@qduc/term2 0.1.7 → 0.2.0

package/dist/services/conversation-service.js.map

@@ -1 +1 @@
-{"version":3,"file":"conversation-service.js","sourceRoot":"","sources":["../../source/services/conversation-service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAIhE;;;;GAIG;AACH,MAAM,OAAO,mBAAmB;IACrB,QAAQ,CAAsB;IAEvC,YAAY,EACV,WAAW,EACX,IAAI,EACJ,SAAS,GAAG,SAAS,GAKtB;QACC,IAAI,CAAC,QAAQ,GAAG,IAAI,mBAAmB,CAAC,SAAS,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC1B,CAAC;IAED,KAAK;QACH,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;IAED,QAAQ,CAAC,KAAa;QACpB,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAED,kBAAkB,CAAC,MAAW;QAC5B,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC3C,CAAC;IAED,cAAc,CAAC,WAAgB;QAC5B,IAAI,CAAC,QAAgB,CAAC,cAAc,EAAE,CAAC,WAAW,CAAC,CAAC;IACvD,CAAC;IAED,WAAW,CAAC,QAAgB;QAC1B,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC;IAED,gBAAgB,CAAC,QAAoB;QACnC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;IAED,eAAe,CAAC,WAAmB;QACjC,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK;QACH,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;IAED,WAAW,CAAC,GAAG,IAAoD;QACjE,OAAO,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,CAAC;IAC5C,CAAC;IAED,sBAAsB,CAAC,GAAG,IAA+D;QACvF,OAAO,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC,GAAG,IAAI,CAAC,CAAC;IACvD,CAAC;CACF"}
+{"version":3,"file":"conversation-service.js","sourceRoot":"","sources":["../../source/services/conversation-service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAMhE;;;;GAIG;AACH,MAAM,OAAO,mBAAmB;IACrB,QAAQ,CAAsB;IAEvC,YAAY,EACV,WAAW,EACX,IAAI,EACJ,SAAS,GAAG,SAAS,GAKtB;QACC,IAAI,CAAC,QAAQ,GAAG,IAAI,mBAAmB,CAAC,SAAS,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC1B,CAAC;IAED,KAAK;QACH,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;IAED,QAAQ,CAAC,KAAa;QACpB,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAED,kBAAkB,CAAC,MAA8B;QAC/C,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC3C,CAAC;IAED,cAAc,CAAC,WAAoB;QACjC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;IAC5C,CAAC;IAED,WAAW,CAAC,QAAgB;QAC1B,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC;IAED,gBAAgB,CAAC,QAAoB;QACnC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;IAED,eAAe,CAAC,WAAmB;QACjC,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK;QACH,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;IAED,WAAW,CAAC,GAAG,IAAoD;QACjE,OAAO,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,CAAC;IAC5C,CAAC;IAED,sBAAsB,CACpB,GAAG,IAA+D;QAElE,OAAO,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC,GAAG,IAAI,CAAC,CAAC;IACvD,CAAC;CACF"}

package/dist/services/conversation-session.auto-approval.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=conversation-session.auto-approval.test.d.ts.map

package/dist/services/conversation-session.auto-approval.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"conversation-session.auto-approval.test.d.ts","sourceRoot":"","sources":["../../source/services/conversation-session.auto-approval.test.ts"],"names":[],"mappings":""}

package/dist/services/conversation-session.auto-approval.test.js

@@ -0,0 +1,617 @@
+import test from 'ava';
+import { ConversationSession } from './conversation-session.js';
+import { createMockSettingsService } from './settings-service.mock.js';
+const createMockLogger = () => ({
+    info: () => { },
+    warn: () => { },
+    error: () => { },
+    debug: () => { },
+    security: () => { },
+    setCorrelationId: () => { },
+    getCorrelationId: () => 'trace-auto-approval-test',
+    clearCorrelationId: () => { },
+});
+class MockStream {
+    events;
+    completed;
+    lastResponseId;
+    interruptions;
+    state;
+    newItems;
+    history;
+    finalOutput;
+    constructor(events = []) {
+        this.events = events;
+        this.completed = Promise.resolve(undefined);
+        this.lastResponseId = 'resp-test';
+        this.interruptions = [];
+        this.state = {};
+        this.newItems = [];
+        this.history = [];
+        this.finalOutput = '';
+    }
+    async *[Symbol.asyncIterator]() {
+        for (const event of this.events) {
+            yield event;
+        }
+    }
+}
+const createApprovalState = () => ({
+    approveCalls: [],
+    rejectCalls: [],
+    approve(interruption) {
+        this.approveCalls.push(interruption);
+    },
+    reject(interruption) {
+        this.rejectCalls.push(interruption);
+    },
+});
+const createShellInterruption = ({ callId, command, toolName = 'shell', }) => ({
+    name: toolName,
+    agent: { name: 'CLI Agent' },
+    arguments: JSON.stringify({ command }),
+    ...(callId ? { callId } : {}),
+});
+const createNonShellInterruption = ({ callId, toolName = 'apply_patch', argumentsValue = { path: 'source/app.tsx' }, }) => ({
+    name: toolName,
+    agent: { name: 'CLI Agent' },
+    arguments: JSON.stringify(argumentsValue),
+    ...(callId ? { callId } : {}),
+});
+const createInterruptedStream = (interruptions) => {
+    const stream = new MockStream();
+    stream.interruptions = interruptions;
+    stream.state = createApprovalState();
+    return stream;
+};
+const createFinalStream = (finalOutput = 'Done.') => {
+    const stream = new MockStream();
+    stream.finalOutput = finalOutput;
+    return stream;
+};
+const getApprovalResult = (t, result) => {
+    t.truthy(result);
+    t.is(result?.type, 'approval_required');
+    if (!result || result.type !== 'approval_required') {
+        throw new Error('Expected approval_required result');
+    }
+    return result;
+};
+const getResponseResult = (t, result) => {
+    t.truthy(result);
+    t.is(result?.type, 'response');
+    if (!result || result.type !== 'response') {
+        throw new Error('Expected response result');
+    }
+    return result;
+};
+const createSessionHarness = ({ settingsOverrides = {}, startStreams = [], continuationStreams = [], chatImpl, }) => {
+    const chatCalls = [];
+    let startIndex = 0;
+    let continuationIndex = 0;
+    const agentClient = {
+        async startStream() {
+            const stream = startStreams[startIndex++];
+            if (!stream) {
+                throw new Error(`Missing startStream stub at index ${String(startIndex - 1)}`);
+            }
+            return stream;
+        },
+        async continueRunStream() {
+            const stream = continuationStreams[continuationIndex++];
+            if (!stream) {
+                throw new Error(`Missing continueRunStream stub at index ${String(continuationIndex - 1)}`);
+            }
+            return stream;
+        },
+        async chat(prompt, options) {
+            chatCalls.push({ prompt, options });
+            if (!chatImpl) {
+                throw new Error('Unexpected chat() call');
+            }
+            return chatImpl(prompt, options);
+        },
+    };
+    const session = new ConversationSession('session-auto-approval', {
+        agentClient: agentClient,
+        deps: {
+            logger: createMockLogger(),
+            settingsService: createMockSettingsService({
+                'shell.autoApproveMode': 'advisory',
+                'agent.autoApproveModel': 'test-auto-model',
+                'agent.autoApproveProvider': 'test-auto-provider',
+                ...settingsOverrides,
+            }),
+        },
+    });
+    return { session, chatCalls };
+};
+const malformedResponseMacro = {
+    exec: async (t, { llmResponse, expectedReasoning }) => {
+        const initialStream = createInterruptedStream([
+            createShellInterruption({ callId: 'call-safe', command: 'ls source' }),
+        ]);
+        const { session, chatCalls } = createSessionHarness({
+            startStreams: [initialStream],
+            chatImpl: async () => llmResponse,
+        });
+        const result = await session.sendMessage('inspect the source tree');
+        const approval = getApprovalResult(t, result).approval;
+        t.deepEqual(approval.llmAdvisory, {
+            model: 'test-auto-model',
+            reasoning: expectedReasoning,
+            approved: false,
+            source: 'llm',
+        });
+        t.is(chatCalls.length, 1);
+    },
+    title: (providedTitle = 'malformed LLM advisory response', { llmResponse }) => `${providedTitle}: ${llmResponse.slice(0, 40)}`,
+};
+test('shell auto-approval off skips advisory evaluation and omits llmAdvisory', async (t) => {
+    const first = createShellInterruption({ callId: 'call-off-1', command: 'ls source' });
+    const second = createShellInterruption({ callId: 'call-off-2', command: 'pwd' });
+    const initialStream = createInterruptedStream([first, second]);
+    const continuationStream = createInterruptedStream([second]);
+    const { session, chatCalls } = createSessionHarness({
+        settingsOverrides: { 'shell.autoApproveMode': 'off' },
+        startStreams: [initialStream],
+        continuationStreams: [continuationStream],
+    });
+    const firstResult = await session.sendMessage('inspect the project');
+    const firstApproval = getApprovalResult(t, firstResult).approval;
+    t.is(firstApproval.llmAdvisory, undefined);
+    const secondResult = await session.handleApprovalDecision('y');
+    const secondApproval = getApprovalResult(t, secondResult).approval;
+    t.is(secondApproval.llmAdvisory, undefined);
+    t.is(chatCalls.length, 0);
+});
+test('RED-classified shell command includes LLM rationale but remains a system rejection advisory', async (t) => {
+    const initialStream = createInterruptedStream([createShellInterruption({ callId: 'call-red', command: 'rm -rf /' })]);
+    const { session, chatCalls } = createSessionHarness({
+        startStreams: [initialStream],
+        chatImpl: async (prompt) => {
+            t.true(prompt.includes('call-red'));
+            t.true(prompt.includes('rm -rf /'));
+            return JSON.stringify({
+                results: [
+                    {
+                        id: 'call-red',
+                        reasoning: 'This command recursively deletes files from the filesystem root.',
+                        approved: false,
+                    },
+                ],
+            });
+        },
+    });
+    const result = await session.sendMessage('clean up the machine');
+    const approval = getApprovalResult(t, result).approval;
+    const llmAdvisory = approval.llmAdvisory;
+    t.truthy(llmAdvisory);
+    t.is(llmAdvisory?.approved, false);
+    t.is(llmAdvisory?.model, 'test-auto-model');
+    t.is(llmAdvisory?.source, 'system');
+    t.regex(llmAdvisory?.reasoning ?? '', /Blocked by safety heuristics \(RED\):/);
+    t.regex(llmAdvisory?.reasoning ?? '', /Model advisory: This command recursively deletes files/);
+    t.is(chatCalls.length, 1);
+});
+test('single safe shell command calls the LLM once and attaches its advisory', async (t) => {
+    const initialStream = createInterruptedStream([
+        createShellInterruption({ callId: 'call-safe-1', command: 'ls source' }),
+    ]);
+    const { session, chatCalls } = createSessionHarness({
+        startStreams: [initialStream],
+        chatImpl: async () => JSON.stringify({
+            results: [
+                {
+                    id: 'call-safe-1',
+                    reasoning: 'Listing the source folder is read-only and matches the request.',
+                    approved: true,
+                },
+            ],
+        }),
+    });
+    const result = await session.sendMessage('inspect the source tree');
+    const approval = getApprovalResult(t, result).approval;
+    t.deepEqual(approval.llmAdvisory, {
+        model: 'test-auto-model',
+        reasoning: 'Listing the source folder is read-only and matches the request.',
+        approved: true,
+        source: 'llm',
+    });
+    t.is(chatCalls.length, 1);
+    t.true(chatCalls[0].prompt.includes('call-safe-1'));
+    t.true(chatCalls[0].prompt.includes('ls source'));
+    t.true(chatCalls[0].prompt.includes('inspect the source tree'));
+    t.is(chatCalls[0].options.model, 'test-auto-model');
+    t.is(chatCalls[0].options.provider, 'test-auto-provider');
+    t.is(chatCalls[0].options.reasoningEffort, 'none');
+});
+test('batch evaluation calls the LLM once and reuses cached advisories across sequential approvals', async (t) => {
+    const first = createShellInterruption({ callId: 'call-batch-1', command: 'ls source' });
+    const second = createShellInterruption({ callId: 'call-batch-2', command: 'pwd' });
+    const third = createShellInterruption({ callId: 'call-batch-3', command: 'git status' });
+    const initialStream = createInterruptedStream([first, second, third]);
+    const continuationOne = createInterruptedStream([second, third]);
+    const continuationTwo = createInterruptedStream([third]);
+    const finalContinuation = createFinalStream('All commands handled.');
+    const { session, chatCalls } = createSessionHarness({
+        startStreams: [initialStream],
+        continuationStreams: [continuationOne, continuationTwo, finalContinuation],
+        chatImpl: async () => JSON.stringify({
+            results: [
+                { id: 'call-batch-1', reasoning: 'Listing files is safe.', approved: true },
+                { id: 'call-batch-2', reasoning: 'Printing the working directory is safe.', approved: true },
+                { id: 'call-batch-3', reasoning: 'Reading git status is safe.', approved: true },
+            ],
+        }),
+    });
+    const firstResult = await session.sendMessage('inspect the repository');
+    t.deepEqual(getApprovalResult(t, firstResult).approval.llmAdvisory, {
+        model: 'test-auto-model',
+        reasoning: 'Listing files is safe.',
+        approved: true,
+        source: 'llm',
+    });
+    t.is(chatCalls.length, 1);
+    const secondResult = await session.handleApprovalDecision('y');
+    t.deepEqual(getApprovalResult(t, secondResult).approval.llmAdvisory, {
+        model: 'test-auto-model',
+        reasoning: 'Printing the working directory is safe.',
+        approved: true,
+        source: 'llm',
+    });
+    t.is(chatCalls.length, 1);
+    const thirdResult = await session.handleApprovalDecision('y');
+    t.deepEqual(getApprovalResult(t, thirdResult).approval.llmAdvisory, {
+        model: 'test-auto-model',
+        reasoning: 'Reading git status is safe.',
+        approved: true,
+        source: 'llm',
+    });
+    t.is(chatCalls.length, 1);
+    const finalResult = await session.handleApprovalDecision('y');
+    t.is(getResponseResult(t, finalResult).finalText, 'All commands handled.');
+    t.is(chatCalls.length, 1);
+});
+test('mixed RED and non-RED batch evaluates both while RED remains system rejected', async (t) => {
+    const red = createShellInterruption({ callId: 'call-mixed-red', command: 'rm -rf /' });
+    const safe = createShellInterruption({ callId: 'call-mixed-safe', command: 'ls source' });
+    const initialStream = createInterruptedStream([red, safe]);
+    const continuationStream = createInterruptedStream([safe]);
+    const { session, chatCalls } = createSessionHarness({
+        startStreams: [initialStream],
+        continuationStreams: [continuationStream],
+        chatImpl: async (prompt) => {
+            t.true(prompt.includes('call-mixed-red'));
+            t.true(prompt.includes('rm -rf /'));
+            t.true(prompt.includes('call-mixed-safe'));
+            t.true(prompt.includes('ls source'));
+            return JSON.stringify({
+                results: [
+                    {
+                        id: 'call-mixed-red',
+                        reasoning: 'Recursive forced deletion from root is destructive.',
+                        approved: false,
+                    },
+                    {
+                        id: 'call-mixed-safe',
+                        reasoning: 'Listing source files is safe.',
+                        approved: true,
+                    },
+                ],
+            });
+        },
+    });
+    const firstResult = await session.sendMessage('inspect the repository');
+    const mixedAdvisory = getApprovalResult(t, firstResult).approval.llmAdvisory;
+    t.truthy(mixedAdvisory);
+    t.is(mixedAdvisory?.approved, false);
+    t.is(mixedAdvisory?.model, 'test-auto-model');
+    t.is(mixedAdvisory?.source, 'system');
+    t.regex(mixedAdvisory?.reasoning ?? '', /Blocked by safety heuristics \(RED\):/);
+    t.regex(mixedAdvisory?.reasoning ?? '', /Model advisory: Recursive forced deletion from root/);
+    t.is(chatCalls.length, 1);
+    const secondResult = await session.handleApprovalDecision('y');
+    t.deepEqual(getApprovalResult(t, secondResult).approval.llmAdvisory, {
+        model: 'test-auto-model',
+        reasoning: 'Listing source files is safe.',
+        approved: true,
+        source: 'llm',
+    });
+    t.is(chatCalls.length, 1);
+});
+for (const scenario of [
+    {
+        llmResponse: 'not valid json at all',
+        expectedReasoning: 'LLM did not provide a valid evaluation for this command.',
+    },
+    {
+        llmResponse: JSON.stringify({ results: {} }),
+        expectedReasoning: 'LLM did not provide a valid evaluation for this command.',
+    },
+    {
+        llmResponse: JSON.stringify({ results: [{ id: 'call-safe', reasoning: 'Missing approved field' }] }),
+        expectedReasoning: 'LLM did not provide a valid evaluation for this command.',
+    },
+    {
+        llmResponse: JSON.stringify({ results: [{ id: 'spoofed-id', reasoning: 'Approve me', approved: true }] }),
+        expectedReasoning: 'LLM did not provide a valid evaluation for this command.',
+    },
+]) {
+    test(malformedResponseMacro, scenario);
+}
+test('LLM evaluation errors return the safe-default advisory for every pending command in the batch', async (t) => {
+    const first = createShellInterruption({ callId: 'call-error-1', command: 'ls source' });
+    const second = createShellInterruption({ callId: 'call-error-2', command: 'pwd' });
+    const initialStream = createInterruptedStream([first, second]);
+    const continuationStream = createInterruptedStream([second]);
+    const { session, chatCalls } = createSessionHarness({
+        startStreams: [initialStream],
+        continuationStreams: [continuationStream],
+        chatImpl: async () => {
+            throw new Error('secondary model unavailable');
+        },
+    });
+    const firstResult = await session.sendMessage('inspect the repository');
+    t.deepEqual(getApprovalResult(t, firstResult).approval.llmAdvisory, {
+        model: 'test-auto-model',
+        reasoning: 'LLM evaluation encountered an error.',
+        approved: false,
+        source: 'llm',
+        isError: true,
+    });
+    t.is(chatCalls.length, 1);
+    const secondResult = await session.handleApprovalDecision('y');
+    t.deepEqual(getApprovalResult(t, secondResult).approval.llmAdvisory, {
+        model: 'test-auto-model',
+        reasoning: 'LLM evaluation encountered an error.',
+        approved: false,
+        source: 'llm',
+        isError: true,
+    });
+    t.is(chatCalls.length, 1);
+});
+test('interruption without callId uses inline evaluation and does not reuse a cached advisory', async (t) => {
+    const first = createShellInterruption({ command: 'ls source' });
+    const second = createShellInterruption({ command: 'pwd' });
+    const initialStream = createInterruptedStream([first, second]);
+    const continuationStream = createInterruptedStream([second]);
+    let llmResponseIndex = 0;
+    const llmResponses = [
+        JSON.stringify({ results: [{ id: '__single__', reasoning: 'Listing files is safe.', approved: true }] }),
+        JSON.stringify({
+            results: [{ id: '__single__', reasoning: 'Printing the working directory is safe.', approved: true }],
+        }),
+    ];
+    const { session, chatCalls } = createSessionHarness({
+        startStreams: [initialStream],
+        continuationStreams: [continuationStream],
+        chatImpl: async () => llmResponses[llmResponseIndex++],
+    });
+    const firstResult = await session.sendMessage('inspect the repository');
+    t.deepEqual(getApprovalResult(t, firstResult).approval.llmAdvisory, {
+        model: 'test-auto-model',
+        reasoning: 'Listing files is safe.',
+        approved: true,
+        source: 'llm',
+    });
+    t.is(chatCalls.length, 1);
+    const secondResult = await session.handleApprovalDecision('y');
+    t.deepEqual(getApprovalResult(t, secondResult).approval.llmAdvisory, {
+        model: 'test-auto-model',
+        reasoning: 'Printing the working directory is safe.',
+        approved: true,
+        source: 'llm',
+    });
+    t.is(chatCalls.length, 2);
+});
+test('reset clears cached advisories before the next approval turn', async (t) => {
+    const firstTurn = createInterruptedStream([createShellInterruption({ callId: 'call-reset', command: 'ls source' })]);
+    const secondTurn = createInterruptedStream([createShellInterruption({ callId: 'call-reset', command: 'ls source' })]);
+    let llmResponseIndex = 0;
+    const llmResponses = [
+        JSON.stringify({ results: [{ id: 'call-reset', reasoning: 'First advisory.', approved: true }] }),
+        JSON.stringify({ results: [{ id: 'call-reset', reasoning: 'Second advisory after reset.', approved: false }] }),
+    ];
+    const { session, chatCalls } = createSessionHarness({
+        startStreams: [firstTurn, secondTurn],
+        chatImpl: async () => llmResponses[llmResponseIndex++],
+    });
+    const firstResult = await session.sendMessage('inspect the repository');
+    t.deepEqual(getApprovalResult(t, firstResult).approval.llmAdvisory, {
+        model: 'test-auto-model',
+        reasoning: 'First advisory.',
+        approved: true,
+        source: 'llm',
+    });
+    t.is(chatCalls.length, 1);
+    session.reset();
+    const secondResult = await session.sendMessage('inspect the repository again');
+    t.deepEqual(getApprovalResult(t, secondResult).approval.llmAdvisory, {
+        model: 'test-auto-model',
+        reasoning: 'Second advisory after reset.',
+        approved: false,
+        source: 'llm',
+    });
+    t.is(chatCalls.length, 2);
+});
+test('turn completion clears cached advisories so a new turn gets a fresh evaluation', async (t) => {
+    const firstTurn = createInterruptedStream([createShellInterruption({ callId: 'call-turn', command: 'ls source' })]);
+    const firstTurnFinal = createFinalStream('First turn done.');
+    const secondTurn = createInterruptedStream([createShellInterruption({ callId: 'call-turn', command: 'ls source' })]);
+    let llmResponseIndex = 0;
+    const llmResponses = [
+        JSON.stringify({ results: [{ id: 'call-turn', reasoning: 'First turn advisory.', approved: true }] }),
+        JSON.stringify({ results: [{ id: 'call-turn', reasoning: 'Second turn advisory.', approved: false }] }),
+    ];
+    const { session, chatCalls } = createSessionHarness({
+        startStreams: [firstTurn, secondTurn],
+        continuationStreams: [firstTurnFinal],
+        chatImpl: async () => llmResponses[llmResponseIndex++],
+    });
+    const firstResult = await session.sendMessage('inspect the repository');
+    t.deepEqual(getApprovalResult(t, firstResult).approval.llmAdvisory, {
+        model: 'test-auto-model',
+        reasoning: 'First turn advisory.',
+        approved: true,
+        source: 'llm',
+    });
+    t.is(chatCalls.length, 1);
+    const completedTurn = await session.handleApprovalDecision('y');
+    t.is(getResponseResult(t, completedTurn).finalText, 'First turn done.');
+    const secondResult = await session.sendMessage('inspect the repository again');
+    t.deepEqual(getApprovalResult(t, secondResult).approval.llmAdvisory, {
+        model: 'test-auto-model',
+        reasoning: 'Second turn advisory.',
+        approved: false,
+        source: 'llm',
+    });
+    t.is(chatCalls.length, 2);
+});
+test('non-shell tools do not trigger advisory evaluation or attach llmAdvisory', async (t) => {
+    const initialStream = createInterruptedStream([
+        createNonShellInterruption({
+            callId: 'call-patch',
+            toolName: 'apply_patch',
+            argumentsValue: { path: 'source/app.tsx' },
+        }),
+    ]);
+    const { session, chatCalls } = createSessionHarness({
+        startStreams: [initialStream],
+    });
+    const result = await session.sendMessage('apply the patch');
+    const approval = getApprovalResult(t, result).approval;
+    t.is(approval.toolName, 'apply_patch');
+    t.is(approval.llmAdvisory, undefined);
+    t.is(chatCalls.length, 0);
+});
+// Phase 2: Full Auto-Approval tests
+test('auto mode: LLM-approved safe command skips approval_required and returns final response', async (t) => {
+    const initialStream = createInterruptedStream([
+        createShellInterruption({ callId: 'call-auto-1', command: 'ls source' }),
+    ]);
+    const finalStream = createFinalStream('Files listed.');
+    const { session, chatCalls } = createSessionHarness({
+        settingsOverrides: { 'shell.autoApproveMode': 'auto' },
+        startStreams: [initialStream],
+        continuationStreams: [finalStream],
+        chatImpl: async () => JSON.stringify({
+            results: [{ id: 'call-auto-1', reasoning: 'Listing files is read-only and safe.', approved: true }],
+        }),
+    });
+    const result = await session.sendMessage('list the source files');
+    t.is(result?.type, 'response');
+    if (result?.type !== 'response')
+        throw new Error('Expected response');
+    t.is(result.finalText, 'Files listed.');
+    t.is(chatCalls.length, 1);
+});
+test('auto mode: LLM-rejected command still prompts user with advisory', async (t) => {
+    const initialStream = createInterruptedStream([
+        // Use a YELLOW command (not RED) so heuristics pass and the LLM makes the rejection call
+        createShellInterruption({ callId: 'call-auto-reject', command: 'git log --all --format="%H"' }),
+    ]);
+    const { session, chatCalls } = createSessionHarness({
+        settingsOverrides: { 'shell.autoApproveMode': 'auto' },
+        startStreams: [initialStream],
+        chatImpl: async () => JSON.stringify({
+            results: [
+                {
+                    id: 'call-auto-reject',
+                    reasoning: 'Dumping all commit hashes is not aligned with the current task.',
+                    approved: false,
+                },
+            ],
+        }),
+    });
+    const result = await session.sendMessage('run the installer');
+    const approval = getApprovalResult(t, result).approval;
+    t.is(approval.llmAdvisory?.approved, false);
+    t.is(approval.llmAdvisory?.source, 'llm');
+    t.is(chatCalls.length, 1);
+});
+test('auto mode: RED command (source=system) is never auto-approved', async (t) => {
+    const initialStream = createInterruptedStream([
+        createShellInterruption({ callId: 'call-auto-red', command: 'rm -rf /' }),
+    ]);
+    const { session, chatCalls } = createSessionHarness({
+        settingsOverrides: { 'shell.autoApproveMode': 'auto' },
+        startStreams: [initialStream],
+        chatImpl: async () => JSON.stringify({
+            results: [
+                { id: 'call-auto-red', reasoning: 'The model explanation should not auto-approve RED.', approved: true },
+            ],
+        }),
+    });
+    const result = await session.sendMessage('clean the system');
+    const approval = getApprovalResult(t, result).approval;
+    t.is(approval.llmAdvisory?.approved, false);
+    t.is(approval.llmAdvisory?.source, 'system');
+    t.regex(approval.llmAdvisory?.reasoning ?? '', /Model advisory: The model explanation should not auto-approve RED\./);
+    t.is(chatCalls.length, 1);
+});
+test('advisory mode: LLM-approved command still prompts the user (Phase 1 behavior preserved)', async (t) => {
+    const initialStream = createInterruptedStream([
+        createShellInterruption({ callId: 'call-advisory', command: 'ls source' }),
+    ]);
+    const { session, chatCalls } = createSessionHarness({
+        settingsOverrides: { 'shell.autoApproveMode': 'advisory' },
+        startStreams: [initialStream],
+        chatImpl: async () => JSON.stringify({
+            results: [{ id: 'call-advisory', reasoning: 'Listing files is safe.', approved: true }],
+        }),
+    });
+    const result = await session.sendMessage('list the source files');
+    const approval = getApprovalResult(t, result).approval;
+    t.is(approval.llmAdvisory?.approved, true);
+    t.is(approval.llmAdvisory?.source, 'llm');
+    t.is(chatCalls.length, 1);
+});
+test('auto mode: batch of two commands — first auto-approved, second triggers prompt when rejected', async (t) => {
+    const first = createShellInterruption({ callId: 'call-batch-auto-1', command: 'ls source' });
+    // Use a YELLOW (non-RED) command so heuristics pass and LLM makes the rejection call
+    const second = createShellInterruption({ callId: 'call-batch-auto-2', command: 'git log --all --format="%H"' });
+    const initialStream = createInterruptedStream([first, second]);
+    // After first is auto-approved, continuation stream surfaces the second interruption
+    const continuationAfterFirst = createInterruptedStream([second]);
+    const { session, chatCalls } = createSessionHarness({
+        settingsOverrides: { 'shell.autoApproveMode': 'auto' },
+        startStreams: [initialStream],
+        continuationStreams: [continuationAfterFirst],
+        chatImpl: async () => JSON.stringify({
+            results: [
+                { id: 'call-batch-auto-1', reasoning: 'Listing files is safe.', approved: true },
+                {
+                    id: 'call-batch-auto-2',
+                    reasoning: 'Dumping all commit hashes is not aligned with the current task.',
+                    approved: false,
+                },
+            ],
+        }),
+    });
+    // First command is auto-approved, continuation hits the second which is rejected by LLM
+    const result = await session.sendMessage('inspect repository and dump history');
+    const approval = getApprovalResult(t, result).approval;
+    t.is(approval.toolName, 'shell');
+    t.is(approval.llmAdvisory?.approved, false);
+    t.is(approval.llmAdvisory?.source, 'llm');
+    t.is(chatCalls.length, 1);
+});
+test('auto mode: evaluator error falls back to prompt without crashing', async (t) => {
+    const initialStream = createInterruptedStream([
+        createShellInterruption({ callId: 'call-auto-err', command: 'ls source' }),
+    ]);
+    const { session, chatCalls } = createSessionHarness({
+        settingsOverrides: { 'shell.autoApproveMode': 'auto' },
+        startStreams: [initialStream],
+        chatImpl: async () => {
+            throw new Error('model unavailable');
+        },
+    });
+    const result = await session.sendMessage('list files');
+    const approval = getApprovalResult(t, result).approval;
+    t.is(approval.llmAdvisory?.approved, false);
+    t.is(approval.llmAdvisory?.source, 'llm');
+    t.is(chatCalls.length, 1);
+});
+//# sourceMappingURL=conversation-session.auto-approval.test.js.map