@burdenoff/fe-libs 2026.906.6 → 2026.907.2

package/dist/shared/assistant/api.d.ts

@@ -41,6 +41,24 @@ export declare function waitForAssistantServiceReady(sandboxId: string, workspac
 export declare function createAssistantSession(sandboxId: string, workspaceId: string, mode: AssistantMode, authContext: AssistantSandboxAuthContext): Promise<{
     sessionId: string;
 }>;
+/**
+ * Tell the sandbox the user approved a pending write.
+ *
+ * ★★ This is the frontend half of the write gate. The sandbox no longer puts
+ * the confirmation token in anything the model can read — the refusal carries a
+ * reference that NAMES the pending change and authorises nothing — so the only
+ * way a refused write becomes executable is this call, made because a person
+ * pressed a button. The model is not in this path.
+ *
+ * ★ The reference is not a secret and is validated as hex by the parser before
+ * it reaches here, so it can safely sit in the URL.
+ *
+ * ★ Throws on failure rather than resolving quietly. A 404 means the pending
+ * write expired or was already spent, and the user must see that their approval
+ * did NOT land — silently swallowing it would leave them believing a change was
+ * authorised when it was not.
+ */
+export declare function approvePendingWrite(sandboxId: string, workspaceId: string, reference: string, authContext: AssistantSandboxAuthContext): Promise<void>;
 /**
  * Our own assistant sandboxes in this workspace that are for a DIFFERENT mode.
  *

package/dist/shared/assistant/api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../../src/shared/assistant/api.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AA8BH,OAAO,KAAK,EACV,aAAa,EACb,mBAAmB,EACnB,mBAAmB,EACnB,2BAA2B,EAC3B,iBAAiB,EACjB,oBAAoB,EACpB,2BAA2B,EAC3B,YAAY,EACb,MAAM,SAAS,CAAC;AA+CjB,wBAAsB,mBAAmB,CACvC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,aAAa,EACnB,MAAM,EAAE,OAAO,EACf,WAAW,EAAE,2BAA2B,EACxC,kBAAkB,GAAE,WAAW,CAAC,MAAM,CAAa,GAClD,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAkBxB;AAED,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wFAAwF;AACxF,wBAAgB,8BAA8B,CAC5C,SAAS,EAAE,wBAAwB,EAAE,EACrC,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,aAAa,EACnB,MAAM,EAAE,OAAO,EACf,WAAW,EAAE,IAAI,CAAC,2BAA2B,EAAE,QAAQ,CAAC,EACxD,kBAAkB,GAAE,WAAW,CAAC,MAAM,CAAa,GAClD,MAAM,GAAG,IAAI,CAoCf;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAEtE;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,aAAa,EACnB,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,IAAI,CACf,2BAA2B,EAC3B,aAAa,GAAG,gBAAgB,CACjC,GACA,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAyCxC;AAED,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,aAAa,EACnB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,OAAO,EACf,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,2BAA2B,GACvC,OAAO,CAAC,MAAM,CAAC,CA+EjB;AAyCD;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,2BAA2B,EACxC,SAAS,SAAU,GAClB,OAAO,CAAC,IAAI,CAAC,CA0Cf;AAED,wBAAsB,4BAA4B,CAChD,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,2BAA2B,EACxC,SAAS,SAAS,GACjB,OAAO,CAAC,IAAI,CAAC,CA0Bf;AAED,wBAAsB,sBAAsB,CAC1C,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,aAAa,EACnB,WAAW,EAAE,2BAA2B,GACvC,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAWhC;AAED;;;;;GAKG;AACH,wBAAgB,kCAAkC,CAChD,SAAS,EAAE,SAAS,wBAAwB,EAAE,EAC9C,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,aAAa,EACnB,MAAM,EAAE,OAAO,EACf,WAAW,EAAE,2BAA2B,GACvC,MAAM,EAAE,CAsBV;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,mCAAmC,CACvD,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,aAAa,EACnB,MAAM,EAAE,OAAO,EACf,WAAW,EAAE,2BAA2B,GACvC,OAAO,CAAC,MAAM,EAAE,CAAC,CAyCnB;AAED;;;;GAIG;AACH,wBAAsB,0BAA0B,CAC9C,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,2BAA2B,GACvC,OAAO,CAAC,IAAI,CAAC,CAWf;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAC3C,IAAI,EAAE,aAAa,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;IACjD,KAAK,CAAC,EAAE,mBAAmB,EAAE,CAAC;CAC/B,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAK1B;AAED,wBAAsB,wBAAwB,CAC5C,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,aAAa,EACnB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAChD,WAAW,EAAE,2BAA2B;AACxC,yFAAyF;AACzF,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,mBAAmB,EAAE,CAAA;CAAE,GAC1C,OAAO,CAAC;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAiBjC;AAED,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,2BAA2B,EACxC,IAAI,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAC1C,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAiBhC;AAED;;;GAGG;AACH,wBAAsB,wBAAwB,CAC5C,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,2BAA2B,GACvC,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAqB9B;AAED,wBAAsB,yBAAyB,CAC7C,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,iBAAiB,EAAE,MAAM,EACzB,WAAW,EAAE,2BAA2B,GACvC,OAAO,CAAC,IAAI,CAAC,CAYf;AAED,wBAAsB,aAAa,CACjC,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,2BAA2B,GACvC,OAAO,CAAC,IAAI,CAAC,CASf;AAED,wBAAsB,qBAAqB,CACzC,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,2BAA2B,GACvC,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAY9B;AAED,wBAAsB,mBAAmB,CACvC,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,2BAA2B,GACvC,OAAO,CAAC,oBAAoB,CAAC,CAc/B;AAED,wBAAsB,yBAAyB,CAC7C,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,2BAA2B,GACvC,OAAO,CAAC,2BAA2B,CAAC,CAkBtC;AAED,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,2BAA2B,GACvC,OAAO,CAAC,OAAO,CAAC,CASlB;AAED,wBAAsB,2BAA2B,CAC/C,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,MAAM,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EACzC,WAAW,EAAE,2BAA2B,GACvC,OAAO,CAAC,IAAI,CAAC,CAaf"}
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../../src/shared/assistant/api.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AA8BH,OAAO,KAAK,EACV,aAAa,EACb,mBAAmB,EACnB,mBAAmB,EACnB,2BAA2B,EAC3B,iBAAiB,EACjB,oBAAoB,EACpB,2BAA2B,EAC3B,YAAY,EACb,MAAM,SAAS,CAAC;AA+CjB,wBAAsB,mBAAmB,CACvC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,aAAa,EACnB,MAAM,EAAE,OAAO,EACf,WAAW,EAAE,2BAA2B,EACxC,kBAAkB,GAAE,WAAW,CAAC,MAAM,CAAa,GAClD,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAkBxB;AAED,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wFAAwF;AACxF,wBAAgB,8BAA8B,CAC5C,SAAS,EAAE,wBAAwB,EAAE,EACrC,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,aAAa,EACnB,MAAM,EAAE,OAAO,EACf,WAAW,EAAE,IAAI,CAAC,2BAA2B,EAAE,QAAQ,CAAC,EACxD,kBAAkB,GAAE,WAAW,CAAC,MAAM,CAAa,GAClD,MAAM,GAAG,IAAI,CAoCf;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAEtE;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,aAAa,EACnB,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,IAAI,CACf,2BAA2B,EAC3B,aAAa,GAAG,gBAAgB,CACjC,GACA,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAyCxC;AAED,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,aAAa,EACnB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,OAAO,EACf,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,2BAA2B,GACvC,OAAO,CAAC,MAAM,CAAC,CA+EjB;AAyCD;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,2BAA2B,EACxC,SAAS,SAAU,GAClB,OAAO,CAAC,IAAI,CAAC,CA0Cf;AAED,wBAAsB,4BAA4B,CAChD,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,2BAA2B,EACxC,SAAS,SAAS,GACjB,OAAO,CAAC,IAAI,CAAC,CA0Bf;AAED,wBAAsB,sBAAsB,CAC1C,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,aAAa,EACnB,WAAW,EAAE,2BAA2B,GACvC,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAWhC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,mBAAmB,CACvC,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,2BAA2B,GACvC,OAAO,CAAC,IAAI,CAAC,CAgBf;AAED;;;;;GAKG;AACH,wBAAgB,kCAAkC,CAChD,SAAS,EAAE,SAAS,wBAAwB,EAAE,EAC9C,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,aAAa,EACnB,MAAM,EAAE,OAAO,EACf,WAAW,EAAE,2BAA2B,GACvC,MAAM,EAAE,CAsBV;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,mCAAmC,CACvD,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,aAAa,EACnB,MAAM,EAAE,OAAO,EACf,WAAW,EAAE,2BAA2B,GACvC,OAAO,CAAC,MAAM,EAAE,CAAC,CAyCnB;AAED;;;;GAIG;AACH,wBAAsB,0BAA0B,CAC9C,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,2BAA2B,GACvC,OAAO,CAAC,IAAI,CAAC,CAWf;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAC3C,IAAI,EAAE,aAAa,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;IACjD,KAAK,CAAC,EAAE,mBAAmB,EAAE,CAAC;CAC/B,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAK1B;AAED,wBAAsB,wBAAwB,CAC5C,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,aAAa,EACnB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAChD,WAAW,EAAE,2BAA2B;AACxC,yFAAyF;AACzF,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,mBAAmB,EAAE,CAAA;CAAE,GAC1C,OAAO,CAAC;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAiBjC;AAED,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,2BAA2B,EACxC,IAAI,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAC1C,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAiBhC;AAED;;;GAGG;AACH,wBAAsB,wBAAwB,CAC5C,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,2BAA2B,GACvC,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAqB9B;AAED,wBAAsB,yBAAyB,CAC7C,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,iBAAiB,EAAE,MAAM,EACzB,WAAW,EAAE,2BAA2B,GACvC,OAAO,CAAC,IAAI,CAAC,CAYf;AAED,wBAAsB,aAAa,CACjC,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,2BAA2B,GACvC,OAAO,CAAC,IAAI,CAAC,CASf;AAED,wBAAsB,qBAAqB,CACzC,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,2BAA2B,GACvC,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAY9B;AAED,wBAAsB,mBAAmB,CACvC,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,2BAA2B,GACvC,OAAO,CAAC,oBAAoB,CAAC,CAc/B;AAED,wBAAsB,yBAAyB,CAC7C,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,2BAA2B,GACvC,OAAO,CAAC,2BAA2B,CAAC,CAkBtC;AAED,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,2BAA2B,GACvC,OAAO,CAAC,OAAO,CAAC,CASlB;AAED,wBAAsB,2BAA2B,CAC/C,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,MAAM,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EACzC,WAAW,EAAE,2BAA2B,GACvC,OAAO,CAAC,IAAI,CAAC,CAaf"}

package/dist/shared/assistant/api.js

@@ -181,14 +181,18 @@ async function k(e, t, n, r = 9e4) {
 async function A(e, t, n, r) {
 	return { sessionId: (await b(e, t, "/sessions", "POST", { mode: n }, r)).session.id };
 }
-function j(e, t, n, r, i) {
+async function j(e, t, n, r) {
+	let i = await b(e, t, `/write-confirmations/${encodeURIComponent(n)}/approve`, "POST", {}, r);
+	if (i?.approved !== !0) throw Error(typeof i?.error == "string" ? i.error : "The change could not be approved. It may have expired — ask the assistant to try again.");
+}
+function M(e, t, n, r, i) {
 	let a = p(n, r);
 	return e.filter((e) => e.metadata?.authStrategy === "sandbox-app-client-headers-v1" && e.metadata?.assistantProduct === t && (!i.userId || e.createdBy === i.userId) && !(h(e) === n && e.metadata?.imageTag === a)).map((e) => e.id);
 }
-async function M(n, r, i, o, s) {
+async function N(n, r, i, o, s) {
 	let c;
 	try {
-		c = j((await t({
+		c = M((await t({
 			query: a,
 			operationName: "GetActiveSandboxes",
 			variables: { context: e(n, s) },
@@ -200,13 +204,13 @@ async function M(n, r, i, o, s) {
 	}
 	return (await Promise.all(c.map(async (e) => {
 		try {
-			return await N(e, n, s), e;
+			return await P(e, n, s), e;
 		} catch {
 			return null;
 		}
 	}))).filter((e) => e !== null);
 }
-async function N(n, r, i) {
+async function P(n, r, i) {
 	await t({
 		query: l,
 		operationName: "StopAssistantSandbox",
@@ -218,7 +222,7 @@ async function N(n, r, i) {
 		authContext: i
 	});
 }
-function P(e) {
+function F(e) {
 	let { mode: t, prompt: n, pageContext: r, parts: i } = e, a = {
 		mode: t,
 		prompt: n,
@@ -226,8 +230,8 @@ function P(e) {
 	};
 	return i && i.length > 0 && (a.parts = i), a;
 }
-async function F(e, t, n, r, i, a, o, s) {
-	let c = await b(e, t, `/sessions/${n}/prompt-async`, "POST", P({
+async function I(e, t, n, r, i, a, o, s) {
+	let c = await b(e, t, `/sessions/${n}/prompt-async`, "POST", F({
 		mode: i,
 		prompt: r,
 		pageContext: a,
@@ -235,13 +239,13 @@ async function F(e, t, n, r, i, a, o, s) {
 	}), o);
 	return { messageID: typeof c.messageID == "string" ? c.messageID : void 0 };
 }
-async function I(e, t, n, r, i) {
+async function L(e, t, n, r, i) {
 	let a = `/sessions/${n}/messages?limit=${i?.limit ?? 50}`;
 	i?.sinceMs && g("sinceParam") !== "unsupported" && (a += `&since=${i.sinceMs}`);
 	let o = await b(e, t, a, "GET", void 0, r);
 	return typeof o.now == "number" && v("sinceParam"), o.messages ?? [];
 }
-async function L(e, t, n, r) {
+async function R(e, t, n, r) {
 	if (g("sse") === "unsupported") return null;
 	try {
 		let i = await b(e, t, `/sessions/${n}/stream-url`, "GET", void 0, r);
@@ -253,7 +257,7 @@ async function L(e, t, n, r) {
 		return y("sse"), null;
 	}
 }
-async function R(n, r, a, o) {
+async function z(n, r, a, o) {
 	await t({
 		query: i,
 		operationName: "ExtendSandboxTtl",
@@ -266,20 +270,20 @@ async function R(n, r, a, o) {
 		authContext: o
 	});
 }
-async function z(e, t, n, r) {
+async function B(e, t, n, r) {
 	await b(e, t, `/sessions/${n}/heartbeat`, "POST", void 0, r).catch(() => void 0);
 }
-async function B(e, t, n, r) {
+async function V(e, t, n, r) {
 	return ((await b(e, t, `/sessions/${n}/artifacts`, "GET", void 0, r)).artifacts ?? []).filter((e) => !e.name.startsWith("."));
 }
-async function V(e, t, n, r) {
+async function H(e, t, n, r) {
 	let i = await b(e, t, `/sessions/${n}`, "GET", void 0, r);
 	return {
 		id: i.session?.id ?? n,
 		mode: i.mode ?? "unknown"
 	};
 }
-async function H(e, t, n, r, i) {
+async function U(e, t, n, r, i) {
 	let a = (await b(e, t, `/sessions/${n}/artifacts/download?path=${encodeURIComponent(r)}`, "GET", void 0, i)).artifact;
 	if (!a) throw Error("Artifact download returned an empty response");
 	return {
@@ -288,7 +292,7 @@ async function H(e, t, n, r, i) {
 		contentBase64: a.contentBase64
 	};
 }
-async function U(e, r) {
+async function W(e, r) {
 	return (await t({
 		query: n,
 		operationName: "CheckAiCredits",
@@ -297,7 +301,7 @@ async function U(e, r) {
 		authContext: r
 	})).checkAiCredits;
 }
-async function W(e, n, r, i, a, o) {
+async function G(e, n, r, i, a, o) {
 	let s = Math.max(0, Math.round(a.input ?? 0)), l = Math.max(0, Math.round(a.output ?? 0));
 	s + l === 0 || !i || await t({
 		query: c,
@@ -314,4 +318,4 @@ async function W(e, n, r, i, a, o) {
 	});
 }
 //#endregion
-export { w as buildAssistantSandboxEnv, P as buildPromptRequestBody, U as checkAssistantAiCredits, T as createAssistantSandbox, A as createAssistantSession, H as downloadAssistantArtifact, R as extendAssistantSandboxTTL, x as findExistingSandbox, B as getAssistantArtifacts, I as getAssistantMessages, V as getAssistantSession, L as getAssistantStreamAccess, C as modeRequiresConfirmWrites, M as releaseSupersededAssistantSandboxes, W as reportAssistantAiTokenUsage, S as selectExistingAssistantSandbox, j as selectSupersededAssistantSandboxes, F as sendAssistantPromptAsync, z as sendHeartbeat, N as stopReapedAssistantSandbox, k as waitForAssistantServiceReady, O as waitForSandboxRunning };
+export { j as approvePendingWrite, w as buildAssistantSandboxEnv, F as buildPromptRequestBody, W as checkAssistantAiCredits, T as createAssistantSandbox, A as createAssistantSession, U as downloadAssistantArtifact, z as extendAssistantSandboxTTL, x as findExistingSandbox, V as getAssistantArtifacts, L as getAssistantMessages, H as getAssistantSession, R as getAssistantStreamAccess, C as modeRequiresConfirmWrites, N as releaseSupersededAssistantSandboxes, G as reportAssistantAiTokenUsage, S as selectExistingAssistantSandbox, M as selectSupersededAssistantSandboxes, I as sendAssistantPromptAsync, B as sendHeartbeat, P as stopReapedAssistantSandbox, k as waitForAssistantServiceReady, O as waitForSandboxRunning };

package/dist/shared/assistant/pendingWrite.d.ts

@@ -38,6 +38,19 @@ export interface PendingWrite {
      * naming the operation alone rather than implying there is nothing to send.
      */
     values: PendingWriteValue[] | null;
+    /**
+     * The pending change's public reference, when the sandbox emitted one.
+     *
+     * ★★ NOT a token, and the distinction is the whole design. The reference
+     * NAMES the pending write so the panel can approve that exact one; it
+     * authorises nothing on its own. The token never leaves the sandbox — being
+     * shown it is what used to let the model approve itself.
+     *
+     * `null` on a sandbox running an image from before the approval endpoint
+     * existed, in which case the card has nothing to approve WITH and correctly
+     * falls back to asking the user to reply in prose.
+     */
+    reference: string | null;
 }
 /**
  * A tool part as the transport delivers it. Deliberately loose: `state.output`

package/dist/shared/assistant/pendingWrite.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pendingWrite.d.ts","sourceRoot":"","sources":["../../../src/shared/assistant/pendingWrite.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,oEAAoE;IACpE,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,YAAY;IAC3B,iDAAiD;IACjD,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,MAAM,EAAE,iBAAiB,EAAE,GAAG,IAAI,CAAC;CACpC;AAOD;;;;GAIG;AACH,UAAU,YAAY;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,GAAG,SAAS,CAAC;CAClE;AA+BD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAsD1E;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,YAAY,EAAE,GAAG,SAAS,GAAG,YAAY,GAAG,IAAI,CAWhG"}
+{"version":3,"file":"pendingWrite.d.ts","sourceRoot":"","sources":["../../../src/shared/assistant/pendingWrite.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,oEAAoE;IACpE,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,YAAY;IAC3B,iDAAiD;IACjD,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,MAAM,EAAE,iBAAiB,EAAE,GAAG,IAAI,CAAC;IACnC;;;;;;;;;;;OAWG;IACH,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AASD;;;;GAIG;AACH,UAAU,YAAY;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,GAAG,SAAS,CAAC;CAClE;AAqCD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAgE1E;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,SAAS,YAAY,EAAE,GAAG,SAAS,GACzC,YAAY,GAAG,IAAI,CAWrB"}

package/dist/shared/assistant/pendingWrite.js

@@ -1,6 +1,6 @@
 //#region src/shared/assistant/pendingWrite.ts
-var e = "CONFIRMATION_REQUIRED", t = /CONFIRMATION_REQUIRED: the write "([^"]+)" was NOT sent/, n = "Values you were about to send:";
-function r(e) {
+var e = "CONFIRMATION_REQUIRED", t = /CONFIRMATION_REQUIRED: the write "([^"]+)" was NOT sent/, n = "Values you were about to send:", r = /Pending change reference:\s*([0-9a-f]{6,64})\b/;
+function i(e) {
 	if (typeof e == "string") return e;
 	if (e && typeof e == "object" && "output" in e) {
 		let t = e.output;
@@ -8,7 +8,7 @@ function r(e) {
 	}
 	return null;
 }
-function i(e) {
+function a(e) {
 	if (!e || typeof e != "object" || Array.isArray(e)) return null;
 	let t = Object.entries(e);
 	return t.length === 0 ? null : t.map(([e, t]) => ({
@@ -16,70 +16,76 @@ function i(e) {
 		value: typeof t == "string" ? t : t == null ? "—" : JSON.stringify(t)
 	}));
 }
-function a(r) {
-	if (!r.includes(e)) return null;
-	let a = t.exec(r)?.[1]?.trim();
-	if (!a) return null;
-	let o = r.indexOf(n);
-	if (o === -1) return {
-		operation: a,
-		values: null
+function o(i) {
+	if (!i.includes(e)) return null;
+	let o = t.exec(i)?.[1]?.trim();
+	if (!o) return null;
+	let s = r.exec(i)?.[1] ?? null, c = i.indexOf(n);
+	if (c === -1) return {
+		operation: o,
+		values: null,
+		reference: s
 	};
-	let s = r.slice(o + 30).trim();
-	if (!s || s.startsWith("(no variables)")) return {
-		operation: a,
-		values: null
+	let l = i.slice(c + 30).trim();
+	if (!l || l.startsWith("(no variables)")) return {
+		operation: o,
+		values: null,
+		reference: s
 	};
-	let c = s.indexOf("{");
-	if (c === -1) return {
-		operation: a,
-		values: null
+	let u = l.indexOf("{");
+	if (u === -1) return {
+		operation: o,
+		values: null,
+		reference: s
 	};
-	let l = 0, u = -1, d = !1, f = !1;
-	for (let e = c; e < s.length; e += 1) {
-		let t = s[e];
-		if (f) {
-			f = !1;
+	let d = 0, f = -1, p = !1, m = !1;
+	for (let e = u; e < l.length; e += 1) {
+		let t = l[e];
+		if (m) {
+			m = !1;
 			continue;
 		}
-		if (t === "\\" && d) {
-			f = !0;
+		if (t === "\\" && p) {
+			m = !0;
 			continue;
 		}
-		if (t === "\"") d = !d;
-		else if (!d && t === "{") l += 1;
-		else if (!d && t === "}" && (--l, l === 0)) {
-			u = e + 1;
+		if (t === "\"") p = !p;
+		else if (!p && t === "{") d += 1;
+		else if (!p && t === "}" && (--d, d === 0)) {
+			f = e + 1;
 			break;
 		}
 	}
-	if (u === -1) return {
-		operation: a,
-		values: null
+	if (f === -1) return {
+		operation: o,
+		values: null,
+		reference: s
 	};
 	try {
 		return {
-			operation: a,
-			values: i(JSON.parse(s.slice(c, u)))
+			operation: o,
+			values: a(JSON.parse(l.slice(u, f))),
+			reference: s
 		};
 	} catch {
 		return {
-			operation: a,
-			values: null
+			operation: o,
+			values: null,
+			reference: s
 		};
 	}
 }
-function o(e) {
+function s(e) {
 	if (!e) return null;
 	let t = null;
 	for (let n of e) {
 		if (n?.type !== "tool") continue;
-		let e = r(n.state?.output);
+		let e = i(n.state?.output);
 		if (!e) continue;
-		let i = a(e);
-		i && (t = i);
+		let r = o(e);
+		r && (t = r);
 	}
 	return t;
 }
 //#endregion
-export { o as findPendingWrite, a as parseConfirmationRefusal };
+export { s as findPendingWrite, o as parseConfirmationRefusal };

package/dist/shared/assistant/quota.d.ts

@@ -43,6 +43,36 @@ export type QuotaRefusal = "exhausted" | "not-provisioned";
  * would not help.
  */
 export declare function classifyQuotaError(error: unknown): QuotaRefusal | null;
+/**
+ * A quota refusal, plus the facts needed to act on it.
+ *
+ * ★★★ Why this exists (prod, 2026-09-07). The assistant was dead for hours and
+ * the only thing anyone could see was "You've reached your sandbox limit on the
+ * current plan." The gateway had named the exact ceiling —
+ * `platform.sandbox.runtime_hours` — in `extensions.quotaName`, and we threw it
+ * away. The workspace had TWO sandbox quotas; the one everybody stared at
+ * (`platform.sandbox.environments`, 0 of 60 used) was fine, and the one that was
+ * actually blocking went unexamined because nothing on screen named it.
+ *
+ * A ceiling you cannot name is a ceiling you cannot raise.
+ */
+export interface QuotaRefusalDetail {
+    refusal: QuotaRefusal;
+    /** WHICH ceiling — e.g. `platform.sandbox.runtime_hours`. */
+    quotaName: string | null;
+    /** The refusing service's trace id, so support can find the request. */
+    traceId: string | null;
+}
+/**
+ * Which refusal this is AND what it was about, or null when not a quota wall.
+ *
+ * ★ Deliberately falls back to {@link isQuotaExhaustedError} rather than using
+ * {@link classifyQuotaError} alone: the classifier keys on `extensions.code`,
+ * but the assistant's raw-fetch transport can surface a bare quota string with
+ * no code at all. Dropping that path here would have quietly narrowed the wall
+ * the chat area already catches.
+ */
+export declare function describeQuotaError(error: unknown): QuotaRefusalDetail | null;
 export type QuotaKind = "sandbox" | "ai-credits" | "generic";
 /**
  * Event the assistant dispatches on a quota wall, namespaced by product.

package/dist/shared/assistant/quota.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"quota.d.ts","sourceRoot":"","sources":["../../../src/shared/assistant/quota.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAmBH;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAmB7D;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,YAAY,GAAG,WAAW,GAAG,iBAAiB,CAAC;AA0C3D;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,YAAY,GAAG,IAAI,CAStE;AAED,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,YAAY,GAAG,SAAS,CAAC;AAE7D;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,SAAS,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B"}
+{"version":3,"file":"quota.d.ts","sourceRoot":"","sources":["../../../src/shared/assistant/quota.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAmBH;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAmB7D;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,YAAY,GAAG,WAAW,GAAG,iBAAiB,CAAC;AA0C3D;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,YAAY,GAAG,IAAI,CAStE;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,YAAY,CAAC;IACtB,6DAA6D;IAC7D,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,wEAAwE;IACxE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAwBD;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,kBAAkB,GAAG,IAAI,CAmB5E;AAED,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,YAAY,GAAG,SAAS,CAAC;AAE7D;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,SAAS,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B"}

package/dist/shared/assistant/quota.js

@@ -38,8 +38,39 @@ function i(e) {
 	let n = e?.statusCode;
 	return typeof n == "number" && n === 429 ? "exhausted" : null;
 }
-function a(e) {
+function a(t) {
+	if (!t || typeof t != "object") return [];
+	let n = [
+		t,
+		t.result,
+		t.networkError
+	], r = [];
+	for (let t of n) {
+		if (!t || typeof t != "object") continue;
+		let n = t.extensions;
+		n && typeof n == "object" && r.push(n);
+		for (let n of e(t, "errors") ?? []) n.extensions && typeof n.extensions == "object" && r.push(n.extensions);
+	}
+	return r;
+}
+function o(e) {
+	let n = i(e) ?? (t(e) ? "exhausted" : null);
+	if (!n) return null;
+	let r = (t) => {
+		for (let n of a(e)) {
+			let e = n[t];
+			if (typeof e == "string" && e.length > 0) return e;
+		}
+		return null;
+	};
+	return {
+		refusal: n,
+		quotaName: r("quotaName"),
+		traceId: r("traceId")
+	};
+}
+function s(e) {
 	return `${e}:quota-exhausted`;
 }
 //#endregion
-export { i as classifyQuotaError, t as isQuotaExhaustedError, a as quotaExhaustedEventName };
+export { i as classifyQuotaError, o as describeQuotaError, t as isQuotaExhaustedError, s as quotaExhaustedEventName };

package/dist/shared/assistant/ui/AssistantChatArea.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AssistantChatArea.d.ts","sourceRoot":"","sources":["../../../../src/shared/assistant/ui/AssistantChatArea.tsx"],"names":[],"mappings":"AAAA,OAAO,EAML,KAAK,EAAE,EACR,MAAM,OAAO,CAAC;AAmEf,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAoLvE;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;;;;;;;OAYG;IACH,WAAW,CAAC,EAAE,oBAAoB,CAAC;CACpC;AAED,eAAO,MAAM,iBAAiB,EAAE,EAAE,CAAC,sBAAsB,CA+nDxD,CAAC"}
+{"version":3,"file":"AssistantChatArea.d.ts","sourceRoot":"","sources":["../../../../src/shared/assistant/ui/AssistantChatArea.tsx"],"names":[],"mappings":"AAAA,OAAO,EAML,KAAK,EAAE,EACR,MAAM,OAAO,CAAC;AAoEf,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAoLvE;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;;;;;;;OAYG;IACH,WAAW,CAAC,EAAE,oBAAoB,CAAC;CACpC;AAED,eAAO,MAAM,iBAAiB,EAAE,EAAE,CAAC,sBAAsB,CAgtDxD,CAAC"}