@vellumai/assistant 0.6.5 → 0.7.0

package/src/permissions/approval-policy.test.ts

@@ -26,7 +26,6 @@ function makeContext(overrides: Partial<ApprovalContext>): ApprovalContext {
   return {
     riskLevel: RiskLevel.Low,
     toolName: "bash",
-    permissionsMode: "workspace",
     isContainerized: false,
     isWorkspaceScoped: false,
     ...overrides,
@@ -75,7 +74,7 @@ describe("ask rule", () => {
   const askRule = makeRule({ decision: "ask" });
 
   test("ask at Low risk", () => {
-    const result = evaluate({ riskLevel: RiskLevel.Low, matchedRule: askRule });
+    const result = evaluate({ riskLevel: RiskLevel.Low, matchedRule: askRule, autoApproveUpTo: "none" });
     expect(result.decision).toBe("prompt");
     expect(result.reason).toContain("ask rule");
     expect(result.matchedRule).toBe(askRule);
@@ -136,16 +135,16 @@ describe("allow rule", () => {
     expect(result.matchedRule).toBeUndefined();
   });
 
-  test("allow at High risk — containerized bash → allow (auto-allow), matchedRule present", () => {
+  test("allow at High risk — containerized bash without sandboxAutoApprove flag → prompt", () => {
     const result = evaluate({
       riskLevel: RiskLevel.High,
       toolName: "bash",
       matchedRule: allowRule,
       isContainerized: true,
     });
-    expect(result.decision).toBe("allow");
-    expect(result.reason).toContain("auto-allow-high-risk");
-    expect(result.matchedRule).toBe(allowRule);
+    expect(result.decision).toBe("prompt");
+    expect(result.reason).toContain("high risk");
+    expect(result.matchedRule).toBeUndefined();
   });
 
   test("allow at High risk — non-bash tool, containerized → prompt, no matchedRule in decision", () => {
@@ -175,21 +174,152 @@ describe("allow rule", () => {
   });
 });
 
+// ── Sandbox auto-approve ─────────────────────────────────────────────────────
+
+describe("sandbox auto-approve", () => {
+  test("bash + hasSandboxAutoApprove + containerized → allow", () => {
+    const result = evaluate({
+      riskLevel: RiskLevel.High,
+      toolName: "bash",
+      hasSandboxAutoApprove: true,
+      isContainerized: true,
+    });
+    expect(result.decision).toBe("allow");
+    expect(result.reason).toContain("sandbox auto-approve");
+  });
+
+  test("bash + hasSandboxAutoApprove + not containerized → allow (path resolution is baked in)", () => {
+    const result = evaluate({
+      riskLevel: RiskLevel.Low,
+      toolName: "bash",
+      hasSandboxAutoApprove: true,
+      isContainerized: false,
+    });
+    // hasSandboxAutoApprove === true means path resolution already passed upstream.
+    // The isContainerized gate was removed — sandbox auto-approve fires regardless.
+    expect(result.decision).toBe("allow");
+    expect(result.reason).toContain("sandbox auto-approve");
+  });
+
+  test("bash + hasSandboxAutoApprove + not containerized + High risk → allow (path resolution validated upstream)", () => {
+    const result = evaluate({
+      riskLevel: RiskLevel.High,
+      toolName: "bash",
+      hasSandboxAutoApprove: true,
+      isContainerized: false,
+    });
+    // Even at High risk, hasSandboxAutoApprove === true means the checker already
+    // validated that all path arguments are within the workspace root.
+    expect(result.decision).toBe("allow");
+    expect(result.reason).toContain("sandbox auto-approve");
+  });
+
+  test("host_bash + hasSandboxAutoApprove + containerized → falls through", () => {
+    const result = evaluate({
+      riskLevel: RiskLevel.Low,
+      toolName: "host_bash",
+      hasSandboxAutoApprove: true,
+      isContainerized: true,
+    });
+    // host_bash is not "bash", so sandbox auto-approve doesn't fire.
+    // Falls through to risk-based: Low → allow (within default "low" threshold)
+    expect(result.decision).toBe("allow");
+    expect(result.reason).toContain("within auto-approve threshold");
+  });
+
+  test("bash + no hasSandboxAutoApprove + containerized → falls through", () => {
+    const result = evaluate({
+      riskLevel: RiskLevel.High,
+      toolName: "bash",
+      hasSandboxAutoApprove: false,
+      isContainerized: true,
+    });
+    // hasSandboxAutoApprove is false, so sandbox auto-approve doesn't fire.
+    // Falls through to risk-based: High → prompt
+    expect(result.decision).toBe("prompt");
+    expect(result.reason).toContain("high risk");
+  });
+
+  test("sandbox auto-approve fires for High risk commands when threshold allows", () => {
+    // e.g. rm -rf in a container where the user has set autoApproveUpTo: "high"
+    const result = evaluate({
+      riskLevel: RiskLevel.High,
+      toolName: "bash",
+      hasSandboxAutoApprove: true,
+      isContainerized: true,
+      autoApproveUpTo: "high",
+    });
+    expect(result.decision).toBe("allow");
+    expect(result.reason).toContain("sandbox auto-approve");
+  });
+
+  test("sandbox auto-approve blocked when autoApproveUpTo is 'none' (Strict mode override)", () => {
+    // Per-conversation Strict override: threshold = none → no commands auto-approved.
+    const result = evaluate({
+      riskLevel: RiskLevel.Low,
+      toolName: "bash",
+      hasSandboxAutoApprove: true,
+      isContainerized: true,
+      autoApproveUpTo: "none",
+    });
+    expect(result.decision).toBe("prompt");
+  });
+
+  test("sandbox auto-approve still works when autoApproveUpTo is 'low'", () => {
+    const result = evaluate({
+      riskLevel: RiskLevel.Low,
+      toolName: "bash",
+      hasSandboxAutoApprove: true,
+      isContainerized: true,
+      autoApproveUpTo: "low",
+    });
+    expect(result.decision).toBe("allow");
+    expect(result.reason).toContain("sandbox auto-approve");
+  });
+
+  test("deny rule still blocks sandbox auto-approve commands", () => {
+    const denyRule = makeRule({ decision: "deny" });
+    const result = evaluate({
+      riskLevel: RiskLevel.High,
+      toolName: "bash",
+      hasSandboxAutoApprove: true,
+      isContainerized: true,
+      matchedRule: denyRule,
+    });
+    // Deny at step 1 prevents step 3 (sandbox auto-approve)
+    expect(result.decision).toBe("deny");
+    expect(result.reason).toContain("deny rule");
+  });
+
+  test("autoApproveUpTo 'none' blocks sandbox auto-approve", () => {
+    const result = evaluate({
+      riskLevel: RiskLevel.Low,
+      toolName: "bash",
+      hasSandboxAutoApprove: true,
+      isContainerized: true,
+      autoApproveUpTo: "none",
+    });
+    expect(result.decision).toBe("prompt");
+    expect(result.reason).toContain("above auto-approve threshold");
+  });
+});
+
 // ── No rule: third-party skill tool ──────────────────────────────────────────
 
 describe("no rule — third-party skill tool", () => {
-  test("skill origin, not bundled → prompt", () => {
+  test("skill origin, not bundled, strict threshold → prompt", () => {
     const result = evaluate({
       riskLevel: RiskLevel.Low,
       toolName: "custom_tool",
       toolOrigin: "skill",
       isSkillBundled: false,
+      autoApproveUpTo: "none",
     });
     expect(result.decision).toBe("prompt");
     expect(result.reason).toContain("Skill tool");
   });
 
-  test("skill origin, not bundled, Medium risk → prompt", () => {
+  test("skill origin, not bundled, Medium risk → prompt (above default threshold)", () => {
     const result = evaluate({
       riskLevel: RiskLevel.Medium,
       toolName: "custom_tool",
@@ -200,11 +330,12 @@ describe("no rule — third-party skill tool", () => {
     expect(result.reason).toContain("Skill tool");
   });
 
-  test("no tool origin but hasManifestOverride → prompt (unregistered skill tool)", () => {
+  test("no tool origin but hasManifestOverride, strict threshold → prompt (unregistered skill tool)", () => {
     const result = evaluate({
       riskLevel: RiskLevel.Low,
       toolName: "unknown_tool",
       hasManifestOverride: true,
+      autoApproveUpTo: "none",
     });
     expect(result.decision).toBe("prompt");
     expect(result.reason).toContain("Skill tool");
@@ -220,73 +351,125 @@ describe("no rule — third-party skill tool", () => {
     // Bundled skill + Low risk + no rule → handled by step 9 or 11
     expect(result.decision).toBe("allow");
   });
+
+  test("skill origin, not bundled, threshold covers risk → allow", () => {
+    const result = evaluate({
+      riskLevel: RiskLevel.Low,
+      toolName: "custom_tool",
+      toolOrigin: "skill",
+      isSkillBundled: false,
+      autoApproveUpTo: "medium",
+    });
+    expect(result.decision).toBe("allow");
+    expect(result.reason).toContain("within auto-approve threshold");
+  });
+
+  test("skill origin, not bundled, threshold does not cover risk → prompt", () => {
+    const result = evaluate({
+      riskLevel: RiskLevel.High,
+      toolName: "custom_tool",
+      toolOrigin: "skill",
+      isSkillBundled: false,
+      autoApproveUpTo: "medium",
+    });
+    expect(result.decision).toBe("prompt");
+    expect(result.reason).toContain("Skill tool");
+  });
+
+  test("hasManifestOverride, threshold covers risk → allow", () => {
+    const result = evaluate({
+      riskLevel: RiskLevel.Low,
+      toolName: "unknown_tool",
+      hasManifestOverride: true,
+      autoApproveUpTo: "low",
+    });
+    expect(result.decision).toBe("allow");
+    expect(result.reason).toContain("within auto-approve threshold");
+  });
 });
 
-// ── No rule: strict mode ─────────────────────────────────────────────────────
+// ── No rule: autoApproveUpTo "none" (strict-equivalent) ────────────────────
 
-describe("no rule — strict mode", () => {
-  test("strict mode, Low risk → prompt", () => {
+describe("no rule — autoApproveUpTo 'none'", () => {
+  test("none threshold, Low risk, not workspace-scoped → prompt", () => {
     const result = evaluate({
       riskLevel: RiskLevel.Low,
       toolName: "file_read",
-      permissionsMode: "strict",
+      autoApproveUpTo: "none",
     });
     expect(result.decision).toBe("prompt");
-    expect(result.reason).toContain("Strict mode");
+    expect(result.reason).toContain("above auto-approve threshold");
   });
 
-  test("strict mode, Medium risk → prompt", () => {
+  test("none threshold, Medium risk → prompt", () => {
     const result = evaluate({
       riskLevel: RiskLevel.Medium,
       toolName: "file_read",
-      permissionsMode: "strict",
+      autoApproveUpTo: "none",
     });
     expect(result.decision).toBe("prompt");
-    expect(result.reason).toContain("Strict mode");
+    expect(result.reason).toContain("above auto-approve threshold");
   });
 
-  test("strict mode, High risk → prompt", () => {
+  test("none threshold, High risk → prompt", () => {
     const result = evaluate({
       riskLevel: RiskLevel.High,
       toolName: "file_read",
-      permissionsMode: "strict",
+      autoApproveUpTo: "none",
     });
     expect(result.decision).toBe("prompt");
-    expect(result.reason).toContain("Strict mode");
+    expect(result.reason).toContain("above auto-approve threshold");
   });
 
-  test("strict mode blocks bundled skill tools without explicit rule", () => {
+  test("none threshold, Low risk, workspace-scoped → prompt (threshold respected)", () => {
     const result = evaluate({
       riskLevel: RiskLevel.Low,
-      toolName: "bundled_tool",
-      permissionsMode: "strict",
-      toolOrigin: "skill",
-      isSkillBundled: true,
+      toolName: "file_read",
+      autoApproveUpTo: "none",
+      isWorkspaceScoped: true,
     });
     expect(result.decision).toBe("prompt");
-    expect(result.reason).toContain("Strict mode");
+    expect(result.reason).toContain("above auto-approve threshold");
+  });
+
+  test("none threshold with low autoApproveUpTo → allow", () => {
+    const result = evaluate({
+      riskLevel: RiskLevel.Low,
+      toolName: "file_read",
+      autoApproveUpTo: "low",
+    });
+    expect(result.decision).toBe("allow");
+    expect(result.reason).toContain("within auto-approve threshold");
+  });
+
+  test("medium risk with low threshold → prompt", () => {
+    const result = evaluate({
+      riskLevel: RiskLevel.Medium,
+      toolName: "file_read",
+      autoApproveUpTo: "low",
+    });
+    expect(result.decision).toBe("prompt");
+    expect(result.reason).toContain("above auto-approve threshold");
   });
 });
 
-// ── No rule: workspace mode ──────────────────────────────────────────────────
+// ── No rule: workspace-scoped operations ──────────────────────────────────────
 
-describe("no rule — workspace mode", () => {
-  test("workspace mode, Low risk, workspace-scoped → allow", () => {
+describe("no rule — workspace-scoped operations", () => {
+  test("Low risk, workspace-scoped, within threshold → allow", () => {
     const result = evaluate({
       riskLevel: RiskLevel.Low,
       toolName: "file_read",
-      permissionsMode: "workspace",
       isWorkspaceScoped: true,
     });
     expect(result.decision).toBe("allow");
-    expect(result.reason).toContain("Workspace mode");
+    expect(result.reason).toContain("Workspace-scoped");
   });
 
-  test("workspace mode, Low risk, NOT workspace-scoped → falls through", () => {
+  test("Low risk, NOT workspace-scoped → falls through to threshold allow", () => {
     const result = evaluate({
       riskLevel: RiskLevel.Low,
       toolName: "file_read",
-      permissionsMode: "workspace",
       isWorkspaceScoped: false,
     });
     // Falls through to risk-based: Low → allow (within default "low" threshold)
@@ -294,41 +477,47 @@ describe("no rule — workspace mode", () => {
     expect(result.reason).toContain("low risk");
   });
 
-  test("workspace mode, Medium risk → falls through to risk-based prompt", () => {
+  test("Medium risk, workspace-scoped → falls through to risk-based prompt", () => {
     const result = evaluate({
       riskLevel: RiskLevel.Medium,
       toolName: "file_write",
-      permissionsMode: "workspace",
       isWorkspaceScoped: true,
     });
     expect(result.decision).toBe("prompt");
     expect(result.reason).toContain("medium risk");
   });
 
-  test("workspace mode, bash, NOT containerized, Low risk, workspace-scoped → falls through (no auto-allow for host bash)", () => {
+  test("bash, NOT containerized, Low risk, workspace-scoped → allow via workspace-scoped check", () => {
     const result = evaluate({
       riskLevel: RiskLevel.Low,
       toolName: "bash",
-      permissionsMode: "workspace",
       isContainerized: false,
       isWorkspaceScoped: true,
     });
-    // Non-containerized bash falls through the workspace check.
-    // Then hits risk-based: Low → allow (within default "low" threshold)
     expect(result.decision).toBe("allow");
-    expect(result.reason).toContain("low risk");
+    expect(result.reason).toContain("Workspace-scoped");
   });
 
-  test("workspace mode, bash, containerized, Low risk, workspace-scoped → allow via workspace mode", () => {
+  test("bash, containerized, Low risk, workspace-scoped → allow via workspace-scoped check", () => {
     const result = evaluate({
       riskLevel: RiskLevel.Low,
       toolName: "bash",
-      permissionsMode: "workspace",
       isContainerized: true,
       isWorkspaceScoped: true,
     });
     expect(result.decision).toBe("allow");
-    expect(result.reason).toContain("Workspace mode");
+    expect(result.reason).toContain("Workspace-scoped");
+  });
+
+  test("Low risk, workspace-scoped, autoApproveUpTo 'none' → prompt (threshold not met)", () => {
+    const result = evaluate({
+      riskLevel: RiskLevel.Low,
+      toolName: "file_read",
+      isWorkspaceScoped: true,
+      autoApproveUpTo: "none",
+    });
+    expect(result.decision).toBe("prompt");
+    expect(result.reason).toContain("above auto-approve threshold");
   });
 });
 
@@ -339,7 +528,6 @@ describe("no rule — bundled skill tool", () => {
     const result = evaluate({
       riskLevel: RiskLevel.Low,
       toolName: "bundled_tool",
-      permissionsMode: "workspace",
       toolOrigin: "skill",
       isSkillBundled: true,
     });
@@ -351,7 +539,6 @@ describe("no rule — bundled skill tool", () => {
     const result = evaluate({
       riskLevel: RiskLevel.Medium,
       toolName: "bundled_tool",
-      permissionsMode: "workspace",
       toolOrigin: "skill",
       isSkillBundled: true,
     });
@@ -363,13 +550,24 @@ describe("no rule — bundled skill tool", () => {
     const result = evaluate({
       riskLevel: RiskLevel.High,
       toolName: "bundled_tool",
-      permissionsMode: "workspace",
       toolOrigin: "skill",
       isSkillBundled: true,
     });
     expect(result.decision).toBe("prompt");
     expect(result.reason).toContain("high risk");
   });
+
+  test("bundled skill, Low risk, autoApproveUpTo 'none' → prompt (threshold respected)", () => {
+    const result = evaluate({
+      riskLevel: RiskLevel.Low,
+      toolName: "bundled_tool",
+      toolOrigin: "skill",
+      isSkillBundled: true,
+      autoApproveUpTo: "none",
+    });
+    expect(result.decision).toBe("prompt");
+    expect(result.reason).toContain("above auto-approve threshold");
+  });
 });
 
 // ── Risk-based fallback ──────────────────────────────────────────────────────
@@ -414,7 +612,6 @@ describe("edge cases", () => {
       matchedRule: denyRule,
       isContainerized: true,
       isWorkspaceScoped: true,
-      permissionsMode: "workspace",
     });
     expect(result.decision).toBe("deny");
   });
@@ -426,21 +623,21 @@ describe("edge cases", () => {
       toolName: "bash",
       matchedRule: askRule,
       isContainerized: true,
+      autoApproveUpTo: "none",
     });
     expect(result.decision).toBe("prompt");
   });
 
-  test("allow rule High risk falls through to prompt even with workspace mode", () => {
+  test("allow rule High risk falls through to prompt", () => {
     const allowRule = makeRule({ decision: "allow" });
     const result = evaluate({
       riskLevel: RiskLevel.High,
       toolName: "file_write",
       matchedRule: allowRule,
-      permissionsMode: "workspace",
       isContainerized: false,
       isWorkspaceScoped: true,
     });
-    // Allow rule + High risk + non-bash → falls through to risk-based: High → prompt
+    // Allow rule + High risk → falls through to risk-based: High → prompt
     expect(result.decision).toBe("prompt");
     expect(result.reason).toContain("high risk");
   });
@@ -463,33 +660,26 @@ describe("edge cases", () => {
     expect(result.reason).toContain("rm -rf /");
   });
 
-  test("strict mode with matched allow rule at Low risk → allow (rule takes precedence)", () => {
+  test("matched allow rule at Low risk → allow (rule takes precedence over threshold)", () => {
     const allowRule = makeRule({ decision: "allow" });
     const result = evaluate({
       riskLevel: RiskLevel.Low,
       toolName: "file_read",
       matchedRule: allowRule,
-      permissionsMode: "strict",
+      autoApproveUpTo: "none",
     });
     expect(result.decision).toBe("allow");
   });
 
-  test("workspace mode non-containerized bash, Low risk, workspace-scoped → low risk allow (not workspace allow)", () => {
-    // This is the subtle bash host exception. The workspace mode check
-    // specifically skips bash when not containerized, so it falls through
-    // to the risk-based path where Low risk still auto-allows.
+  test("non-containerized bash, Low risk, workspace-scoped → workspace-scoped allow", () => {
     const result = evaluate({
       riskLevel: RiskLevel.Low,
       toolName: "bash",
-      permissionsMode: "workspace",
       isContainerized: false,
       isWorkspaceScoped: true,
     });
     expect(result.decision).toBe("allow");
-    // The reason should be "low risk" not "Workspace mode" — the workspace
-    // auto-allow was bypassed because bash is on the host.
-    expect(result.reason).not.toContain("Workspace mode");
-    expect(result.reason).toContain("low risk");
+    expect(result.reason).toContain("Workspace-scoped");
   });
 
   test("hasManifestOverride with toolOrigin set to skill — third-party check triggers on origin", () => {
@@ -499,6 +689,7 @@ describe("edge cases", () => {
       toolOrigin: "skill",
       isSkillBundled: false,
       hasManifestOverride: true,
+      autoApproveUpTo: "none",
     });
     expect(result.decision).toBe("prompt");
     expect(result.reason).toContain("Skill tool");
@@ -618,6 +809,38 @@ describe("autoApproveUpTo threshold", () => {
     });
   });
 
+  describe('autoApproveUpTo: "high" — everything auto-allows', () => {
+    test("Low risk → allow", () => {
+      const result = evaluate({
+        riskLevel: RiskLevel.Low,
+        toolName: "some_tool",
+        autoApproveUpTo: "high",
+      });
+      expect(result.decision).toBe("allow");
+      expect(result.reason).toContain("within auto-approve threshold");
+    });
+
+    test("Medium risk → allow", () => {
+      const result = evaluate({
+        riskLevel: RiskLevel.Medium,
+        toolName: "some_tool",
+        autoApproveUpTo: "high",
+      });
+      expect(result.decision).toBe("allow");
+      expect(result.reason).toContain("within auto-approve threshold");
+    });
+
+    test("High risk → allow", () => {
+      const result = evaluate({
+        riskLevel: RiskLevel.High,
+        toolName: "some_tool",
+        autoApproveUpTo: "high",
+      });
+      expect(result.decision).toBe("allow");
+      expect(result.reason).toContain("within auto-approve threshold");
+    });
+  });
+
   describe("threshold interacts correctly with rule-based decisions", () => {
     test("deny rule still denies regardless of threshold", () => {
       const denyRule = makeRule({ decision: "deny" });
@@ -631,7 +854,7 @@ describe("autoApproveUpTo threshold", () => {
       expect(result.matchedRule).toBe(denyRule);
     });
 
-    test("ask rule still prompts regardless of threshold", () => {
+    test("ask rule auto-approves when risk is within threshold", () => {
       const askRule = makeRule({ decision: "ask" });
       const result = evaluate({
         riskLevel: RiskLevel.Low,
@@ -639,10 +862,49 @@ describe("autoApproveUpTo threshold", () => {
         matchedRule: askRule,
         autoApproveUpTo: "medium",
       });
+      expect(result.decision).toBe("allow");
+      expect(result.reason).toContain("within auto-approve threshold");
+    });
+
+    test("ask rule still prompts when threshold does not cover the risk", () => {
+      const askRule = makeRule({ decision: "ask" });
+      const result = evaluate({
+        riskLevel: RiskLevel.High,
+        toolName: "bash",
+        matchedRule: askRule,
+        autoApproveUpTo: "medium",
+      });
       expect(result.decision).toBe("prompt");
       expect(result.matchedRule).toBe(askRule);
     });
 
+    test("ask rule prompts when threshold is strict (none)", () => {
+      const askRule = makeRule({ decision: "ask" });
+      const result = evaluate({
+        riskLevel: RiskLevel.Low,
+        toolName: "bash",
+        matchedRule: askRule,
+        autoApproveUpTo: "none",
+      });
+      expect(result.decision).toBe("prompt");
+      expect(result.matchedRule).toBe(askRule);
+    });
+
+    test("skill_load_dynamic ask rule always prompts even with high threshold", () => {
+      const dynamicSkillAskRule = makeRule({
+        decision: "ask",
+        pattern: "skill_load_dynamic:my-skill",
+      });
+      const result = evaluate({
+        riskLevel: RiskLevel.Low,
+        toolName: "skill_load",
+        matchedRule: dynamicSkillAskRule,
+        autoApproveUpTo: "high",
+      });
+      expect(result.decision).toBe("prompt");
+      expect(result.matchedRule).toBe(dynamicSkillAskRule);
+    });
+
     test("allow rule still allows non-High regardless of threshold", () => {
       const allowRule = makeRule({ decision: "allow" });
       const result = evaluate({
@@ -656,43 +918,36 @@ describe("autoApproveUpTo threshold", () => {
     });
   });
 
-  describe("threshold interacts correctly with strict mode", () => {
-    test("strict mode still prompts even with medium threshold", () => {
+  describe("threshold controls workspace-scoped operations", () => {
+    test("workspace-scoped Low with 'medium' threshold → allow via workspace-scoped path", () => {
       const result = evaluate({
         riskLevel: RiskLevel.Low,
         toolName: "file_read",
-        permissionsMode: "strict",
+        isWorkspaceScoped: true,
         autoApproveUpTo: "medium",
       });
-      expect(result.decision).toBe("prompt");
-      expect(result.reason).toContain("Strict mode");
+      expect(result.decision).toBe("allow");
+      expect(result.reason).toContain("Workspace-scoped");
     });
-  });
 
-  describe("threshold interacts correctly with workspace mode", () => {
-    test("workspace mode workspace-scoped Low still allows via workspace path (before threshold)", () => {
+    test("workspace-scoped Low with 'none' threshold → prompt (threshold gates workspace-scoped too)", () => {
       const result = evaluate({
         riskLevel: RiskLevel.Low,
         toolName: "file_read",
-        permissionsMode: "workspace",
         isWorkspaceScoped: true,
         autoApproveUpTo: "none",
       });
-      // Workspace mode auto-allow fires before the threshold fallback
-      expect(result.decision).toBe("allow");
-      expect(result.reason).toContain("Workspace mode");
+      expect(result.decision).toBe("prompt");
+      expect(result.reason).toContain("above auto-approve threshold");
     });
 
-    test("workspace mode non-workspace-scoped Low with none threshold → prompt", () => {
+    test("non-workspace-scoped Low with 'none' threshold → prompt", () => {
       const result = evaluate({
         riskLevel: RiskLevel.Low,
         toolName: "file_read",
-        permissionsMode: "workspace",
         isWorkspaceScoped: false,
         autoApproveUpTo: "none",
       });
-      // Falls through workspace check (not workspace-scoped), then threshold
-      // "none" means Low risk is above threshold → prompt
       expect(result.decision).toBe("prompt");
       expect(result.reason).toContain("above auto-approve threshold");
     });
@@ -727,6 +982,12 @@ describe("resolveThreshold", () => {
       expect(resolveThreshold("none", "headless")).toBe("none");
     });
 
+    test("returns high scalar for any context", () => {
+      expect(resolveThreshold("high", "conversation")).toBe("high");
+      expect(resolveThreshold("high", "background")).toBe("high");
+      expect(resolveThreshold("high", "headless")).toBe("high");
+    });
+
     test("returns scalar when executionContext is omitted", () => {
       expect(resolveThreshold("low")).toBe("low");
     });
@@ -735,20 +996,19 @@ describe("resolveThreshold", () => {
   describe("object form", () => {
     const perContext = {
       conversation: "low" as const,
-      background: "medium" as const,
-      headless: "none" as const,
+      autonomous: "medium" as const,
     };
 
     test("returns conversation threshold for conversation context", () => {
       expect(resolveThreshold(perContext, "conversation")).toBe("low");
     });
 
-    test("returns background threshold for background context", () => {
+    test("returns autonomous threshold for background context", () => {
       expect(resolveThreshold(perContext, "background")).toBe("medium");
     });
 
-    test("returns headless threshold for headless context", () => {
-      expect(resolveThreshold(perContext, "headless")).toBe("none");
+    test("returns autonomous threshold for headless context", () => {
+      expect(resolveThreshold(perContext, "headless")).toBe("medium");
     });
 
     test("defaults to conversation when executionContext is omitted", () => {
@@ -808,12 +1068,13 @@ describe("guardian threshold-based auto-approve (ordinal comparison)", () => {
   // This is the logic that replaces the old `riskLevel !== RiskLevel.High` check.
   function isWithinThreshold(
     riskLevel: RiskLevel,
-    bgThreshold: "none" | "low" | "medium",
+    bgThreshold: "none" | "low" | "medium" | "high",
   ): boolean {
     const thresholdOrdinal: Record<string, number> = {
       none: -1,
       low: 0,
       medium: 1,
+      high: 2,
     };
     const riskOrdinal: Record<string, number> = {
       [RiskLevel.Low]: 0,
@@ -825,10 +1086,10 @@ describe("guardian threshold-based auto-approve (ordinal comparison)", () => {
     );
   }
 
-  describe('default config (background: "medium") — behavioral parity with old riskLevel !== High', () => {
+  describe('default config (autonomous: "medium") — behavioral parity with old riskLevel !== High', () => {
     test("Low risk → within threshold (auto-approve)", () => {
       const bgThreshold = resolveThreshold(
-        { conversation: "low", background: "medium", headless: "none" },
+        { conversation: "low", autonomous: "medium" },
         "background",
       );
       expect(bgThreshold).toBe("medium");
@@ -837,7 +1098,7 @@ describe("guardian threshold-based auto-approve (ordinal comparison)", () => {
 
     test("Medium risk → within threshold (auto-approve)", () => {
       const bgThreshold = resolveThreshold(
-        { conversation: "low", background: "medium", headless: "none" },
+        { conversation: "low", autonomous: "medium" },
         "background",
       );
       expect(isWithinThreshold(RiskLevel.Medium, bgThreshold)).toBe(true);
@@ -845,17 +1106,17 @@ describe("guardian threshold-based auto-approve (ordinal comparison)", () => {
 
     test("High risk → above threshold (prompt)", () => {
       const bgThreshold = resolveThreshold(
-        { conversation: "low", background: "medium", headless: "none" },
+        { conversation: "low", autonomous: "medium" },
         "background",
       );
       expect(isWithinThreshold(RiskLevel.High, bgThreshold)).toBe(false);
     });
   });
 
-  describe('tighter config (background: "low") — only Low auto-approves', () => {
+  describe('tighter config (autonomous: "low") — only Low auto-approves', () => {
     test("Low risk → within threshold", () => {
       const bgThreshold = resolveThreshold(
-        { conversation: "low", background: "low", headless: "none" },
+        { conversation: "low", autonomous: "low" },
         "background",
       );
       expect(bgThreshold).toBe("low");
@@ -864,7 +1125,7 @@ describe("guardian threshold-based auto-approve (ordinal comparison)", () => {
 
     test("Medium risk → above threshold (prompt)", () => {
       const bgThreshold = resolveThreshold(
-        { conversation: "low", background: "low", headless: "none" },
+        { conversation: "low", autonomous: "low" },
         "background",
       );
       expect(isWithinThreshold(RiskLevel.Medium, bgThreshold)).toBe(false);
@@ -872,17 +1133,17 @@ describe("guardian threshold-based auto-approve (ordinal comparison)", () => {
 
     test("High risk → above threshold (prompt)", () => {
       const bgThreshold = resolveThreshold(
-        { conversation: "low", background: "low", headless: "none" },
+        { conversation: "low", autonomous: "low" },
         "background",
       );
       expect(isWithinThreshold(RiskLevel.High, bgThreshold)).toBe(false);
     });
   });
 
-  describe('strictest config (background: "none") — nothing auto-approves', () => {
+  describe('strictest config (autonomous: "none") — nothing auto-approves', () => {
     test("Low risk → above threshold (prompt)", () => {
       const bgThreshold = resolveThreshold(
-        { conversation: "low", background: "none", headless: "none" },
+        { conversation: "low", autonomous: "none" },
         "background",
       );
       expect(bgThreshold).toBe("none");
@@ -891,7 +1152,7 @@ describe("guardian threshold-based auto-approve (ordinal comparison)", () => {
 
     test("Medium risk → above threshold (prompt)", () => {
       const bgThreshold = resolveThreshold(
-        { conversation: "low", background: "none", headless: "none" },
+        { conversation: "low", autonomous: "none" },
         "background",
       );
       expect(isWithinThreshold(RiskLevel.Medium, bgThreshold)).toBe(false);
@@ -899,14 +1160,45 @@ describe("guardian threshold-based auto-approve (ordinal comparison)", () => {
 
     test("High risk → above threshold (prompt)", () => {
       const bgThreshold = resolveThreshold(
-        { conversation: "low", background: "none", headless: "none" },
+        { conversation: "low", autonomous: "none" },
         "background",
       );
       expect(isWithinThreshold(RiskLevel.High, bgThreshold)).toBe(false);
     });
   });
 
+  describe('loosest config (autonomous: "high") — everything auto-approves', () => {
+    test("Low risk → within threshold (auto-approve)", () => {
+      const bgThreshold = resolveThreshold(
+        { conversation: "low", autonomous: "high" },
+        "background",
+      );
+      expect(bgThreshold).toBe("high");
+      expect(isWithinThreshold(RiskLevel.Low, bgThreshold)).toBe(true);
+    });
+
+    test("Medium risk → within threshold (auto-approve)", () => {
+      const bgThreshold = resolveThreshold(
+        { conversation: "low", autonomous: "high" },
+        "background",
+      );
+      expect(isWithinThreshold(RiskLevel.Medium, bgThreshold)).toBe(true);
+    });
+
+    test("High risk → within threshold (auto-approve)", () => {
+      const bgThreshold = resolveThreshold(
+        { conversation: "low", autonomous: "high" },
+        "background",
+      );
+      expect(isWithinThreshold(RiskLevel.High, bgThreshold)).toBe(true);
+    });
+  });
+
   describe("scalar config form resolves correctly for background context", () => {
+    test('scalar "high" → background resolves to high', () => {
+      expect(resolveThreshold("high", "background")).toBe("high");
+    });
+
     test('scalar "medium" → background resolves to medium', () => {
       expect(resolveThreshold("medium", "background")).toBe("medium");
     });
@@ -921,28 +1213,28 @@ describe("guardian threshold-based auto-approve (ordinal comparison)", () => {
   });
 
   describe("default (undefined) resolves per-context defaults", () => {
-    test("undefined config → medium threshold for background", () => {
+    test("undefined config → low threshold for background", () => {
       const bgThreshold = resolveThreshold(undefined, "background");
-      expect(bgThreshold).toBe("medium");
-      // Low and Medium risk are within threshold, High is not
+      expect(bgThreshold).toBe("low");
+      // Low-risk auto-approves at the "low" threshold
       expect(isWithinThreshold(RiskLevel.Low, bgThreshold)).toBe(true);
-      expect(isWithinThreshold(RiskLevel.Medium, bgThreshold)).toBe(true);
+      expect(isWithinThreshold(RiskLevel.Medium, bgThreshold)).toBe(false);
       expect(isWithinThreshold(RiskLevel.High, bgThreshold)).toBe(false);
     });
 
-    test("undefined config → low threshold for conversation", () => {
+    test("undefined config → medium threshold for conversation", () => {
       const convThreshold = resolveThreshold(undefined, "conversation");
-      expect(convThreshold).toBe("low");
+      expect(convThreshold).toBe("medium");
     });
 
-    test("undefined config → none threshold for headless", () => {
+    test("undefined config → low threshold for headless", () => {
       const hlThreshold = resolveThreshold(undefined, "headless");
-      expect(hlThreshold).toBe("none");
+      expect(hlThreshold).toBe("low");
     });
 
-    test("undefined config + no context → low (conversation default)", () => {
+    test("undefined config + no context → medium (conversation default)", () => {
       const threshold = resolveThreshold(undefined);
-      expect(threshold).toBe("low");
+      expect(threshold).toBe("medium");
     });
   });
 });