@vellumai/assistant 0.11.6 → 0.11.7-staging.2

package/src/permissions/gateway-threshold-reader.ts

@@ -54,6 +54,18 @@ const conversationThresholdCache = new Map<
 >();
 const CONVERSATION_CACHE_TTL_MS = 5_000;
 
+// ── Contact threshold cache (5s TTL) ─────────────────────────────────────────
+// Same short TTL as the conversation override: the owner can change a
+// contact's ceiling mid-conversation, but a burst of tool calls in one
+// turn should not pay an IPC round-trip each time. Negative entries (no
+// ceiling) are cached too. Transport failures are not.
+
+const contactThresholdCache = new Map<
+  string,
+  { threshold: string | null; timestamp: number }
+>();
+const CONTACT_CACHE_TTL_MS = 5_000;
+
 // ── Channel-permission cell cache (5s TTL) ───────────────────────────────────
 // The permission-matrix cell for (adapter × channel-type × channel-ID ×
 // contact-type). Same short TTL as the conversation cache: a guardian can
@@ -188,9 +200,25 @@ export function _clearGlobalCacheForTesting(): void {
   cachedGlobalThresholds = null;
   cachedGlobalTimestamp = 0;
   conversationThresholdCache.clear();
+  contactThresholdCache.clear();
   channelPermissionCellCache.clear();
 }
 
+/**
+ * Drop the cached ceiling for one contact.
+ */
+export function invalidateContactThresholdCache(contactId: string): void {
+  contactThresholdCache.delete(contactId);
+}
+
+/**
+ * Drop every cached contact ceiling. `contacts_changed` calls this so the
+ * next approval re-reads after any contact ACL write.
+ */
+export function invalidateAllContactThresholdCaches(): void {
+  contactThresholdCache.clear();
+}
+
 // ── Helpers ──────────────────────────────────────────────────────────────────
 
 function mapExecutionContextToField(
@@ -214,6 +242,78 @@ function isValidThreshold(value: string): value is AutoApproveThreshold {
   );
 }
 
+type ContactThresholdLookup =
+  | { status: "hit"; threshold: AutoApproveThreshold }
+  | { status: "miss" }
+  | { status: "failure" };
+
+/**
+ * Read the contact-level auto-approve ceiling from the gateway.
+ *
+ * A hit is a usable `none | low | medium | high`. A miss is an unknown
+ * contact, an unset or corrupt column, or an unexpected response shape.
+ * A failure is a transport error and is never cached, so a later call
+ * can still see a real ceiling.
+ */
+async function lookupContactThreshold(
+  contactId: string,
+  options?: { bypassCache?: boolean },
+): Promise<ContactThresholdLookup> {
+  if (!options?.bypassCache) {
+    const cached = contactThresholdCache.get(contactId);
+    if (cached && Date.now() - cached.timestamp < CONTACT_CACHE_TTL_MS) {
+      if (cached.threshold !== null && isValidThreshold(cached.threshold)) {
+        return { status: "hit", threshold: cached.threshold };
+      }
+      return { status: "miss" };
+    }
+  }
+
+  const result = (await ipcCall("get_contact_threshold", {
+    contactId,
+  })) as ConversationThreshold | null | undefined;
+
+  if (result === undefined) {
+    noteFailure(
+      "contact_threshold",
+      { contactId },
+      "IPC call failed for contact threshold",
+    );
+    return { status: "failure" };
+  }
+
+  noteSuccess("contact_threshold");
+  if (result && isValidThreshold(result.threshold)) {
+    contactThresholdCache.set(contactId, {
+      threshold: result.threshold,
+      timestamp: Date.now(),
+    });
+    return { status: "hit", threshold: result.threshold };
+  }
+
+  contactThresholdCache.set(contactId, {
+    threshold: null,
+    timestamp: Date.now(),
+  });
+  return { status: "miss" };
+}
+
+/**
+ * The contact-level auto-approve ceiling for `contactId`, or `null` when
+ * the contact has none (unset, unknown, corrupt) or the lookup failed.
+ * Approval-time lift uses this so a live `contacts` row is the source of
+ * truth.
+ */
+export async function getContactAutoApproveThreshold(
+  contactId: string | undefined,
+): Promise<AutoApproveThreshold | null> {
+  if (!contactId) {
+    return null;
+  }
+  const result = await lookupContactThreshold(contactId);
+  return result.status === "hit" ? result.threshold : null;
+}
+
 /**
  * Result of a cell lookup. `ok: false` is a transport failure — distinct
  * from `resolved: null` (a successful round-trip that found no cell) so the
@@ -322,9 +422,16 @@ export async function channelNoCellDefault(
 /**
  * Read the auto-approve threshold from the gateway via IPC.
  *
- * For `"conversation"` context with a `conversationId`, checks for a
- * per-conversation override first. Falls through to global defaults when
- * the conversation override is absent.
+ * Cascade, most specific first:
+ * 1. Per-conversation override (when `"conversation"` context has an id)
+ * 2. Contact-level ceiling (when `contactId` looks up a usable threshold)
+ * 3. Channel-permission matrix cell (collapsed for contacts)
+ * 4. Global defaults for the execution context
+ *
+ * The contact ceiling is the owner's override for that person, read live
+ * from the gateway `contacts` row. It is not collapsed to the channel's
+ * two levels, so `medium` and `high` can authorize sandbox bash. A miss
+ * (unset, unknown, transport failure) inherits the cell / global cascade.
  *
  * Caches global thresholds for 30 seconds to avoid hammering the gateway.
  * On any IPC error or unexpected response, returns `"none"` (Strict) so
@@ -334,6 +441,7 @@ export async function getAutoApproveThreshold(
   conversationId: string | undefined,
   executionContext?: ExecutionContext,
   cellQuery?: ResolveChannelPermissionRequest,
+  contactId?: string,
 ): Promise<AutoApproveThreshold> {
   const ctx: ExecutionContext = executionContext ?? "conversation";
 
@@ -386,6 +494,17 @@ export async function getAutoApproveThreshold(
     }
   }
 
+  // Contact-level ceiling: the owner's override for this person, looked up
+  // by contact id. Beats the collapsed room / trust-class cascade.
+  // Conversation override above is more specific (this chat) and still
+  // wins when set. A miss or transport failure falls through.
+  if (contactId) {
+    const contact = await lookupContactThreshold(contactId);
+    if (contact.status === "hit") {
+      return contact.threshold;
+    }
+  }
+
   // Channel-permission matrix cell: for non-guardian actors this layer is
   // total in every direction — a successful walk that finds no cell resolves
   // the room default (the collapsed global), and a failed read resolves
@@ -467,13 +586,15 @@ async function fetchGlobalThresholds(options?: {
  * Used by the permission checker immediately before surfacing an
  * interactive prompt: the cached snapshot (5s conversation TTL with
  * negative caching, 30s global TTL) may predate a threshold change the
- * user just made — e.g. switching to Full access — because no threshold
- * write path invalidates these in-process caches (the web picker writes
- * through the gateway HTTP route, the desktop picker through the
- * `set_conversation_threshold` IPC). Prompting from a stale threshold
- * directly contradicts the user's visible setting. A prompt is already a
- * rare, user-visible interruption, so the extra IPC round-trip is cheap
- * relative to a wrong prompt.
+ * user just made (for example switching to Full access) because no
+ * conversation or global write path invalidates those caches (the web
+ * picker writes through the gateway HTTP route, the desktop picker
+ * through the `set_conversation_threshold` IPC). A `contacts_changed`
+ * event clears every cached contact ceiling after a contact ACL write.
+ * Prompting from a stale threshold directly contradicts the user's
+ * visible setting. A prompt is already a rare, user-visible
+ * interruption, so the extra IPC round-trip is cheap relative to a
+ * wrong prompt.
  *
  * Returns the freshly-resolved threshold, or `null` when the gateway
  * could not be reached. Callers must keep their original decision on
@@ -496,6 +617,7 @@ export async function refreshAutoApproveThreshold(
   conversationId: string | undefined,
   executionContext?: ExecutionContext,
   cellQuery?: ResolveChannelPermissionRequest,
+  contactId?: string,
 ): Promise<AutoApproveThreshold | null> {
   const ctx: ExecutionContext = executionContext ?? "conversation";
 
@@ -528,6 +650,18 @@ export async function refreshAutoApproveThreshold(
     });
   }
 
+  if (contactId) {
+    const contact = await lookupContactThreshold(contactId, {
+      bypassCache: true,
+    });
+    if (contact.status === "failure") {
+      return null;
+    }
+    if (contact.status === "hit") {
+      return contact.threshold;
+    }
+  }
+
   // Fresh cell read (cache bypassed, then primed). A transport failure here
   // returns null — the caller keeps its prompt rather than falling through
   // to a global threshold that may be looser than the unreadable cell

package/src/permissions/prompter.ts

@@ -14,8 +14,6 @@ const log = getLogger("permission-prompter");
 
 type ConfirmResult = {
   decision: UserDecision;
-  selectedPattern?: string;
-  selectedScope?: string;
   decisionContext?: string;
   wasTimeout?: boolean;
   wasSystemCancel?: boolean;
@@ -208,8 +206,6 @@ export class PermissionPrompter {
     requestId: string,
     decision: UserDecision,
     options?: {
-      selectedPattern?: string;
-      selectedScope?: string;
       decisionContext?: string;
     },
   ): void {
@@ -226,8 +222,6 @@ export class PermissionPrompter {
     this.ownedIds.delete(requestId);
     (interaction?.rpcResolve as ((v: ConfirmResult) => void) | undefined)?.({
       decision,
-      selectedPattern: options?.selectedPattern,
-      selectedScope: options?.selectedScope,
       decisionContext: options?.decisionContext,
     });
   }

package/src/permissions/types.ts

@@ -36,10 +36,6 @@ export const THRESHOLD_ORDINAL: Record<string, number> = {
 
 export type UserDecision = "allow" | "deny";
 
-export function isAllowDecision(decision: UserDecision): boolean {
-  return decision === "allow";
-}
-
 export interface PermissionCheckResult {
   decision: "allow" | "deny" | "prompt";
   reason: string;
@@ -90,4 +86,9 @@ export interface PolicyContext {
    * grant then never fires.
    */
   procToSkillsActive?: boolean;
+  /**
+   * Contact ID of the requester's member record. The threshold reader looks
+   * up this contact's auto-approve ceiling from the gateway at use time.
+   */
+  requesterContactId?: string;
 }

package/src/persistence/__tests__/bulk-write-gate.test.ts

@@ -6,7 +6,6 @@ import { describe, expect, test } from "bun:test";
 import { assertNotLiveDb } from "../../__tests__/assert-not-live-db.js";
 import { bulkWriteGateHolder, withBulkWriteGate } from "../bulk-write-gate.js";
 import { deleteConversationRowsInBatches } from "../conversation-row-batch-delete.js";
-import { copyForkMessagesViaSubprocess } from "../fork-message-copy.js";
 
 /** A promise whose resolution the test controls. */
 function deferred(): { promise: Promise<void>; release: () => void } {
@@ -73,43 +72,6 @@ describe("withBulkWriteGate", () => {
 });
 
 describe("gated bulk writers", () => {
-  test("fork message-copy queues behind a held gate", async () => {
-    const holder = deferred();
-    const holding = withBulkWriteGate("holder", () => holder.promise);
-
-    let copySettled = false;
-    const copy = copyForkMessagesViaSubprocess({
-      forkConversationId: "fork-1",
-      idPairs: [{ oldId: "old-1", newId: "new-1" }],
-      forceInProcess: true,
-    }).then((result) => {
-      copySettled = true;
-      return result;
-    });
-
-    await Bun.sleep(20);
-    expect(copySettled).toBe(false);
-
-    holder.release();
-    await holding;
-    await copy;
-    expect(copySettled).toBe(true);
-  });
-
-  test("empty fork message-copy skips the gate entirely", async () => {
-    const holder = deferred();
-    const holding = withBulkWriteGate("holder", () => holder.promise);
-
-    const result = await copyForkMessagesViaSubprocess({
-      forkConversationId: "fork-1",
-      idPairs: [],
-    });
-    expect(result.ok).toBe(true);
-
-    holder.release();
-    await holding;
-  });
-
   test("main-DB batched delete queues behind a held gate", async () => {
     const holder = deferred();
     const holding = withBulkWriteGate("holder", () => holder.promise);

package/src/persistence/bulk-write-gate.ts

@@ -2,16 +2,15 @@
 // Bulk-write gate — process-wide FIFO serialization of bulk main-DB writers.
 // ---------------------------------------------------------------------------
 //
-// The batched bulk writers (fork message-copy, conversation-row batch delete)
-// each hold the main database's write lock only briefly per batch — but SQLite
-// has a single writer, so two bulk streams running concurrently gain no
-// throughput. They only convoy: every batch of each stream contends with the
-// other's (waiting up to `busy_timeout`), and the inter-batch yield each
-// stream inserts for foreground fairness is consumed by the sibling stream
-// instead of the live user turn it was meant for. Concurrent streams are
-// reachable because the memory jobs worker groups jobs by
-// `(type, conversationId)` — retrospectives for two different conversations
-// run in parallel.
+// The batched bulk writer (conversation-row batch delete) holds the main
+// database's write lock only briefly per batch — but SQLite has a single
+// writer, so two bulk streams running concurrently gain no throughput. They
+// only convoy: every batch of each stream contends with the other's (waiting
+// up to `busy_timeout`), and the inter-batch yield each stream inserts for
+// foreground fairness is consumed by the sibling stream instead of the live
+// user turn it was meant for. Concurrent streams are reachable because the
+// memory jobs worker groups jobs by `(type, conversationId)` — work for two
+// different conversations can run in parallel.
 //
 // This gate serializes those streams within the process: one bulk writer runs
 // at a time, the rest queue FIFO, and the write lock (plus the yields) go back