@vellumai/assistant 0.6.2 → 0.6.4

package/src/__tests__/anthropic-provider.test.ts

@@ -307,7 +307,10 @@ describe("AnthropicProvider — Cache-Control Characterization", () => {
     // Turn-starting user message (first) keeps 1h
     const turnStart = sent[0];
     const turnStartLast = turnStart.content[turnStart.content.length - 1];
-    expect(turnStartLast.cache_control).toEqual({ type: "ephemeral", ttl: "1h" });
+    expect(turnStartLast.cache_control).toEqual({
+      type: "ephemeral",
+      ttl: "1h",
+    });
 
     // Last message (tool_result) gets 5m advancing tail
     const lastMessage = sent[sent.length - 1];
@@ -398,7 +401,10 @@ describe("AnthropicProvider — Cache-Control Characterization", () => {
     }>;
     const user = sent[0];
     expect(user.content[0].cache_control).toBeUndefined();
-    expect(user.content[1].cache_control).toEqual({ type: "ephemeral", ttl: "1h" });
+    expect(user.content[1].cache_control).toEqual({
+      type: "ephemeral",
+      ttl: "1h",
+    });
   });
 
   // -----------------------------------------------------------------------
@@ -442,7 +448,10 @@ describe("AnthropicProvider — Cache-Control Characterization", () => {
     // Workspace block (first): no cache_control
     expect(user.content[0].cache_control).toBeUndefined();
     // User text (last): cache_control with 1h TTL
-    expect(user.content[1].cache_control).toEqual({ type: "ephemeral", ttl: "1h" });
+    expect(user.content[1].cache_control).toEqual({
+      type: "ephemeral",
+      ttl: "1h",
+    });
   });
 
   test("workspace + multi-block single user message: cache on last block only", async () => {
@@ -476,7 +485,10 @@ describe("AnthropicProvider — Cache-Control Characterization", () => {
     // Only last block gets cache_control
     expect(user.content[0].cache_control).toBeUndefined();
     expect(user.content[1].cache_control).toBeUndefined();
-    expect(user.content[2].cache_control).toEqual({ type: "ephemeral", ttl: "1h" });
+    expect(user.content[2].cache_control).toEqual({
+      type: "ephemeral",
+      ttl: "1h",
+    });
   });
 
   // -----------------------------------------------------------------------
@@ -724,7 +736,8 @@ describe("AnthropicProvider — Cache-Control Characterization", () => {
   test("orphaned server_tool_use gets synthetic web_search_tool_result injected", async () => {
     // When stream is interrupted, server_tool_use may be stored without its
     // paired web_search_tool_result. repairOrphanedServerToolUse should inject
-    // a synthetic empty-content web_search_tool_result after the orphan.
+    // a synthetic error web_search_tool_result after the orphan so the model
+    // knows the search failed (rather than silently returning zero results).
     const messages: Message[] = [
       userMsg("Search for something"),
       {
@@ -757,7 +770,10 @@ describe("AnthropicProvider — Cache-Control Characterization", () => {
     expect(sent[1].content[0].type).toBe("server_tool_use");
     expect(sent[1].content[1].type).toBe("web_search_tool_result");
     expect(sent[1].content[1].tool_use_id).toBe("srvtoolu_abc123");
-    expect(sent[1].content[1].content).toEqual([]);
+    expect(sent[1].content[1].content).toEqual({
+      type: "web_search_tool_result_error",
+      error_code: "unavailable",
+    });
     expect(sent[2].role).toBe("user");
     expect(sent[2].content[0].type).toBe("text");
   });
@@ -1037,7 +1053,10 @@ describe("AnthropicProvider — Cache-Control Characterization", () => {
         b.tool_use_id === "srvtoolu_interrupted",
     );
     expect(syntheticResults).toHaveLength(1);
-    expect(syntheticResults[0].content).toEqual([]);
+    expect(syntheticResults[0].content).toEqual({
+      type: "web_search_tool_result_error",
+      error_code: "unavailable",
+    });
   });
 
   test("paired server_tool_use is not modified by repair", async () => {
@@ -1408,7 +1427,10 @@ describe("AnthropicProvider — Cache-Control Characterization", () => {
     // Last user message (turn 3): 1h cache on last block only
     const lastUser = userMsgs[userMsgs.length - 1];
     expect(lastUser.content[0].cache_control).toBeUndefined();
-    expect(lastUser.content[1].cache_control).toEqual({ type: "ephemeral", ttl: "1h" });
+    expect(lastUser.content[1].cache_control).toEqual({
+      type: "ephemeral",
+      ttl: "1h",
+    });
 
     // No top-level cache_control — breakpoints are set directly on blocks
     expect(
@@ -1437,14 +1459,19 @@ describe("AnthropicProvider — Cache-Control Characterization", () => {
 
     // First message is the turn-starting user text — gets 1h cache
     expect(sent[0].role).toBe("user");
-    expect(sent[0].content[0].cache_control).toEqual({ type: "ephemeral", ttl: "1h" });
+    expect(sent[0].content[0].cache_control).toEqual({
+      type: "ephemeral",
+      ttl: "1h",
+    });
 
     // Non-last tool result messages do NOT get cache_control
     const toolResultMsgs = sent.filter(
       (m) =>
         m.role === "user" &&
         Array.isArray(m.content) &&
-        m.content.every((b) => typeof b !== "string" && b.type === "tool_result"),
+        m.content.every(
+          (b) => typeof b !== "string" && b.type === "tool_result",
+        ),
     );
     expect(toolResultMsgs.length).toBeGreaterThan(0);
     for (const tr of toolResultMsgs.slice(0, -1)) {
@@ -1693,3 +1720,229 @@ describe("AnthropicProvider — Managed Proxy Fallback", () => {
     });
   });
 });
+
+// ---------------------------------------------------------------------------
+// Tests — Orphaned UTF-16 surrogate sanitization
+// ---------------------------------------------------------------------------
+
+describe("AnthropicProvider — surrogate sanitization", () => {
+  let provider: AnthropicProvider;
+
+  beforeEach(() => {
+    lastStreamParams = null;
+    provider = new AnthropicProvider("sk-ant-test", "claude-sonnet-4-6");
+  });
+
+  test("strips orphaned high surrogate from a tool result before sending", async () => {
+    // An orphaned high surrogate — the exact shape that triggers Anthropic's
+    // "no low surrogate in string" 400. The mock's JSON.parse(JSON.stringify)
+    // on line ~44 would throw if sanitization didn't happen.
+    const LONE_HIGH = "\uD83C";
+    const messages: Message[] = [
+      toolUseMsg("tu1", "bash"),
+      toolResultMsg("tu1", `shell output ${LONE_HIGH} more output`),
+      userMsg("what happened?"),
+    ];
+
+    await provider.sendMessage(messages);
+
+    const sent = lastStreamParams!.messages as Array<{
+      role: string;
+      content: Array<{ type: string; content?: string; text?: string }>;
+    }>;
+    // Find the tool_result block in the captured payload and assert no orphans.
+    const toolResult = sent
+      .flatMap((m) => m.content)
+      .find((b) => b.type === "tool_result");
+    expect(toolResult).toBeDefined();
+    expect(toolResult!.content).toBeDefined();
+    const content = toolResult!.content as string;
+    for (let i = 0; i < content.length; i++) {
+      const code = content.charCodeAt(i);
+      if (code >= 0xd800 && code <= 0xdbff) {
+        const next = i + 1 < content.length ? content.charCodeAt(i + 1) : 0;
+        expect(next >= 0xdc00 && next <= 0xdfff).toBe(true);
+        i++;
+      } else {
+        expect(code < 0xdc00 || code > 0xdfff).toBe(true);
+      }
+    }
+  });
+
+  test("clean payloads are not copied unnecessarily", async () => {
+    // When there are no orphans, the sanitizer should be a no-op. We can't
+    // easily assert reference equality through the mock boundary (the mock
+    // JSON-round-trips params for capture), but we can at least confirm the
+    // call succeeds without error on ordinary payloads containing valid
+    // surrogate pairs (emoji).
+    const EMOJI = "\uD83C\uDF89";
+    await provider.sendMessage([userMsg(`hello ${EMOJI} world`)]);
+    const sent = lastStreamParams!.messages as Array<{
+      content: Array<{ text?: string }>;
+    }>;
+    expect(sent[0].content[0].text).toContain(EMOJI);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Haiku model gating
+// ---------------------------------------------------------------------------
+
+describe("AnthropicProvider — Haiku Model Gating", () => {
+  let provider: AnthropicProvider;
+
+  beforeEach(() => {
+    lastStreamParams = null;
+    _lastStreamOptions = null;
+    lastConstructorArgs = null;
+    provider = new AnthropicProvider(
+      "sk-ant-test",
+      "claude-haiku-4-5-20251001",
+    );
+  });
+
+  test("max_tokens defaults to 8192 for Haiku", async () => {
+    await provider.sendMessage([userMsg("Hi")], undefined, "You are helpful.");
+
+    expect(lastStreamParams!.max_tokens).toBe(8192);
+  });
+
+  test("caller max_tokens is clamped to 8192 for Haiku", async () => {
+    await provider.sendMessage([userMsg("Hi")], undefined, "You are helpful.", {
+      config: { max_tokens: 64000 },
+    });
+
+    expect(lastStreamParams!.max_tokens).toBe(8192);
+  });
+
+  test("caller max_tokens below 8192 is preserved for Haiku", async () => {
+    await provider.sendMessage([userMsg("Hi")], undefined, "You are helpful.", {
+      config: { max_tokens: 128 },
+    });
+
+    expect(lastStreamParams!.max_tokens).toBe(128);
+  });
+
+  test("non-Haiku provider respects caller max_tokens without clamping", async () => {
+    const sonnetProvider = new AnthropicProvider(
+      "sk-ant-test",
+      "claude-sonnet-4-6",
+    );
+    await sonnetProvider.sendMessage(
+      [userMsg("Hi")],
+      undefined,
+      "You are helpful.",
+      { config: { max_tokens: 200 } },
+    );
+
+    expect(lastStreamParams!.max_tokens).toBe(200);
+  });
+
+  test("cache_control omits ttl for Haiku", async () => {
+    await provider.sendMessage([userMsg("Hi")], undefined, "You are helpful.");
+
+    const system = lastStreamParams!.system as Array<{
+      cache_control?: { type: string; ttl?: string };
+    }>;
+    expect(system[0].cache_control).toEqual({ type: "ephemeral" });
+    expect(system[0].cache_control).not.toHaveProperty("ttl");
+  });
+
+  test("betas array is empty for Haiku (no extended cache TTL or 1M context)", async () => {
+    await provider.sendMessage([userMsg("Hi")], undefined, "You are helpful.");
+
+    // When betas is empty, the non-beta stream path is used, so no betas
+    // field should appear in lastStreamParams.
+    expect(lastStreamParams!.betas).toBeUndefined();
+  });
+
+  test("effort is stripped for Haiku even when provided in config", async () => {
+    await provider.sendMessage([userMsg("Hi")], undefined, "You are helpful.", {
+      config: { effort: "high" },
+    });
+
+    expect(lastStreamParams!.output_config).toBeUndefined();
+  });
+});
+
+// ---------------------------------------------------------------------------
+// OpenRouter routing Anthropic models through the Messages API
+// ---------------------------------------------------------------------------
+
+describe("OpenRouterProvider — Anthropic dispatch", () => {
+  beforeEach(() => {
+    lastStreamParams = null;
+    _lastStreamOptions = null;
+    lastConstructorArgs = null;
+  });
+
+  test("anthropic/ models are routed to Anthropic Messages API with Bearer auth", async () => {
+    const { OpenRouterProvider } = await import(
+      "../providers/openrouter/client.js"
+    );
+    const provider = new OpenRouterProvider(
+      "or-key",
+      "anthropic/claude-sonnet-4.6",
+    );
+    await provider.sendMessage([userMsg("hi")], undefined, "You are helpful.");
+
+    expect(lastConstructorArgs).toMatchObject({
+      apiKey: null,
+      authToken: "or-key",
+      baseURL: "https://openrouter.ai/api",
+    });
+    expect(lastStreamParams).toBeTruthy();
+    expect(lastStreamParams!.model).toBe("anthropic/claude-sonnet-4.6");
+  });
+
+  test("custom baseURL has trailing /v1 stripped for Messages API", async () => {
+    const { OpenRouterProvider } = await import(
+      "../providers/openrouter/client.js"
+    );
+    const provider = new OpenRouterProvider(
+      "ast-key",
+      "anthropic/claude-opus-4.6",
+      {
+        baseURL: "https://platform.example.com/v1/runtime-proxy/openrouter/v1",
+      },
+    );
+    await provider.sendMessage([userMsg("hi")]);
+
+    expect(lastConstructorArgs).toMatchObject({
+      baseURL: "https://platform.example.com/v1/runtime-proxy/openrouter",
+    });
+  });
+
+  test("thinking config flows through to Anthropic Messages API natively", async () => {
+    const { OpenRouterProvider } = await import(
+      "../providers/openrouter/client.js"
+    );
+    const provider = new OpenRouterProvider(
+      "or-key",
+      "anthropic/claude-sonnet-4.6",
+    );
+    await provider.sendMessage([userMsg("hi")], undefined, undefined, {
+      config: { thinking: { type: "adaptive" } },
+    });
+
+    expect(lastStreamParams!.thinking).toEqual({ type: "adaptive" });
+    // The OpenAI-compat `reasoning` parameter must NOT be sent on the
+    // native Messages API path.
+    expect(lastStreamParams!.reasoning).toBeUndefined();
+  });
+
+  test("per-request model override routes based on the overridden model", async () => {
+    const { OpenRouterProvider } = await import(
+      "../providers/openrouter/client.js"
+    );
+    // Default model is non-Anthropic, but the request overrides with an
+    // Anthropic model — dispatch must honour the request-level model.
+    const provider = new OpenRouterProvider("or-key", "x-ai/grok-4");
+    await provider.sendMessage([userMsg("hi")], undefined, undefined, {
+      config: { model: "anthropic/claude-haiku-4.5" },
+    });
+
+    expect(lastStreamParams).toBeTruthy();
+    expect(lastStreamParams!.model).toBe("anthropic/claude-haiku-4.5");
+  });
+});

package/src/__tests__/app-builder-tool-scripts.test.ts

@@ -25,6 +25,7 @@ function makeMockStore(overrides: Partial<AppStore> = {}): AppStore {
   return {
     getApp: () => makeApp(),
     listApps: () => [makeApp()],
+    appFileExists: () => false,
     createApp: (params) =>
       makeApp({ name: params.name, description: params.description }),
     updateApp: (id, updates) => makeApp({ id, ...updates }),

package/src/__tests__/app-executors.test.ts

@@ -56,6 +56,7 @@ function mockStore(
   return {
     getApp: (id: string) => (id === app.id ? app : null),
     listApps: () => [app],
+    appFileExists: (_appId: string, path: string) => path in files,
     createApp: () => app,
     updateApp: () => app,
     deleteApp: () => {},

package/src/__tests__/app-source-watcher.test.ts

@@ -21,23 +21,25 @@ const testDirNameMap = new Map<string, string>([["my-app", "app-id-1"]]);
 
 let capturedWatchCallback: ((eventType: string, filename: string | null) => void) | null = null;
 const mockWatcher = { close: mock(() => {}) };
+const mockExistsSync = mock((p: string): boolean => p === TEST_APPS_DIR);
+const mockWatch = mock(
+  (
+    _path: string,
+    _opts: Record<string, unknown>,
+    callback: (eventType: string, filename: string | null) => void,
+  ) => {
+    capturedWatchCallback = callback;
+    return mockWatcher;
+  },
+);
 
 mock.module("node:fs", () => {
   // eslint-disable-next-line @typescript-eslint/no-require-imports
   const actualFs = require("node:fs");
   return {
     ...actualFs,
-    existsSync: mock((p: string) => p === TEST_APPS_DIR),
-    watch: mock(
-      (
-        _path: string,
-        _opts: Record<string, unknown>,
-        callback: (eventType: string, filename: string | null) => void,
-      ) => {
-        capturedWatchCallback = callback;
-        return mockWatcher;
-      },
-    ),
+    existsSync: mockExistsSync,
+    watch: mockWatch,
   };
 });
 
@@ -67,6 +69,8 @@ describe("AppSourceWatcher", () => {
     onChangeSpy = mock(() => {});
     capturedWatchCallback = null;
     mockWatcher.close.mockClear();
+    // Reset existsSync to default behavior for each test
+    mockExistsSync.mockImplementation((p: string) => p === TEST_APPS_DIR);
   });
 
   afterEach(() => {
@@ -156,4 +160,26 @@ describe("AppSourceWatcher", () => {
 
     expect(mockWatcher.close).toHaveBeenCalledTimes(1);
   });
+
+  test("ensureStarted() initializes watcher after apps directory is created", () => {
+    // Simulate apps dir not existing at start time
+    mockExistsSync.mockImplementation((_p: string) => false);
+
+    watcher.start(onChangeSpy);
+    expect(capturedWatchCallback).toBeNull(); // watcher didn't start
+
+    // Simulate apps dir now existing (e.g. after app_create)
+    mockExistsSync.mockImplementation((p: string) => p === TEST_APPS_DIR);
+
+    watcher.ensureStarted();
+    expect(capturedWatchCallback).not.toBeNull(); // watcher started
+  });
+
+  test("ensureStarted() is a no-op when watcher is already running", () => {
+    watcher.start(onChangeSpy);
+    const callCountAfterStart = mockWatch.mock.calls.length;
+
+    watcher.ensureStarted();
+    expect(mockWatch.mock.calls.length).toBe(callCountAfterStart); // no extra watch call
+  });
 });

package/src/__tests__/approval-routes-http.test.ts

@@ -6,6 +6,7 @@
  */
 import { beforeEach, describe, expect, mock, test } from "bun:test";
 
+import { _setOverridesForTesting } from "../config/assistant-feature-flags.js";
 import type { Conversation } from "../daemon/conversation.js";
 import type { ServerMessage } from "../daemon/message-protocol.js";
 
@@ -68,6 +69,7 @@ mock.module("../permissions/trust-store.js", () => ({
 }));
 
 import { getDb, initializeDb } from "../memory/db.js";
+import { CONVERSATION_HOST_ACCESS_PROMPT } from "../permissions/v2-consent-policy.js";
 import { AssistantEventHub } from "../runtime/assistant-event-hub.js";
 import { RuntimeHttpServer } from "../runtime/http-server.js";
 import * as pendingInteractions from "../runtime/pending-interactions.js";
@@ -109,6 +111,7 @@ function makeIdleSession(opts?: {
     usageStats: { inputTokens: 0, outputTokens: 0, estimatedCost: 0 },
     updateClient: () => {},
     setHostBashProxy: () => {},
+    setHostBrowserProxy: () => {},
     setHostFileProxy: () => {},
     setHostCuProxy: () => {},
     addPreactivatedSkillId: () => {},
@@ -174,6 +177,7 @@ function makeConfirmationEmittingSession(opts?: {
     usageStats: { inputTokens: 0, outputTokens: 0, estimatedCost: 0 },
     updateClient: () => {},
     setHostBashProxy: () => {},
+    setHostBrowserProxy: () => {},
     setHostFileProxy: () => {},
     setHostCuProxy: () => {},
     addPreactivatedSkillId: () => {},
@@ -221,6 +225,7 @@ describe("standalone approval endpoints — HTTP layer", () => {
   let eventHub: AssistantEventHub;
 
   beforeEach(() => {
+    _setOverridesForTesting({});
     const db = getDb();
     db.run("DELETE FROM messages");
     db.run("DELETE FROM conversations");
@@ -359,7 +364,21 @@ describe("standalone approval endpoints — HTTP layer", () => {
     });
 
     test("returns 400 for invalid decision", async () => {
-      await startServer(() => makeIdleSession());
+      const session = makeIdleSession();
+      await startServer(() => session);
+
+      pendingInteractions.register("req-1", {
+        conversation: session,
+        conversationId: "conv-1",
+        kind: "confirmation",
+        confirmationDetails: {
+          toolName: "shell_command",
+          input: { command: "ls" },
+          riskLevel: "medium",
+          allowlistOptions: [],
+          scopeOptions: [],
+        },
+      });
 
       const res = await fetch(url("confirm"), {
         method: "POST",
@@ -371,6 +390,124 @@ describe("standalone approval endpoints — HTTP layer", () => {
 
       await stopServer();
     });
+
+    test("rejects temporal approval decisions for conversation host-access prompts", async () => {
+      let confirmedDecision: string | undefined;
+
+      const session = makeIdleSession({
+        onConfirmation: (_reqId, dec) => {
+          confirmedDecision = dec;
+        },
+      });
+
+      await startServer(() => session);
+
+      pendingInteractions.register("req-host-access", {
+        conversation: session,
+        conversationId: "conv-1",
+        kind: "confirmation",
+        confirmationDetails: {
+          toolName: "host_bash",
+          input: { command: "ls" },
+          riskLevel: "medium",
+          ...CONVERSATION_HOST_ACCESS_PROMPT,
+        },
+      });
+
+      const res = await fetch(url("confirm"), {
+        method: "POST",
+        headers: { "Content-Type": "application/json", ...AUTH_HEADERS },
+        body: JSON.stringify({
+          requestId: "req-host-access",
+          decision: "allow_10m",
+        }),
+      });
+      const body = (await res.json()) as { error?: { message?: string } };
+
+      expect(res.status).toBe(403);
+      expect(body.error?.message).toContain(
+        "Conversation host-access prompts only accept allow or deny",
+      );
+      expect(confirmedDecision).toBeUndefined();
+      expect(pendingInteractions.get("req-host-access")).toBeDefined();
+
+      await stopServer();
+    });
+
+    test("canonicalizes advertised legacy allow verbs to one-time allow under v2", async () => {
+      _setOverridesForTesting({ "permission-controls-v2": true });
+      let handledDecision: string | undefined;
+      const handlingSession = makeIdleSession({
+        onConfirmation: (_requestId, decision) => {
+          handledDecision = decision;
+        },
+      });
+      await startServer(() => handlingSession);
+
+      pendingInteractions.register("req-v2", {
+        conversation: handlingSession,
+        conversationId: "conv-1",
+        kind: "confirmation",
+        confirmationDetails: {
+          toolName: "shell_command",
+          input: { command: "ls" },
+          riskLevel: "medium",
+          allowlistOptions: [],
+          scopeOptions: [],
+          temporaryOptionsAvailable: ["allow_10m"],
+        },
+      });
+
+      const res = await fetch(url("confirm"), {
+        method: "POST",
+        headers: { "Content-Type": "application/json", ...AUTH_HEADERS },
+        body: JSON.stringify({
+          requestId: "req-v2",
+          decision: "allow_10m",
+        }),
+      });
+
+      expect(res.status).toBe(200);
+      expect(handledDecision).toBe("allow");
+      expect(pendingInteractions.get("req-v2")).toBeUndefined();
+
+      await stopServer();
+    });
+
+    test("rejects unadvertised legacy approval verbs under v2", async () => {
+      _setOverridesForTesting({ "permission-controls-v2": true });
+      const session = makeIdleSession();
+      await startServer(() => session);
+
+      pendingInteractions.register("req-v2-invalid", {
+        conversation: session,
+        conversationId: "conv-1",
+        kind: "confirmation",
+        confirmationDetails: {
+          toolName: "shell_command",
+          input: { command: "ls" },
+          riskLevel: "medium",
+          allowlistOptions: [],
+          scopeOptions: [],
+        },
+      });
+
+      const res = await fetch(url("confirm"), {
+        method: "POST",
+        headers: { "Content-Type": "application/json", ...AUTH_HEADERS },
+        body: JSON.stringify({
+          requestId: "req-v2-invalid",
+          decision: "allow_10m",
+        }),
+      });
+      const body = (await res.json()) as { error?: { message?: string } };
+
+      expect(res.status).toBe(400);
+      expect(body.error?.message).toContain("resolve to allow or deny");
+      expect(pendingInteractions.get("req-v2-invalid")).toBeDefined();
+
+      await stopServer();
+    });
   });
 
   // ── POST /v1/secret ──────────────────────────────────────────────────
@@ -625,6 +762,46 @@ describe("standalone approval endpoints — HTTP layer", () => {
       await stopServer();
     });
 
+    test("returns 403 for trust rules under v2", async () => {
+      _setOverridesForTesting({ "permission-controls-v2": true });
+      const session = makeIdleSession();
+      await startServer(() => session);
+
+      pendingInteractions.register("req-v2-trust", {
+        conversation: session,
+        conversationId: "conv-1",
+        kind: "confirmation",
+        confirmationDetails: {
+          toolName: "shell_command",
+          input: { command: "ls" },
+          riskLevel: "medium",
+          allowlistOptions: [
+            { label: "Allow ls", description: "test", pattern: "ls" },
+          ],
+          scopeOptions: [{ label: "Conversation", scope: "session" }],
+          persistentDecisionsAllowed: true,
+        },
+      });
+
+      const res = await fetch(url("trust-rules"), {
+        method: "POST",
+        headers: { "Content-Type": "application/json", ...AUTH_HEADERS },
+        body: JSON.stringify({
+          requestId: "req-v2-trust",
+          pattern: "ls",
+          scope: "session",
+          decision: "allow",
+        }),
+      });
+      const body = (await res.json()) as { error?: { message?: string } };
+
+      expect(res.status).toBe(403);
+      expect(body.error?.message).toContain("permission-controls-v2");
+      expect(pendingInteractions.get("req-v2-trust")).toBeDefined();
+
+      await stopServer();
+    });
+
     test("returns 403 when pattern does not match allowlist", async () => {
       const session = makeIdleSession();
       await startServer(() => session);