feat(coder): unified Plan/Ask/Bypass permission picker

Replace the raw per-agent mode dropdown in the BooCoder composer with a
curated three-option permission ladder mapped generically onto each
provider's native modes: `plan` id -> Plan, default -> Ask, isUnattended
-> Bypass (claude bypassPermissions, qwen yolo, opencode full-access).
modeId stays the single wire field; the active unified mode is derived
from it (no contracts change).

Native BooCode gains its own mode set: Ask stages to the pending-changes
queue (today's behavior), Bypass auto-applies the queue to disk after the
turn (interactive messages path + task dispatcher path), Plan falls back
to Ask. The shared apps/server inference engine is left untouched.

Also preserve isUnattended on live-probed ACP modes so opencode's bypass
mode stays detectable from the wire.

Coder 373 tests green; coder + web typecheck clean.

apps/coder/src/routes/messages.ts

@@ -4,6 +4,7 @@ import type { Sql } from '../db.js';
 import type { Broker } from '@boocode/server/broker';
 import type { WsFrame } from '@boocode/contracts/ws-frames';
 import { resolveChatId } from './chat-resolve.js';
+import { applyAll } from '../services/pending_changes.js';
 
 const AnswerUserInputBody = z.object({
   tool_call_id: z.string().min(1),
@@ -247,6 +248,35 @@ export function registerMessageRoutes(
 
       inference.enqueue(sessionId, chatId, assistantMsg!.id, 'default');
 
+      // Bypass permission mode (native BooCode): auto-apply staged edits to disk
+      // once the turn settles. `enqueue` registers synchronously, so hasActive is
+      // true immediately; poll until it clears, apply, then re-publish
+      // message_complete so the DiffPanel reflects the now-applied (non-pending)
+      // state. Best-effort — failures stay in the pending queue for manual apply.
+      if (mode_id === 'bypass') {
+        const projectId = sessionRows[0]!.project_id;
+        const assistantId = assistantMsg!.id;
+        void (async () => {
+          try {
+            const [proj] = await sql<{ path: string }[]>`SELECT path FROM projects WHERE id = ${projectId}`;
+            if (!proj?.path) return;
+            for (let i = 0; i < 1200 && inference.hasActive(chatId); i++) {
+              await new Promise((r) => setTimeout(r, 1000));
+            }
+            const applied = await applyAll(sql, sessionId, proj.path);
+            if (applied.length > 0) {
+              broker.publishFrame(sessionId, {
+                type: 'message_complete',
+                message_id: assistantId,
+                chat_id: chatId,
+              } as unknown as WsFrame);
+            }
+          } catch {
+            /* best-effort auto-apply — leave staged changes for manual apply */
+          }
+        })();
+      }
+
       reply.code(202);
       return { user_message_id: userMsg!.id, assistant_message_id: assistantMsg!.id };
     },