Why did crystl start asking me about things it used to approve?

Your gem’s mode is now a ceiling. A permission mode declared inside a project, such as permissionMode: bypassPermissions in a .claude/agents/*.md file, can narrow what crystl auto-approves but can no longer widen it. Before, a file in the repo could auto-approve arbitrary commands under a gem you had set to the middle mode, which meant anyone who could write that file had unattended command execution. Under in gem those declarations now grant nothing extra, so work that ran silently may raise panels. Set the gem to all if you want the repo’s declaration to hold. See the gem is the ceiling.