Stop asking the operator to approve manage_tasks

manage_tasks's handler has no side effect of its own — it parses its
arguments and returns a fixed string. The task list it appears to control
is actually mutated earlier, by the director's decide() loop at the
tool_call event, before this tool ever executes. By the time an approval
prompt for it would reach the operator, there is nothing left for a denial
to undo, the same reasoning that already exempts read-only tools like lsp
from approval.

Author: TheGreatAxios

src/permission/classify.ts

@@ -14,10 +14,16 @@ import type { RootsProvider } from "./worktree-roots.js";
 // Read-only tools never need approval as long as they don't touch a restricted
 // path; they cannot change the workspace. `lsp` is included here even though
 // it is activated dynamically mid-session (see director.ts onActivateTools) —
-// hover/definition/reference lookups are as inert as a grep. Every other posix
-// tool is consequential and defaults to the "ask" tier. Catastrophic commands
-// are denied earlier by the authorization plugin, so they never reach here.
-const READ_ONLY_TOOLS = new Set(["read_file", "search_files", "grep", "list_dir", "lsp"]);
+// hover/definition/reference lookups are as inert as a grep. `manage_tasks` is
+// included for a related but distinct reason: its handler (src/agent/tools.ts)
+// has no side effect of its own — the task list is mutated earlier, by the
+// director's decide() loop at the tool_call event, before this tool ever
+// executes (see applyManageTasksToolCall in src/agent/director.ts). By the
+// time an operator would see an approval prompt for it, there is nothing left
+// for a denial to prevent. Every other posix tool is consequential and
+// defaults to the "ask" tier. Catastrophic commands are denied earlier by the
+// authorization plugin, so they never reach here.
+const READ_ONLY_TOOLS = new Set(["read_file", "search_files", "grep", "list_dir", "lsp", "manage_tasks"]);
 
 // Tools that take a single path-like argument the gate should check against
 // restriction (outside the workspace boundary, or writes under the session state root).

src/permission/gate.ts

@@ -175,7 +175,6 @@ const AUTO_ALLOWED_TOOLS = new Set([
   "write_file",
   "edit_file",
   "delete_file",
-  "manage_tasks",
   "manage_goal",
   "present",
   "tool_search",

src/permission/permission.test.ts

@@ -985,13 +985,30 @@ describe("createPermissionGate", () => {
     const editVerdict = await gate.evaluate({ id: "c", name: "edit_file", arguments: { path: "src/a.ts" } });
     expect(editVerdict.allowed).toBe(true);
     // Benign built-ins a hands-off run should not stop for.
-    for (const name of ["manage_tasks", "present", "tool_search", "use_skill", "search_agents", "task"]) {
+    for (const name of ["present", "tool_search", "use_skill", "search_agents", "task"]) {
       const verdict = await gate.evaluate({ id: "c", name, arguments: {} });
       expect(verdict.allowed).toBe(true);
     }
     expect(asked).toBe(0);
   });
 
+  // manage_tasks's handler has no side effect — the task list is mutated
+  // earlier by the director, before this tool ever executes — so denying it
+  // cannot undo anything. It auto-allows unconditionally, not just in auto
+  // mode, unlike the tools above.
+  test("manage_tasks auto-allows outside auto mode too", async () => {
+    let asked = 0;
+    const gate = createPermissionGate({
+      approvals: [],
+      requestApproval: async () => { asked++; return { allow: false }; },
+      interactive: true,
+      skipPermissions: false,
+    });
+    const verdict = await gate.evaluate({ id: "c", name: "manage_tasks", arguments: {} });
+    expect(verdict.allowed).toBe(true);
+    expect(asked).toBe(0);
+  });
+
   test("auto mode routes MCP tools to the operator prompt rather than blanket-allow", async () => {
     let asked = 0;
     const gate = createPermissionGate({