diff --git a/deploy/docker/docker-compose.yml b/deploy/docker/docker-compose.yml
index 202e386..bfc675e 100644
--- a/deploy/docker/docker-compose.yml
+++ b/deploy/docker/docker-compose.yml
@@ -120,6 +120,7 @@ services:
       - "13002:3002"
     volumes:
       - ${HOME}/.claude:/root/.claude
+      - ${HOME}/.claude.json:/root/.claude.json
     environment:
       - DB_HOST=postgres
       - DB_PORT=5432
diff --git a/packages/services/agent-service/src/infrastructure/engines/claude-agent-sdk/claude-agent-sdk-engine.ts b/packages/services/agent-service/src/infrastructure/engines/claude-agent-sdk/claude-agent-sdk-engine.ts
index 5326539..7f84fc7 100644
--- a/packages/services/agent-service/src/infrastructure/engines/claude-agent-sdk/claude-agent-sdk-engine.ts
+++ b/packages/services/agent-service/src/infrastructure/engines/claude-agent-sdk/claude-agent-sdk-engine.ts
@@ -107,8 +107,7 @@ export class ClaudeAgentSdkEngine implements AgentEnginePort {
           maxBudgetUsd: params.maxBudgetUsd,
           env,
           abortController,
-          allowDangerouslySkipPermissions: true,
-          permissionMode: 'bypassPermissions',
+          permissionMode: 'acceptEdits',
           stderr: (data: string) => {
             this.logger.debug(`SDK stderr (${params.sessionId}): ${data.trim()}`);
           },
@@ -275,8 +274,7 @@ export class ClaudeAgentSdkEngine implements AgentEnginePort {
           resume: sdkSessionId,
           env,
           abortController,
-          allowDangerouslySkipPermissions: true,
-          permissionMode: 'bypassPermissions',
+          permissionMode: 'acceptEdits',
           canUseTool: async (toolName, toolInput) => {
             const riskLevel = this.classifyToolRisk(toolName, toolInput);
             if (riskLevel <= CommandRiskLevel.LOW_RISK_WRITE) {