#18193: fix: default elevatedDefault to 'off' instead of 'on' (#18177)

## Summary Fixes #18177. When `tools.elevated.enabled` is `true` and `elevatedDefault` is not explicitly configured, the fallback value in `resolveReplyDirectives` was `"on"` instead of `"off"`. This caused **all** `exec` tool calls to be routed through the elevated approval gate, resulting in 120-second timeouts for cron jobs and non-interactive agent sessions. ## Root Cause In `src/auto-reply/reply/get-reply-directives.ts`, the nullish coalescing chain for `resolvedElevatedLevel` ended with `"on"`: ```ts const resolvedElevatedLevel = elevatedAllowed ? (directives.elevatedLevel ?? sessionEntry?.elevatedLevel ?? agentCfg?.elevatedDefault ?? "on") // <-- BUG : "off"; ``` ## Fix Change the fallback from `"on"` to `"off"`. Elevated mode should be opt-in per session (e.g. via `/elevated on` or `agents.defaults.elevatedDefault: "on"`), not automatically enabled. ## Before ``` ❌ BUG CONFIRMED: elevatedDefault fallback = "on" (should be "off") ``` ## After ``` ✅ PASS: elevatedDefault fallback = "off" (correct) ``` ## Changes - `src/auto-reply/reply/get-reply-directives.ts`: change fallback from `"on"` to `"off"` (1 line) - `src/auto-reply/reply/elevated-default.test.ts`: regression test - `CHANGELOG.md`: entry added <!-- greptile_comment --> <h3>Greptile Summary</h3> Changed the fallback value for `elevatedDefault` from `"on"` to `"off"` in `get-reply-directives.ts:356`. When `tools.elevated.enabled` is `true` but no explicit `elevatedDefault` is configured, exec commands will no longer be automatically routed through the elevated approval gate, fixing 120-second timeouts in cron jobs and non-interactive agent sessions. **Changes:** - Fixed fallback value in nullish coalescing chain from `"on"` → `"off"` (1 line change in `get-reply-directives.ts:356`) - Added comprehensive regression test with 3 test cases covering the fix and related elevated permissions logic - Updated `CHANGELOG.md` with clear user-facing description of the fix **Analysis:** - The fix aligns with the documented design: elevated mode should be opt-in per session (via `/elevated on` or explicit `elevatedDefault: "on"` config), not automatically enabled - Follows the same pattern as `resolvedReasoningLevel` (line 348-351) which also defaults to `"off"` - Test directly exercises the real `resolveReplyDirectives` function with mocked downstream dependencies, ensuring the fix works end-to-end <h3>Confidence Score: 5/5</h3> - This PR is safe to merge with minimal risk - Single-line fix addresses a critical timeout issue with clear root cause. The change is well-isolated, follows existing patterns in the codebase (e.g., `resolvedReasoningLevel` also defaults to "off"), and includes comprehensive regression tests that verify the fix. The behavior change is intentional and aligns with the documented design that elevated mode should be opt-in. - No files require special attention _{Last reviewed commit: b9eb0fd} <!-- greptile_other_comments_section --> <!-- /greptile_comment -->