--allowed-tools", strings.Join(resultToolClaudeTools, ","))
+		args = append(args, "--permission-mode", claudePermissionMode, "--allowed-tools", strings.Join(resultToolClaudeTools, ","))
 	}
 	if model != "" {
 		args = append(args, "--model", model)
@@ -352,7 +367,7 @@ func claudeArgs(model string, allowResultTool bool) []string {
 func claudeHarnessArgs(promptPath, model string, allowResultTool bool) []string {
 	args := []string{"--print", "--verbose", "--output-format", "stream-json"}
 	if allowResultTool {
-		args = append(args, "--allowed-tools", strings.Join(resultToolClaudeTools, ","))
+		args = append(args, "--permission-mode", claudePermissionMode, "--allowed-tools", strings.Join(resultToolClaudeTools, ","))
 	}
 	if model != "" {
 		args = append(args, "--model", model)

pkg/engine/engine_test.go

@@ -248,15 +248,15 @@ func TestEngineCommandArgs(t *testing.T) {
 
 	t.Run("claude with result-tool grant", func(t *testing.T) {
 		got := claudeArgs("claude-sonnet-4.6", true)
-		want := []string{"--print", "--verbose", "--output-format", "stream-json", "--allowed-tools", "Bash,Write,Edit", "--model", "claude-sonnet-4.6", "-"}
+		want := []string{"--print", "--verbose", "--output-format", "stream-json", "--permission-mode", "acceptEdits", "--allowed-tools", "Bash,Write,Edit,Read,Read(/tmp/*),Read(/tmp/gh-aw/*)", "--model", "claude-sonnet-4.6", "-"}
 		if !reflect.DeepEqual(got, want) {
 			t.Fatalf("claudeArgs() = %#v, want %#v", got, want)
 		}
 	})
 
 	t.Run("claude harness args", func(t *testing.T) {
 		got := claudeHarnessArgs("/tmp/prompt.txt", "claude-sonnet-4.6", true)
-		want := []string{"--print", "--verbose", "--output-format", "stream-json", "--allowed-tools", "Bash,Write,Edit", "--model", "claude-sonnet-4.6", "--prompt-file", "/tmp/prompt.txt"}
+		want := []string{"--print", "--verbose", "--output-format", "stream-json", "--permission-mode", "acceptEdits", "--allowed-tools", "Bash,Write,Edit,Read,Read(/tmp/*),Read(/tmp/gh-aw/*)", "--model", "claude-sonnet-4.6", "--prompt-file", "/tmp/prompt.txt"}
 		if !reflect.DeepEqual(got, want) {
 			t.Fatalf("claudeHarnessArgs() = %#v, want %#v", got, want)
 		}
@@ -279,7 +279,8 @@ func TestEngineCommandArgs(t *testing.T) {
 		wantArgs := []string{
 			harnessPath, "claude",
 			"--print", "--verbose", "--output-format", "stream-json",
-			"--allowed-tools", "Bash,Write,Edit",
+			"--permission-mode", "acceptEdits",
+			"--allowed-tools", "Bash,Write,Edit,Read,Read(/tmp/*),Read(/tmp/gh-aw/*)",
 			"--model", "claude-sonnet-4.6",
 			"--prompt-file", "/tmp/prompt.txt",
 		}