@vellumai/assistant 0.4.26 → 0.4.29

package/src/__tests__/test-support/browser-skill-harness.ts

@@ -1,28 +1,28 @@
-import type { Message } from '../../providers/types.js';
+import type { Message } from "../../providers/types.js";
 
 /** The 14 browser tool names provided by the browser skill. */
 export const BROWSER_TOOL_NAMES = [
-  'browser_navigate',
-  'browser_snapshot',
-  'browser_screenshot',
-  'browser_close',
-  'browser_click',
-  'browser_type',
-  'browser_press_key',
-  'browser_scroll',
-  'browser_select_option',
-  'browser_hover',
-  'browser_wait_for',
-  'browser_extract',
-  'browser_wait_for_download',
-  'browser_fill_credential',
+  "browser_navigate",
+  "browser_snapshot",
+  "browser_screenshot",
+  "browser_close",
+  "browser_click",
+  "browser_type",
+  "browser_press_key",
+  "browser_scroll",
+  "browser_select_option",
+  "browser_hover",
+  "browser_wait_for",
+  "browser_extract",
+  "browser_wait_for_download",
+  "browser_fill_credential",
 ] as const;
 
 /** Number of browser tools provided by the skill. */
 export const BROWSER_TOOL_COUNT = BROWSER_TOOL_NAMES.length;
 
 /** Skill ID for the bundled browser skill. */
-export const BROWSER_SKILL_ID = 'browser';
+export const BROWSER_SKILL_ID = "browser";
 
 let toolUseCounter = 0;
 
@@ -30,26 +30,29 @@ let toolUseCounter = 0;
  * Build a synthetic conversation history containing a skill_load tool_use
  * and matching tool_result with a <loaded_skill /> marker.
  */
-export function buildSkillLoadHistory(skillId: string, versionHash?: string): Message[] {
+export function buildSkillLoadHistory(
+  skillId: string,
+  versionHash?: string,
+): Message[] {
   const toolUseId = `test-tool-use-${skillId}-${toolUseCounter++}`;
-  const versionAttr = versionHash ? ` version="${versionHash}"` : '';
+  const versionAttr = versionHash ? ` version="${versionHash}"` : "";
   return [
     {
-      role: 'assistant',
+      role: "assistant",
       content: [
         {
-          type: 'tool_use',
+          type: "tool_use",
           id: toolUseId,
-          name: 'skill_load',
+          name: "skill_load",
           input: { skill: skillId },
         },
       ],
     },
     {
-      role: 'user',
+      role: "user",
       content: [
         {
-          type: 'tool_result',
+          type: "tool_result",
           tool_use_id: toolUseId,
           content: `Skill loaded successfully.\n<loaded_skill id="${skillId}"${versionAttr} />`,
         },
@@ -61,12 +64,17 @@ export function buildSkillLoadHistory(skillId: string, versionHash?: string): Me
 /**
  * Assert that a set of tool names is exactly the expected set (order-independent).
  */
-export function expectToolNamesEqual(actual: string[], expected: readonly string[]): void {
+export function expectToolNamesEqual(
+  actual: string[],
+  expected: readonly string[],
+): void {
   const sorted = [...actual].sort();
   const expectedSorted = [...expected].sort();
   if (JSON.stringify(sorted) !== JSON.stringify(expectedSorted)) {
     throw new Error(
-      `Tool names mismatch.\nExpected: ${JSON.stringify(expectedSorted)}\nActual: ${JSON.stringify(sorted)}`
+      `Tool names mismatch.\nExpected: ${JSON.stringify(
+        expectedSorted,
+      )}\nActual: ${JSON.stringify(sorted)}`,
     );
   }
 }
@@ -77,7 +85,9 @@ export function expectToolNamesEqual(actual: string[], expected: readonly string
 export function assertBrowserToolsPresent(toolNames: string[]): void {
   for (const name of BROWSER_TOOL_NAMES) {
     if (!toolNames.includes(name)) {
-      throw new Error(`Expected browser tool "${name}" to be present in tool names`);
+      throw new Error(
+        `Expected browser tool "${name}" to be present in tool names`,
+      );
     }
   }
 }
@@ -88,7 +98,9 @@ export function assertBrowserToolsPresent(toolNames: string[]): void {
 export function assertBrowserToolsAbsent(toolNames: string[]): void {
   for (const name of BROWSER_TOOL_NAMES) {
     if (toolNames.includes(name)) {
-      throw new Error(`Expected browser tool "${name}" to be absent from tool names`);
+      throw new Error(
+        `Expected browser tool "${name}" to be absent from tool names`,
+      );
     }
   }
 }

package/src/__tests__/test-support/computer-use-skill-harness.ts

@@ -4,27 +4,27 @@
 
 /** The 12 computer_use_* action tool names provided by the bundled computer-use skill. */
 export const COMPUTER_USE_TOOL_NAMES = [
-  'computer_use_click',
-  'computer_use_double_click',
-  'computer_use_right_click',
-  'computer_use_type_text',
-  'computer_use_key',
-  'computer_use_scroll',
-  'computer_use_drag',
-  'computer_use_wait',
-  'computer_use_open_app',
-  'computer_use_run_applescript',
-  'computer_use_done',
-  'computer_use_respond',
+  "computer_use_click",
+  "computer_use_double_click",
+  "computer_use_right_click",
+  "computer_use_type_text",
+  "computer_use_key",
+  "computer_use_scroll",
+  "computer_use_drag",
+  "computer_use_wait",
+  "computer_use_open_app",
+  "computer_use_run_applescript",
+  "computer_use_done",
+  "computer_use_respond",
 ] as const;
 
 /** The skill ID for the bundled computer-use skill (used in later PRs). */
-export const COMPUTER_USE_SKILL_ID = 'computer-use';
+export const COMPUTER_USE_SKILL_ID = "computer-use";
 
 /** Number of computer_use_* tools. */
 export const COMPUTER_USE_TOOL_COUNT = COMPUTER_USE_TOOL_NAMES.length; // 12
 
-import { expect } from 'bun:test';
+import { expect } from "bun:test";
 
 /**
  * Assert that every COMPUTER_USE_TOOL_NAMES entry is present in `names`.

package/src/__tests__/tool-approval-handler.test.ts

@@ -106,7 +106,7 @@ function makeContext(overrides: Partial<ToolContext> = {}): ToolContext {
     conversationId: "conv-1",
     assistantId: "self",
     requestId: "req-1",
-    guardianTrustClass: "trusted_contact",
+    trustClass: "trusted_contact",
     ...overrides,
   };
 }
@@ -142,7 +142,7 @@ describe("ToolApprovalHandler / pre-exec gate grant check", () => {
     );
     expect(mintResult.ok).toBe(true);
 
-    const context = makeContext({ guardianTrustClass: "trusted_contact" });
+    const context = makeContext({ trustClass: "trusted_contact" });
     const result = await handler.checkPreExecutionGates(
       toolName,
       input,
@@ -163,7 +163,7 @@ describe("ToolApprovalHandler / pre-exec gate grant check", () => {
     const toolName = "bash";
     const input = { command: "rm -rf /" };
 
-    const context = makeContext({ guardianTrustClass: "trusted_contact" });
+    const context = makeContext({ trustClass: "trusted_contact" });
     const result = await handler.checkPreExecutionGates(
       toolName,
       input,
@@ -197,7 +197,7 @@ describe("ToolApprovalHandler / pre-exec gate grant check", () => {
       }),
     );
 
-    const context = makeContext({ guardianTrustClass: "unknown" });
+    const context = makeContext({ trustClass: "unknown" });
     const result = await handler.checkPreExecutionGates(
       toolName,
       input,
@@ -215,7 +215,7 @@ describe("ToolApprovalHandler / pre-exec gate grant check", () => {
     const toolName = "bash";
     const input = { command: "deploy" };
 
-    const context = makeContext({ guardianTrustClass: "unknown" });
+    const context = makeContext({ trustClass: "unknown" });
     const result = await handler.checkPreExecutionGates(
       toolName,
       input,
@@ -244,7 +244,7 @@ describe("ToolApprovalHandler / pre-exec gate grant check", () => {
       }),
     );
 
-    const context = makeContext({ guardianTrustClass: "trusted_contact" });
+    const context = makeContext({ trustClass: "trusted_contact" });
 
     // First invocation — should consume the grant and allow
     const first = await handler.checkPreExecutionGates(
@@ -285,7 +285,7 @@ describe("ToolApprovalHandler / pre-exec gate grant check", () => {
       }),
     );
 
-    const context = makeContext({ guardianTrustClass: "trusted_contact" });
+    const context = makeContext({ trustClass: "trusted_contact" });
     const result = await handler.checkPreExecutionGates(
       toolName,
       invokeInput,
@@ -314,7 +314,7 @@ describe("ToolApprovalHandler / pre-exec gate grant check", () => {
       }),
     );
 
-    const context = makeContext({ guardianTrustClass: "trusted_contact" });
+    const context = makeContext({ trustClass: "trusted_contact" });
     const result = await handler.checkPreExecutionGates(
       toolName,
       input,
@@ -333,7 +333,7 @@ describe("ToolApprovalHandler / pre-exec gate grant check", () => {
     const input = { command: "deploy" };
 
     // No grants minted at all
-    const context = makeContext({ guardianTrustClass: "guardian" });
+    const context = makeContext({ trustClass: "guardian" });
     const result = await handler.checkPreExecutionGates(
       toolName,
       input,
@@ -352,7 +352,7 @@ describe("ToolApprovalHandler / pre-exec gate grant check", () => {
     const toolName = "bash";
     const input = { command: "deploy" };
 
-    const context = makeContext({ guardianTrustClass: "guardian" });
+    const context = makeContext({ trustClass: "guardian" });
     const result = await handler.checkPreExecutionGates(
       toolName,
       input,
@@ -378,7 +378,7 @@ describe("ToolApprovalHandler / pre-exec gate grant check", () => {
     );
 
     const context = makeContext({
-      guardianTrustClass: "trusted_contact",
+      trustClass: "trusted_contact",
       requestId: "req-1",
     });
     const result = await handler.checkPreExecutionGates(
@@ -410,7 +410,7 @@ describe("ToolApprovalHandler / pre-exec gate grant check", () => {
 
     // Context conversationId does not match the grant's conversationId
     const context = makeContext({
-      guardianTrustClass: "trusted_contact",
+      trustClass: "trusted_contact",
       conversationId: "conv-1",
     });
     const result = await handler.checkPreExecutionGates(
@@ -432,7 +432,7 @@ describe("ToolApprovalHandler / pre-exec gate grant check", () => {
 
     // executionChannel defaults to undefined (non-voice)
     const context = makeContext({
-      guardianTrustClass: "trusted_contact",
+      trustClass: "trusted_contact",
       executionChannel: "telegram",
     });
 
@@ -472,7 +472,7 @@ describe("ToolApprovalHandler / pre-exec gate grant check", () => {
     }, 300);
 
     const context = makeContext({
-      guardianTrustClass: "trusted_contact",
+      trustClass: "trusted_contact",
       executionChannel: "voice",
     });
 
@@ -503,7 +503,7 @@ describe("ToolApprovalHandler / pre-exec gate grant check", () => {
     setTimeout(() => controller.abort(), 200);
 
     const context = makeContext({
-      guardianTrustClass: "trusted_contact",
+      trustClass: "trusted_contact",
       executionChannel: "voice",
       signal: controller.signal,
     });

package/src/__tests__/tool-execution-abort-cleanup.test.ts

@@ -111,7 +111,7 @@ function makeToolContext(workingDir: string, signal?: AbortSignal) {
     workingDir,
     sessionId: "test-session",
     conversationId: "test-conv",
-    guardianTrustClass: "guardian" as const,
+    trustClass: "guardian" as const,
     signal,
   };
 }

package/src/__tests__/tool-execution-pipeline.benchmark.test.ts

@@ -434,7 +434,7 @@ describe("Tool execution pipeline benchmark", () => {
       workingDir: "/tmp",
       sessionId: "bench-session",
       conversationId: "bench-conv",
-      guardianTrustClass: "guardian",
+      trustClass: "guardian",
     };
 
     function makeTool(name: string, sleepMs: number): Tool {

package/src/__tests__/tool-executor-lifecycle-events.test.ts

@@ -162,7 +162,7 @@ function makeContext(events: ToolLifecycleEvent[]) {
     workingDir: "/tmp/project",
     sessionId: "session-1",
     conversationId: "conversation-1",
-    guardianTrustClass: "guardian" as const,
+    trustClass: "guardian" as const,
     onToolLifecycleEvent: (event: ToolLifecycleEvent) => {
       events.push(event);
     },
@@ -527,7 +527,7 @@ describe("ToolExecutor lifecycle events", () => {
         workingDir: "/tmp/project",
         sessionId: "session-1",
         conversationId: "conversation-1",
-        guardianTrustClass: "guardian",
+        trustClass: "guardian",
         onToolLifecycleEvent: () => new Promise<void>(() => {}),
       },
     );

package/src/__tests__/tool-executor-shell-integration.test.ts

@@ -149,7 +149,7 @@ function makeContext(overrides?: Partial<ToolContext>): ToolContext {
     workingDir: "/tmp/project",
     sessionId: "session-integration",
     conversationId: "conversation-integration",
-    guardianTrustClass: "guardian",
+    trustClass: "guardian",
     ...overrides,
   };
 }

package/src/__tests__/tool-executor.test.ts

@@ -167,7 +167,7 @@ function makeContext(overrides?: Partial<ToolContext>): ToolContext {
     workingDir: "/tmp/project",
     sessionId: "session-1",
     conversationId: "conversation-1",
-    guardianTrustClass: "guardian",
+    trustClass: "guardian",
     ...overrides,
   };
 }
@@ -1894,7 +1894,7 @@ describe("ToolExecutor forcePromptSideEffects enforcement", () => {
 });
 
 // ---------------------------------------------------------------------------
-// persistentDecisionsAllowed contract (PR 15)
+// persistentDecisionsAllowed contract
 // ---------------------------------------------------------------------------
 
 describe("ToolExecutor persistentDecisionsAllowed contract", () => {
@@ -1904,8 +1904,7 @@ describe("ToolExecutor persistentDecisionsAllowed contract", () => {
     getToolOverride = undefined;
     checkResultOverride = {
       decision: "prompt",
-      reason:
-        "Proxied network mode requires explicit approval for each invocation.",
+      reason: "Requires explicit approval",
     };
     checkFnOverride = undefined;
     if (addRuleSpy) {
@@ -1939,7 +1938,7 @@ describe("ToolExecutor persistentDecisionsAllowed contract", () => {
     return addRuleSpy;
   }
 
-  test("proxied bash always_allow does NOT save a trust rule", async () => {
+  test("proxied bash always_allow saves a trust rule (no special-casing)", async () => {
     const spy = setupAddRuleSpy();
 
     const prompter = makePrompterWithDecision(
@@ -1955,10 +1954,10 @@ describe("ToolExecutor persistentDecisionsAllowed contract", () => {
     );
 
     expect(result.isError).toBe(false);
-    expect(spy).not.toHaveBeenCalled();
+    expect(spy).toHaveBeenCalledTimes(1);
   });
 
-  test("non-proxied bash always_allow DOES save a trust rule", async () => {
+  test("non-proxied bash always_allow saves a trust rule", async () => {
     const spy = setupAddRuleSpy();
 
     const prompter = makePrompterWithDecision(
@@ -1977,7 +1976,7 @@ describe("ToolExecutor persistentDecisionsAllowed contract", () => {
     expect(spy).toHaveBeenCalledTimes(1);
   });
 
-  test("proxied bash always_deny does NOT save a trust rule", async () => {
+  test("proxied bash always_deny saves a deny rule (no special-casing)", async () => {
     const spy = setupAddRuleSpy();
 
     const prompter = makePrompterWithDecision(
@@ -1993,10 +1992,10 @@ describe("ToolExecutor persistentDecisionsAllowed contract", () => {
     );
 
     expect(result.isError).toBe(true);
-    expect(spy).not.toHaveBeenCalled();
+    expect(spy).toHaveBeenCalledTimes(1);
   });
 
-  test("persistentDecisionsAllowed: false is emitted in lifecycle event for proxied bash", async () => {
+  test("persistentDecisionsAllowed: true is emitted in lifecycle event for proxied bash", async () => {
     let capturedEvent: ToolPermissionPromptEvent | undefined;
     const prompter = makePrompterWithDecision("allow");
     const executor = new ToolExecutor(prompter);
@@ -2014,7 +2013,7 @@ describe("ToolExecutor persistentDecisionsAllowed contract", () => {
 
     expect(result.isError).toBe(false);
     expect(capturedEvent).toBeDefined();
-    expect(capturedEvent!.persistentDecisionsAllowed).toBe(false);
+    expect(capturedEvent!.persistentDecisionsAllowed).toBe(true);
   });
 
   test("persistentDecisionsAllowed: true is emitted in lifecycle event for non-proxied bash", async () => {
@@ -2038,7 +2037,7 @@ describe("ToolExecutor persistentDecisionsAllowed contract", () => {
     expect(capturedEvent!.persistentDecisionsAllowed).toBe(true);
   });
 
-  test("persistentDecisionsAllowed is passed to prompter confirmation_request for proxied bash", async () => {
+  test("persistentDecisionsAllowed is true for proxied bash in prompter confirmation_request", async () => {
     let capturedPersistent: unknown;
     const prompter = {
       prompt: async (
@@ -2069,87 +2068,13 @@ describe("ToolExecutor persistentDecisionsAllowed contract", () => {
     );
 
     expect(result.isError).toBe(false);
-    expect(capturedPersistent).toBe(false);
+    expect(capturedPersistent).toBe(true);
   });
 
-  test("host_bash with proxied network_mode still allows persistent decisions", async () => {
-    // host_bash does not support network_mode — proxied-mode persistence
-    // blocking applies only to sandboxed bash, not host_bash.
+  test("bash always_allow saves a trust rule regardless of network_mode", async () => {
     const spy = setupAddRuleSpy();
 
-    const prompter = makePrompterWithDecision(
-      "always_allow",
-      "host_bash:*",
-      "/tmp/project",
-    );
-    const executor = new ToolExecutor(prompter);
-    const result = await executor.execute(
-      "host_bash",
-      { command: "curl https://example.com", network_mode: "proxied" },
-      makeContext(),
-    );
-
-    expect(result.isError).toBe(false);
-    expect(spy).toHaveBeenCalledTimes(1);
-  });
-});
-
-// ---------------------------------------------------------------------------
-// E2E: Proxied bash vs. proxy approval persistence invariants (PR 32)
-//
-// Design invariant: the proxied-run activation prompt (when the agent wants
-// to run `bash` with `network_mode=proxied`) must NOT allow saving persistent
-// trust rules — each invocation must be explicitly approved. In contrast,
-// the proxy-request approval path (when the proxy service asks the user
-// about a specific outbound request) CAN save persistent trust rules so the
-// user doesn't get re-prompted for the same host/pattern.
-// ---------------------------------------------------------------------------
-
-describe("E2E: proxied bash activation vs proxy approval persistence", () => {
-  beforeEach(() => {
-    fakeToolResult = { content: "ok", isError: false };
-    lastCheckArgs = undefined;
-    getToolOverride = undefined;
-    checkResultOverride = {
-      decision: "prompt",
-      reason: "Requires explicit approval",
-    };
-    checkFnOverride = undefined;
-    if (addRuleSpy) {
-      addRuleSpy.mockRestore();
-      addRuleSpy = undefined;
-    }
-  });
-
-  function setupAddRuleSpy() {
-    addRuleSpy = spyOn(trustStore, "addRule").mockImplementation(
-      (
-        tool: string,
-        pattern: string,
-        scope: string,
-        decision = "allow",
-        priority = 100,
-        options?: { allowHighRisk?: boolean; executionTarget?: string },
-      ) => {
-        return {
-          id: "spy-rule-id",
-          tool,
-          pattern,
-          scope,
-          decision,
-          priority,
-          createdAt: Date.now(),
-          ...options,
-        } as TrustRule;
-      },
-    );
-    return addRuleSpy;
-  }
-
-  test("proxied bash: always_allow skips rule, always_deny skips rule, non-proxied bash saves both", async () => {
-    const spy = setupAddRuleSpy();
-
-    // 1. Proxied bash always_allow -> NO rule saved
+    // 1. Proxied bash always_allow -> rule IS saved
     const p1 = makePrompterWithDecision(
       "always_allow",
       "bash:curl*",
@@ -2162,61 +2087,22 @@ describe("E2E: proxied bash activation vs proxy approval persistence", () => {
       makeContext(),
     );
     expect(r1.isError).toBe(false);
-    expect(spy).not.toHaveBeenCalled();
+    expect(spy).toHaveBeenCalledTimes(1);
+    spy.mockClear();
 
-    // 2. Proxied bash always_deny -> NO rule saved
+    // 2. Non-proxied bash always_allow -> rule IS saved
     const p2 = makePrompterWithDecision(
-      "always_deny",
-      "bash:curl*",
-      "/tmp/project",
-    );
-    const e2 = new ToolExecutor(p2);
-    const r2 = await e2.execute(
-      "bash",
-      { command: "curl https://evil.com", network_mode: "proxied" },
-      makeContext(),
-    );
-    expect(r2.isError).toBe(true);
-    expect(spy).not.toHaveBeenCalled();
-
-    // 3. Non-proxied bash always_allow -> rule IS saved
-    const p3 = makePrompterWithDecision(
       "always_allow",
       "bash:git*",
       "/tmp/project",
     );
-    const e3 = new ToolExecutor(p3);
-    const r3 = await e3.execute("bash", { command: "git push" }, makeContext());
-    expect(r3.isError).toBe(false);
+    const e2 = new ToolExecutor(p2);
+    const r2 = await e2.execute("bash", { command: "git push" }, makeContext());
+    expect(r2.isError).toBe(false);
     expect(spy).toHaveBeenCalledTimes(1);
-    expect(spy.mock.calls[0][0]).toBe("bash");
-    expect(spy.mock.calls[0][1]).toBe("bash:git*");
-    expect(spy.mock.calls[0][3]).toBe("allow");
-  });
-
-  test("proxied bash always_allow_high_risk also skips rule saving", async () => {
-    const spy = setupAddRuleSpy();
-
-    const prompter = makePrompterWithDecision(
-      "always_allow_high_risk",
-      "bash:*",
-      "everywhere",
-    );
-    const executor = new ToolExecutor(prompter);
-    const result = await executor.execute(
-      "bash",
-      {
-        command: "curl -X POST https://api.example.com/deploy",
-        network_mode: "proxied",
-      },
-      makeContext(),
-    );
-
-    expect(result.isError).toBe(false);
-    expect(spy).not.toHaveBeenCalled();
   });
 
-  test("non-proxied bash always_deny DOES save a deny rule", async () => {
+  test("bash always_deny saves a deny rule regardless of network_mode", async () => {
     const spy = setupAddRuleSpy();
 
     const prompter = makePrompterWithDecision(
@@ -2238,51 +2124,7 @@ describe("E2E: proxied bash activation vs proxy approval persistence", () => {
     expect(spy.mock.calls[0][3]).toBe("deny");
   });
 
-  test("file_write with proxied network_mode is NOT affected (persistence still allowed)", async () => {
-    // Only bash with proxied mode disables persistence
-    const spy = setupAddRuleSpy();
-
-    const prompter = makePrompterWithDecision(
-      "always_allow",
-      "file_write:*",
-      "/tmp/project",
-    );
-    const executor = new ToolExecutor(prompter);
-    const result = await executor.execute(
-      "file_write",
-      { path: "/tmp/test.txt", content: "data", network_mode: "proxied" },
-      makeContext(),
-    );
-
-    expect(result.isError).toBe(false);
-    expect(spy).toHaveBeenCalledTimes(1);
-  });
-
-  test("host_bash proxied always_allow_high_risk still saves rule (host_bash ignores network_mode)", async () => {
-    // host_bash does not support network_mode — persistence blocking
-    // applies only to sandboxed bash.
-    const spy = setupAddRuleSpy();
-
-    const prompter = makePrompterWithDecision(
-      "always_allow_high_risk",
-      "host_bash:*",
-      "everywhere",
-    );
-    const executor = new ToolExecutor(prompter);
-    const result = await executor.execute(
-      "host_bash",
-      {
-        command: "wget https://example.com/data.tar.gz",
-        network_mode: "proxied",
-      },
-      makeContext(),
-    );
-
-    expect(result.isError).toBe(false);
-    expect(spy).toHaveBeenCalledTimes(1);
-  });
-
-  test('proxied bash denied result message omits "rule saved" suffix', async () => {
+  test('proxied bash denied result message includes "rule saved" suffix', async () => {
     setupAddRuleSpy();
 
     const prompter = makePrompterWithDecision(
@@ -2298,9 +2140,8 @@ describe("E2E: proxied bash activation vs proxy approval persistence", () => {
     );
 
     expect(result.isError).toBe(true);
-    // Since no rule was saved, the message should NOT include "rule was saved"
     expect(result.content).toContain("Permission denied by user");
-    expect(result.content).not.toContain("rule was saved");
+    expect(result.content).toContain("rule was saved");
   });
 
   test('non-proxied bash denied result message includes "rule saved" suffix', async () => {