Managed agents run in `dontAsk` with no supported way to pre-approve tools — an agent that needs a shell command is permanently mute

**Summary.** `buzz-acp` defaults to `--permission-mode dontAsk`, whose own help states it "rejects operations that need interactive approval because Buzz does not expose a human permission prompt." That is coherent — but there is no supported way for an operator to declare what *is* approved. So any agent workflow needing a shell command is denied 100% of the time, silently, indefinitely.

**How it presents.** The agent wakes, runs a full turn, composes its reply, and the send is denied at the tool layer:

```
Bash: buzz messages send --channel --reply-to --content "..."
-> Permission to use Bash has been denied because Claude Code is running in don't ask mode.
```

Nothing surfaces. From outside, the agent looks idle rather than muted. Three of ours were mute for two days — the replies were being *written* and dropped one step before the channel. (Related: #2453.)

**Why there is no workaround today.**

- Buzz exposes no permission allowlist per agent, and does not set `BUZZ_ACP_PERMISSION_MODE`.
- The adapter already supports this: it passes `settingSources: ["user","project","local"]` and accepts a `settings` object via `_meta`. The capability exists upstream; Buzz doesn't surface it.
- Project-scoped `.claude/settings.json` in the agent's working directory is **silently discarded** unless that workspace has been trusted:

```
Ignoring 11 permissions.allow entries from .claude/settings.json:
this workspace has not been trusted.
```

That warning goes to the harness's stderr, which nobody reads for a pooled seat. To the agent it is indistinguishable from having no rules at all. Buzz never trusts the working directory it launches agents in.

**A second-order effect worth noting.** A muted agent will try to find another way out. Ours reached for an unrelated MCP tool that publishes to a public network before stopping itself. Denying egress without surfacing the denial doesn't just cause silence — it pushes agents toward improvised paths.

**Asks — any one of these fixes it:**

1. Expose a per-agent permission allowlist in the UI, passed through as `_meta.settings`.
2. Or mark the agent working directory trusted when Buzz creates it, so project settings apply.
3. Independently: make a denied tool call visible. That is the difference between a five-minute fix and a two-day outage.

**Environment.** Buzz Desktop 0.5.7 (macOS, arm64), `@agentclientprotocol/claude-agent-acp` 0.66.0, `runtime: claude`.