@vellumai/assistant 0.6.6 → 0.7.0

package/src/permissions/gateway-threshold-reader.ts

@@ -1,14 +1,12 @@
 /**
  * Gateway-backed auto-approve threshold reader.
  *
- * When the `permission-controls-v3` feature flag is enabled, reads
- * thresholds from the gateway via IPC. Falls back to `undefined` (caller
- * uses config-based `resolveThreshold`) when the flag is off or the gateway
- * is unreachable.
+ * Reads thresholds from the gateway via IPC. The gateway is the sole source
+ * of truth for auto-approve thresholds. When the gateway is unreachable,
+ * defaults to "none" (Strict) so no tools are auto-approved without an
+ * explicit gateway-supplied threshold.
  */
 
-import { isAssistantFeatureFlagEnabled } from "../config/assistant-feature-flags.js";
-import { getConfig } from "../config/loader.js";
 import { ipcCall } from "../ipc/gateway-client.js";
 import { getLogger } from "../util/logger.js";
 import type { ExecutionContext } from "./approval-policy.js";
@@ -21,8 +19,7 @@ type Threshold = "none" | "low" | "medium" | "high";
 
 interface GlobalThresholds {
   interactive: string;
-  background: string;
-  headless: string;
+  autonomous: string;
 }
 
 interface ConversationThreshold {
@@ -55,21 +52,13 @@ export function _clearGlobalCacheForTesting(): void {
   conversationThresholdCache.clear();
 }
 
-// ── Hardcoded fallback defaults ──────────────────────────────────────────────
-
-const HARDCODED_DEFAULTS: Record<ExecutionContext, Threshold> = {
-  conversation: "low",
-  background: "medium",
-  headless: "none",
-};
-
 // ── Helpers ──────────────────────────────────────────────────────────────────
 
 function mapExecutionContextToField(
   executionContext: ExecutionContext,
 ): keyof GlobalThresholds {
   if (executionContext === "conversation") return "interactive";
-  return executionContext;
+  return "autonomous";
 }
 
 function isValidThreshold(value: string): value is Threshold {
@@ -86,25 +75,18 @@ function isValidThreshold(value: string): value is Threshold {
 /**
  * Read the auto-approve threshold from the gateway via IPC.
  *
- * Returns `undefined` when the feature flag is off (caller falls back to
- * config-based `resolveThreshold`).
- *
  * For `"conversation"` context with a `conversationId`, checks for a
  * per-conversation override first. Falls through to global defaults when
  * the conversation override is absent.
  *
  * Caches global thresholds for 30 seconds to avoid hammering the gateway.
- * On any IPC error, logs a warning and returns hardcoded defaults.
+ * On any IPC error or unexpected response, returns `"none"` (Strict) so
+ * no tools are silently auto-approved when the gateway is unreachable.
  */
 export async function getAutoApproveThreshold(
   conversationId: string | undefined,
   executionContext?: ExecutionContext,
-): Promise<Threshold | undefined> {
-  const config = getConfig();
-  if (!isAssistantFeatureFlagEnabled("permission-controls-v3", config)) {
-    return undefined;
-  }
-
+): Promise<Threshold> {
   const ctx: ExecutionContext = executionContext ?? "conversation";
 
   // For conversation context with a conversationId, try per-conversation override first
@@ -120,9 +102,8 @@ export async function getAutoApproveThreshold(
     } else {
       // ipcCall() returns undefined on transport failure (socket not found,
       // timeout, etc.) and null when the gateway explicitly says "no override".
-      // We must distinguish the two: only cache the negative on `null`, and
-      // fall back to hardcoded defaults on `undefined` without poisoning the
-      // cache — otherwise a transient IPC failure would cause subsequent
+      // On transport failure, fall through to the global threshold without
+      // poisoning the cache — a transient IPC failure must not cause subsequent
       // approval checks to skip a real override for up to 5 seconds.
       const result = (await ipcCall("get_conversation_threshold", {
         conversationId,
@@ -131,25 +112,23 @@ export async function getAutoApproveThreshold(
       if (result === undefined) {
         log.warn(
           { conversationId },
-          "IPC call failed for conversation threshold override, falling back to defaults",
+          "IPC call failed for conversation threshold override, falling through to global",
         );
-        return HARDCODED_DEFAULTS[ctx];
-      }
-
-      if (result && isValidThreshold(result.threshold)) {
+        // Fall through to global threshold fetch below.
+      } else if (result && isValidThreshold(result.threshold)) {
         conversationThresholdCache.set(conversationId, {
           threshold: result.threshold,
           timestamp: Date.now(),
         });
         return result.threshold;
+      } else {
+        // result === null (or an unexpected shape) — cache the negative result
+        // and fall through to global defaults.
+        conversationThresholdCache.set(conversationId, {
+          threshold: null,
+          timestamp: Date.now(),
+        });
       }
-
-      // result === null (or an unexpected shape) — cache the negative result
-      // and fall through to global defaults.
-      conversationThresholdCache.set(conversationId, {
-        threshold: null,
-        timestamp: Date.now(),
-      });
     }
   }
 
@@ -161,15 +140,17 @@ export async function getAutoApproveThreshold(
     if (isValidThreshold(value)) {
       return value;
     }
-    // Unexpected value from gateway — fall back to hardcoded
-    log.warn({ field, value }, "Gateway returned unexpected threshold value");
-    return HARDCODED_DEFAULTS[ctx];
+    // Unexpected value from gateway — default to "none" (Strict).
+    log.warn({ field, value }, "Gateway returned unexpected threshold value, defaulting to none");
+    return "none";
   } catch (err) {
+    // Gateway unreachable — default to "none" (Strict) so no tools are
+    // silently auto-approved when the gateway is down.
     log.warn(
       { error: String(err) },
-      "Failed to fetch global thresholds, falling back to defaults",
+      "Failed to fetch global thresholds, defaulting to none",
     );
-    return HARDCODED_DEFAULTS[ctx];
+    return "none";
   }
 }
 

package/src/permissions/ipc-risk-types.ts

@@ -0,0 +1,95 @@
+/**
+ * Types for gateway IPC risk classification.
+ *
+ * These types mirror the gateway's classify_risk IPC response shape
+ * (gateway/src/ipc/risk-classification-handlers.ts) and request parameters.
+ * Keep in sync when the gateway response evolves.
+ */
+
+import type { DirectoryScopeOption, ScopeOption } from "./risk-types.js";
+import type { AllowlistOption } from "./types.js";
+
+// ── Dangerous pattern (mirrors gateway wire format) ─────────────────────────
+
+export interface DangerousPattern {
+  type: string;
+  description: string;
+  text: string;
+}
+
+// ── Gateway response type ───────────────────────────────────────────────────
+
+/**
+ * The response returned by the gateway's `classify_risk` IPC method.
+ *
+ * Mirrors the `ClassificationResult` in
+ * `gateway/src/ipc/risk-classification-handlers.ts`.
+ */
+export interface ClassificationResult {
+  risk: "low" | "medium" | "high" | "unknown";
+  reason: string;
+  matchType: "user_rule" | "registry" | "unknown";
+  scopeOptions: ScopeOption[];
+  allowlistOptions?: AllowlistOption[];
+  directoryScopeOptions?: DirectoryScopeOption[];
+  resolvedPaths?: string[];
+  actionKeys?: string[];
+  commandCandidates?: string[];
+  dangerousPatterns?: DangerousPattern[];
+  opaqueConstructs?: boolean;
+  isComplexSyntax?: boolean;
+  sandboxAutoApprove?: boolean;
+}
+
+// ── Gateway request type ────────────────────────────────────────────────────
+
+/**
+ * File classifier context pre-resolved by the assistant and forwarded
+ * to the gateway so it can run file-risk classification without importing
+ * assistant-specific path helpers.
+ */
+export interface FileContext {
+  protectedDir: string;
+  deprecatedDir: string;
+  hooksDir: string;
+  actorTokenSigningKeyPath: string;
+  skillSourceDirs: string[];
+}
+
+/**
+ * Skill metadata pre-resolved by the assistant and forwarded to the
+ * gateway for skill-load risk classification.
+ */
+export interface SkillMetadata {
+  skillId: string;
+  selector: string;
+  versionHash: string;
+  transitiveHash?: string;
+  hasInlineExpansions: boolean;
+  isDynamic: boolean;
+}
+
+/**
+ * Parameters for the `classify_risk` IPC request.
+ *
+ * Mirrors the Zod schema in
+ * `gateway/src/ipc/risk-classification-handlers.ts`.
+ */
+export interface ClassifyRiskParams {
+  tool: string;
+  command?: string;
+  url?: string;
+  path?: string;
+  skill?: string;
+  mode?: string;
+  script?: string;
+  workingDir?: string;
+  workspaceRoot?: string;
+  allowPrivateNetwork?: boolean;
+  networkMode?: string;
+  isContainerized?: boolean;
+  fileContext?: FileContext;
+  skillMetadata?: SkillMetadata;
+  /** Tool registry default risk level for unknown tools. */
+  registryDefaultRisk?: string;
+}

package/src/permissions/prompter.ts

@@ -20,7 +20,6 @@ interface PendingPrompt {
   reject: (reason: Error) => void;
   timer: ReturnType<typeof setTimeout>;
   toolUseId?: string;
-  hostAccessEnablePrompt?: boolean;
 }
 
 export type ConfirmationStateCallback = (
@@ -63,11 +62,10 @@ export class PermissionPrompter {
     executionTarget?: ExecutionTarget,
     persistentDecisionsAllowed?: boolean,
     signal?: AbortSignal,
-    temporaryOptionsAvailable?: Array<"allow_10m" | "allow_conversation">,
     toolUseId?: string,
-    hostAccessEnablePrompt?: boolean,
     riskReason?: string,
     isContainerized?: boolean,
+    directoryScopeOptions?: readonly { scope: string; label: string }[],
   ): Promise<{
     decision: UserDecision;
     selectedPattern?: string;
@@ -98,7 +96,6 @@ export class PermissionPrompter {
         reject,
         timer,
         toolUseId,
-        hostAccessEnablePrompt,
       });
 
       if (signal) {
@@ -129,11 +126,13 @@ export class PermissionPrompter {
           label: o.label,
           scope: o.scope,
         })),
+        directoryScopeOptions: directoryScopeOptions
+          ? directoryScopeOptions.map((o) => ({ scope: o.scope, label: o.label }))
+          : undefined,
         diff,
         conversationId,
         executionTarget,
         persistentDecisionsAllowed: persistentDecisionsAllowed ?? true,
-        temporaryOptionsAvailable,
         toolUseId,
       });
 
@@ -155,10 +154,6 @@ export class PermissionPrompter {
     return this.pending.get(requestId)?.toolUseId;
   }
 
-  isHostAccessEnablePrompt(requestId: string): boolean {
-    return this.pending.get(requestId)?.hostAccessEnablePrompt === true;
-  }
-
   resolveConfirmation(
     requestId: string,
     decision: UserDecision,

package/src/permissions/risk-types.ts

@@ -1,15 +1,11 @@
 /**
- * Types for the data-driven command risk classifier.
+ * Shared risk assessment types used by the permission checker.
  *
- * All types are JSON-serializable — no native RegExp, no function references.
- * Regex patterns are stored as strings (use `String.raw` for ergonomics in TS).
- * This constraint exists because the registry will eventually be persisted to a
- * DB with per-user/per-org overrides that need to round-trip cleanly.
- *
- * @see /docs/bash-risk-classifier-design.md
+ * Classifier-internal types (CommandRiskSpec, ArgRule, ArgSchema, etc.) have
+ * been migrated to the gateway and removed from the assistant.
  */
 
-import { type AllowlistOption, RiskLevel } from "./types.js";
+import type { AllowlistOption } from "./types.js";
 
 // ── Risk levels ──────────────────────────────────────────────────────────────
 
@@ -23,12 +19,6 @@ import { type AllowlistOption, RiskLevel } from "./types.js";
  */
 export type Risk = "low" | "medium" | "high" | "unknown";
 
-/**
- * Risk levels that can be assigned to commands in the registry.
- * Excludes "unknown" — that's a classifier output, not a registry value.
- */
-export type RegistryRisk = "low" | "medium" | "high";
-
 // ── Risk assessment output ───────────────────────────────────────────────────
 
 /** A scope option presented to the user when classifying an unknown command. */
@@ -39,6 +29,17 @@ export interface ScopeOption {
   label: string;
 }
 
+/**
+ * A directory scope option emitted by the gateway for filesystem operations.
+ * Mirrors `DirectoryScopeOption` in `gateway/src/risk/risk-types.ts`.
+ */
+export interface DirectoryScopeOption {
+  /** Path glob (e.g. "/workspace/scratch/*") or the sentinel "everywhere". */
+  scope: string;
+  /** Human-readable label (e.g. "In scratch/"). */
+  label: string;
+}
+
 /**
  * The output of a risk classifier. Tool-agnostic — every classifier
  * (bash, file_write, web_fetch, etc.) produces this same shape.
@@ -59,204 +60,17 @@ export interface RiskAssessment {
    * directly instead of calling the per-tool strategy function.
    */
   allowlistOptions?: AllowlistOption[];
-}
-
-// ── Classifier interface ─────────────────────────────────────────────────────
-
-/**
- * Generic risk classifier interface. Each tool type (bash, file_write, etc.)
- * implements this with a tool-specific input type.
- */
-export interface RiskClassifier<TInput> {
-  classify(input: TInput): Promise<RiskAssessment>;
-}
-
-// ── Bash classifier input ────────────────────────────────────────────────────
-
-/** Input to the bash risk classifier. */
-export interface BashClassifierInput {
-  /** The raw command string. */
-  command: string;
-  /** Which tool is being invoked. */
-  toolName: "bash" | "host_bash";
-  /** Working directory (for path resolution in arg rules). */
-  workingDir?: string;
-}
-
-// ── Command registry types ───────────────────────────────────────────────────
-
-/**
- * A single arg-level risk rule within a command spec.
- *
- * Evaluated per arg token. If `flags` is set, the rule only fires when the
- * arg matches one of those flags. If `valuePattern` is set, the arg (or the
- * flag's consumed value) must match the regex.
- */
-export interface ArgRule {
-  /**
-   * Stable ID for DB references, partial overrides, and audit trails.
-   * Convention: `"command:descriptor"` (e.g. `"curl:upload-file"`, `"rm:recursive-force"`).
-   */
-  id: string;
   /**
-   * Flag(s) that trigger this rule. Omit for positional/any-arg matching.
-   * Combined short flags are listed as literals (e.g. `"-rf"`, `"-fr"`).
+   * Directory scope options emitted by the gateway for filesystem operations.
+   * Mirrors `directoryScopeOptions` in the gateway's ClassificationResult.
+   * Present when the gateway's classifier identified one or more filesystem
+   * path arguments and generated a directory-scope ladder for them.
    */
-  flags?: string[];
+  directoryScopeOptions?: DirectoryScopeOption[];
   /**
-   * Regex string matched against the arg value. Omit if flag presence alone
-   * triggers the rule. Stored as a string (not a native RegExp) for JSON
-   * serialization.
+   * Fully resolved filesystem path arguments from the gateway classifier.
+   * Threaded into `findHighestPriorityRule` so directory-scoped trust rules
+   * match against actual target paths, not just the working directory.
    */
-  valuePattern?: string;
-  /** Risk level when this rule fires. */
-  risk: RegistryRisk;
-  /** Human-readable reason (shown in permission prompt). */
-  reason: string;
-}
-
-/**
- * Risk specification for a single command (or subcommand).
- *
- * The registry is a `Record<string, CommandRiskSpec>` mapping program names
- * to their specs. Subcommands nest recursively.
- */
-export interface CommandRiskSpec {
-  /** Base risk when no arg rules match. */
-  baseRisk: RegistryRisk;
-  /**
-   * Subcommand-level overrides. Keys are subcommand names
-   * (e.g. `{ push: { baseRisk: "medium", ... } }` under `git`).
-   * Subcommands can nest further (e.g. `git stash drop`).
-   */
-  subcommands?: Record<string, CommandRiskSpec>;
-  /** Arg-level rules, evaluated per arg. First match per arg wins. */
-  argRules?: ArgRule[];
-  /**
-   * Is this a wrapper command? (sudo, env, nice, etc.)
-   * When true, the classifier unwraps to find the inner command and
-   * takes the max of the wrapper's baseRisk and the inner command's risk.
-   */
-  isWrapper?: boolean;
-  /**
-   * Flags that put a wrapper into a non-exec mode (e.g. command -v, env -0).
-   * When the first arg matches a non-exec flag, skip unwrapping and classify
-   * the wrapper standalone against its own arg rules.
-   */
-  nonExecFlags?: string[];
-  /**
-   * Does this command have non-standard syntax where intermediate scope
-   * options would be confusing? (find, xargs, awk, etc.)
-   * When true, the scope ladder only offers exact match and command-level wildcard.
-   */
-  complexSyntax?: boolean;
-  /** Human-readable reason for the base risk (shown when no arg rule matches). */
-  reason?: string;
-  /**
-   * When true, this command auto-approves in the assistant's workspace
-   * without consulting the user's autoApproveUpTo threshold.
-   */
-  sandboxAutoApprove?: boolean;
-  /**
-   * Arg-parsing schema for extracting structured argument information.
-   * Used by `parseArgs()` to classify args into flags, positionals, and
-   * path arguments for downstream path-based policy checks.
-   */
-  argSchema?: ArgSchema;
-}
-
-// ── Arg schema types ─────────────────────────────────────────────────────────
-
-/** Describes the role of a positional argument in a command. */
-export interface PositionalDesc {
-  /** The semantic role of this positional argument. */
-  role: "path" | "pattern" | "script" | "value" | "command";
-  /**
-   * When true, this descriptor applies to all subsequent positionals too
-   * (i.e. the remaining args are all of this role).
-   */
-  rest?: boolean;
-}
-
-/**
- * Schema for parsing a command's arguments into structured data.
- *
- * Drives the `parseArgs()` utility to classify each token as a flag,
- * positional, or path argument.
- */
-export interface ArgSchema {
-  /** Flags that consume the next token as a value (e.g. `-o`, `--output`). */
-  valueFlags?: string[];
-  /**
-   * Describes how positional arguments should be interpreted:
-   * - `"paths"` (or omitted): all positionals are filesystem paths
-   * - `"none"`: no positionals are filesystem paths
-   * - `PositionalDesc[]`: per-index role descriptors
-   */
-  positionals?: "paths" | "none" | PositionalDesc[];
-  /** Flag names whose consumed values are filesystem paths (e.g. `{ "-t": true }`). */
-  pathFlags?: Record<string, true>;
-  /**
-   * Whether `--` ends flag parsing (everything after is positional).
-   * Defaults to `true` when omitted.
-   */
-  respectsDoubleDash?: boolean;
-}
-
-/**
- * The result of parsing a command's arguments via `parseArgs()`.
- */
-export interface ParsedArgs {
-  /** Flag name to value (`true` for boolean flags, string for value-consuming flags). */
-  flags: Map<string, string | true>;
-  /** All positional arguments in order. */
-  positionals: string[];
-  /** Subset of positionals and flag values that are filesystem paths. */
-  pathArgs: string[];
-  /** Whether a `--` double-dash terminator was encountered. */
-  sawDoubleDash: boolean;
-}
-
-// ── User rule types ──────────────────────────────────────────────────────────
-
-/**
- * A user-created risk classification rule.
- *
- * Created via the scope ladder UI (from permission prompts) or manually
- * in settings. Stored in the user's DB.
- */
-export interface UserRule {
-  /** Auto-generated unique ID. */
-  id: string;
-  /** Regex pattern (converted from glob at creation time). */
-  pattern: string;
-  /** User-assigned risk level. */
-  risk: RegistryRisk;
-  /** Human-readable label (shown in settings UI). */
-  label: string;
-  /** ISO 8601 timestamp of when the rule was created. */
-  createdAt: string;
-  /** How the rule was created. */
-  source: "scope_ladder" | "manual";
-}
-
-// ── Risk → RiskLevel mapping ─────────────────────────────────────────────────
-
-/**
- * Map a classifier `Risk` value to the permission system's `RiskLevel` enum.
- *
- * `"unknown"` maps to `RiskLevel.Medium` — matching the existing checker.ts
- * behavior where unrecognized commands are treated as medium-risk.
- */
-export function riskToRiskLevel(risk: Risk): RiskLevel {
-  switch (risk) {
-    case "low":
-      return RiskLevel.Low;
-    case "medium":
-      return RiskLevel.Medium;
-    case "high":
-      return RiskLevel.High;
-    case "unknown":
-      return RiskLevel.Medium;
-  }
+  resolvedPaths?: string[];
 }

package/src/permissions/types.ts

@@ -1,43 +1,26 @@
-import type { TrustRuleBase } from "@vellumai/ces-contracts";
-
-/**
- * Re-exported TrustRule type from `@vellumai/ces-contracts`.
- *
- * The contracts package defines `TrustRule` as a discriminated union over tool
- * families (scoped, URL, managed-skill, skill-load, generic). Some variants
- * don't carry `executionTarget`. To maintain backward
- * compatibility with existing callsites that access those fields on any rule,
- * we flatten the union here by intersecting the base with the optional fields.
- */
-export type TrustRule = TrustRuleBase & {
+export type {
+  AllowlistOption,
+  ScopeOption,
+} from "@vellumai/skill-host-contracts";
+export { RiskLevel } from "@vellumai/skill-host-contracts";
+
+/** A persistent trust rule stored on disk and used for permission matching. */
+export interface TrustRule {
+  id: string;
+  tool: string;
+  pattern: string;
+  decision: "allow" | "deny" | "ask";
+  priority: number;
+  createdAt: number;
   scope?: string;
   executionTarget?: string;
-};
-
-export enum RiskLevel {
-  Low = "low",
-  Medium = "medium",
-  High = "high",
+  userModifiedAt?: number;
 }
 
-export type UserDecision =
-  | "allow"
-  | "allow_10m"
-  | "allow_conversation"
-  | "always_allow"
-  | "deny"
-  | "always_deny"
-  | "temporary_override";
+export type UserDecision = "allow" | "deny";
 
-/** Returns true for any allow-variant decision. Centralizes the check to prevent omissions when new allow variants are added. */
 export function isAllowDecision(decision: UserDecision): boolean {
-  return (
-    decision === "allow" ||
-    decision === "allow_10m" ||
-    decision === "allow_conversation" ||
-    decision === "always_allow" ||
-    decision === "temporary_override"
-  );
+  return decision === "allow";
 }
 
 export interface PermissionCheckResult {
@@ -46,22 +29,9 @@ export interface PermissionCheckResult {
   matchedRule?: TrustRule;
 }
 
-export interface AllowlistOption {
-  label: string;
-  description: string;
-  pattern: string;
-}
-
-export interface ScopeOption {
-  label: string;
-  scope: string;
-}
-
 /** Contextual information passed alongside a permission check for policy decisions. */
 export interface PolicyContext {
   executionTarget?: string;
-  /** Ephemeral rules for task-scoped permissions — checked before persistent trust.json rules. */
-  ephemeralRules?: TrustRule[];
   /**
    * Execution context for per-context threshold resolution.
    * - "conversation": interactive client session (default)

package/src/permissions/workspace-policy.ts

@@ -63,14 +63,12 @@ const HOST_TOOLS = new Set([
   "host_file_read",
   "host_file_write",
   "host_file_edit",
+  "host_file_transfer",
   "host_bash",
   "computer_use_run_applescript",
 ]);
 
-/**
- * Check whether a tool name is a host-level tool that requires the
- * `hostAccess` permission to execute.
- */
+/** Check whether a tool name is a host-level tool. */
 export function isHostTool(toolName: string): boolean {
   return HOST_TOOLS.has(toolName);
 }

package/src/playbooks/playbook-compiler.ts

@@ -6,7 +6,7 @@
 
 import { and, eq, sql } from "drizzle-orm";
 
-import { getDb } from "../memory/db.js";
+import { getDb } from "../memory/db-connection.js";
 import { memoryGraphNodes } from "../memory/schema.js";
 import type { Playbook } from "./types.js";
 import { parsePlaybookStatement } from "./types.js";