@superjackfruitlabs/salaam 0.0.3 → 0.0.4

package/src/agentpod-work-decisions.ts

@@ -2,14 +2,43 @@ import { randomUUID } from 'node:crypto';
 import type { AgentPodWork } from './agentpod-work.js';
 import type { ManagedWork } from './managed.js';
 import { canonical, digest, ServiceError } from './protocol.js';
-import { workDecisionAnswer, type WorkDecision } from './agentpod-work-decision-protocol.js';
+import { type RunGrants, runGrantCovers, runGrantPrefix } from './run-grants.js';
+import {
+  workDecisionAnswer,
+  type WorkDecision,
+  type WorkDecisionDetail,
+} from './agentpod-work-decision-protocol.js';
 /** Private authenticated Hub control only. Answers choose an existing approval;
  * they never execute an operation or supply a second effect grant. */
 export class AgentPodWorkDecisions {
   constructor(
     readonly work: AgentPodWork,
     readonly managed: ManagedWork,
+    readonly grants?: RunGrants,
   ) {}
+  /** The run directory a grant for this operation would cover, when it is a covered write. */
+  private grantable(binding: unknown, op: { kind: string; value: string }): string | null {
+    if (!this.grants || op.kind !== 'workspace') return null;
+    const run = (binding as { run?: { id?: unknown } } | null)?.run;
+    const prefix = runGrantPrefix(typeof run?.id === 'string' ? run.id : '');
+    let args: Record<string, unknown> = {};
+    try {
+      args = JSON.parse(op.value) as Record<string, unknown>;
+    } catch {
+      return null;
+    }
+    return prefix && runGrantCovers(prefix, args) ? prefix : null;
+  }
+  /** "Always allow" covers exactly what the standing workspace-write rule answers: a workspace
+   * write anywhere in the workspace, never a delete or a hidden path. */
+  private alwaysAllowable(op: { kind: string; value: string }): boolean {
+    if (op.kind !== 'workspace') return false;
+    try {
+      return runGrantCovers('', JSON.parse(op.value) as Record<string, unknown>);
+    } catch {
+      return false;
+    }
+  }
   private owner(binding: unknown) {
     const root = this.work.authority.inspect(binding);
     const row = this.work.store.db
@@ -51,10 +80,23 @@ export class AgentPodWorkDecisions {
             version: 1,
             request_id: randomUUID(),
             ...identity,
-            question: 'Approve this exact operation? ' + op.kind + ' ' + op.action_key,
+            question: approvalDetail(op).summary + '?',
+            detail: approvalDetail(op),
             options: [
-              { id: 'approve', title: 'Approve once' },
-              { id: 'deny', title: 'Deny' },
+              { id: 'approve' as const, title: 'Approve once' },
+              ...(this.grantable(root.binding, op)
+                ? [{ id: 'approve-run' as const, title: 'Approve for this run' }]
+                : []),
+              ...(this.alwaysAllowable(op)
+                ? [
+                    {
+                      id: 'always' as const,
+                      title: 'Always allow this agent to write in its workspace',
+                      requires: 'workspace-admin' as const,
+                    },
+                  ]
+                : []),
+              { id: 'deny' as const, title: 'Deny' },
             ],
           }),
         );
@@ -97,13 +139,45 @@ export class AgentPodWorkDecisions {
           approval.expires_at !== offered.expires_at
         )
           throw new ServiceError('approval_mismatch', 'Approval ownership changed');
+        // "Approve for this run" must have been offered, and still be grantable, to be chosen.
+        const prefix =
+          answer.option_id === 'approve-run'
+            ? this.grantable(root.binding, this.managed.operation(offered.operation_id))
+            : null;
+        if (
+          answer.option_id === 'approve-run' &&
+          (!prefix || !offered.options.some((o) => o.id === 'approve-run'))
+        )
+          throw new ServiceError('approval_mismatch', 'This approval cannot cover the run');
+        // "Always allow" approves this write; the standing rule is the hub's, set before it forwards.
+        if (
+          answer.option_id === 'always' &&
+          (!offered.options.some((o) => o.id === 'always') ||
+            !this.alwaysAllowable(this.managed.operation(offered.operation_id)))
+        )
+          throw new ServiceError(
+            'approval_mismatch',
+            'Always allow was not offered for this write',
+          );
         this.managed.decide(
           offered.approval_id,
           answer.request_id,
           offered.approval_revision,
           offered.operation_digest,
-          answer.option_id,
+          answer.option_id === 'deny' ? 'deny' : 'approve',
         );
+        const grant =
+          answer.option_id === 'approve-run'
+            ? this.grants!.createInTransaction({
+                session_id: root.session_id,
+                task_id: task.id,
+                plan_revision: offered.plan_revision,
+                binding_digest: offered.binding_digest,
+                path_prefix: prefix!,
+                approval_id: offered.approval_id,
+                granted_by: answer.answered_by,
+              })
+            : null;
         this.work.store.execution.assert(root.session_id);
         return {
           version: 1 as const,
@@ -111,8 +185,52 @@ export class AgentPodWorkDecisions {
           decision_digest: answer.decision_digest,
           approval_id: offered.approval_id,
           decision: answer.option_id,
+          ...(grant ? { grant_id: grant.id } : {}),
         };
       },
     );
   }
 }
+
+/** Readable approvals: what a person approves, from the operation's own canonical arguments only.
+ * A workspace write names its file, the change, its size, a short preview and the agent's one-line
+ * reason; anything else names its kind and target. The digest still binds the exact operation. */
+export function approvalDetail(op: {
+  kind: string;
+  action_key: string;
+  target: string;
+  value: string;
+  operation_digest: string;
+}): WorkDecisionDetail {
+  const base = { version: 1 as const, reason: null, files: [], digest: op.operation_digest };
+  if (op.kind === 'review') return { ...base, summary: 'Accept this step for review' };
+  if (op.kind !== 'workspace')
+    return { ...base, summary: ('Run ' + op.kind + ' ' + op.target).slice(0, 200) };
+  let args: Record<string, unknown> = {};
+  try {
+    args = JSON.parse(op.value) as Record<string, unknown>;
+  } catch {
+    /* not a patch: the generic form below */
+  }
+  const path = typeof args.path === 'string' ? args.path : op.target.replace(/^station:/, '');
+  const content = typeof args.content === 'string' ? args.content : null;
+  const change = args.content === null ? 'delete' : args.expected_hash === null ? 'create' : 'edit';
+  const verb = { create: 'Create', edit: 'Edit', delete: 'Delete' }[change];
+  const reason =
+    typeof args.reason === 'string' && args.reason.trim()
+      ? args.reason.replace(/\s+/g, ' ').trim().slice(0, 300)
+      : null;
+  return {
+    ...base,
+    summary: (verb + ' ' + path + ' in the workspace').slice(0, 200),
+    reason,
+    files: [
+      {
+        path: path.slice(0, 512),
+        change,
+        bytes: content === null ? null : Buffer.byteLength(content),
+        preview: content === null ? null : content.slice(0, 1200),
+      },
+    ],
+  };
+}