feat(server): add Claude Code auto mode

[yuruiz]

Summary

• Exposes Anthropic's classifier-driven auto permission tier as a selectable Claude mode (CLI v2.1.83+, SDK v0.2.91+).
• Refuses auto upfront when the agent env routes through Bedrock or Vertex, since auto mode is Anthropic-API-only.
• Renames the internal TurnState literal \"autonomous\" -> \"background\" so logs and types don't collide with Anthropic's new auto permission tier (paseo's wake-up turn vocabulary is unrelated to permission tiers).

Closes #747 (Phase 1 MVP + Phase 2 full UX). Phase 3 (autoMode.allow / soft_deny editing, PreToolUse "defer", PermissionDenied hook plumbing) intentionally deferred.

Changes

File	Change
packages/server/package.json	Bump @anthropic-ai/claude-agent-sdk to ^0.2.91, pin @modelcontextprotocol/sdk to 1.27.1, widen zod range to ^3.23.8 || ^4.0.0
packages/app/package.json, packages/desktop/package.json	Widen zod range to match server
packages/server/src/server/agent/provider-manifest.ts	Add auto entry to CLAUDE_MODES between acceptEdits and plan
packages/server/src/server/agent/providers/claude-agent.ts	Add auto to DEFAULT_MODES; eligibility check rejects auto when CLAUDE_CODE_USE_BEDROCK / CLAUDE_CODE_USE_VERTEX is set in launch env or process env; rename TurnState literal \"autonomous\" -> \"background\"; drop a now-redundant @ts-expect-error
packages/server/src/server/agent/providers/claude-agent.redesign.test.ts, packages/server/src/server/agent/create-agent-mode.test.ts	Sync test fixtures with new mode + renamed literal

Why pin @modelcontextprotocol/sdk to 1.27.1?

@modelcontextprotocol/sdk@1.29.0 has a TypeScript regression with zod 4 schemas: mcp-server.ts calls fail to typecheck (ZodNumber not assignable to AnySchema, Type instantiation is excessively deep and possibly infinite) on tsgo. Pre-existing baseline (1.27.1, claude-agent-sdk 0.2.71) typechecks clean. Pinning is the minimum-risk path to ship auto mode without dragging in the regression. Worth filing upstream — happy to do that as a follow-up if useful.

Why widen the zod range instead of bumping to ^4?

The resolved node_modules/zod was already 4.3.6 before this PR (transitively required by ai, openai, @agentclientprotocol/sdk, etc.). claude-agent-sdk@0.2.91+ has peerDependencies.zod: ^4.0.0, which conflicted with the declared ^3.23.8. Widening the range to ^3.23.8 \|\| ^4.0.0 matches the runtime reality without forcing every workspace through a zod 4 migration.

Eligibility-check semantics

setMode(\"auto\") calls detectIneligibleAutoModeTransport(this.launchEnv):

• launchEnv (per-agent overlay) takes precedence over process.env, so an explicit \"0\" disables the inherited setting.
• Truthy values (\"1\", \"true\", etc.) trigger the refusal.
• The error surfaces through the existing set_agent_mode_response channel as accepted: false + error: \"...\", which mobile/CLI already render.

This intentionally does not gate on plan tier or model — those are SDK-side checks. The Bedrock/Vertex case is a hard incompatibility that paseo can detect locally without extra infrastructure.

Test plan

• npm run typecheck (passes — pre-commit hook)
• npm run lint (passes)
• npm run format:check (passes)
• Manual: run a Claude agent on a Max-plan account, switch to auto mode, verify classifier-driven approvals work
• Manual: set CLAUDE_CODE_USE_BEDROCK=1 in agent env, attempt to switch to auto, verify the friendly refusal message
• Manual: verify mode picker in mobile + desktop UI renders the new auto option correctly (it's data-driven via availableModes, no app code changes were needed)

Out of scope (Phase 3 — separate follow-ups)

• autoMode.allow / autoMode.soft_deny per-agent configuration UI
• PreToolUse \"defer\" decision support in paseo's permission policy layer
• PermissionDenied hook plumbing as a first-class WebSocket event
• autoMode.environment auto-population based on agent context (worktree, scheduled run, voice session, etc.)