@agent-native/core 0.171.3 → 0.172.0

package/dist/agent/tool-approval-migrations.d.ts

@@ -35,6 +35,27 @@ export declare const AGENT_TOOL_APPROVAL_TABLE_SQL: {
 export declare const AGENT_TOOL_APPROVAL_INDEX_SQL = "CREATE INDEX IF NOT EXISTS idx_agent_tool_approvals_binding\n  ON agent_tool_approvals(owner_email, org_id, thread_id, tool_name, call_id, status)";
 export declare const AGENT_TOOL_APPROVAL_LOGICAL_INDEX_SQL = "CREATE INDEX IF NOT EXISTS idx_agent_tool_approvals_logical\n  ON agent_tool_approvals(owner_email, org_id, thread_id, turn_id, tool_name, approval_key_hash, status)";
 export declare const AGENT_TOOL_APPROVAL_RECOVERY_INDEX_SQL = "CREATE INDEX IF NOT EXISTS idx_agent_tool_approvals_recovery\n  ON agent_tool_approvals(owner_email, org_id, thread_id, approval_key_hash, status, turn_id)";
+export declare const AGENT_TOOL_APPROVAL_POLICY_TABLE_SQL: {
+    readonly postgres: `CREATE TABLE IF NOT EXISTS agent_tool_approval_policies (
+  id TEXT PRIMARY KEY,
+  owner_email TEXT NOT NULL,
+  org_id TEXT,
+  tool_name TEXT NOT NULL,
+  enabled BOOLEAN NOT NULL,
+  created_at BIGINT NOT NULL,
+  updated_at BIGINT NOT NULL
+)`;
+    readonly sqlite: `CREATE TABLE IF NOT EXISTS agent_tool_approval_policies (
+  id TEXT PRIMARY KEY,
+  owner_email TEXT NOT NULL,
+  org_id TEXT,
+  tool_name TEXT NOT NULL,
+  enabled INTEGER NOT NULL,
+  created_at INTEGER NOT NULL,
+  updated_at INTEGER NOT NULL
+)`;
+};
+export declare const AGENT_TOOL_APPROVAL_POLICY_INDEX_SQL = "CREATE INDEX IF NOT EXISTS idx_agent_tool_approval_policies_scope\n  ON agent_tool_approval_policies(owner_email, org_id, tool_name, enabled)";
 /**
  * Durable approval grants are created and consumed on request paths, but their
  * schema belongs to the release migration boundary in production.

package/dist/agent/tool-approval-migrations.js

@@ -37,6 +37,28 @@ export const AGENT_TOOL_APPROVAL_LOGICAL_INDEX_SQL = `CREATE INDEX IF NOT EXISTS
   ON agent_tool_approvals(owner_email, org_id, thread_id, turn_id, tool_name, approval_key_hash, status)`;
 export const AGENT_TOOL_APPROVAL_RECOVERY_INDEX_SQL = `CREATE INDEX IF NOT EXISTS idx_agent_tool_approvals_recovery
   ON agent_tool_approvals(owner_email, org_id, thread_id, approval_key_hash, status, turn_id)`;
+export const AGENT_TOOL_APPROVAL_POLICY_TABLE_SQL = {
+    postgres: `CREATE TABLE IF NOT EXISTS agent_tool_approval_policies (
+  id TEXT PRIMARY KEY,
+  owner_email TEXT NOT NULL,
+  org_id TEXT,
+  tool_name TEXT NOT NULL,
+  enabled BOOLEAN NOT NULL,
+  created_at BIGINT NOT NULL,
+  updated_at BIGINT NOT NULL
+)`,
+    sqlite: `CREATE TABLE IF NOT EXISTS agent_tool_approval_policies (
+  id TEXT PRIMARY KEY,
+  owner_email TEXT NOT NULL,
+  org_id TEXT,
+  tool_name TEXT NOT NULL,
+  enabled INTEGER NOT NULL,
+  created_at INTEGER NOT NULL,
+  updated_at INTEGER NOT NULL
+)`,
+};
+export const AGENT_TOOL_APPROVAL_POLICY_INDEX_SQL = `CREATE INDEX IF NOT EXISTS idx_agent_tool_approval_policies_scope
+  ON agent_tool_approval_policies(owner_email, org_id, tool_name, enabled)`;
 /**
  * Durable approval grants are created and consumed on request paths, but their
  * schema belongs to the release migration boundary in production.
@@ -68,4 +90,14 @@ ${AGENT_TOOL_APPROVAL_INDEX_SQL}`,
             sqlite: AGENT_TOOL_APPROVAL_RECOVERY_INDEX_SQL,
         },
     },
+    {
+        version: 4,
+        name: "agent-tool-approval-policies-table-and-index",
+        sql: {
+            postgres: `${AGENT_TOOL_APPROVAL_POLICY_TABLE_SQL.postgres};
+${AGENT_TOOL_APPROVAL_POLICY_INDEX_SQL}`,
+            sqlite: `${AGENT_TOOL_APPROVAL_POLICY_TABLE_SQL.sqlite};
+${AGENT_TOOL_APPROVAL_POLICY_INDEX_SQL}`,
+        },
+    },
 ];

package/dist/agent/tool-approval-store.d.ts

@@ -1,4 +1,5 @@
 export declare function ensureAgentToolApprovalTable(): Promise<void>;
+export declare function ensureAgentToolApprovalPolicyTable(): Promise<void>;
 export interface AgentToolApprovalBinding {
     ownerEmail: string;
     orgId?: string | null;
@@ -10,6 +11,16 @@ export interface AgentToolApprovalBinding {
     expiresAt?: number;
 }
 export declare function hashAgentToolApprovalKey(approvalKey: string): string;
+export interface AgentToolApprovalPolicyBinding {
+    ownerEmail: string;
+    orgId?: string | null;
+    toolName: string;
+}
+export declare function setAgentToolApprovalPolicy(input: {
+    binding: AgentToolApprovalPolicyBinding;
+    enabled: boolean;
+}): Promise<void>;
+export declare function isAgentToolAlwaysAllowed(input: AgentToolApprovalPolicyBinding): Promise<boolean>;
 /**
  * Recover the durable scope for an approval continuation when a transport
  * drops the original turn id. A single pending logical turn is safe to

package/dist/agent/tool-approval-store.js

@@ -1,7 +1,7 @@
 import { createHash, randomUUID } from "node:crypto";
 import { getDbExec, isPostgres, retryOnDdlRace } from "../db/client.js";
 import { ensureIndexExists, ensureTableExists } from "../db/ddl-guard.js";
-import { AGENT_TOOL_APPROVAL_INDEX_SQL, AGENT_TOOL_APPROVAL_LOGICAL_INDEX_SQL, AGENT_TOOL_APPROVAL_RECOVERY_INDEX_SQL, AGENT_TOOL_APPROVAL_TABLE_SQL, } from "./tool-approval-migrations.js";
+import { AGENT_TOOL_APPROVAL_INDEX_SQL, AGENT_TOOL_APPROVAL_LOGICAL_INDEX_SQL, AGENT_TOOL_APPROVAL_POLICY_INDEX_SQL, AGENT_TOOL_APPROVAL_POLICY_TABLE_SQL, AGENT_TOOL_APPROVAL_RECOVERY_INDEX_SQL, AGENT_TOOL_APPROVAL_TABLE_SQL, } from "./tool-approval-migrations.js";
 // 15 minutes was too short in practice: a user who steps away mid-approval
 // (switching tabs to update their client, checking something else) comes back
 // to a silently expired grant with no visible error — clicking Approve just
@@ -11,6 +11,7 @@ import { AGENT_TOOL_APPROVAL_INDEX_SQL, AGENT_TOOL_APPROVAL_LOGICAL_INDEX_SQL, A
 const APPROVAL_TTL_MS = 60 * 60_000;
 const APPROVAL_CLEANUP_AGE_MS = 24 * 60 * 60_000;
 let initPromise;
+let policyInitPromise;
 export async function ensureAgentToolApprovalTable() {
     if (!initPromise) {
         initPromise = (async () => {
@@ -34,9 +35,83 @@ export async function ensureAgentToolApprovalTable() {
     }
     return initPromise;
 }
+export async function ensureAgentToolApprovalPolicyTable() {
+    if (!policyInitPromise) {
+        policyInitPromise = (async () => {
+            const createSql = AGENT_TOOL_APPROVAL_POLICY_TABLE_SQL[isPostgres() ? "postgres" : "sqlite"];
+            if (isPostgres()) {
+                await ensureTableExists("agent_tool_approval_policies", createSql);
+                await ensureIndexExists("idx_agent_tool_approval_policies_scope", AGENT_TOOL_APPROVAL_POLICY_INDEX_SQL);
+                return;
+            }
+            const client = getDbExec();
+            await retryOnDdlRace(() => client.execute(createSql));
+            await retryOnDdlRace(() => client.execute(AGENT_TOOL_APPROVAL_POLICY_INDEX_SQL));
+        })().catch((error) => {
+            policyInitPromise = undefined;
+            throw error;
+        });
+    }
+    return policyInitPromise;
+}
 export function hashAgentToolApprovalKey(approvalKey) {
     return createHash("sha256").update(approvalKey).digest("hex");
 }
+function normalizeApprovalPolicyBinding(binding) {
+    const ownerEmail = binding.ownerEmail.trim().toLowerCase();
+    const toolName = binding.toolName.trim();
+    if (!ownerEmail)
+        throw new Error("Approval policy owner is required.");
+    if (!toolName)
+        throw new Error("Approval policy tool name is required.");
+    return {
+        ownerEmail,
+        orgId: binding.orgId?.trim() || null,
+        toolName,
+    };
+}
+function approvalPolicyId(binding) {
+    return `agent-tool-approval-policy-${createHash("sha256")
+        .update(`${binding.ownerEmail}\u0000${binding.orgId ?? ""}\u0000${binding.toolName}`)
+        .digest("hex")}`;
+}
+export async function setAgentToolApprovalPolicy(input) {
+    const binding = normalizeApprovalPolicyBinding(input.binding);
+    await ensureAgentToolApprovalPolicyTable();
+    const now = Date.now();
+    const id = approvalPolicyId(binding);
+    await getDbExec().execute({
+        sql: `INSERT INTO agent_tool_approval_policies
+      (id, owner_email, org_id, tool_name, enabled, created_at, updated_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?)
+      ON CONFLICT(id) DO UPDATE SET
+        enabled = excluded.enabled,
+        updated_at = excluded.updated_at`,
+        args: [
+            id,
+            binding.ownerEmail,
+            binding.orgId,
+            binding.toolName,
+            input.enabled,
+            now,
+            now,
+        ],
+    });
+}
+export async function isAgentToolAlwaysAllowed(input) {
+    const binding = normalizeApprovalPolicyBinding(input);
+    await ensureAgentToolApprovalPolicyTable();
+    const result = await getDbExec().execute({
+        sql: `SELECT 1 FROM agent_tool_approval_policies
+      WHERE owner_email = ?
+        AND ((org_id IS NULL AND CAST(? AS TEXT) IS NULL) OR org_id = ?)
+        AND tool_name = ?
+        AND enabled = TRUE
+      LIMIT 1`,
+        args: [binding.ownerEmail, binding.orgId, binding.orgId, binding.toolName],
+    });
+    return (result.rows ?? []).length > 0;
+}
 /**
  * Recover the durable scope for an approval continuation when a transport
  * drops the original turn id. A single pending logical turn is safe to

package/dist/cli/code-agent-executor.js

@@ -9,7 +9,7 @@ import { actionsToEngineTools, runAgentLoop, } from "../agent/production-agent.j
 import { createToolSearchEntry, TOOL_SEARCH_ACTION_NAME, } from "../agent/tool-search.js";
 import { getAppConfig } from "../app-config/index.js";
 import { formatPromptWithAttachments, } from "../code-agents/prompt-attachments.js";
-import { createCodingToolRegistry, isReadOnlyShellCommand, runCodingCommand, truncateBashOutput, truncateCodingOutput, } from "../coding-tools/index.js";
+import { createCodingToolRegistry, canonicalizeShellCommand, isReadOnlyShellCommand, runCodingCommand, truncateBashOutput, truncateCodingOutput, } from "../coding-tools/index.js";
 import { buildMergedConfig, McpClientManager, mcpToolsToActionEntries, } from "../mcp-client/index.js";
 import { readAgentsBundleFromFs, generateDevelopmentSkillsPromptBlock, } from "../server/agents-bundle.js";
 import { getAmbientOrgId, getAmbientUserEmail, runWithRequestContext, } from "../server/request-context.js";
@@ -2303,6 +2303,13 @@ export function classifyCodeAgentCommandPermission(command) {
     const normalized = command.trim().toLowerCase();
     if (!normalized)
         return { kind: "read" };
+    // Match every rule below against the quote-stripped form as well as the raw
+    // one. The shell removes quoting before the command word exists, so
+    // `git 'checkout' main` runs the branch operation these rules forbid while
+    // matching none of them verbatim.
+    const { canonical, unanalyzable } = canonicalizeShellCommand(command);
+    const canonicalized = canonical.trim().toLowerCase();
+    const matches = (pattern) => pattern.test(normalized) || pattern.test(canonicalized);
     const blockedPatterns = [
         [
             /\bgit\s+(checkout|switch|reset|rebase|stash|clean|worktree)\b/,
@@ -2315,7 +2322,7 @@ export function classifyCodeAgentCommandPermission(command) {
         [/\bdrizzle-kit\s+push\b/, "drizzle-kit push is not allowed"],
     ];
     for (const [pattern, reason] of blockedPatterns) {
-        if (pattern.test(normalized))
+        if (matches(pattern))
             return { kind: "forbidden", reason };
     }
     const approvalPatterns = [
@@ -2331,10 +2338,20 @@ export function classifyCodeAgentCommandPermission(command) {
         [/\bdelete\s+from\b(?![\s\S]*\bwhere\b)/, "unscoped delete command"],
     ];
     for (const [pattern, reason] of approvalPatterns) {
-        if (pattern.test(normalized)) {
+        if (matches(pattern)) {
             return { kind: "approval-required", reason };
         }
     }
+    // A command whose real text this pass cannot recover is not a command we can
+    // clear. `$(printf git) $(printf checkout) main` runs the forbidden operation
+    // while containing neither token, so a rule that did not match proves nothing.
+    // Ask rather than fall through to `write` on a guess.
+    if (unanalyzable) {
+        return {
+            kind: "approval-required",
+            reason: "command builds its text at runtime (command substitution or $'…' escaping), so policy matching cannot see what will run",
+        };
+    }
     if (isReadOnlyShellCommand(command)) {
         return { kind: "read" };
     }

package/dist/client/AgentPanel.d.ts

@@ -26,6 +26,7 @@ export declare function preloadAgentChatSurface(): Promise<void>;
 import type { AgentChatSurfaceKind } from "./agent-chat-adapter.js";
 import type { AssistantChatProps } from "./AssistantChat.js";
 import type { MultiTabAssistantChatHeaderProps, MultiTabAssistantChatProps } from "./MultiTabAssistantChat.js";
+export declare function shouldHandleAgentSidebarToggle(event: Event, toggleScopeId?: string | null): boolean;
 type PanelMode = "chat" | "cli" | "resources" | "settings";
 export declare function normalizeAgentPanelModeForSurface(mode: PanelMode, allowSettingsMode: boolean, chatOnly?: boolean): PanelMode;
 export declare function deferAgentPanelOverlayOpen(event: {
@@ -249,6 +250,8 @@ export interface AgentSidebarProps {
     onFullscreenRequest?: () => void;
     /** Ambient resource context rendered as a composer chip. */
     scope?: import("./use-chat-threads.js").ChatThreadScope | null;
+    /** Identity used to route host-scoped sidebar toggle events. */
+    toggleScopeId?: string;
     /** Keep app-owned chat history isolated to the supplied scope. */
     isolateHistoryByScope?: boolean;
     /** @deprecated Scope context now appears inside the composer. */
@@ -266,7 +269,7 @@ export interface AgentSidebarProps {
  * Wraps app content with a toggleable agent sidebar.
  * Use AgentToggleButton in your header to open/close it.
  */
-export declare function AgentSidebar({ children, enabled, emptyStateText, suggestions, dynamicSuggestions, composerToolbarSlot, composerSlot, onComposerTextChange, imageModelMenu, availableAgents, availableModels, modelListLoading, selectedAgent, onAgentChange, onConnectLocalRuntime, onConnectProvider, runtime, adapterReloadKey, threadFooterSlot, defaultSidebarWidth, sidebarWidth, position, defaultOpen, animateMobile, animateDesktop, chatViewTransition, chatViewTransitionHandoff, storageKey, openStorageKey, restoreActiveThread, apiUrl, agentChatSurface, desktopIdentityUnauthenticated, desktopIdentityAuthenticated, showTabBar, suppressInlineOpenApp, composerPlaceholder, openOnChatRunning, onFullscreenRequest, scope, isolateHistoryByScope, showScopeBadge, browserTabId, threadUrlSync, agentPageHref, suppressFirstRunOnboarding, }: AgentSidebarProps): React.JSX.Element;
+export declare function AgentSidebar({ children, enabled, emptyStateText, suggestions, dynamicSuggestions, composerToolbarSlot, composerSlot, onComposerTextChange, imageModelMenu, availableAgents, availableModels, modelListLoading, selectedAgent, onAgentChange, onConnectLocalRuntime, onConnectProvider, runtime, adapterReloadKey, threadFooterSlot, defaultSidebarWidth, sidebarWidth, position, defaultOpen, animateMobile, animateDesktop, chatViewTransition, chatViewTransitionHandoff, storageKey, openStorageKey, restoreActiveThread, apiUrl, agentChatSurface, desktopIdentityUnauthenticated, desktopIdentityAuthenticated, showTabBar, suppressInlineOpenApp, composerPlaceholder, openOnChatRunning, onFullscreenRequest, scope, toggleScopeId, isolateHistoryByScope, showScopeBadge, browserTabId, threadUrlSync, agentPageHref, suppressFirstRunOnboarding, }: AgentSidebarProps): React.JSX.Element;
 /**
  * Focus the agent chat composer input.
  * Opens the sidebar if closed, then focuses the text input.

package/dist/client/AgentPanel.js

@@ -74,6 +74,12 @@ const AgentTerminal = lazy(() => import("./terminal/index.js").then((m) => ({ de
 const AGENT_PANEL_PREPARE_EVENT = "agent-panel:prepare";
 const AGENT_PANEL_SET_MODE_EVENT = "agent-panel:set-mode";
 const AGENT_PANEL_OPEN_SETTINGS_EVENT = "agent-panel:open-settings";
+export function shouldHandleAgentSidebarToggle(event, toggleScopeId) {
+    const detail = event.detail;
+    if (!detail || detail.scopeId === undefined)
+        return true;
+    return typeof detail.scopeId === "string" && detail.scopeId === toggleScopeId;
+}
 function postPerAppChatSidebarStateToEmbeddedFrames(open) {
     const message = buildAppChatSidebarStateMessage(open);
     for (const frame of document.querySelectorAll("iframe")) {
@@ -1423,7 +1429,7 @@ export function AgentChatSurface({ mode = "panel", className, defaultMode = "cha
  * Wraps app content with a toggleable agent sidebar.
  * Use AgentToggleButton in your header to open/close it.
  */
-export function AgentSidebar({ children, enabled = true, emptyStateText = "How can I help you?", suggestions, dynamicSuggestions, composerToolbarSlot, composerSlot, onComposerTextChange, imageModelMenu, availableAgents, availableModels, modelListLoading, selectedAgent, onAgentChange, onConnectLocalRuntime, onConnectProvider, runtime, adapterReloadKey, threadFooterSlot, defaultSidebarWidth, sidebarWidth, position = "right", defaultOpen = false, animateMobile = true, animateDesktop = true, chatViewTransition = false, chatViewTransitionHandoff = false, storageKey, openStorageKey, restoreActiveThread = true, apiUrl, agentChatSurface, desktopIdentityUnauthenticated, desktopIdentityAuthenticated, showTabBar = true, suppressInlineOpenApp, composerPlaceholder, openOnChatRunning = false, onFullscreenRequest, scope, isolateHistoryByScope = false, showScopeBadge, browserTabId, threadUrlSync, agentPageHref, suppressFirstRunOnboarding = false, }) {
+export function AgentSidebar({ children, enabled = true, emptyStateText = "How can I help you?", suggestions, dynamicSuggestions, composerToolbarSlot, composerSlot, onComposerTextChange, imageModelMenu, availableAgents, availableModels, modelListLoading, selectedAgent, onAgentChange, onConnectLocalRuntime, onConnectProvider, runtime, adapterReloadKey, threadFooterSlot, defaultSidebarWidth, sidebarWidth, position = "right", defaultOpen = false, animateMobile = true, animateDesktop = true, chatViewTransition = false, chatViewTransitionHandoff = false, storageKey, openStorageKey, restoreActiveThread = true, apiUrl, agentChatSurface, desktopIdentityUnauthenticated, desktopIdentityAuthenticated, showTabBar = true, suppressInlineOpenApp, composerPlaceholder, openOnChatRunning = false, onFullscreenRequest, scope, toggleScopeId, isolateHistoryByScope = false, showScopeBadge, browserTabId, threadUrlSync, agentPageHref, suppressFirstRunOnboarding = false, }) {
     const staticHostedHarnessEnabled = isHostedHarnessConfigured(injectedAgentNativeConfig().harness);
     const hostedHarnessQuery = useActionQuery("get-hosted-harness-config", undefined, { enabled: staticHostedHarnessEnabled });
     const hostedHarnessStatus = hostedHarnessQuery.data;
@@ -1729,7 +1735,9 @@ export function AgentSidebar({ children, enabled = true, emptyStateText = "How c
         };
     }, [setOpenPersisted]);
     useEffect(() => {
-        const toggleHandler = () => {
+        const toggleHandler = (event) => {
+            if (!shouldHandleAgentSidebarToggle(event, toggleScopeId))
+                return;
             if (isPerAppChatHosted) {
                 requestPerAppChatCommand("toggle");
                 return;
@@ -1774,7 +1782,7 @@ export function AgentSidebar({ children, enabled = true, emptyStateText = "How c
             window.removeEventListener("agent-panel:open", openHandler);
             window.removeEventListener("agent-panel:close", closeHandler);
         };
-    }, [setOpenPersisted, frameCodeMode, isPerAppChatHosted]);
+    }, [setOpenPersisted, frameCodeMode, isPerAppChatHosted, toggleScopeId]);
     // Listen for sidebar mode commands from the frame parent.
     // When frame is in "code" mode, hide the app sidebar.
     // When frame is in "app" mode, show the app sidebar, sync width and panel mode.

package/dist/client/AssistantChat.d.ts

@@ -438,14 +438,14 @@ export interface AssistantChatProps {
     externalStreaming?: boolean;
     /**
      * Optional host hooks for the inline `needsApproval` affordance beyond the
-     * built-in Approve. Additive: omit entirely to keep today's default
-     * behavior (Deny is local-only, no "Always allow" button). Code sessions
-     * pass these through to the same `host.controlRun` commands their
-     * standalone approval banner already uses (see CodeAgentsApp).
+     * built-in Approve and action-type policy. Code sessions pass their
+     * exact-command callback through for the standalone banner, but suppress the
+     * shared action-type menu (see CodeAgentsApp).
      */
     approvalActions?: {
         onDeny?: (approvalKey: string) => void;
-        onAlwaysAllow?: (approvalKey: string) => void;
+        onAlwaysAllow?: (approvalKey: string, toolName: string) => void | Promise<void>;
+        alwaysAllowScope?: "action" | "exact-command";
     };
 }
 export declare function shouldShowAssistantChatModelSelector(showModelSelector: boolean | undefined): boolean;

package/dist/client/AssistantChat.js

@@ -38,6 +38,7 @@ import { addMcpConnectionCompleteListener, consumeMcpConnectionResume, } from ".
 import { McpConnectionSuggestion } from "./resources/McpConnectionSuggestion.js";
 import { claimRunStream, createRunStreamToken, ownsRunStream, releaseRunStream, } from "./run-stream-ownership.js";
 import { AgentAutoContinueSignal, readSSEStreamRaw, settleInterruptedToolCalls, } from "./sse-event-processor.js";
+import { callAction } from "./use-action.js";
 import { useAgentEngineConfigured } from "./use-agent-engine-configured.js";
 import { appendChatThreadScopeParams, } from "./use-chat-threads.js";
 import { useDevMode } from "./use-dev-mode.js";
@@ -4268,24 +4269,36 @@ const AssistantChatInner = forwardRef(function AssistantChatInner({ emptyStateTe
     // tool call, re-issue the turn carrying the call's approval key so the server
     // gate lets that specific call run. Reuses the same append path as recovery /
     // queued messages (no hand-written fetch).
+    const approveToolCall = useCallback((approvalKey) => {
+        void addToQueue("Approved. Go ahead and run the requested action.", // i18n-ignore -- stable hidden agent instruction, not UI copy.
+        undefined, undefined, undefined, undefined, "queued", undefined, false, false, false, true, // hideUserMessage: this is a protocol continuation, not a new prompt
+        undefined, [approvalKey]);
+    }, [addToQueue]);
+    const alwaysAllowToolCall = useCallback((approvalKey, toolName) => {
+        if (approvalActions?.onAlwaysAllow) {
+            return approvalActions.onAlwaysAllow(approvalKey, toolName);
+        }
+        return callAction("set-tool-approval-policy", {
+            toolName,
+            enabled: true,
+        }).then(() => approveToolCall(approvalKey));
+    }, [approvalActions, approveToolCall]);
+    const showActionTypeApprovalPolicy = approvalActions?.alwaysAllowScope !== "exact-command";
     const approvalCtx = useMemo(() => ({
         getApprovalResolution,
         onApprovalResolved: recordApprovalResolution,
-        onApprove: (approvalKey) => {
-            void addToQueue("Approved. Go ahead and run the requested action.", // i18n-ignore -- stable hidden agent instruction, not UI copy.
-            undefined, undefined, undefined, undefined, "queued", undefined, false, false, false, true, // hideUserMessage: this is a protocol continuation, not a new prompt
-            undefined, [approvalKey]);
-        },
-        ...(approvalActions?.onDeny ? { onDeny: approvalActions.onDeny } : {}),
-        ...(approvalActions?.onAlwaysAllow
-            ? { onAlwaysAllow: approvalActions.onAlwaysAllow }
+        onApprove: approveToolCall,
+        ...(showActionTypeApprovalPolicy
+            ? { onAlwaysAllow: alwaysAllowToolCall }
             : {}),
+        ...(approvalActions?.onDeny ? { onDeny: approvalActions.onDeny } : {}),
     }), [
-        addToQueue,
-        execMode,
-        getApprovalResolution,
+        alwaysAllowToolCall,
         approvalActions,
+        approveToolCall,
+        getApprovalResolution,
         recordApprovalResolution,
+        showActionTypeApprovalPolicy,
     ]);
     return (_jsx(SuppressInlineOpenAppContext.Provider, { value: suppressInlineOpenApp, children: _jsx(CheckpointContext.Provider, { value: checkpointCtx, children: _jsx(MessageActionsContext.Provider, { value: messageActionsCtx, children: _jsx(ApprovalContext.Provider, { value: approvalCtx, children: _jsx(ChatRunDurationContext.Provider, { value: lastChatRunDurationMs, children: _jsx(ServerRunActiveContext.Provider, { value: serverRunActive, children: _jsx(ChatRunningRunIdContext.Provider, { value: activeChatRunId, children: _jsx(ChatRunningTurnIdContext.Provider, { value: activeChatTurnId, children: _jsx(ChatRunningContext.Provider
                                     // Keep the current message in a non-complete state while

package/dist/client/chat/tool-call-display.d.ts

@@ -23,8 +23,8 @@ export declare function ToolCallStackMotion({ children, className, }: {
  * re-issues the turn approving a specific paused tool call (opt-in
  * `needsApproval` actions). When null, the Approve button is not rendered.
  * Deny defaults to local-only (the action stays un-run) unless `onDeny` is
- * provided, and "Always allow" only renders when `onAlwaysAllow` is provided
- * — both are additive so existing action-approval consumers are unaffected.
+ * provided. The chevron menu persists an action-type policy before approving
+ * the current call.
  */
 export type ApprovalResolution = "approved" | "denied";
 export type ApprovalContextValue = {
@@ -51,10 +51,10 @@ export type ApprovalContextValue = {
      */
     onDeny?: (approvalKey: string) => void;
     /**
-     * Optional host hook that persists this exact call so future occurrences
-     * skip the approval gate. When absent, no "Always allow" button renders.
+     * Optional host hook that persists this action type and resolves the current
+     * call. The default AssistantChat implementation uses the shared policy.
      */
-    onAlwaysAllow?: (approvalKey: string) => void;
+    onAlwaysAllow?: (approvalKey: string, toolName: string) => void | Promise<void>;
 };
 export declare const ApprovalContext: React.Context<ApprovalContextValue | null>;
 /** Pending human-in-the-loop gate still waiting for Approve/Deny. */

package/dist/client/chat/tool-call-display.js

@@ -1,9 +1,10 @@
 import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-import { IconLoader2, IconAlertTriangle, IconCircleX, IconCheck, IconChevronRight, IconCopy, IconCode, IconBrandSlack, IconTerminal2, IconDatabase, IconSearch, IconFileCode, IconShieldCheck, IconX, } from "@tabler/icons-react";
+import { IconLoader2, IconAlertTriangle, IconCircleX, IconCheck, IconChevronDown, IconChevronRight, IconCopy, IconCode, IconBrandSlack, IconTerminal2, IconDatabase, IconSearch, IconFileCode, IconShieldCheck, IconX, } from "@tabler/icons-react";
 import React, { useState, useEffect, useCallback, useLayoutEffect, useRef, } from "react";
 import { formatAgentChatContextItemsForPrompt } from "../agent-chat.js";
 import { AgentTaskCard } from "../AgentTaskCard.js";
 import { writeClipboardText } from "../clipboard.js";
+import { DropdownMenu, DropdownMenuContent, DropdownMenuItem, DropdownMenuTrigger, } from "../components/ui/dropdown-menu.js";
 import { Popover, PopoverContent, PopoverTrigger, } from "../components/ui/popover.js";
 import { ConnectBuilderCard } from "../ConnectBuilderCard.js";
 import { FileStorageSetupCard } from "../FileStorageSetupCard.js";
@@ -251,6 +252,8 @@ function ApprovalAffordance({ toolName, toolCallId, approval, }) {
     const t = useT();
     const ctx = React.useContext(ApprovalContext);
     const [localResolution, setLocalResolution] = useState(null);
+    const [isAlwaysAllowing, setIsAlwaysAllowing] = useState(false);
+    const [alwaysAllowFailed, setAlwaysAllowFailed] = useState(false);
     const retainedResolution = ctx?.getApprovalResolution?.(approval.approvalKey, toolCallId, approval.askId) ?? null;
     const resolution = retainedResolution ??
         localResolution ??
@@ -266,19 +269,32 @@ function ApprovalAffordance({ toolName, toolCallId, approval, }) {
     if (resolution === "denied") {
         return (_jsx("div", { className: "mt-1.5 text-xs text-muted-foreground", children: t("agentChat.approval.denied", { tool: toolName }) }));
     }
-    return (_jsxs("div", { className: "mt-1.5 flex min-w-0 flex-wrap items-center gap-2 rounded-md border border-border bg-muted/40 px-2.5 py-1.5", children: [_jsx(IconShieldCheck, { className: "h-3.5 w-3.5 shrink-0 text-muted-foreground" }), _jsx("span", { className: "min-w-0 flex-1 text-xs text-muted-foreground", children: t("agentChat.approval.question", { tool: toolName }) }), ctx && (_jsxs("button", { type: "button", onClick: () => {
-                    setLocalResolution("approved");
-                    ctx.onApprovalResolved?.(approval.approvalKey, "approved", toolCallId, approval.askId);
-                    ctx.onApprove(approval.approvalKey);
-                }, className: cn("inline-flex shrink-0 items-center gap-1 rounded-md px-2.5 py-1 text-xs font-medium transition-colors", "bg-foreground text-background hover:bg-foreground/90"), children: [_jsx(IconCheck, { className: "h-3.5 w-3.5" }), t("agentChat.approval.approve")] })), ctx?.onAlwaysAllow && (_jsxs("button", { type: "button", onClick: () => {
-                    setLocalResolution("approved");
-                    ctx.onApprovalResolved?.(approval.approvalKey, "approved", toolCallId, approval.askId);
-                    ctx.onAlwaysAllow?.(approval.approvalKey);
-                }, title: t("agentChat.approval.alwaysAllowHint"), className: cn("inline-flex shrink-0 items-center gap-1 rounded-md border border-border px-2.5 py-1 text-xs font-medium transition-colors", "text-foreground hover:bg-muted"), children: [_jsx(IconShieldCheck, { className: "h-3.5 w-3.5" }), t("agentChat.approval.alwaysAllow")] })), _jsxs("button", { type: "button", onClick: () => {
+    const handleAlwaysAllow = async () => {
+        if (!ctx?.onAlwaysAllow || isAlwaysAllowing)
+            return;
+        setIsAlwaysAllowing(true);
+        setAlwaysAllowFailed(false);
+        try {
+            await ctx.onAlwaysAllow(approval.approvalKey, toolName);
+            setLocalResolution("approved");
+            ctx.onApprovalResolved?.(approval.approvalKey, "approved", toolCallId, approval.askId);
+        }
+        catch {
+            setAlwaysAllowFailed(true);
+        }
+        finally {
+            setIsAlwaysAllowing(false);
+        }
+    };
+    return (_jsxs("div", { className: "mt-1.5 flex min-w-0 flex-wrap items-center gap-2 rounded-md border border-border bg-muted/40 px-2.5 py-1.5", children: [_jsx(IconShieldCheck, { className: "h-3.5 w-3.5 shrink-0 text-muted-foreground" }), _jsx("span", { className: "min-w-0 flex-1 text-xs text-muted-foreground", children: t("agentChat.approval.question", { tool: toolName }) }), ctx && (_jsxs("div", { className: "inline-flex shrink-0 items-stretch", children: [_jsxs("button", { type: "button", disabled: isAlwaysAllowing, onClick: () => {
+                            setLocalResolution("approved");
+                            ctx.onApprovalResolved?.(approval.approvalKey, "approved", toolCallId, approval.askId);
+                            ctx.onApprove(approval.approvalKey);
+                        }, className: cn("inline-flex shrink-0 items-center gap-1 px-2.5 py-1 text-xs font-medium transition-colors", "bg-foreground text-background hover:bg-foreground/90", ctx.onAlwaysAllow ? "rounded-s-md rounded-e-none" : "rounded-md", "disabled:pointer-events-none disabled:opacity-50"), children: [_jsx(IconCheck, { className: "h-3.5 w-3.5" }), t("agentChat.approval.approve")] }), ctx.onAlwaysAllow && (_jsxs(DropdownMenu, { children: [_jsx(DropdownMenuTrigger, { asChild: true, children: _jsx("button", { type: "button", disabled: isAlwaysAllowing, "aria-label": t("agentChat.approval.moreOptions"), title: t("agentChat.approval.moreOptions"), className: cn("inline-flex w-7 shrink-0 items-center justify-center rounded-s-none rounded-e-md border-s border-background/25 bg-foreground text-background transition-colors hover:bg-foreground/90", "disabled:pointer-events-none disabled:opacity-50"), children: _jsx(IconChevronDown, { className: "h-3.5 w-3.5" }) }) }), _jsx(DropdownMenuContent, { align: "end", children: _jsxs(DropdownMenuItem, { onSelect: () => void handleAlwaysAllow(), title: t("agentChat.approval.alwaysAllowActionHint"), children: [_jsx(IconShieldCheck, { className: "h-4 w-4" }), t("agentChat.approval.alwaysAllowAction")] }) })] }))] })), _jsxs("button", { type: "button", disabled: isAlwaysAllowing, onClick: () => {
                     setLocalResolution("denied");
                     ctx?.onApprovalResolved?.(approval.approvalKey, "denied", toolCallId, approval.askId);
                     ctx?.onDeny?.(approval.approvalKey);
-                }, className: cn("inline-flex shrink-0 items-center gap-1 rounded-md border border-border px-2.5 py-1 text-xs font-medium transition-colors", "text-foreground hover:bg-muted"), children: [_jsx(IconX, { className: "h-3.5 w-3.5" }), t("agentChat.approval.deny")] })] }));
+                }, className: cn("inline-flex shrink-0 items-center gap-1 rounded-md border border-border px-2.5 py-1 text-xs font-medium transition-colors", "text-foreground hover:bg-muted", "disabled:pointer-events-none disabled:opacity-50"), children: [_jsx(IconX, { className: "h-3.5 w-3.5" }), t("agentChat.approval.deny")] }), alwaysAllowFailed && (_jsx("span", { role: "alert", className: "basis-full text-xs text-destructive", children: t("agentChat.common.saveFailed") }))] }));
 }
 // ─── ToolCallDisplay ──────────────────────────────────────────────────────────
 export function ToolCallDisplay({ toolName, toolCallId, argsText, args, result, mcpApp, chatUI, isRunning, outcome, structuredMeta, activity, approval, repeatCount, isLatestRunning = isRunning, isActiveTail, }) {

package/dist/client/resources/McpIntegrationDialog.js

@@ -242,7 +242,7 @@ export function McpIntegrationDialog({ open, onOpenChange, initialIntegrationId
         });
     };
     const quickConnect = (integration) => {
-        if (hasOrg) {
+        if (hasOrg && supportsMcpIntegrationOrganizationScope(integration)) {
             setSelected(integration);
             setMode("choice");
             return;
@@ -271,7 +271,7 @@ export function McpIntegrationDialog({ open, onOpenChange, initialIntegrationId
     const selectCatalogConnection = (integration) => {
         if (!mcpServersQuery.isSuccess)
             return;
-        if (hasOrg) {
+        if (hasOrg && supportsMcpIntegrationOrganizationScope(integration)) {
             setSelected(integration);
             setMode("choice");
             return;
@@ -329,7 +329,7 @@ export function McpIntegrationDialog({ open, onOpenChange, initialIntegrationId
         if (quickConnectAttemptedRef.current === attemptKey)
             return;
         quickConnectAttemptedRef.current = attemptKey;
-        if (hasOrg) {
+        if (hasOrg && supportsMcpIntegrationOrganizationScope(integration)) {
             setSelected(integration);
             setMode("choice");
             return;
@@ -507,7 +507,7 @@ export function McpIntegrationDialog({ open, onOpenChange, initialIntegrationId
                                                 : t("mcpIntegrations.presetAuthDescription")
                                         : t("mcpIntegrations.customDescription") })] }), _jsx("div", { className: "min-h-0 flex-1 overflow-y-auto px-7 py-7 sm:px-10", children: _jsxs("div", { className: "mx-auto max-w-2xl space-y-3", children: [renderScopeSelector(), selected?.setupNoteKey && !selectedRequiresSetup ? (_jsx("div", { className: "rounded-md bg-muted/40 px-3 py-2 text-[11px] leading-relaxed text-muted-foreground", children: t(selected.setupNoteKey) })) : null, selectedRequiresSetup && selected && (_jsxs("div", { className: "mx-auto grid w-full max-w-xl gap-4 py-8", children: [_jsxs("div", { children: [_jsx("p", { className: "text-base font-semibold tracking-[-0.02em] text-foreground", children: t("mcpIntegrations.providerSetupRequired") }), _jsx("p", { className: "mt-1 text-sm leading-6 text-muted-foreground", children: t("mcpIntegrations.providerSetupDescription", {
                                                             name: selected.name,
-                                                        }) })] }), selected.setupNoteKey ? (_jsx("p", { className: "text-sm leading-6 text-muted-foreground", children: t(selected.setupNoteKey) })) : null, selected.docsUrl ? (_jsxs("a", { href: selected.docsUrl, target: "_blank", rel: "noopener noreferrer", className: "inline-flex w-fit items-center gap-1 text-sm font-medium text-foreground underline underline-offset-4 hover:text-muted-foreground", children: [t("mcpIntegrations.viewSetup"), _jsx(IconExternalLink, { className: "size-3.5" })] })) : null] })), !selected && (_jsxs("div", { className: "flex items-center justify-between gap-3 rounded-md bg-muted/30 px-3 py-2 text-[11px]", children: [_jsx("span", { className: "text-muted-foreground", children: customAuthMode === "oauth"
+                                                        }) })] }), selected.setupNoteKey ? (_jsx("p", { className: "text-sm leading-6 text-muted-foreground", children: t(selected.setupNoteKey) })) : null, _jsxs("div", { className: "flex items-center justify-between gap-3 rounded-md border border-border px-3 py-2", children: [_jsxs("div", { className: "min-w-0", children: [_jsx("p", { className: "text-sm font-medium text-foreground", children: t("mcpIntegrations.personalConnection") }), _jsx("p", { className: "text-[11px] leading-relaxed text-muted-foreground", children: t("mcpIntegrations.personalDescription") })] }), _jsx("span", { className: "shrink-0 text-[11px] text-muted-foreground", children: t("mcpIntegrations.personal") })] }), selected.docsUrl ? (_jsxs("a", { href: selected.docsUrl, target: "_blank", rel: "noopener noreferrer", className: "inline-flex w-fit items-center gap-1 text-sm font-medium text-foreground underline underline-offset-4 hover:text-muted-foreground", children: [t("mcpIntegrations.viewSetup"), _jsx(IconExternalLink, { className: "size-3.5" })] })) : null] })), !selected && (_jsxs("div", { className: "flex items-center justify-between gap-3 rounded-md bg-muted/30 px-3 py-2 text-[11px]", children: [_jsx("span", { className: "text-muted-foreground", children: customAuthMode === "oauth"
                                                     ? t(
                                                     /* i18n-key-ignore */
                                                     "mcpIntegrations.customOAuthDefault", { defaultValue: "Sign in with OAuth" })
@@ -541,5 +541,5 @@ export function McpIntegrationDialog({ open, onOpenChange, initialIntegrationId
                                                         }, placeholder: selected?.headerPlaceholder ??
                                                             t("mcpIntegrations.headersPlaceholder") })] })), selected?.docsUrl && (_jsxs("a", { href: selected.docsUrl, target: "_blank", rel: "noopener noreferrer", className: "inline-flex items-center gap-1 text-[11px] text-muted-foreground underline hover:text-foreground", children: [t("mcpIntegrations.openSetupDocs"), _jsx(IconExternalLink, { className: "h-3 w-3" })] }))] })), testResult && (_jsxs("div", { className: cn("flex items-start gap-1 rounded-md px-3 py-2 text-[11px] leading-snug", testResult.ok
                                             ? "bg-green-500/5 text-green-600 dark:text-green-400"
-                                            : "bg-red-500/5 text-red-600 dark:text-red-400"), children: [testResult.ok && (_jsx(IconCheck, { className: "mt-0.5 h-3 w-3 shrink-0" })), _jsx("span", { className: "min-w-0 break-words", children: testResult.message })] })), error && (_jsx("div", { className: "break-words rounded-md bg-red-500/5 px-3 py-2 text-[11px] leading-snug text-red-600 dark:text-red-400", children: error }))] }) }), _jsxs("div", { className: "flex shrink-0 items-center justify-between gap-2 border-t border-border px-7 py-4", children: [!selectedRequiresSetup && (_jsx("button", { type: "button", onClick: runTest, disabled: !url.trim() || busy, className: "rounded-md border border-border bg-background px-3 py-1.5 text-[12px] font-medium text-foreground hover:bg-accent disabled:pointer-events-none disabled:opacity-40", children: t("mcpIntegrations.test") })), !selected && customAuthMode === "oauth" ? (_jsxs("button", { type: "button", onClick: connectCustomWithOAuth, disabled: !name.trim() || !url.trim() || busy, "aria-busy": busy, className: "rounded-md border border-border bg-background px-3 py-1.5 text-[12px] font-medium text-foreground hover:bg-accent disabled:pointer-events-none disabled:opacity-40", children: [busy && (_jsx(IconLoader2, { className: "me-1.5 inline h-3.5 w-3.5 animate-spin" })), t("mcpIntegrations.connectWithOAuth")] })) : null, selectedRequiresSetup ? (_jsxs("div", { className: "ms-auto flex items-center gap-2", children: [selected?.docsUrl ? (_jsxs("a", { href: selected.docsUrl, target: "_blank", rel: "noopener noreferrer", className: "inline-flex min-w-[92px] items-center justify-center gap-1.5 rounded-md border border-border bg-background px-3 py-1.5 text-[12px] font-medium text-foreground hover:bg-accent", children: [t("mcpIntegrations.viewSetup"), _jsx(IconExternalLink, { className: "h-3 w-3" })] })) : null, selected?.authMode === "oauth" && (_jsxs("button", { type: "button", onClick: () => connectWithOAuth(selected), disabled: busy, "aria-busy": busy, className: "inline-flex min-w-[132px] items-center justify-center gap-1.5 rounded-md bg-primary px-3 py-1.5 text-[12px] font-medium text-primary-foreground hover:bg-primary/90 disabled:pointer-events-none disabled:opacity-40", children: [busy && (_jsx(IconLoader2, { className: "h-3.5 w-3.5 animate-spin" })), t("mcpIntegrations.continueToConnect")] }))] })) : selected?.authMode === "oauth" ? (_jsxs("button", { type: "button", onClick: () => connectWithOAuth(selected), disabled: !name.trim() || !url.trim() || busy, "aria-busy": busy, className: "inline-flex min-w-[92px] items-center justify-center gap-1.5 rounded-md bg-primary px-3 py-1.5 text-[12px] font-medium text-primary-foreground hover:bg-primary/90 disabled:pointer-events-none disabled:opacity-40", children: [busy && _jsx(IconLoader2, { className: "h-3.5 w-3.5 animate-spin" }), t("mcpIntegrations.connectWithOAuth")] })) : !selected && customAuthMode === "oauth" ? null : (_jsxs("button", { type: "button", onClick: submitForm, disabled: !name.trim() || !url.trim() || busy, className: "inline-flex min-w-[92px] items-center justify-center gap-1.5 rounded-md bg-primary px-3 py-1.5 text-[12px] font-medium text-primary-foreground hover:bg-primary/90 disabled:pointer-events-none disabled:opacity-40", children: [busy && _jsx(IconLoader2, { className: "h-3.5 w-3.5 animate-spin" }), t("mcpIntegrations.connect")] }))] })] }))] }) }));
+                                            : "bg-red-500/5 text-red-600 dark:text-red-400"), children: [testResult.ok && (_jsx(IconCheck, { className: "mt-0.5 h-3 w-3 shrink-0" })), _jsx("span", { className: "min-w-0 break-words", children: testResult.message })] })), error && (_jsx("div", { className: "break-words rounded-md bg-red-500/5 px-3 py-2 text-[11px] leading-snug text-red-600 dark:text-red-400", children: error }))] }) }), _jsxs("div", { className: "flex shrink-0 items-center justify-between gap-2 border-t border-border px-7 py-4", children: [!selectedRequiresSetup && (_jsx("button", { type: "button", onClick: runTest, disabled: !url.trim() || busy, className: "rounded-md border border-border bg-background px-3 py-1.5 text-[12px] font-medium text-foreground hover:bg-accent disabled:pointer-events-none disabled:opacity-40", children: t("mcpIntegrations.test") })), !selected && customAuthMode === "oauth" ? (_jsxs("button", { type: "button", onClick: connectCustomWithOAuth, disabled: !name.trim() || !url.trim() || busy, "aria-busy": busy, className: "rounded-md border border-border bg-background px-3 py-1.5 text-[12px] font-medium text-foreground hover:bg-accent disabled:pointer-events-none disabled:opacity-40", children: [busy && (_jsx(IconLoader2, { className: "me-1.5 inline h-3.5 w-3.5 animate-spin" })), t("mcpIntegrations.connectWithOAuth")] })) : null, selectedRequiresSetup ? (_jsx("div", { className: "ms-auto flex items-center gap-2", children: selected?.authMode === "oauth" && (_jsxs("button", { type: "button", onClick: () => connectWithOAuth(selected), disabled: busy, "aria-busy": busy, className: "inline-flex min-w-[132px] items-center justify-center gap-1.5 rounded-md bg-primary px-3 py-1.5 text-[12px] font-medium text-primary-foreground hover:bg-primary/90 disabled:pointer-events-none disabled:opacity-40", children: [busy && (_jsx(IconLoader2, { className: "h-3.5 w-3.5 animate-spin" })), t("mcpIntegrations.continueToConnect")] })) })) : selected?.authMode === "oauth" ? (_jsxs("button", { type: "button", onClick: () => connectWithOAuth(selected), disabled: !name.trim() || !url.trim() || busy, "aria-busy": busy, className: "inline-flex min-w-[92px] items-center justify-center gap-1.5 rounded-md bg-primary px-3 py-1.5 text-[12px] font-medium text-primary-foreground hover:bg-primary/90 disabled:pointer-events-none disabled:opacity-40", children: [busy && _jsx(IconLoader2, { className: "h-3.5 w-3.5 animate-spin" }), t("mcpIntegrations.connectWithOAuth")] })) : !selected && customAuthMode === "oauth" ? null : (_jsxs("button", { type: "button", onClick: submitForm, disabled: !name.trim() || !url.trim() || busy, className: "inline-flex min-w-[92px] items-center justify-center gap-1.5 rounded-md bg-primary px-3 py-1.5 text-[12px] font-medium text-primary-foreground hover:bg-primary/90 disabled:pointer-events-none disabled:opacity-40", children: [busy && _jsx(IconLoader2, { className: "h-3.5 w-3.5 animate-spin" }), t("mcpIntegrations.connect")] }))] })] }))] }) }));
 }

package/dist/client/resources/mcp-integration-catalog.js

@@ -272,7 +272,7 @@ export const DEFAULT_MCP_INTEGRATIONS = [
     },
     {
         id: "atlassian",
-        name: "Atlassian",
+        name: "Jira",
         provider: "atlassian",
         description: "Read and write Jira issues and Confluence content.",
         descriptionKey: "mcpIntegrations.catalog.atlassian.description",

package/dist/coding-tools/index.d.ts

@@ -5,6 +5,12 @@ export interface CodingCommandResult {
     stderr: string;
     timedOut: boolean;
     durationMs?: number;
+    /**
+     * The command exited but something it started outlived it and still holds the
+     * output pipe, so the captured output stops here rather than at end-of-stream.
+     * Distinct from a clean finish — the caller is not looking at the whole story.
+     */
+    outputStillOpen?: boolean;
 }
 /**
  * Structured metadata emitted on tool_start / tool_done events so the UI can
@@ -103,4 +109,29 @@ export declare function truncateCodingOutput(value: string, max: number): string
  * signal (error messages, test results, etc.).
  */
 export declare function truncateBashOutput(value: string, headChars?: number, tailChars?: number): string;
+/**
+ * Strip shell quoting so a policy regex sees the word the shell will actually
+ * run. Bash removes quotes before the command word exists, so `git 'checkout'`
+ * and `gi''t checkout` both execute `git checkout` while matching no rule
+ * written against the literal text — every denylist entry is otherwise one pair
+ * of quotes away from being bypassed.
+ *
+ * `unanalyzable` reports constructs whose executed text this pass cannot
+ * recover, so no rule matched against the canonical form can be trusted:
+ * `$'…'` ANSI-C escapes (`$'\x67it'` → `git`) and command substitution
+ * (`$(printf git) $(printf checkout) main` runs the forbidden operation while
+ * the string contains neither token). Callers must escalate rather than clear a
+ * command when this is set. Substitution inside single quotes is literal, so it
+ * does not set the flag.
+ *
+ * ponytail: plain parameter expansion (`$VAR`, `${VAR}`) can also build a token
+ * at runtime and is NOT flagged — doing so would make ordinary `cd $TMPDIR`
+ * commands require approval. Closing that needs a real shell parser, which is
+ * the upgrade path if this boundary ever has to hold against a determined
+ * attacker rather than a misbehaving model.
+ */
+export declare function canonicalizeShellCommand(command: string): {
+    canonical: string;
+    unanalyzable: boolean;
+};
 export declare function isReadOnlyShellCommand(command: string): boolean;