@vellumai/assistant 0.11.4 → 0.11.5-staging.1

package/src/permissions/checker.ts

@@ -1,4 +1,3 @@
-import { createHash } from "node:crypto";
 import { homedir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 
@@ -19,10 +18,6 @@ import { getSkillRoots } from "../skills/path-classifier.js";
 import { computeTransitiveSkillVersionHash } from "../skills/transitive-version-hash.js";
 import { computeSkillVersionHash } from "../skills/version-hash.js";
 import type { ManifestOverride } from "../tools/execution-target.js";
-import {
-  looksLikeHostPortShorthand,
-  looksLikePathOnlyInput,
-} from "../tools/network/url-safety.js";
 import { getTool, getToolOwner, resolveTool } from "../tools/registry.js";
 import { resolveRealPath } from "../tools/shared/filesystem/path-policy.js";
 import type { Tool } from "../tools/types.js";
@@ -46,9 +41,7 @@ import {
   getAutoApproveThreshold,
   refreshAutoApproveThreshold,
 } from "./gateway-threshold-reader.js";
-import type { RiskAssessment } from "./risk-types.js";
 import {
-  type AllowlistOption,
   type PermissionCheckResult,
   type PolicyContext,
   RiskLevel,
@@ -60,114 +53,19 @@ import {
   resolveSandboxBase,
 } from "./workspace-policy.js";
 
-// ── Risk classification cache ────────────────────────────────────────────────
-// classifyRisk() is called on every permission check and delegates to the
-// gateway via IPC. Cache results keyed on
-// (toolName, inputHash, workingDir, manifestOverride).
-// Invalidated when trust rules change since risk classification for file tools
-// depends on skill source path checks which reference config, but the core
-// risk logic is input-deterministic.
-/** The result of classifyRisk(): a risk level with an optional human-readable reason. */
-export interface RiskClassification {
-  level: RiskLevel;
-  /** Human-readable explanation of why this risk level was assigned. */
-  reason?: string;
-}
-
 /**
- * Extended risk classification that includes gateway-provided metadata
- * used by check() for command candidate building and sandbox auto-approve.
+ * One gateway classification as the daemon carries it: the `classify_risk`
+ * response with `risk` mapped onto the daemon's {@link RiskLevel} as `level`.
+ * Produced once per tool invocation by {@link classifyRisk} and handed down
+ * through `checkPermission` and {@link check}; the daemon keeps no memo of
+ * it, so a trust-rule, config, or skill change is reflected on the next call.
  */
-interface RiskClassificationWithMeta extends RiskClassification {
-  /** Command candidates from the gateway for trust rule matching (bash tools). */
-  commandCandidates?: string[];
-  /** Action keys from the gateway for trust rule matching (bash tools). */
-  actionKeys?: string[];
-  /** Whether the command qualifies for sandbox auto-approve (bash tools). */
-  sandboxAutoApprove?: boolean;
-  /**
-   * Lexically-resolved path args from the gateway for bash sandbox
-   * auto-approve. Stored in the cache so the symlink escape check can be
-   * re-run on cache hits (symlink targets may change between calls).
-   */
-  sandboxPathArgs?: string[];
-  /** Allowlist options from the gateway for generateAllowlistOptions(). */
-  allowlistOptions?: AllowlistOption[];
-  /** Resolved filesystem path arguments for directory-scoped rule matching. */
-  resolvedPaths?: string[];
-}
-
-const RISK_CACHE_MAX = 256;
-const riskCache = new Map<string, RiskClassificationWithMeta>();
-
-// ── Assessment cache ─────────────────────────────────────────────────────────
-// Stores the full ClassificationResult from the gateway so that
-// generateAllowlistOptions() can read gateway-produced allowlistOptions
-// without re-classifying. Keyed on (toolName, inputHash) — a simpler key
-// than the full risk cache since generateAllowlistOptions() does not receive
-// workingDir or manifestOverride. Cleared alongside the risk cache.
-const assessmentCache = new Map<string, RiskAssessment>();
-
-function assessmentCacheKey(
-  toolName: string,
-  input: Record<string, unknown>,
-): string {
-  const { reason: _reason, activity: _activity, ...cacheableInput } = input;
-  const inputJson = JSON.stringify(cacheableInput);
-  const hash = createHash("sha256").update(inputJson).digest("hex");
-  return `${toolName}\0${hash}`;
-}
-
-function riskCacheKey(
-  toolName: string,
-  input: Record<string, unknown>,
-  workingDir?: string,
-  manifestOverride?: ManifestOverride,
-  fsStateKey?: string,
-): string {
-  // Strip `reason` and `activity` before computing the cache key — they are
-  // cosmetic status text that varies per invocation even for identical tool
-  // operations, causing unnecessary cache misses.
-  const { reason: _reason, activity: _activity, ...cacheableInput } = input;
-  const inputJson = JSON.stringify(cacheableInput);
-  const hash = createHash("sha256")
-    .update(inputJson)
-    .update("\0")
-    .update(workingDir ?? "")
-    .update("\0")
-    .update(manifestOverride ? JSON.stringify(manifestOverride) : "")
-    // For file tools, fold in the symlink-resolved target path(s). File risk
-    // depends on filesystem state (a symlink can be retargeted under a
-    // protected dir between calls), so the same raw input must miss the cache
-    // when its canonicalized target changes.
-    .update("\0")
-    .update(fsStateKey ?? "")
-    .digest("hex");
-  return `${toolName}\0${hash}`;
-}
-
-/**
- * Compute the filesystem-state component of the risk cache key for file tools:
- * the symlink-resolved target path(s). Returns `undefined` for non-file tools
- * (whose risk does not depend on filesystem state).
- */
-function fileToolFsStateKey(
-  toolName: string,
-  input: Record<string, unknown>,
-  workingDir?: string,
-): string | undefined {
-  if (!FILE_TOOL_NAMES.has(toolName)) {
-    return undefined;
-  }
-  const resolved = resolveFileToolPaths(toolName, input, workingDir);
-  return `${resolved.resolvedPath ?? ""}\0${resolved.resolvedTransferDestPath ?? ""}\0${resolved.resolvedWorkingDir ?? ""}`;
-}
-
-/** Clear the risk classification cache. Called when trust rules change. Exported for test setup. */
-export function clearRiskCache(): void {
-  riskCache.clear();
-  assessmentCache.clear();
-}
+export type RiskClassificationWithMeta = Omit<
+  ClassifyRiskIpcResponse,
+  "risk"
+> & {
+  level: RiskLevel;
+};
 
 // ── Approval policy singleton ────────────────────────────────────────────────
 const defaultApprovalPolicy = new DefaultApprovalPolicy();
@@ -347,81 +245,20 @@ function computeTransitiveHashSafe(skillId: string): string | undefined {
   }
 }
 
-function canonicalizeWebFetchUrl(parsed: URL): URL {
-  parsed.hash = "";
-  parsed.username = "";
-  parsed.password = "";
-
-  try {
-    // Normalize equivalent escaped paths (for example, "/%70rivate" -> "/private")
-    // so path-scoped trust rules cannot be bypassed via percent-encoding.
-    parsed.pathname = decodeURI(parsed.pathname);
-  } catch {
-    // Keep URL parser canonical form when decoding fails.
-  }
-
-  if (parsed.hostname.endsWith(".")) {
-    parsed.hostname = parsed.hostname.replace(/\.+$/, "");
-  }
-
-  return parsed;
-}
-
-function normalizeWebFetchUrl(rawUrl: string): URL | null {
-  const trimmed = rawUrl.trim();
-  if (!trimmed) {
-    return null;
-  }
-
-  if (looksLikeHostPortShorthand(trimmed)) {
-    try {
-      return canonicalizeWebFetchUrl(new URL(`https://${trimmed}`));
-    } catch {
-      return null;
-    }
-  }
-
-  try {
-    const parsed = new URL(trimmed);
-    if (parsed.protocol === "http:" || parsed.protocol === "https:") {
-      return canonicalizeWebFetchUrl(parsed);
-    }
-    return null;
-  } catch {
-    // Fall through.
-  }
-
-  if (looksLikePathOnlyInput(trimmed)) {
-    return null;
-  }
-
-  if (/^[a-zA-Z][a-zA-Z0-9+.-]*:/.test(trimmed)) {
-    return null;
-  }
-
-  try {
-    return canonicalizeWebFetchUrl(new URL(`https://${trimmed}`));
-  } catch {
-    return null;
-  }
-}
-
-function escapeMinimatchLiteral(value: string): string {
-  return value.replace(/([\\*?[\]{}()!+@|])/g, "\\$1");
-}
-
 // ── IPC param builders ───────────────────────────────────────────────────────
-// Build the ClassifyRiskParams for each tool family. These resolve
+// Build the classify_risk request for each tool family. These resolve
 // assistant-local context (file paths, skill metadata, etc.) before
 // forwarding to the gateway.
 
 import type {
-  ClassifyRiskParams,
-  FileContext,
-  SkillMetadata,
-} from "./ipc-risk-types.js";
-
-function buildFileContext(): FileContext {
+  ClassifyRiskFileContext,
+  ClassifyRiskIpcParams,
+  ClassifyRiskIpcResponse,
+  ClassifyRiskSkillMetadata,
+  RiskLevelValue,
+} from "@vellumai/gateway-client";
+
+function buildFileContext(): ClassifyRiskFileContext {
   const config = getConfig();
   // Canonicalize the protected directories via realpath so that a symlinked
   // component anywhere in their path still prefix-matches the canonicalized
@@ -479,16 +316,6 @@ function resolveClassificationPath(
   return resolveRealPath(base);
 }
 
-const FILE_TOOL_NAMES = new Set([
-  "file_read",
-  "file_write",
-  "file_edit",
-  "host_file_read",
-  "host_file_write",
-  "host_file_edit",
-  "host_file_transfer",
-]);
-
 interface FileToolResolution {
   filePath: string;
   effectiveWorkingDir: string;
@@ -508,10 +335,8 @@ interface FileToolResolution {
 
 /**
  * Resolve the security-sensitive path(s) of a file tool invocation, including
- * symlink canonicalization. Shared by the IPC param builder and the risk cache
- * key so both observe the same filesystem state — file risk now depends on
- * symlink targets, so the cache must key on the canonicalized path, not just
- * the raw tool input.
+ * symlink canonicalization, for the IPC params: file risk depends on the
+ * symlink target, not the raw tool input.
  */
 function resolveFileToolPaths(
   toolName: string,
@@ -568,7 +393,9 @@ function resolveFileToolPaths(
   };
 }
 
-function resolveSkillMetadata(selector: string): SkillMetadata | undefined {
+function resolveSkillMetadata(
+  selector: string,
+): ClassifyRiskSkillMetadata | undefined {
   const resolved = resolveSkillIdAndHash(selector);
   if (!resolved) {
     return undefined;
@@ -593,7 +420,7 @@ function buildClassifyRiskParams(
   input: Record<string, unknown>,
   workingDir?: string,
   manifestOverride?: ManifestOverride,
-): ClassifyRiskParams {
+): ClassifyRiskIpcParams {
   // ── Bash/host_bash ──
   if (toolName === "bash" || toolName === "host_bash") {
     // Count credential references attached to this invocation.
@@ -683,7 +510,7 @@ function buildClassifyRiskParams(
   // instead of hardcoding medium for unknown tools. When the tool is not in the
   // registry but a manifestOverride provides a risk, use that instead.
   const tool = getTool(toolName);
-  let registryDefaultRisk: string | undefined;
+  let registryDefaultRisk: RiskLevelValue | undefined;
   if (tool) {
     registryDefaultRisk =
       tool.defaultRiskLevel === RiskLevel.Low
@@ -719,11 +546,9 @@ function riskStringToLevel(risk: string): RiskLevel {
  * with symlink resolution. The gateway's lexical check cannot follow
  * symlinks (no filesystem access), so the daemon resolves each path arg
  * through {@link isPathWithinWorkspaceRoot} (which uses realpathSync) and
- * revokes auto-approve if any escapes the workspace boundary.
- *
- * Called both on fresh gateway results and on cache hits, because symlink
- * targets can change between invocations — a path that was safe on the
- * first call may escape on the second if the symlink was retargeted.
+ * revokes auto-approve if any escapes the workspace boundary. Runs on every
+ * classification, so a symlink retargeted between two invocations of the
+ * same command is caught on the second.
  */
 function applyBashSymlinkEscapeCheck(
   result: RiskClassificationWithMeta,
@@ -755,31 +580,6 @@ export async function classifyRisk(
 ): Promise<RiskClassificationWithMeta> {
   signal?.throwIfAborted();
 
-  // Check cache first.
-  const cacheKey = riskCacheKey(
-    toolName,
-    input,
-    workingDir,
-    manifestOverride,
-    fileToolFsStateKey(toolName, input, workingDir),
-  );
-  const cached = riskCache.get(cacheKey);
-  if (cached !== undefined) {
-    // LRU refresh
-    riskCache.delete(cacheKey);
-    riskCache.set(cacheKey, cached);
-    // Re-run the symlink escape check on cache hits: symlink targets can
-    // change between invocations, so a path that was safe when cached may
-    // now escape. Return a shallow copy so the cache entry is not mutated.
-    if (cached.sandboxPathArgs && cached.sandboxPathArgs.length > 0) {
-      const fresh = { ...cached };
-      applyBashSymlinkEscapeCheck(fresh, cached.sandboxPathArgs);
-      return fresh;
-    }
-    return cached;
-  }
-
-  // ── Delegate to gateway via IPC ────────────────────────────────────────────
   const ipcParams = buildClassifyRiskParams(
     toolName,
     input,
@@ -797,15 +597,10 @@ export async function classifyRisk(
     );
   }
 
+  const { risk, ...carried } = gatewayResult;
   const result: RiskClassificationWithMeta = {
-    level: riskStringToLevel(gatewayResult.risk),
-    reason: gatewayResult.reason,
-    commandCandidates: gatewayResult.commandCandidates,
-    actionKeys: gatewayResult.actionKeys,
-    sandboxAutoApprove: gatewayResult.sandboxAutoApprove,
-    sandboxPathArgs: gatewayResult.sandboxPathArgs,
-    allowlistOptions: gatewayResult.allowlistOptions,
-    resolvedPaths: gatewayResult.resolvedPaths,
+    ...carried,
+    level: riskStringToLevel(risk),
   };
 
   // ── Symlink escape check for bash sandbox auto-approve ───────────────
@@ -815,41 +610,8 @@ export async function classifyRisk(
   // `ln -s /etc /workspace/escape`) would pass the lexical check and
   // be auto-approved. Resolve the gateway-provided path args through
   // symlinks here and revoke auto-approve if any escapes the workspace.
-  // The check is also re-run on cache hits (see above) because symlink
-  // targets can change between invocations.
   applyBashSymlinkEscapeCheck(result, gatewayResult.sandboxPathArgs);
 
-  // Cache the result.
-  if (riskCache.size >= RISK_CACHE_MAX) {
-    const oldest = riskCache.keys().next().value;
-    if (oldest !== undefined) {
-      riskCache.delete(oldest);
-    }
-  }
-  riskCache.set(cacheKey, result);
-
-  // Store a RiskAssessment-shaped entry in the assessment cache so that
-  // generateAllowlistOptions() can retrieve gateway-produced allowlistOptions
-  // and permission-checker.ts can populate riskScopeOptions for the Rule
-  // Editor Modal via cachedAssessment.scopeOptions.
-  const assessment: RiskAssessment = {
-    riskLevel: gatewayResult.risk === "unknown" ? "medium" : gatewayResult.risk,
-    reason: gatewayResult.reason,
-    scopeOptions: gatewayResult.scopeOptions ?? [],
-    matchType: gatewayResult.matchType ?? "unknown",
-    allowlistOptions: gatewayResult.allowlistOptions,
-    directoryScopeOptions: gatewayResult.directoryScopeOptions,
-    resolvedPaths: gatewayResult.resolvedPaths,
-  };
-  const aKey = assessmentCacheKey(toolName, input);
-  if (assessmentCache.size >= RISK_CACHE_MAX) {
-    const oldest = assessmentCache.keys().next().value;
-    if (oldest !== undefined) {
-      assessmentCache.delete(oldest);
-    }
-  }
-  assessmentCache.set(aKey, assessment);
-
   return result;
 }
 
@@ -899,6 +661,14 @@ function isRetrospectiveSkillAuthoringGrant(
   return false;
 }
 
+/**
+ * Decide allow / prompt / deny for one tool invocation.
+ *
+ * `classification` is the invocation's gateway classification when the caller
+ * already holds it (the executor classifies once, before its gates, and hands
+ * it down through `checkPermission`); a caller without one gets a fresh
+ * classification of the same input here.
+ */
 export async function check(
   toolName: string,
   input: Record<string, unknown>,
@@ -906,6 +676,7 @@ export async function check(
   policyContext?: PolicyContext,
   manifestOverride?: ManifestOverride,
   signal?: AbortSignal,
+  classification?: RiskClassificationWithMeta,
 ): Promise<PermissionCheckResult> {
   signal?.throwIfAborted();
 
@@ -917,7 +688,7 @@ export async function check(
     };
   }
 
-  const classification = await classifyRisk(
+  classification ??= await classifyRisk(
     toolName,
     input,
     workingDir,
@@ -926,24 +697,7 @@ export async function check(
     signal,
   );
 
-  const { level: classifiedRisk, reason: riskReason } = classification;
-
-  // Inline-command ("dynamic") skill loads execute embedded shell at load time
-  // via child_process.spawn, outside the tool-approval pipeline that the
-  // auto-approve threshold governs. Treat an uncovered one as High so the
-  // standard threshold decides it like any other high-risk action: it runs at
-  // Full access (autoApproveUpTo "high") and prompts below it. A covering user
-  // trust rule arrives as matchType
-  // "user_rule" with the risk already lowered (the escape hatch), so leave it
-  // untouched. The gateway classifier is authoritative and also returns High;
-  // this local elevation is defense-in-depth for the gateway-unreachable or
-  // under-classified path. The separate non-interactive denial (no human to
-  // approve embedded shell) lives in tools/permission-checker.ts.
-  const risk =
-    isDynamicSkillLoadInvocation(toolName, input) &&
-    getCachedAssessment(toolName, input)?.matchType !== "user_rule"
-      ? RiskLevel.High
-      : classifiedRisk;
+  const { level: risk, reason: riskReason } = classification;
 
   // Use gateway-provided sandboxAutoApprove instead of evaluating locally.
   const hasSandboxAutoApprove = classification.sandboxAutoApprove ?? false;
@@ -1021,276 +775,6 @@ export async function check(
   };
 }
 
-const TOOL_DISPLAY_NAMES: Record<string, string> = {
-  file_read: "file reads",
-  file_write: "file writes",
-  file_edit: "file edits",
-  host_file_read: "host file reads",
-  host_file_write: "host file writes",
-  host_file_edit: "host file edits",
-  host_file_transfer: "host file transfers",
-  web_fetch: "URL fetches",
-  network_request: "network requests",
-};
-
-function friendlyBasename(filePath: string): string {
-  const parts = filePath.split("/");
-  return parts[parts.length - 1] || filePath;
-}
-
-function friendlyHostname(url: URL): string {
-  return url.hostname.replace(/^www\./, "");
-}
-
-// ── Per-tool allowlist option strategies ─────────────────────────────────────
-// Each strategy receives the tool name and raw input and returns allowlist
-// options. Adding support for a new tool type means adding a function here
-// and registering it in ALLOWLIST_STRATEGIES below.
-
-type AllowlistStrategy = (
-  toolName: string,
-  input: Record<string, unknown>,
-) => Promise<AllowlistOption[]> | AllowlistOption[];
-
-function fileAllowlistStrategy(
-  toolName: string,
-  input: Record<string, unknown>,
-): AllowlistOption[] {
-  let filePath: string;
-  if (toolName === "host_file_transfer") {
-    // Use the host-side path: source_path for to_sandbox, dest_path for to_host.
-    const direction = (input.direction as string) ?? "";
-    filePath =
-      direction === "to_sandbox"
-        ? ((input.source_path as string) ?? "")
-        : ((input.dest_path as string) ?? "");
-  } else {
-    filePath =
-      (input.path as string) ??
-      (input.file_path as string) ??
-      (input.dest_path as string) ??
-      (input.source_path as string) ??
-      "";
-  }
-  const toolLabel = TOOL_DISPLAY_NAMES[toolName] ?? toolName;
-  const options: AllowlistOption[] = [];
-
-  // Patterns must match the "tool:path" format used by check()
-  options.push({
-    label: filePath,
-    description: `This file only`,
-    pattern: `${toolName}:${filePath}`,
-  });
-
-  // Ancestor directory wildcards — walk up from immediate parent, stop at home dir or /
-  const home = homedir();
-  let dir = dirname(filePath);
-  const maxLevels = 3;
-  let levels = 0;
-  while (dir && dir !== "/" && dir !== "." && levels < maxLevels) {
-    const dirName = friendlyBasename(dir);
-    options.push({
-      label: `${dir}/**`,
-      description: `Anything in ${dirName}/`,
-      pattern: `${toolName}:${dir}/**`,
-    });
-    if (dir === home) {
-      break;
-    }
-    const parent = dirname(dir);
-    if (parent === dir) {
-      break;
-    }
-    dir = parent;
-    levels++;
-  }
-
-  options.push({
-    label: `${toolName}:*`,
-    description: `All ${toolLabel}`,
-    pattern: `${toolName}:*`,
-  });
-  return options;
-}
-
-function urlAllowlistStrategy(
-  toolName: string,
-  input: Record<string, unknown>,
-): AllowlistOption[] {
-  const rawUrl = getStringField(input, "url").trim();
-  const normalized = normalizeWebFetchUrl(rawUrl);
-  const exact = normalized?.href ?? rawUrl;
-
-  const options: AllowlistOption[] = [];
-  if (exact) {
-    options.push({
-      label: exact,
-      description: "This exact URL",
-      pattern: `${toolName}:${escapeMinimatchLiteral(exact)}`,
-    });
-  }
-  if (normalized) {
-    const host = friendlyHostname(normalized);
-    options.push({
-      label: `${normalized.origin}/*`,
-      description: `Any page on ${host}`,
-      pattern: `${toolName}:${escapeMinimatchLiteral(normalized.origin)}/*`,
-    });
-  }
-  const toolLabel = TOOL_DISPLAY_NAMES[toolName] ?? toolName;
-  // Use standalone "**" globstar — minimatch only treats ** as globstar when
-  // it is its own path segment, so "${toolName}:*" would fail to match URL
-  // candidates containing "/".  The tool field is already filtered separately.
-  options.push({
-    label: `${toolName}:*`,
-    description: `All ${toolLabel}`,
-    pattern: `**`,
-  });
-
-  const seen = new Set<string>();
-  return options.filter((o) => {
-    if (seen.has(o.pattern)) {
-      return false;
-    }
-    seen.add(o.pattern);
-    return true;
-  });
-}
-
-function managedSkillAllowlistStrategy(
-  toolName: string,
-  input: Record<string, unknown>,
-): AllowlistOption[] {
-  const skillId = getStringField(input, "skill_id").trim();
-  const toolLabel =
-    toolName === "scaffold_managed_skill" ? "scaffold" : "delete";
-  const options: AllowlistOption[] = [];
-  if (skillId) {
-    options.push({
-      label: skillId,
-      description: `This skill only`,
-      pattern: `${toolName}:${skillId}`,
-    });
-  }
-  options.push({
-    label: `${toolName}:*`,
-    description: `All managed skill ${toolLabel}s`,
-    pattern: `${toolName}:*`,
-  });
-  return options;
-}
-
-function skillLoadAllowlistStrategy(
-  _toolName: string,
-  input: Record<string, unknown>,
-): AllowlistOption[] {
-  const rawSelector = getStringField(input, "skill").trim();
-
-  if (rawSelector) {
-    const resolved = resolveSkillIdAndHash(rawSelector);
-
-    if (resolved && hasInlineExpansions(resolved.id)) {
-      const transitiveHash = computeTransitiveHashSafe(resolved.id);
-      const options: AllowlistOption[] = [];
-      if (transitiveHash) {
-        options.push({
-          label: `${resolved.id}@${transitiveHash}`,
-          description: "This exact version (pinned)",
-          pattern: `skill_load_dynamic:${resolved.id}@${transitiveHash}`,
-        });
-      }
-      options.push({
-        label: resolved.id,
-        description: "This skill (any version)",
-        pattern: `skill_load_dynamic:${resolved.id}`,
-      });
-      return options;
-    }
-
-    if (resolved && resolved.versionHash) {
-      return [
-        {
-          label: `${resolved.id}@${resolved.versionHash}`,
-          description: "This exact version",
-          pattern: `skill_load:${resolved.id}@${resolved.versionHash}`,
-        },
-      ];
-    }
-    return [
-      {
-        label: rawSelector,
-        description: "This skill",
-        pattern: `skill_load:${rawSelector}`,
-      },
-    ];
-  }
-
-  return [
-    {
-      label: "skill_load:*",
-      description: "All skill loads",
-      pattern: "skill_load:*",
-    },
-  ];
-}
-
-const ALLOWLIST_STRATEGIES: Record<string, AllowlistStrategy> = {
-  file_read: fileAllowlistStrategy,
-  file_write: fileAllowlistStrategy,
-  file_edit: fileAllowlistStrategy,
-  host_file_read: fileAllowlistStrategy,
-  host_file_write: fileAllowlistStrategy,
-  host_file_edit: fileAllowlistStrategy,
-  host_file_transfer: fileAllowlistStrategy,
-  web_fetch: urlAllowlistStrategy,
-  network_request: urlAllowlistStrategy,
-  scaffold_managed_skill: managedSkillAllowlistStrategy,
-  delete_managed_skill: managedSkillAllowlistStrategy,
-  skill_load: skillLoadAllowlistStrategy,
-};
-
-export async function generateAllowlistOptions(
-  toolName: string,
-  input: Record<string, unknown>,
-  signal?: AbortSignal,
-): Promise<AllowlistOption[]> {
-  signal?.throwIfAborted();
-
-  // Use gateway-produced allowlist options from the assessment cache.
-  // For bash/host_bash tools, these are always provided by the gateway.
-  // For other tools that have classifier-produced options, use those too.
-  const aKey = assessmentCacheKey(toolName, input);
-  const cachedAssessment = assessmentCache.get(aKey);
-  if (
-    cachedAssessment?.allowlistOptions &&
-    cachedAssessment.allowlistOptions.length > 0
-  ) {
-    return cachedAssessment.allowlistOptions;
-  }
-
-  // Fall back to the per-tool strategy function for non-bash tools
-  // or when no cached assessment exists.
-  if (Object.hasOwn(ALLOWLIST_STRATEGIES, toolName)) {
-    return ALLOWLIST_STRATEGIES[toolName](toolName, input);
-  }
-
-  return [{ label: "*", description: "Everything", pattern: "*" }];
-}
-
-/**
- * Retrieve a cached RiskAssessment for a given tool invocation.
- * Returns `undefined` when no classifier-backed assessment exists
- * (e.g. MCP tools, unknown tools that fall through to registry defaults).
- */
-export function getCachedAssessment(
-  toolName: string,
-  input: Record<string, unknown>,
-): RiskAssessment | undefined {
-  return assessmentCache.get(assessmentCacheKey(toolName, input));
-}
-
-// Directory-based scope only applies to filesystem and shell tools.
-// All other tools auto-use "everywhere" (the client handles this).
 export const SCOPE_AWARE_TOOLS = new Set([
   "bash",
   "host_bash",