@agent-native/core 0.171.3 → 0.172.1

package/dist/agent/tool-approval-migrations.d.ts

@@ -35,6 +35,27 @@ export declare const AGENT_TOOL_APPROVAL_TABLE_SQL: {
 export declare const AGENT_TOOL_APPROVAL_INDEX_SQL = "CREATE INDEX IF NOT EXISTS idx_agent_tool_approvals_binding\n  ON agent_tool_approvals(owner_email, org_id, thread_id, tool_name, call_id, status)";
 export declare const AGENT_TOOL_APPROVAL_LOGICAL_INDEX_SQL = "CREATE INDEX IF NOT EXISTS idx_agent_tool_approvals_logical\n  ON agent_tool_approvals(owner_email, org_id, thread_id, turn_id, tool_name, approval_key_hash, status)";
 export declare const AGENT_TOOL_APPROVAL_RECOVERY_INDEX_SQL = "CREATE INDEX IF NOT EXISTS idx_agent_tool_approvals_recovery\n  ON agent_tool_approvals(owner_email, org_id, thread_id, approval_key_hash, status, turn_id)";
+export declare const AGENT_TOOL_APPROVAL_POLICY_TABLE_SQL: {
+    readonly postgres: `CREATE TABLE IF NOT EXISTS agent_tool_approval_policies (
+  id TEXT PRIMARY KEY,
+  owner_email TEXT NOT NULL,
+  org_id TEXT,
+  tool_name TEXT NOT NULL,
+  enabled BOOLEAN NOT NULL,
+  created_at BIGINT NOT NULL,
+  updated_at BIGINT NOT NULL
+)`;
+    readonly sqlite: `CREATE TABLE IF NOT EXISTS agent_tool_approval_policies (
+  id TEXT PRIMARY KEY,
+  owner_email TEXT NOT NULL,
+  org_id TEXT,
+  tool_name TEXT NOT NULL,
+  enabled INTEGER NOT NULL,
+  created_at INTEGER NOT NULL,
+  updated_at INTEGER NOT NULL
+)`;
+};
+export declare const AGENT_TOOL_APPROVAL_POLICY_INDEX_SQL = "CREATE INDEX IF NOT EXISTS idx_agent_tool_approval_policies_scope\n  ON agent_tool_approval_policies(owner_email, org_id, tool_name, enabled)";
 /**
  * Durable approval grants are created and consumed on request paths, but their
  * schema belongs to the release migration boundary in production.

package/dist/agent/tool-approval-migrations.js

@@ -37,6 +37,28 @@ export const AGENT_TOOL_APPROVAL_LOGICAL_INDEX_SQL = `CREATE INDEX IF NOT EXISTS
   ON agent_tool_approvals(owner_email, org_id, thread_id, turn_id, tool_name, approval_key_hash, status)`;
 export const AGENT_TOOL_APPROVAL_RECOVERY_INDEX_SQL = `CREATE INDEX IF NOT EXISTS idx_agent_tool_approvals_recovery
   ON agent_tool_approvals(owner_email, org_id, thread_id, approval_key_hash, status, turn_id)`;
+export const AGENT_TOOL_APPROVAL_POLICY_TABLE_SQL = {
+    postgres: `CREATE TABLE IF NOT EXISTS agent_tool_approval_policies (
+  id TEXT PRIMARY KEY,
+  owner_email TEXT NOT NULL,
+  org_id TEXT,
+  tool_name TEXT NOT NULL,
+  enabled BOOLEAN NOT NULL,
+  created_at BIGINT NOT NULL,
+  updated_at BIGINT NOT NULL
+)`,
+    sqlite: `CREATE TABLE IF NOT EXISTS agent_tool_approval_policies (
+  id TEXT PRIMARY KEY,
+  owner_email TEXT NOT NULL,
+  org_id TEXT,
+  tool_name TEXT NOT NULL,
+  enabled INTEGER NOT NULL,
+  created_at INTEGER NOT NULL,
+  updated_at INTEGER NOT NULL
+)`,
+};
+export const AGENT_TOOL_APPROVAL_POLICY_INDEX_SQL = `CREATE INDEX IF NOT EXISTS idx_agent_tool_approval_policies_scope
+  ON agent_tool_approval_policies(owner_email, org_id, tool_name, enabled)`;
 /**
  * Durable approval grants are created and consumed on request paths, but their
  * schema belongs to the release migration boundary in production.
@@ -68,4 +90,14 @@ ${AGENT_TOOL_APPROVAL_INDEX_SQL}`,
             sqlite: AGENT_TOOL_APPROVAL_RECOVERY_INDEX_SQL,
         },
     },
+    {
+        version: 4,
+        name: "agent-tool-approval-policies-table-and-index",
+        sql: {
+            postgres: `${AGENT_TOOL_APPROVAL_POLICY_TABLE_SQL.postgres};
+${AGENT_TOOL_APPROVAL_POLICY_INDEX_SQL}`,
+            sqlite: `${AGENT_TOOL_APPROVAL_POLICY_TABLE_SQL.sqlite};
+${AGENT_TOOL_APPROVAL_POLICY_INDEX_SQL}`,
+        },
+    },
 ];

package/dist/agent/tool-approval-store.d.ts

@@ -1,4 +1,5 @@
 export declare function ensureAgentToolApprovalTable(): Promise<void>;
+export declare function ensureAgentToolApprovalPolicyTable(): Promise<void>;
 export interface AgentToolApprovalBinding {
     ownerEmail: string;
     orgId?: string | null;
@@ -10,6 +11,16 @@ export interface AgentToolApprovalBinding {
     expiresAt?: number;
 }
 export declare function hashAgentToolApprovalKey(approvalKey: string): string;
+export interface AgentToolApprovalPolicyBinding {
+    ownerEmail: string;
+    orgId?: string | null;
+    toolName: string;
+}
+export declare function setAgentToolApprovalPolicy(input: {
+    binding: AgentToolApprovalPolicyBinding;
+    enabled: boolean;
+}): Promise<void>;
+export declare function isAgentToolAlwaysAllowed(input: AgentToolApprovalPolicyBinding): Promise<boolean>;
 /**
  * Recover the durable scope for an approval continuation when a transport
  * drops the original turn id. A single pending logical turn is safe to

package/dist/agent/tool-approval-store.js

@@ -1,7 +1,7 @@
 import { createHash, randomUUID } from "node:crypto";
 import { getDbExec, isPostgres, retryOnDdlRace } from "../db/client.js";
 import { ensureIndexExists, ensureTableExists } from "../db/ddl-guard.js";
-import { AGENT_TOOL_APPROVAL_INDEX_SQL, AGENT_TOOL_APPROVAL_LOGICAL_INDEX_SQL, AGENT_TOOL_APPROVAL_RECOVERY_INDEX_SQL, AGENT_TOOL_APPROVAL_TABLE_SQL, } from "./tool-approval-migrations.js";
+import { AGENT_TOOL_APPROVAL_INDEX_SQL, AGENT_TOOL_APPROVAL_LOGICAL_INDEX_SQL, AGENT_TOOL_APPROVAL_POLICY_INDEX_SQL, AGENT_TOOL_APPROVAL_POLICY_TABLE_SQL, AGENT_TOOL_APPROVAL_RECOVERY_INDEX_SQL, AGENT_TOOL_APPROVAL_TABLE_SQL, } from "./tool-approval-migrations.js";
 // 15 minutes was too short in practice: a user who steps away mid-approval
 // (switching tabs to update their client, checking something else) comes back
 // to a silently expired grant with no visible error — clicking Approve just
@@ -11,6 +11,7 @@ import { AGENT_TOOL_APPROVAL_INDEX_SQL, AGENT_TOOL_APPROVAL_LOGICAL_INDEX_SQL, A
 const APPROVAL_TTL_MS = 60 * 60_000;
 const APPROVAL_CLEANUP_AGE_MS = 24 * 60 * 60_000;
 let initPromise;
+let policyInitPromise;
 export async function ensureAgentToolApprovalTable() {
     if (!initPromise) {
         initPromise = (async () => {
@@ -34,9 +35,83 @@ export async function ensureAgentToolApprovalTable() {
     }
     return initPromise;
 }
+export async function ensureAgentToolApprovalPolicyTable() {
+    if (!policyInitPromise) {
+        policyInitPromise = (async () => {
+            const createSql = AGENT_TOOL_APPROVAL_POLICY_TABLE_SQL[isPostgres() ? "postgres" : "sqlite"];
+            if (isPostgres()) {
+                await ensureTableExists("agent_tool_approval_policies", createSql);
+                await ensureIndexExists("idx_agent_tool_approval_policies_scope", AGENT_TOOL_APPROVAL_POLICY_INDEX_SQL);
+                return;
+            }
+            const client = getDbExec();
+            await retryOnDdlRace(() => client.execute(createSql));
+            await retryOnDdlRace(() => client.execute(AGENT_TOOL_APPROVAL_POLICY_INDEX_SQL));
+        })().catch((error) => {
+            policyInitPromise = undefined;
+            throw error;
+        });
+    }
+    return policyInitPromise;
+}
 export function hashAgentToolApprovalKey(approvalKey) {
     return createHash("sha256").update(approvalKey).digest("hex");
 }
+function normalizeApprovalPolicyBinding(binding) {
+    const ownerEmail = binding.ownerEmail.trim().toLowerCase();
+    const toolName = binding.toolName.trim();
+    if (!ownerEmail)
+        throw new Error("Approval policy owner is required.");
+    if (!toolName)
+        throw new Error("Approval policy tool name is required.");
+    return {
+        ownerEmail,
+        orgId: binding.orgId?.trim() || null,
+        toolName,
+    };
+}
+function approvalPolicyId(binding) {
+    return `agent-tool-approval-policy-${createHash("sha256")
+        .update(`${binding.ownerEmail}\u0000${binding.orgId ?? ""}\u0000${binding.toolName}`)
+        .digest("hex")}`;
+}
+export async function setAgentToolApprovalPolicy(input) {
+    const binding = normalizeApprovalPolicyBinding(input.binding);
+    await ensureAgentToolApprovalPolicyTable();
+    const now = Date.now();
+    const id = approvalPolicyId(binding);
+    await getDbExec().execute({
+        sql: `INSERT INTO agent_tool_approval_policies
+      (id, owner_email, org_id, tool_name, enabled, created_at, updated_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?)
+      ON CONFLICT(id) DO UPDATE SET
+        enabled = excluded.enabled,
+        updated_at = excluded.updated_at`,
+        args: [
+            id,
+            binding.ownerEmail,
+            binding.orgId,
+            binding.toolName,
+            input.enabled,
+            now,
+            now,
+        ],
+    });
+}
+export async function isAgentToolAlwaysAllowed(input) {
+    const binding = normalizeApprovalPolicyBinding(input);
+    await ensureAgentToolApprovalPolicyTable();
+    const result = await getDbExec().execute({
+        sql: `SELECT 1 FROM agent_tool_approval_policies
+      WHERE owner_email = ?
+        AND ((org_id IS NULL AND CAST(? AS TEXT) IS NULL) OR org_id = ?)
+        AND tool_name = ?
+        AND enabled = TRUE
+      LIMIT 1`,
+        args: [binding.ownerEmail, binding.orgId, binding.orgId, binding.toolName],
+    });
+    return (result.rows ?? []).length > 0;
+}
 /**
  * Recover the durable scope for an approval continuation when a transport
  * drops the original turn id. A single pending logical turn is safe to

package/dist/agent-web/generator.d.ts

@@ -7,17 +7,40 @@ export interface AgentWebPage {
     markdownPath?: string;
     lastmod?: string | Date;
 }
+export interface AgentWebResource {
+    title: string;
+    url: string;
+    description?: string;
+}
+export interface AgentWebOrganization {
+    name: string;
+    url?: string;
+    sameAs?: string[];
+    contactPoint?: {
+        "@type": "ContactPoint";
+        contactType: string;
+        email?: string;
+        telephone?: string;
+        url?: string;
+    };
+    address?: {
+        "@type": "PostalAddress";
+        streetAddress?: string;
+        addressLocality?: string;
+        addressRegion?: string;
+        postalCode?: string;
+        addressCountry?: string;
+    };
+}
 export interface BuildAgentWebStaticFilesOptions {
     siteName: string;
     siteUrl: string;
     description?: string;
     pages: AgentWebPage[];
     config: AgentWebConfig;
-    organization?: {
-        name: string;
-        url?: string;
-        sameAs?: string[];
-    };
+    developerResources?: AgentWebResource[];
+    whenToUse?: string[];
+    organization?: AgentWebOrganization;
 }
 export interface AgentWebStaticFile {
     path: string;
@@ -43,17 +66,28 @@ export declare function buildBaseJsonLd(options: {
     siteName: string;
     siteUrl: string;
     description?: string;
-    organization?: {
-        name: string;
-        url?: string;
-        sameAs?: string[];
-    };
+    organization?: AgentWebOrganization;
 }): ({
     "@context": string;
     "@type": string;
     name: string;
     url: string;
     sameAs?: string[] | undefined;
+    contactPoint?: {
+        "@type": "ContactPoint";
+        contactType: string;
+        email?: string;
+        telephone?: string;
+        url?: string;
+    } | undefined;
+    address?: {
+        "@type": "PostalAddress";
+        streetAddress?: string;
+        addressLocality?: string;
+        addressRegion?: string;
+        postalCode?: string;
+        addressCountry?: string;
+    } | undefined;
 } | {
     "@context": string;
     "@type": string;

package/dist/agent-web/generator.js

@@ -91,11 +91,24 @@ ${entries}
 `;
 }
 export function buildLlmsTxt(options) {
+    const developerResources = options.developerResources ?? [];
+    const whenToUse = options.whenToUse ?? [];
     const lines = [
         `# ${options.siteName}`,
         "",
         options.description ? `> ${options.description}` : undefined,
         options.description ? "" : undefined,
+        whenToUse.length ? "## When to use this" : undefined,
+        ...whenToUse.map((instruction) => `- ${instruction}`),
+        whenToUse.length ? "" : undefined,
+        developerResources.length ? "## Developer resources" : undefined,
+        ...developerResources.map((resource) => {
+            const description = resource.description
+                ? `: ${resource.description}`
+                : "";
+            return `- [${resource.title}](${absoluteResourceUrl(options.siteUrl, resource.url)})${description}`;
+        }),
+        developerResources.length ? "" : undefined,
         "## Pages",
         ...options.pages.map((page) => {
             const description = page.description ? `: ${page.description}` : "";
@@ -110,11 +123,24 @@ export function buildLlmsTxt(options) {
     return `${lines.join("\n")}\n`;
 }
 export function buildLlmsFullTxt(options) {
+    const developerResources = options.developerResources ?? [];
+    const whenToUse = options.whenToUse ?? [];
     const lines = [
         `# ${options.siteName}`,
         "",
         options.description ?? "",
         "",
+        whenToUse.length ? "## When to use this" : undefined,
+        ...whenToUse.map((instruction) => `- ${instruction}`),
+        whenToUse.length ? "" : undefined,
+        developerResources.length ? "## Developer resources" : undefined,
+        ...developerResources.map((resource) => {
+            const description = resource.description
+                ? `: ${resource.description}`
+                : "";
+            return `- [${resource.title}](${absoluteResourceUrl(options.siteUrl, resource.url)})${description}`;
+        }),
+        developerResources.length ? "" : undefined,
         ...options.pages.flatMap((page) => [
             `## ${page.title}`,
             "",
@@ -141,6 +167,12 @@ export function buildBaseJsonLd(options) {
             ...(options.organization?.sameAs?.length
                 ? { sameAs: options.organization.sameAs }
                 : {}),
+            ...(options.organization?.contactPoint
+                ? { contactPoint: options.organization.contactPoint }
+                : {}),
+            ...(options.organization?.address
+                ? { address: options.organization.address }
+                : {}),
         },
         {
             "@context": "https://schema.org",
@@ -188,6 +220,7 @@ export function buildMarkdownResponseHeaders(options) {
     return {
         "content-type": "text/markdown; charset=utf-8",
         "x-markdown-tokens": String(estimateMarkdownTokens(options.markdown)),
+        vary: "Accept, Accept-Encoding",
         link: `<${absoluteUrl(options.siteUrl, "/llms.txt")}>; rel="llms-txt", <${absoluteUrl(options.siteUrl, markdownUrlForPage(options.pagePath, options.markdownPath))}>; rel="alternate"; type="text/markdown"`,
     };
 }
@@ -213,6 +246,11 @@ export function absoluteUrl(siteUrl, pagePath) {
     const path = normalizePagePath(pagePath);
     return `${base}${path}`;
 }
+function absoluteResourceUrl(siteUrl, resourceUrl) {
+    return /^https?:\/\//i.test(resourceUrl)
+        ? resourceUrl
+        : absoluteUrl(siteUrl, resourceUrl);
+}
 function normalizePagePath(pagePath) {
     const withSlash = pagePath.startsWith("/") ? pagePath : `/${pagePath}`;
     if (withSlash.length > 1 && withSlash.endsWith("/")) {

package/dist/agent-web/index.d.ts

@@ -1,2 +1,2 @@
 export { AGENT_WEB_CRAWLER_CATEGORIES, DEFAULT_AGENT_WEB_CRAWLER_POLICY, agentWebConfigFromPackageJson, deriveAgentWebPublicRoutes, normalizeAgentWebConfig, pathPatternMatches, resolveAgentWebCrawlerPolicy, type AgentWebConfig, type AgentWebCrawlerCategory, type AgentWebCrawlerDecision, type AgentWebCrawlerOverrides, type AgentWebCrawlerPolicy, type AgentWebInputConfig, type DeriveAgentWebPublicRoutesOptions, } from "./config.js";
-export { AGENT_WEB_CRAWLER_USER_AGENTS, absoluteUrl, buildAgentWebStaticFiles, buildBaseJsonLd, buildLlmsFullTxt, buildLlmsTxt, buildMarkdownResponseHeaders, buildPageJsonLd, buildRobotsTxt, buildSitemapXml, estimateMarkdownTokens, markdownFilePathForPage, markdownUrlForPage, type AgentWebPage, type AgentWebStaticFile, type BuildAgentWebStaticFilesOptions, type MarkdownResponseHeadersOptions, } from "./generator.js";
+export { AGENT_WEB_CRAWLER_USER_AGENTS, absoluteUrl, buildAgentWebStaticFiles, buildBaseJsonLd, buildLlmsFullTxt, buildLlmsTxt, buildMarkdownResponseHeaders, buildPageJsonLd, buildRobotsTxt, buildSitemapXml, estimateMarkdownTokens, markdownFilePathForPage, markdownUrlForPage, type AgentWebPage, type AgentWebOrganization, type AgentWebResource, type AgentWebStaticFile, type BuildAgentWebStaticFilesOptions, type MarkdownResponseHeadersOptions, } from "./generator.js";

package/dist/cli/code-agent-executor.js

@@ -9,7 +9,7 @@ import { actionsToEngineTools, runAgentLoop, } from "../agent/production-agent.j
 import { createToolSearchEntry, TOOL_SEARCH_ACTION_NAME, } from "../agent/tool-search.js";
 import { getAppConfig } from "../app-config/index.js";
 import { formatPromptWithAttachments, } from "../code-agents/prompt-attachments.js";
-import { createCodingToolRegistry, isReadOnlyShellCommand, runCodingCommand, truncateBashOutput, truncateCodingOutput, } from "../coding-tools/index.js";
+import { createCodingToolRegistry, canonicalizeShellCommand, isReadOnlyShellCommand, runCodingCommand, truncateBashOutput, truncateCodingOutput, } from "../coding-tools/index.js";
 import { buildMergedConfig, McpClientManager, mcpToolsToActionEntries, } from "../mcp-client/index.js";
 import { readAgentsBundleFromFs, generateDevelopmentSkillsPromptBlock, } from "../server/agents-bundle.js";
 import { getAmbientOrgId, getAmbientUserEmail, runWithRequestContext, } from "../server/request-context.js";
@@ -2303,6 +2303,13 @@ export function classifyCodeAgentCommandPermission(command) {
     const normalized = command.trim().toLowerCase();
     if (!normalized)
         return { kind: "read" };
+    // Match every rule below against the quote-stripped form as well as the raw
+    // one. The shell removes quoting before the command word exists, so
+    // `git 'checkout' main` runs the branch operation these rules forbid while
+    // matching none of them verbatim.
+    const { canonical, unanalyzable } = canonicalizeShellCommand(command);
+    const canonicalized = canonical.trim().toLowerCase();
+    const matches = (pattern) => pattern.test(normalized) || pattern.test(canonicalized);
     const blockedPatterns = [
         [
             /\bgit\s+(checkout|switch|reset|rebase|stash|clean|worktree)\b/,
@@ -2315,7 +2322,7 @@ export function classifyCodeAgentCommandPermission(command) {
         [/\bdrizzle-kit\s+push\b/, "drizzle-kit push is not allowed"],
     ];
     for (const [pattern, reason] of blockedPatterns) {
-        if (pattern.test(normalized))
+        if (matches(pattern))
             return { kind: "forbidden", reason };
     }
     const approvalPatterns = [
@@ -2331,10 +2338,20 @@ export function classifyCodeAgentCommandPermission(command) {
         [/\bdelete\s+from\b(?![\s\S]*\bwhere\b)/, "unscoped delete command"],
     ];
     for (const [pattern, reason] of approvalPatterns) {
-        if (pattern.test(normalized)) {
+        if (matches(pattern)) {
             return { kind: "approval-required", reason };
         }
     }
+    // A command whose real text this pass cannot recover is not a command we can
+    // clear. `$(printf git) $(printf checkout) main` runs the forbidden operation
+    // while containing neither token, so a rule that did not match proves nothing.
+    // Ask rather than fall through to `write` on a guess.
+    if (unanalyzable) {
+        return {
+            kind: "approval-required",
+            reason: "command builds its text at runtime (command substitution or $'…' escaping), so policy matching cannot see what will run",
+        };
+    }
     if (isReadOnlyShellCommand(command)) {
         return { kind: "read" };
     }

package/dist/client/AgentPanel.d.ts

@@ -26,6 +26,7 @@ export declare function preloadAgentChatSurface(): Promise<void>;
 import type { AgentChatSurfaceKind } from "./agent-chat-adapter.js";
 import type { AssistantChatProps } from "./AssistantChat.js";
 import type { MultiTabAssistantChatHeaderProps, MultiTabAssistantChatProps } from "./MultiTabAssistantChat.js";
+export declare function shouldHandleAgentSidebarToggle(event: Event, toggleScopeId?: string | null): boolean;
 type PanelMode = "chat" | "cli" | "resources" | "settings";
 export declare function normalizeAgentPanelModeForSurface(mode: PanelMode, allowSettingsMode: boolean, chatOnly?: boolean): PanelMode;
 export declare function deferAgentPanelOverlayOpen(event: {
@@ -249,6 +250,8 @@ export interface AgentSidebarProps {
     onFullscreenRequest?: () => void;
     /** Ambient resource context rendered as a composer chip. */
     scope?: import("./use-chat-threads.js").ChatThreadScope | null;
+    /** Identity used to route host-scoped sidebar toggle events. */
+    toggleScopeId?: string;
     /** Keep app-owned chat history isolated to the supplied scope. */
     isolateHistoryByScope?: boolean;
     /** @deprecated Scope context now appears inside the composer. */
@@ -266,7 +269,7 @@ export interface AgentSidebarProps {
  * Wraps app content with a toggleable agent sidebar.
  * Use AgentToggleButton in your header to open/close it.
  */
-export declare function AgentSidebar({ children, enabled, emptyStateText, suggestions, dynamicSuggestions, composerToolbarSlot, composerSlot, onComposerTextChange, imageModelMenu, availableAgents, availableModels, modelListLoading, selectedAgent, onAgentChange, onConnectLocalRuntime, onConnectProvider, runtime, adapterReloadKey, threadFooterSlot, defaultSidebarWidth, sidebarWidth, position, defaultOpen, animateMobile, animateDesktop, chatViewTransition, chatViewTransitionHandoff, storageKey, openStorageKey, restoreActiveThread, apiUrl, agentChatSurface, desktopIdentityUnauthenticated, desktopIdentityAuthenticated, showTabBar, suppressInlineOpenApp, composerPlaceholder, openOnChatRunning, onFullscreenRequest, scope, isolateHistoryByScope, showScopeBadge, browserTabId, threadUrlSync, agentPageHref, suppressFirstRunOnboarding, }: AgentSidebarProps): React.JSX.Element;
+export declare function AgentSidebar({ children, enabled, emptyStateText, suggestions, dynamicSuggestions, composerToolbarSlot, composerSlot, onComposerTextChange, imageModelMenu, availableAgents, availableModels, modelListLoading, selectedAgent, onAgentChange, onConnectLocalRuntime, onConnectProvider, runtime, adapterReloadKey, threadFooterSlot, defaultSidebarWidth, sidebarWidth, position, defaultOpen, animateMobile, animateDesktop, chatViewTransition, chatViewTransitionHandoff, storageKey, openStorageKey, restoreActiveThread, apiUrl, agentChatSurface, desktopIdentityUnauthenticated, desktopIdentityAuthenticated, showTabBar, suppressInlineOpenApp, composerPlaceholder, openOnChatRunning, onFullscreenRequest, scope, toggleScopeId, isolateHistoryByScope, showScopeBadge, browserTabId, threadUrlSync, agentPageHref, suppressFirstRunOnboarding, }: AgentSidebarProps): React.JSX.Element;
 /**
  * Focus the agent chat composer input.
  * Opens the sidebar if closed, then focuses the text input.

package/dist/client/AgentPanel.js

@@ -74,6 +74,12 @@ const AgentTerminal = lazy(() => import("./terminal/index.js").then((m) => ({ de
 const AGENT_PANEL_PREPARE_EVENT = "agent-panel:prepare";
 const AGENT_PANEL_SET_MODE_EVENT = "agent-panel:set-mode";
 const AGENT_PANEL_OPEN_SETTINGS_EVENT = "agent-panel:open-settings";
+export function shouldHandleAgentSidebarToggle(event, toggleScopeId) {
+    const detail = event.detail;
+    if (!detail || detail.scopeId === undefined)
+        return true;
+    return typeof detail.scopeId === "string" && detail.scopeId === toggleScopeId;
+}
 function postPerAppChatSidebarStateToEmbeddedFrames(open) {
     const message = buildAppChatSidebarStateMessage(open);
     for (const frame of document.querySelectorAll("iframe")) {
@@ -1423,7 +1429,7 @@ export function AgentChatSurface({ mode = "panel", className, defaultMode = "cha
  * Wraps app content with a toggleable agent sidebar.
  * Use AgentToggleButton in your header to open/close it.
  */
-export function AgentSidebar({ children, enabled = true, emptyStateText = "How can I help you?", suggestions, dynamicSuggestions, composerToolbarSlot, composerSlot, onComposerTextChange, imageModelMenu, availableAgents, availableModels, modelListLoading, selectedAgent, onAgentChange, onConnectLocalRuntime, onConnectProvider, runtime, adapterReloadKey, threadFooterSlot, defaultSidebarWidth, sidebarWidth, position = "right", defaultOpen = false, animateMobile = true, animateDesktop = true, chatViewTransition = false, chatViewTransitionHandoff = false, storageKey, openStorageKey, restoreActiveThread = true, apiUrl, agentChatSurface, desktopIdentityUnauthenticated, desktopIdentityAuthenticated, showTabBar = true, suppressInlineOpenApp, composerPlaceholder, openOnChatRunning = false, onFullscreenRequest, scope, isolateHistoryByScope = false, showScopeBadge, browserTabId, threadUrlSync, agentPageHref, suppressFirstRunOnboarding = false, }) {
+export function AgentSidebar({ children, enabled = true, emptyStateText = "How can I help you?", suggestions, dynamicSuggestions, composerToolbarSlot, composerSlot, onComposerTextChange, imageModelMenu, availableAgents, availableModels, modelListLoading, selectedAgent, onAgentChange, onConnectLocalRuntime, onConnectProvider, runtime, adapterReloadKey, threadFooterSlot, defaultSidebarWidth, sidebarWidth, position = "right", defaultOpen = false, animateMobile = true, animateDesktop = true, chatViewTransition = false, chatViewTransitionHandoff = false, storageKey, openStorageKey, restoreActiveThread = true, apiUrl, agentChatSurface, desktopIdentityUnauthenticated, desktopIdentityAuthenticated, showTabBar = true, suppressInlineOpenApp, composerPlaceholder, openOnChatRunning = false, onFullscreenRequest, scope, toggleScopeId, isolateHistoryByScope = false, showScopeBadge, browserTabId, threadUrlSync, agentPageHref, suppressFirstRunOnboarding = false, }) {
     const staticHostedHarnessEnabled = isHostedHarnessConfigured(injectedAgentNativeConfig().harness);
     const hostedHarnessQuery = useActionQuery("get-hosted-harness-config", undefined, { enabled: staticHostedHarnessEnabled });
     const hostedHarnessStatus = hostedHarnessQuery.data;
@@ -1729,7 +1735,9 @@ export function AgentSidebar({ children, enabled = true, emptyStateText = "How c
         };
     }, [setOpenPersisted]);
     useEffect(() => {
-        const toggleHandler = () => {
+        const toggleHandler = (event) => {
+            if (!shouldHandleAgentSidebarToggle(event, toggleScopeId))
+                return;
             if (isPerAppChatHosted) {
                 requestPerAppChatCommand("toggle");
                 return;
@@ -1774,7 +1782,7 @@ export function AgentSidebar({ children, enabled = true, emptyStateText = "How c
             window.removeEventListener("agent-panel:open", openHandler);
             window.removeEventListener("agent-panel:close", closeHandler);
         };
-    }, [setOpenPersisted, frameCodeMode, isPerAppChatHosted]);
+    }, [setOpenPersisted, frameCodeMode, isPerAppChatHosted, toggleScopeId]);
     // Listen for sidebar mode commands from the frame parent.
     // When frame is in "code" mode, hide the app sidebar.
     // When frame is in "app" mode, show the app sidebar, sync width and panel mode.

package/dist/client/AssistantChat.d.ts

@@ -438,14 +438,14 @@ export interface AssistantChatProps {
     externalStreaming?: boolean;
     /**
      * Optional host hooks for the inline `needsApproval` affordance beyond the
-     * built-in Approve. Additive: omit entirely to keep today's default
-     * behavior (Deny is local-only, no "Always allow" button). Code sessions
-     * pass these through to the same `host.controlRun` commands their
-     * standalone approval banner already uses (see CodeAgentsApp).
+     * built-in Approve and action-type policy. Code sessions pass their
+     * exact-command callback through for the standalone banner, but suppress the
+     * shared action-type menu (see CodeAgentsApp).
      */
     approvalActions?: {
         onDeny?: (approvalKey: string) => void;
-        onAlwaysAllow?: (approvalKey: string) => void;
+        onAlwaysAllow?: (approvalKey: string, toolName: string) => void | Promise<void>;
+        alwaysAllowScope?: "action" | "exact-command";
     };
 }
 export declare function shouldShowAssistantChatModelSelector(showModelSelector: boolean | undefined): boolean;

package/dist/client/AssistantChat.js

@@ -38,6 +38,7 @@ import { addMcpConnectionCompleteListener, consumeMcpConnectionResume, } from ".
 import { McpConnectionSuggestion } from "./resources/McpConnectionSuggestion.js";
 import { claimRunStream, createRunStreamToken, ownsRunStream, releaseRunStream, } from "./run-stream-ownership.js";
 import { AgentAutoContinueSignal, readSSEStreamRaw, settleInterruptedToolCalls, } from "./sse-event-processor.js";
+import { callAction } from "./use-action.js";
 import { useAgentEngineConfigured } from "./use-agent-engine-configured.js";
 import { appendChatThreadScopeParams, } from "./use-chat-threads.js";
 import { useDevMode } from "./use-dev-mode.js";
@@ -4268,24 +4269,36 @@ const AssistantChatInner = forwardRef(function AssistantChatInner({ emptyStateTe
     // tool call, re-issue the turn carrying the call's approval key so the server
     // gate lets that specific call run. Reuses the same append path as recovery /
     // queued messages (no hand-written fetch).
+    const approveToolCall = useCallback((approvalKey) => {
+        void addToQueue("Approved. Go ahead and run the requested action.", // i18n-ignore -- stable hidden agent instruction, not UI copy.
+        undefined, undefined, undefined, undefined, "queued", undefined, false, false, false, true, // hideUserMessage: this is a protocol continuation, not a new prompt
+        undefined, [approvalKey]);
+    }, [addToQueue]);
+    const alwaysAllowToolCall = useCallback((approvalKey, toolName) => {
+        if (approvalActions?.onAlwaysAllow) {
+            return approvalActions.onAlwaysAllow(approvalKey, toolName);
+        }
+        return callAction("set-tool-approval-policy", {
+            toolName,
+            enabled: true,
+        }).then(() => approveToolCall(approvalKey));
+    }, [approvalActions, approveToolCall]);
+    const showActionTypeApprovalPolicy = approvalActions?.alwaysAllowScope !== "exact-command";
     const approvalCtx = useMemo(() => ({
         getApprovalResolution,
         onApprovalResolved: recordApprovalResolution,
-        onApprove: (approvalKey) => {
-            void addToQueue("Approved. Go ahead and run the requested action.", // i18n-ignore -- stable hidden agent instruction, not UI copy.
-            undefined, undefined, undefined, undefined, "queued", undefined, false, false, false, true, // hideUserMessage: this is a protocol continuation, not a new prompt
-            undefined, [approvalKey]);
-        },
-        ...(approvalActions?.onDeny ? { onDeny: approvalActions.onDeny } : {}),
-        ...(approvalActions?.onAlwaysAllow
-            ? { onAlwaysAllow: approvalActions.onAlwaysAllow }
+        onApprove: approveToolCall,
+        ...(showActionTypeApprovalPolicy
+            ? { onAlwaysAllow: alwaysAllowToolCall }
             : {}),
+        ...(approvalActions?.onDeny ? { onDeny: approvalActions.onDeny } : {}),
     }), [
-        addToQueue,
-        execMode,
-        getApprovalResolution,
+        alwaysAllowToolCall,
         approvalActions,
+        approveToolCall,
+        getApprovalResolution,
         recordApprovalResolution,
+        showActionTypeApprovalPolicy,
     ]);
     return (_jsx(SuppressInlineOpenAppContext.Provider, { value: suppressInlineOpenApp, children: _jsx(CheckpointContext.Provider, { value: checkpointCtx, children: _jsx(MessageActionsContext.Provider, { value: messageActionsCtx, children: _jsx(ApprovalContext.Provider, { value: approvalCtx, children: _jsx(ChatRunDurationContext.Provider, { value: lastChatRunDurationMs, children: _jsx(ServerRunActiveContext.Provider, { value: serverRunActive, children: _jsx(ChatRunningRunIdContext.Provider, { value: activeChatRunId, children: _jsx(ChatRunningTurnIdContext.Provider, { value: activeChatTurnId, children: _jsx(ChatRunningContext.Provider
                                     // Keep the current message in a non-complete state while

package/dist/client/chat/tool-call-display.d.ts

@@ -23,8 +23,8 @@ export declare function ToolCallStackMotion({ children, className, }: {
  * re-issues the turn approving a specific paused tool call (opt-in
  * `needsApproval` actions). When null, the Approve button is not rendered.
  * Deny defaults to local-only (the action stays un-run) unless `onDeny` is
- * provided, and "Always allow" only renders when `onAlwaysAllow` is provided
- * — both are additive so existing action-approval consumers are unaffected.
+ * provided. The chevron menu persists an action-type policy before approving
+ * the current call.
  */
 export type ApprovalResolution = "approved" | "denied";
 export type ApprovalContextValue = {
@@ -51,10 +51,10 @@ export type ApprovalContextValue = {
      */
     onDeny?: (approvalKey: string) => void;
     /**
-     * Optional host hook that persists this exact call so future occurrences
-     * skip the approval gate. When absent, no "Always allow" button renders.
+     * Optional host hook that persists this action type and resolves the current
+     * call. The default AssistantChat implementation uses the shared policy.
      */
-    onAlwaysAllow?: (approvalKey: string) => void;
+    onAlwaysAllow?: (approvalKey: string, toolName: string) => void | Promise<void>;
 };
 export declare const ApprovalContext: React.Context<ApprovalContextValue | null>;
 /** Pending human-in-the-loop gate still waiting for Approve/Deny. */