@vellumai/assistant 0.10.12 → 0.11.0-staging.2

package/src/permissions/checker.test.ts

@@ -15,12 +15,14 @@ mock.module("../config/assistant-feature-flags.js", () => ({
 }));
 
 // `buildPolicyContext` (used by the integration tests below) precomputes the
-// proc-to-skills gate via `isProcToSkillsActive`. Drive it through this slot so
-// a test can put the production threading path in the active / inactive state.
-let mockProcToSkillsActive = true;
+// proc-to-skills gate via `isV3TierActive`. Drive it through this slot so a
+// test can put the production threading path in the active / inactive state.
+let mockV3TierActive = true;
 mock.module("../config/memory-v3-gate.js", () => ({
-  isProcToSkillsActive: () => mockProcToSkillsActive,
-  isMemoryV3Live: () => mockProcToSkillsActive,
+  isMemoryEnabled: (config?: { memory?: { enabled?: boolean } }) =>
+    config?.memory?.enabled !== false,
+  isV3TierActive: () => mockV3TierActive,
+  isMemoryV3Live: () => mockV3TierActive,
   usesConceptPageMemory: (memory?: {
     enabled?: boolean;
     v2?: { enabled?: boolean };
@@ -30,10 +32,35 @@ mock.module("../config/memory-v3-gate.js", () => ({
     (memory?.v3?.live === true || memory?.v2?.enabled === true),
 }));
 
-// Mock skill resolution — return null by default (no skill found).
+// Mock skill resolution — return null by default (no skill found). The
+// `skill_load` predicate tests drive both slots to model a locally installed
+// skill with or without inline command expansions.
+type MockSkill = {
+  id: string;
+  directoryPath: string;
+  inlineCommandExpansions?: string[];
+  includes?: string[];
+};
+let mockSkillCatalog: MockSkill[] = [];
+let mockResolvedSkill: MockSkill | null = null;
+// Set to make the corresponding skills-module call throw, modelling an
+// unreadable catalog or a selector resolution that hits the filesystem and
+// fails.
+let mockCatalogError: Error | null = null;
+let mockSelectorError: Error | null = null;
 mock.module("../config/skills.js", () => ({
-  loadSkillCatalog: () => [],
-  resolveSkillSelector: () => ({ skill: null }),
+  loadSkillCatalog: () => {
+    if (mockCatalogError) {
+      throw mockCatalogError;
+    }
+    return mockSkillCatalog;
+  },
+  resolveSkillSelector: () => {
+    if (mockSelectorError) {
+      throw mockSelectorError;
+    }
+    return { skill: mockResolvedSkill };
+  },
 }));
 
 // Mock skills helpers used for file context building.
@@ -42,9 +69,9 @@ mock.module("../skills/path-classifier.js", () => ({
   getSkillRoots: () => ["/mock/skills/managed/", "/mock/skills/bundled/"],
 }));
 
-mock.module("../skills/include-graph.js", () => ({
-  indexCatalogById: () => new Map(),
-}));
+// `../skills/include-graph.js` is intentionally left unmocked: it is a pure,
+// side-effect-free traversal, and the `skill_load` predicate tests below need
+// the production include walk to run over `mockSkillCatalog`.
 
 mock.module("../skills/transitive-version-hash.js", () => ({
   computeTransitiveSkillVersionHash: () => "mock-transitive-hash",
@@ -115,10 +142,14 @@ mock.module("./trust-store.js", () => ({
   onRulesChanged: () => {},
 }));
 
-// Mock workspace policy.
+// Mock workspace policy. Spread the real module so pure path helpers
+// (resolveSandboxBase) keep their real behavior for param building.
+const realWorkspacePolicy = await import("./workspace-policy.js");
 let mockIsPathWithinWorkspaceRoot = true;
 mock.module("./workspace-policy.js", () => ({
+  ...realWorkspacePolicy,
   isWorkspaceScopedInvocation: () => false,
+  isOutOfWorkspaceFileInvocation: () => false,
   isPathWithinWorkspaceRoot: () => mockIsPathWithinWorkspaceRoot,
 }));
 
@@ -143,9 +174,13 @@ mock.module("../tools/network/url-safety.js", () => ({
 import type { ClassificationResult } from "./ipc-risk-types.js";
 
 let mockIpcClassifyRiskResult: ClassificationResult | undefined;
+let lastClassifyRiskParams: Record<string, unknown> | undefined;
 
 mock.module("../ipc/gateway-client.js", () => ({
-  ipcClassifyRisk: async () => mockIpcClassifyRiskResult,
+  ipcClassifyRisk: async (params: Record<string, unknown>) => {
+    lastClassifyRiskParams = params;
+    return mockIpcClassifyRiskResult;
+  },
   ipcCall: async () => undefined,
   ipcCallPersistent: async () => undefined,
   resetPersistentClient: () => {},
@@ -155,6 +190,7 @@ mock.module("../ipc/gateway-client.js", () => ({
 
 import {
   mkdtempSync,
+  realpathSync,
   rmSync,
   symlinkSync,
   unlinkSync,
@@ -171,6 +207,7 @@ import {
   generateAllowlistOptions,
   generateScopeOptions,
   getCachedAssessment,
+  isInstalledStaticSkillLoad,
 } from "./checker.js";
 import { RiskLevel } from "./types.js";
 
@@ -180,10 +217,15 @@ describe("Permission Checker (gateway IPC)", () => {
   beforeEach(() => {
     mockIsContainerized = false;
     mockIpcClassifyRiskResult = undefined;
+    lastClassifyRiskParams = undefined;
     mockCachedThreshold = "low";
     mockRefreshedThreshold = null;
-    mockProcToSkillsActive = true;
+    mockV3TierActive = true;
     thresholdCallLog.length = 0;
+    mockSkillCatalog = [];
+    mockResolvedSkill = null;
+    mockCatalogError = null;
+    mockSelectorError = null;
   });
 
   // ── classifyRisk ──────────────────────────────────────────────────────────
@@ -246,6 +288,70 @@ describe("Permission Checker (gateway IPC)", () => {
       );
     });
 
+    test("sends canonicalized boundary params for sandbox file tools", async () => {
+      mockIpcClassifyRiskResult = {
+        risk: "medium",
+        reason: "File write outside the workspace",
+        matchType: "registry",
+        scopeOptions: [],
+      };
+      const workingDir = mkdtempSync(join(tmpdir(), "checker-boundary-"));
+      try {
+        await classifyRisk(
+          "file_write",
+          { path: "/tmp/checker-boundary-outside.txt" },
+          workingDir,
+        );
+        expect(lastClassifyRiskParams?.isContainerized).toBe(false);
+        // The boundary is canonicalized so the gateway compares canonical
+        // against canonical (macOS tmpdir lives behind a /var symlink).
+        expect(lastClassifyRiskParams?.resolvedWorkingDir).toBe(
+          realpathSync(workingDir),
+        );
+      } finally {
+        rmSync(workingDir, { recursive: true, force: true });
+      }
+    });
+
+    test("classifies a dangling symlink by its destination", async () => {
+      mockIpcClassifyRiskResult = {
+        risk: "medium",
+        reason: "File write outside the workspace",
+        matchType: "registry",
+        scopeOptions: [],
+      };
+      const workingDir = realpathSync(
+        mkdtempSync(join(tmpdir(), "checker-dangling-")),
+      );
+      const outside = realpathSync(
+        mkdtempSync(join(tmpdir(), "checker-dangling-out-")),
+      );
+      try {
+        const destination = join(outside, "not-yet.txt");
+        symlinkSync(destination, join(workingDir, "dangle"));
+        await classifyRisk("file_write", { path: "dangle" }, workingDir);
+        // The destination does not exist, but a write through the link
+        // creates it — classification must see the destination.
+        expect(lastClassifyRiskParams?.resolvedPath).toBe(destination);
+      } finally {
+        rmSync(workingDir, { recursive: true, force: true });
+        rmSync(outside, { recursive: true, force: true });
+      }
+    });
+
+    test("omits the canonicalized boundary for host file tools", async () => {
+      mockIpcClassifyRiskResult = {
+        risk: "medium",
+        reason: "Host file write (default)",
+        matchType: "registry",
+        scopeOptions: [],
+      };
+      await classifyRisk("host_file_write", {
+        path: "/tmp/checker-boundary-host.txt",
+      });
+      expect(lastClassifyRiskParams?.resolvedWorkingDir).toBeUndefined();
+    });
+
     test("caches results for identical inputs", async () => {
       mockIpcClassifyRiskResult = {
         risk: "low",
@@ -1085,7 +1191,7 @@ describe("Permission Checker (gateway IPC)", () => {
       // Same retrospective ToolContext, but the feature is inactive (flag off
       // or v3 not live). buildPolicyContext stamps `procToSkillsActive: false`,
       // so the grant is dead and the high-risk scaffold prompts.
-      mockProcToSkillsActive = false;
+      mockV3TierActive = false;
       mockIpcClassifyRiskResult = {
         risk: "high",
         reason: "Skill scaffold",
@@ -1262,4 +1368,181 @@ describe("Permission Checker (gateway IPC)", () => {
       expect(options).toEqual([]);
     });
   });
+
+  // ── isInstalledStaticSkillLoad ────────────────────────────────────────────
+
+  describe("isInstalledStaticSkillLoad", () => {
+    function installSkill(inlineCommandExpansions?: string[]): void {
+      const skill: MockSkill = {
+        id: "note-taker",
+        directoryPath: "/mock/skills/bundled/note-taker",
+        inlineCommandExpansions,
+      };
+      mockResolvedSkill = skill;
+      mockSkillCatalog = [skill];
+    }
+
+    /**
+     * Install a `note-taker` parent whose selector resolves, plus whichever
+     * children are given. Children the parent includes but that are absent
+     * from `children` model an include that is not installed locally.
+     */
+    function installGraph(
+      parentIncludes: string[],
+      children: MockSkill[],
+      parentInlineCommandExpansions?: string[],
+    ): void {
+      const parent: MockSkill = {
+        id: "note-taker",
+        directoryPath: "/mock/skills/bundled/note-taker",
+        inlineCommandExpansions: parentInlineCommandExpansions,
+        includes: parentIncludes,
+      };
+      mockResolvedSkill = parent;
+      mockSkillCatalog = [parent, ...children];
+    }
+
+    function child(id: string, overrides: Partial<MockSkill> = {}): MockSkill {
+      return {
+        id,
+        directoryPath: `/mock/skills/bundled/${id}`,
+        ...overrides,
+      };
+    }
+
+    test("returns false for a tool other than skill_load", () => {
+      installSkill();
+      expect(isInstalledStaticSkillLoad("bash", { skill: "note-taker" })).toBe(
+        false,
+      );
+    });
+
+    test("returns false when the selector is missing", () => {
+      installSkill();
+      expect(isInstalledStaticSkillLoad("skill_load", {})).toBe(false);
+    });
+
+    test("returns false when the selector is blank", () => {
+      installSkill();
+      expect(isInstalledStaticSkillLoad("skill_load", { skill: "   " })).toBe(
+        false,
+      );
+    });
+
+    test("returns false when the skill is not installed locally", () => {
+      mockResolvedSkill = null;
+      mockSkillCatalog = [];
+      expect(
+        isInstalledStaticSkillLoad("skill_load", { skill: "note-taker" }),
+      ).toBe(false);
+    });
+
+    test("returns false when the resolved skill has inline expansions", () => {
+      installSkill(["git status"]);
+      expect(
+        isInstalledStaticSkillLoad("skill_load", { skill: "note-taker" }),
+      ).toBe(false);
+    });
+
+    test("returns true for an installed skill with no inline expansions", () => {
+      installSkill();
+      expect(
+        isInstalledStaticSkillLoad("skill_load", { skill: "note-taker" }),
+      ).toBe(true);
+    });
+
+    // ── Transitive include graph ────────────────────────────────────────────
+    // Loading a parent auto-installs its missing includes and renders inline
+    // commands in included children, so the predicate must clear the whole
+    // graph, not just the target.
+
+    test("returns false when an included skill is missing locally", () => {
+      installGraph(["formatting"], []);
+      expect(
+        isInstalledStaticSkillLoad("skill_load", { skill: "note-taker" }),
+      ).toBe(false);
+    });
+
+    test("returns false when an included skill has inline expansions", () => {
+      installGraph(
+        ["formatting"],
+        [child("formatting", { inlineCommandExpansions: ["git status"] })],
+      );
+      expect(
+        isInstalledStaticSkillLoad("skill_load", { skill: "note-taker" }),
+      ).toBe(false);
+    });
+
+    test("returns false when a grandchild include is missing locally", () => {
+      installGraph(
+        ["formatting"],
+        [child("formatting", { includes: ["typography"] })],
+      );
+      expect(
+        isInstalledStaticSkillLoad("skill_load", { skill: "note-taker" }),
+      ).toBe(false);
+    });
+
+    test("returns false when a grandchild include has inline expansions", () => {
+      installGraph(
+        ["formatting"],
+        [
+          child("formatting", { includes: ["typography"] }),
+          child("typography", { inlineCommandExpansions: ["date"] }),
+        ],
+      );
+      expect(
+        isInstalledStaticSkillLoad("skill_load", { skill: "note-taker" }),
+      ).toBe(false);
+    });
+
+    test("returns false for a cyclic include graph", () => {
+      installGraph(
+        ["formatting"],
+        [child("formatting", { includes: ["note-taker"] })],
+      );
+      expect(
+        isInstalledStaticSkillLoad("skill_load", { skill: "note-taker" }),
+      ).toBe(false);
+    });
+
+    test("returns true when every transitive include is installed and static", () => {
+      installGraph(
+        ["formatting"],
+        [
+          child("formatting", { includes: ["typography"] }),
+          child("typography"),
+        ],
+      );
+      expect(
+        isInstalledStaticSkillLoad("skill_load", { skill: "note-taker" }),
+      ).toBe(true);
+    });
+
+    // ── Fail-closed ─────────────────────────────────────────────────────────
+    // The live-voice contention gate calls this from a synchronous event
+    // callback, so a throw would abort the rest of the frame's dispatch.
+
+    test("returns false when the catalog cannot be read", () => {
+      installSkill();
+      mockCatalogError = new Error("catalog unreadable");
+      expect(() =>
+        isInstalledStaticSkillLoad("skill_load", { skill: "note-taker" }),
+      ).not.toThrow();
+      expect(
+        isInstalledStaticSkillLoad("skill_load", { skill: "note-taker" }),
+      ).toBe(false);
+    });
+
+    test("returns false when selector resolution throws", () => {
+      installSkill();
+      mockSelectorError = new Error("skill directory unreadable");
+      expect(() =>
+        isInstalledStaticSkillLoad("skill_load", { skill: "note-taker" }),
+      ).not.toThrow();
+      expect(
+        isInstalledStaticSkillLoad("skill_load", { skill: "note-taker" }),
+      ).toBe(false);
+    });
+  });
 });

package/src/permissions/checker.ts

@@ -4,13 +4,17 @@ import { dirname, join, resolve } from "node:path";
 
 import { getIsContainerized } from "../config/env-registry.js";
 import { getConfig } from "../config/loader.js";
-import { loadSkillCatalog, resolveSkillSelector } from "../config/skills.js";
+import {
+  loadSkillCatalog,
+  resolveSkillSelector,
+  type SkillSummary,
+} from "../config/skills.js";
 import { ipcClassifyRisk } from "../ipc/gateway-client.js";
 import {
   MEMORY_RETROSPECTIVE_ORIGIN,
   SKILL_MANAGEMENT_SKILL_ID,
 } from "../plugins/defaults/memory/memory-retrospective-constants.js";
-import { indexCatalogById } from "../skills/include-graph.js";
+import { indexCatalogById, validateIncludes } from "../skills/include-graph.js";
 import { getSkillRoots } from "../skills/path-classifier.js";
 import { computeTransitiveSkillVersionHash } from "../skills/transitive-version-hash.js";
 import { computeSkillVersionHash } from "../skills/version-hash.js";
@@ -53,6 +57,7 @@ import {
 import {
   isPathWithinWorkspaceRoot,
   isWorkspaceScopedInvocation,
+  resolveSandboxBase,
 } from "./workspace-policy.js";
 
 // ── Risk classification cache ────────────────────────────────────────────────
@@ -155,7 +160,7 @@ function fileToolFsStateKey(
     return undefined;
   }
   const resolved = resolveFileToolPaths(toolName, input, workingDir);
-  return `${resolved.resolvedPath ?? ""}\0${resolved.resolvedTransferDestPath ?? ""}`;
+  return `${resolved.resolvedPath ?? ""}\0${resolved.resolvedTransferDestPath ?? ""}\0${resolved.resolvedWorkingDir ?? ""}`;
 }
 
 /** Clear the risk classification cache. Called when trust rules change. Exported for test setup. */
@@ -210,7 +215,7 @@ function resolveSkillIdAndHash(
  * registry (`getToolOwner(name)`) rather than read from the `Tool` object,
  * since ownership lives on the registry, not on the tool itself.
  */
-function isToolOwnerSkillBundled(tool: Tool | undefined): boolean {
+export function isToolOwnerSkillBundled(tool: Tool | undefined): boolean {
   if (!tool) {
     return false;
   }
@@ -223,18 +228,44 @@ function isToolOwnerSkillBundled(tool: Tool | undefined): boolean {
 }
 
 /**
- * Check whether a skill (by id) has parsed inline command expansions.
- * Returns false when the skill is not found in the catalog.
+ * Whether a catalog entry carries parsed inline command expansions, which
+ * execute shell commands at load time. Returns false for an absent entry.
  */
-function hasInlineExpansions(skillId: string): boolean {
-  const catalog = loadSkillCatalog();
-  const skill = catalog.find((s) => s.id === skillId);
+function summaryHasInlineExpansions(skill: SkillSummary | undefined): boolean {
   return (
     skill?.inlineCommandExpansions != null &&
     skill.inlineCommandExpansions.length > 0
   );
 }
 
+/**
+ * Check whether a skill (by id) has parsed inline command expansions.
+ * Returns false when the skill is not found in the catalog.
+ */
+function hasInlineExpansions(skillId: string): boolean {
+  const catalog = loadSkillCatalog();
+  return summaryHasInlineExpansions(catalog.find((s) => s.id === skillId));
+}
+
+/**
+ * The id of the skill a `skill_load` invocation targets, or `null` for any
+ * other tool, a blank selector, or a selector that names no skill in the
+ * local catalog.
+ */
+function resolveSkillLoadTargetId(
+  toolName: string,
+  input: Record<string, unknown>,
+): string | null {
+  if (toolName !== "skill_load") {
+    return null;
+  }
+  const selector = getStringField(input, "skill").trim();
+  if (!selector) {
+    return null;
+  }
+  return resolveSkillIdAndHash(selector)?.id ?? null;
+}
+
 /**
  * Whether this invocation is an inline-command ("dynamic") skill load: a
  * `skill_load` whose resolved skill carries inline command expansions,
@@ -249,15 +280,56 @@ export function isDynamicSkillLoadInvocation(
   toolName: string,
   input: Record<string, unknown>,
 ): boolean {
-  if (toolName !== "skill_load") {
-    return false;
-  }
-  const selector = getStringField(input, "skill").trim();
-  if (!selector) {
+  const skillId = resolveSkillLoadTargetId(toolName, input);
+  return skillId !== null && hasInlineExpansions(skillId);
+}
+
+/**
+ * Whether a `skill_load` invocation is a pure read: the target skill and every
+ * skill reachable through its `includes` graph are installed locally and carry
+ * no inline command expansions.
+ *
+ * The whole graph matters because the load executor (tools/skills/load.ts)
+ * auto-installs missing includes from the remote catalog
+ * (`autoInstallFromCatalog`) and renders inline command expansions for both the
+ * target and its included children. So a missing include anywhere in the graph
+ * writes to the workspace, an inline expansion anywhere in it executes shell,
+ * and either makes the load something other than a read.
+ *
+ * Fails closed and never throws — an unresolvable selector, a target absent
+ * from the catalog, a missing include, a cycle, or an unreadable catalog all
+ * return false. Selector resolution and catalog reads both touch the
+ * filesystem, so both sit inside the guard: callers include a synchronous
+ * live-voice event callback where a throw would abort the rest of the frame's
+ * dispatch. Exported for gates that must not proceed on anything capable of
+ * writing local state.
+ */
+export function isInstalledStaticSkillLoad(
+  toolName: string,
+  input: Record<string, unknown>,
+): boolean {
+  try {
+    const skillId = resolveSkillLoadTargetId(toolName, input);
+    if (skillId === null) {
+      return false;
+    }
+    const catalogIndex = indexCatalogById(loadSkillCatalog());
+    if (!catalogIndex.has(skillId)) {
+      return false;
+    }
+    // `validateIncludes` is the shared include-graph walk: it reports the first
+    // missing child or cycle, and on success yields every transitively included
+    // id in DFS order.
+    const validation = validateIncludes(skillId, catalogIndex);
+    if (!validation.ok) {
+      return false;
+    }
+    return validation.visited.every(
+      (id) => !summaryHasInlineExpansions(catalogIndex.get(id)),
+    );
+  } catch {
     return false;
   }
-  const resolved = resolveSkillIdAndHash(selector);
-  return resolved !== null && hasInlineExpansions(resolved.id);
 }
 
 /**
@@ -389,25 +461,6 @@ function buildFileContext(): FileContext {
  * filesystem this process cannot see (e.g. host_file paths proxied to a remote
  * client), so this never regresses below today's lexical behavior.
  */
-// The Docker sandbox mounts the workspace at /workspace, and the model emits
-// container-scoped paths (e.g. "/workspace/tools/evil.ts") even on local turns.
-// Mirror the gateway's resolveSandboxPath remap so the symlink-resolved path we
-// forward lines up with the gateway's lexical fallback and the protected dirs.
-const CONTAINER_WORKSPACE_PREFIX = "/workspace/";
-const CONTAINER_WORKSPACE_EXACT = "/workspace";
-
-function resolveSandboxBase(rawPath: string, workingDir: string): string {
-  let effectivePath = rawPath;
-  if (!rawPath.startsWith(workingDir + "/") && rawPath !== workingDir) {
-    if (rawPath.startsWith(CONTAINER_WORKSPACE_PREFIX)) {
-      effectivePath = rawPath.slice(CONTAINER_WORKSPACE_PREFIX.length);
-    } else if (rawPath === CONTAINER_WORKSPACE_EXACT) {
-      effectivePath = ".";
-    }
-  }
-  return resolve(workingDir, effectivePath);
-}
-
 function resolveClassificationPath(
   filePath: string,
   workingDir: string,
@@ -441,6 +494,13 @@ interface FileToolResolution {
   effectiveWorkingDir: string;
   isHostTool: boolean;
   resolvedPath?: string;
+  /**
+   * Symlink-canonicalized working dir for sandbox file tools, paired with
+   * `resolvedPath` so the gateway's workspace-boundary check compares
+   * canonical against canonical (a symlinked workspace prefix, e.g. macOS
+   * /var → /private/var, must not read as an escape). Unset for host tools.
+   */
+  resolvedWorkingDir?: string;
   transferSandboxDestPath?: string;
   transferSandboxWorkingDir?: string;
   resolvedTransferDestPath?: string;
@@ -490,6 +550,9 @@ function resolveFileToolPaths(
       effectiveWorkingDir,
       isHostTool,
     ),
+    resolvedWorkingDir: isHostTool
+      ? undefined
+      : resolveRealPath(effectiveWorkingDir),
     transferSandboxDestPath,
     transferSandboxWorkingDir,
     // The to_sandbox destination is a workspace write — symlink-resolve it too
@@ -573,7 +636,9 @@ function buildClassifyRiskParams(
       tool: toolName,
       path: resolved.filePath,
       resolvedPath: resolved.resolvedPath,
+      resolvedWorkingDir: resolved.resolvedWorkingDir,
       workingDir: resolved.effectiveWorkingDir,
+      isContainerized: getIsContainerized(),
       fileContext: buildFileContext(),
       transferSandboxDestPath: resolved.transferSandboxDestPath,
       transferSandboxWorkingDir: resolved.transferSandboxWorkingDir,
@@ -797,7 +862,8 @@ export async function classifyRisk(
 // prompt. The grant resolves these tools to ALLOW non-interactively, and ONLY
 // when all of these hold:
 //   - procedural-memory-as-skills is active (`policyContext.procToSkillsActive`,
-//     precomputed by buildPolicyContext: memory-v3 is live),
+//     precomputed by buildPolicyContext: the v3 tier is active — memory is on
+//     and memory-v3 is live),
 //   - the turn is the retrospective background source — guardian trust, `vellum`
 //     source channel, `memory_retrospective` origin (set in
 //     memory-retrospective-job.ts).

package/src/permissions/confirmation-guardian-request.test.ts

@@ -50,7 +50,7 @@ mock.module("../runtime/confirmation-request-guardian-bridge.js", () => ({
   },
 }));
 
-import type { ServerMessage } from "../daemon/message-protocol.js";
+import type { AssistantEvent } from "../api/index.js";
 import { createGuardianRequestForConfirmation } from "./confirmation-guardian-request.js";
 
 const MSG = {
@@ -59,7 +59,7 @@ const MSG = {
   toolName: "Bash",
   input: { command: "ls" },
   riskLevel: "medium",
-} as unknown as ServerMessage & { type: "confirmation_request" };
+} as unknown as AssistantEvent & { type: "confirmation_request" };
 
 describe("createGuardianRequestForConfirmation", () => {
   beforeEach(() => {

package/src/permissions/confirmation-guardian-request.ts

@@ -17,7 +17,7 @@
  * therefore the emitters — stays cheap and free of import-time side effects.
  */
 
-import type { ServerMessage } from "../daemon/message-protocol.js";
+import type { ConfirmationRequestEvent } from "../api/index.js";
 import { IntegrityError } from "../util/errors.js";
 import { getLogger } from "../util/logger.js";
 
@@ -30,7 +30,7 @@ const log = getLogger("confirmation-guardian-request");
  * never thrown.
  */
 export async function createGuardianRequestForConfirmation(
-  msg: ServerMessage & { type: "confirmation_request" },
+  msg: ConfirmationRequestEvent,
   conversationId: string,
   opts?: {
     /**