@vellumai/assistant 0.6.6 → 0.7.1

package/src/permissions/gateway-threshold-reader.ts

@@ -1,14 +1,12 @@
 /**
  * Gateway-backed auto-approve threshold reader.
  *
- * When the `permission-controls-v3` feature flag is enabled, reads
- * thresholds from the gateway via IPC. Falls back to `undefined` (caller
- * uses config-based `resolveThreshold`) when the flag is off or the gateway
- * is unreachable.
+ * Reads thresholds from the gateway via IPC. The gateway is the sole source
+ * of truth for auto-approve thresholds. When the gateway is unreachable,
+ * defaults to "none" (Strict) so no tools are auto-approved without an
+ * explicit gateway-supplied threshold.
  */
 
-import { isAssistantFeatureFlagEnabled } from "../config/assistant-feature-flags.js";
-import { getConfig } from "../config/loader.js";
 import { ipcCall } from "../ipc/gateway-client.js";
 import { getLogger } from "../util/logger.js";
 import type { ExecutionContext } from "./approval-policy.js";
@@ -21,8 +19,7 @@ type Threshold = "none" | "low" | "medium" | "high";
 
 interface GlobalThresholds {
   interactive: string;
-  background: string;
-  headless: string;
+  autonomous: string;
 }
 
 interface ConversationThreshold {
@@ -55,21 +52,13 @@ export function _clearGlobalCacheForTesting(): void {
   conversationThresholdCache.clear();
 }
 
-// ── Hardcoded fallback defaults ──────────────────────────────────────────────
-
-const HARDCODED_DEFAULTS: Record<ExecutionContext, Threshold> = {
-  conversation: "low",
-  background: "medium",
-  headless: "none",
-};
-
 // ── Helpers ──────────────────────────────────────────────────────────────────
 
 function mapExecutionContextToField(
   executionContext: ExecutionContext,
 ): keyof GlobalThresholds {
   if (executionContext === "conversation") return "interactive";
-  return executionContext;
+  return "autonomous";
 }
 
 function isValidThreshold(value: string): value is Threshold {
@@ -86,25 +75,18 @@ function isValidThreshold(value: string): value is Threshold {
 /**
  * Read the auto-approve threshold from the gateway via IPC.
  *
- * Returns `undefined` when the feature flag is off (caller falls back to
- * config-based `resolveThreshold`).
- *
  * For `"conversation"` context with a `conversationId`, checks for a
  * per-conversation override first. Falls through to global defaults when
  * the conversation override is absent.
  *
  * Caches global thresholds for 30 seconds to avoid hammering the gateway.
- * On any IPC error, logs a warning and returns hardcoded defaults.
+ * On any IPC error or unexpected response, returns `"none"` (Strict) so
+ * no tools are silently auto-approved when the gateway is unreachable.
  */
 export async function getAutoApproveThreshold(
   conversationId: string | undefined,
   executionContext?: ExecutionContext,
-): Promise<Threshold | undefined> {
-  const config = getConfig();
-  if (!isAssistantFeatureFlagEnabled("permission-controls-v3", config)) {
-    return undefined;
-  }
-
+): Promise<Threshold> {
   const ctx: ExecutionContext = executionContext ?? "conversation";
 
   // For conversation context with a conversationId, try per-conversation override first
@@ -120,9 +102,8 @@ export async function getAutoApproveThreshold(
     } else {
       // ipcCall() returns undefined on transport failure (socket not found,
       // timeout, etc.) and null when the gateway explicitly says "no override".
-      // We must distinguish the two: only cache the negative on `null`, and
-      // fall back to hardcoded defaults on `undefined` without poisoning the
-      // cache — otherwise a transient IPC failure would cause subsequent
+      // On transport failure, fall through to the global threshold without
+      // poisoning the cache — a transient IPC failure must not cause subsequent
       // approval checks to skip a real override for up to 5 seconds.
       const result = (await ipcCall("get_conversation_threshold", {
         conversationId,
@@ -131,25 +112,23 @@ export async function getAutoApproveThreshold(
       if (result === undefined) {
         log.warn(
           { conversationId },
-          "IPC call failed for conversation threshold override, falling back to defaults",
+          "IPC call failed for conversation threshold override, falling through to global",
         );
-        return HARDCODED_DEFAULTS[ctx];
-      }
-
-      if (result && isValidThreshold(result.threshold)) {
+        // Fall through to global threshold fetch below.
+      } else if (result && isValidThreshold(result.threshold)) {
         conversationThresholdCache.set(conversationId, {
           threshold: result.threshold,
           timestamp: Date.now(),
         });
         return result.threshold;
+      } else {
+        // result === null (or an unexpected shape) — cache the negative result
+        // and fall through to global defaults.
+        conversationThresholdCache.set(conversationId, {
+          threshold: null,
+          timestamp: Date.now(),
+        });
       }
-
-      // result === null (or an unexpected shape) — cache the negative result
-      // and fall through to global defaults.
-      conversationThresholdCache.set(conversationId, {
-        threshold: null,
-        timestamp: Date.now(),
-      });
     }
   }
 
@@ -161,15 +140,20 @@ export async function getAutoApproveThreshold(
     if (isValidThreshold(value)) {
       return value;
     }
-    // Unexpected value from gateway — fall back to hardcoded
-    log.warn({ field, value }, "Gateway returned unexpected threshold value");
-    return HARDCODED_DEFAULTS[ctx];
+    // Unexpected value from gateway — default to "none" (Strict).
+    log.warn(
+      { field, value },
+      "Gateway returned unexpected threshold value, defaulting to none",
+    );
+    return "none";
   } catch (err) {
+    // Gateway unreachable — default to "none" (Strict) so no tools are
+    // silently auto-approved when the gateway is down.
     log.warn(
       { error: String(err) },
-      "Failed to fetch global thresholds, falling back to defaults",
+      "Failed to fetch global thresholds, defaulting to none",
     );
-    return HARDCODED_DEFAULTS[ctx];
+    return "none";
   }
 }
 

package/src/permissions/ipc-risk-types.ts

@@ -0,0 +1,95 @@
+/**
+ * Types for gateway IPC risk classification.
+ *
+ * These types mirror the gateway's classify_risk IPC response shape
+ * (gateway/src/ipc/risk-classification-handlers.ts) and request parameters.
+ * Keep in sync when the gateway response evolves.
+ */
+
+import type { DirectoryScopeOption, ScopeOption } from "./risk-types.js";
+import type { AllowlistOption } from "./types.js";
+
+// ── Dangerous pattern (mirrors gateway wire format) ─────────────────────────
+
+export interface DangerousPattern {
+  type: string;
+  description: string;
+  text: string;
+}
+
+// ── Gateway response type ───────────────────────────────────────────────────
+
+/**
+ * The response returned by the gateway's `classify_risk` IPC method.
+ *
+ * Mirrors the `ClassificationResult` in
+ * `gateway/src/ipc/risk-classification-handlers.ts`.
+ */
+export interface ClassificationResult {
+  risk: "low" | "medium" | "high" | "unknown";
+  reason: string;
+  matchType: "user_rule" | "registry" | "unknown";
+  scopeOptions: ScopeOption[];
+  allowlistOptions?: AllowlistOption[];
+  directoryScopeOptions?: DirectoryScopeOption[];
+  resolvedPaths?: string[];
+  actionKeys?: string[];
+  commandCandidates?: string[];
+  dangerousPatterns?: DangerousPattern[];
+  opaqueConstructs?: boolean;
+  isComplexSyntax?: boolean;
+  sandboxAutoApprove?: boolean;
+}
+
+// ── Gateway request type ────────────────────────────────────────────────────
+
+/**
+ * File classifier context pre-resolved by the assistant and forwarded
+ * to the gateway so it can run file-risk classification without importing
+ * assistant-specific path helpers.
+ */
+export interface FileContext {
+  protectedDir: string;
+  deprecatedDir: string;
+  hooksDir: string;
+  actorTokenSigningKeyPath: string;
+  skillSourceDirs: string[];
+}
+
+/**
+ * Skill metadata pre-resolved by the assistant and forwarded to the
+ * gateway for skill-load risk classification.
+ */
+export interface SkillMetadata {
+  skillId: string;
+  selector: string;
+  versionHash: string;
+  transitiveHash?: string;
+  hasInlineExpansions: boolean;
+  isDynamic: boolean;
+}
+
+/**
+ * Parameters for the `classify_risk` IPC request.
+ *
+ * Mirrors the Zod schema in
+ * `gateway/src/ipc/risk-classification-handlers.ts`.
+ */
+export interface ClassifyRiskParams {
+  tool: string;
+  command?: string;
+  url?: string;
+  path?: string;
+  skill?: string;
+  mode?: string;
+  script?: string;
+  workingDir?: string;
+  workspaceRoot?: string;
+  allowPrivateNetwork?: boolean;
+  networkMode?: string;
+  isContainerized?: boolean;
+  fileContext?: FileContext;
+  skillMetadata?: SkillMetadata;
+  /** Tool registry default risk level for unknown tools. */
+  registryDefaultRisk?: string;
+}

package/src/permissions/prompter.ts

@@ -16,11 +16,12 @@ interface PendingPrompt {
     selectedPattern?: string;
     selectedScope?: string;
     decisionContext?: string;
+    wasTimeout?: boolean;
+    wasSystemCancel?: boolean;
   }) => void;
   reject: (reason: Error) => void;
   timer: ReturnType<typeof setTimeout>;
   toolUseId?: string;
-  hostAccessEnablePrompt?: boolean;
 }
 
 export type ConfirmationStateCallback = (
@@ -63,18 +64,20 @@ export class PermissionPrompter {
     executionTarget?: ExecutionTarget,
     persistentDecisionsAllowed?: boolean,
     signal?: AbortSignal,
-    temporaryOptionsAvailable?: Array<"allow_10m" | "allow_conversation">,
     toolUseId?: string,
-    hostAccessEnablePrompt?: boolean,
     riskReason?: string,
     isContainerized?: boolean,
+    directoryScopeOptions?: readonly { scope: string; label: string }[],
   ): Promise<{
     decision: UserDecision;
     selectedPattern?: string;
     selectedScope?: string;
     decisionContext?: string;
+    wasTimeout?: boolean;
+    wasSystemCancel?: boolean;
+    wasAbort?: boolean;
   }> {
-    if (signal?.aborted) return { decision: "deny" };
+    if (signal?.aborted) return { decision: "deny", wasAbort: true };
 
     const requestId = uuid();
 
@@ -89,6 +92,7 @@ export class PermissionPrompter {
         this.onStateChanged?.(requestId, "timed_out", "timeout", toolUseId);
         resolve({
           decision: "deny",
+          wasTimeout: true,
           decisionContext: `The permission prompt for the "${toolName}" tool timed out. The user did not explicitly deny this request — they may have been away or busy. You may retry this tool call if it is still needed for the current task.`,
         });
       }, timeoutMs);
@@ -98,7 +102,6 @@ export class PermissionPrompter {
         reject,
         timer,
         toolUseId,
-        hostAccessEnablePrompt,
       });
 
       if (signal) {
@@ -106,7 +109,7 @@ export class PermissionPrompter {
           if (this.pending.has(requestId)) {
             clearTimeout(timer);
             this.pending.delete(requestId);
-            resolve({ decision: "deny" });
+            resolve({ decision: "deny", wasAbort: true });
           }
         };
         signal.addEventListener("abort", onAbort, { once: true });
@@ -129,11 +132,13 @@ export class PermissionPrompter {
           label: o.label,
           scope: o.scope,
         })),
+        directoryScopeOptions: directoryScopeOptions
+          ? directoryScopeOptions.map((o) => ({ scope: o.scope, label: o.label }))
+          : undefined,
         diff,
         conversationId,
         executionTarget,
         persistentDecisionsAllowed: persistentDecisionsAllowed ?? true,
-        temporaryOptionsAvailable,
         toolUseId,
       });
 
@@ -155,10 +160,6 @@ export class PermissionPrompter {
     return this.pending.get(requestId)?.toolUseId;
   }
 
-  isHostAccessEnablePrompt(requestId: string): boolean {
-    return this.pending.get(requestId)?.hostAccessEnablePrompt === true;
-  }
-
   resolveConfirmation(
     requestId: string,
     decision: UserDecision,
@@ -192,6 +193,7 @@ export class PermissionPrompter {
       this.pending.delete(requestId);
       pending.resolve({
         decision: "deny",
+        wasSystemCancel: true,
         decisionContext:
           "The user sent a new message instead of responding to this permission prompt. Stop what you are doing and respond to the user's new message. Do NOT retry this tool or request permission again until the user asks you to.",
       });

package/src/permissions/risk-types.ts

@@ -1,15 +1,11 @@
 /**
- * Types for the data-driven command risk classifier.
+ * Shared risk assessment types used by the permission checker.
  *
- * All types are JSON-serializable — no native RegExp, no function references.
- * Regex patterns are stored as strings (use `String.raw` for ergonomics in TS).
- * This constraint exists because the registry will eventually be persisted to a
- * DB with per-user/per-org overrides that need to round-trip cleanly.
- *
- * @see /docs/bash-risk-classifier-design.md
+ * Classifier-internal types (CommandRiskSpec, ArgRule, ArgSchema, etc.) have
+ * been migrated to the gateway and removed from the assistant.
  */
 
-import { type AllowlistOption, RiskLevel } from "./types.js";
+import type { AllowlistOption } from "./types.js";
 
 // ── Risk levels ──────────────────────────────────────────────────────────────
 
@@ -23,12 +19,6 @@ import { type AllowlistOption, RiskLevel } from "./types.js";
  */
 export type Risk = "low" | "medium" | "high" | "unknown";
 
-/**
- * Risk levels that can be assigned to commands in the registry.
- * Excludes "unknown" — that's a classifier output, not a registry value.
- */
-export type RegistryRisk = "low" | "medium" | "high";
-
 // ── Risk assessment output ───────────────────────────────────────────────────
 
 /** A scope option presented to the user when classifying an unknown command. */
@@ -39,6 +29,17 @@ export interface ScopeOption {
   label: string;
 }
 
+/**
+ * A directory scope option emitted by the gateway for filesystem operations.
+ * Mirrors `DirectoryScopeOption` in `gateway/src/risk/risk-types.ts`.
+ */
+export interface DirectoryScopeOption {
+  /** Path glob (e.g. "/workspace/scratch/*") or the sentinel "everywhere". */
+  scope: string;
+  /** Human-readable label (e.g. "In scratch/"). */
+  label: string;
+}
+
 /**
  * The output of a risk classifier. Tool-agnostic — every classifier
  * (bash, file_write, web_fetch, etc.) produces this same shape.
@@ -59,204 +60,17 @@ export interface RiskAssessment {
    * directly instead of calling the per-tool strategy function.
    */
   allowlistOptions?: AllowlistOption[];
-}
-
-// ── Classifier interface ─────────────────────────────────────────────────────
-
-/**
- * Generic risk classifier interface. Each tool type (bash, file_write, etc.)
- * implements this with a tool-specific input type.
- */
-export interface RiskClassifier<TInput> {
-  classify(input: TInput): Promise<RiskAssessment>;
-}
-
-// ── Bash classifier input ────────────────────────────────────────────────────
-
-/** Input to the bash risk classifier. */
-export interface BashClassifierInput {
-  /** The raw command string. */
-  command: string;
-  /** Which tool is being invoked. */
-  toolName: "bash" | "host_bash";
-  /** Working directory (for path resolution in arg rules). */
-  workingDir?: string;
-}
-
-// ── Command registry types ───────────────────────────────────────────────────
-
-/**
- * A single arg-level risk rule within a command spec.
- *
- * Evaluated per arg token. If `flags` is set, the rule only fires when the
- * arg matches one of those flags. If `valuePattern` is set, the arg (or the
- * flag's consumed value) must match the regex.
- */
-export interface ArgRule {
-  /**
-   * Stable ID for DB references, partial overrides, and audit trails.
-   * Convention: `"command:descriptor"` (e.g. `"curl:upload-file"`, `"rm:recursive-force"`).
-   */
-  id: string;
   /**
-   * Flag(s) that trigger this rule. Omit for positional/any-arg matching.
-   * Combined short flags are listed as literals (e.g. `"-rf"`, `"-fr"`).
+   * Directory scope options emitted by the gateway for filesystem operations.
+   * Mirrors `directoryScopeOptions` in the gateway's ClassificationResult.
+   * Present when the gateway's classifier identified one or more filesystem
+   * path arguments and generated a directory-scope ladder for them.
    */
-  flags?: string[];
+  directoryScopeOptions?: DirectoryScopeOption[];
   /**
-   * Regex string matched against the arg value. Omit if flag presence alone
-   * triggers the rule. Stored as a string (not a native RegExp) for JSON
-   * serialization.
+   * Fully resolved filesystem path arguments from the gateway classifier.
+   * Threaded into `findHighestPriorityRule` so directory-scoped trust rules
+   * match against actual target paths, not just the working directory.
    */
-  valuePattern?: string;
-  /** Risk level when this rule fires. */
-  risk: RegistryRisk;
-  /** Human-readable reason (shown in permission prompt). */
-  reason: string;
-}
-
-/**
- * Risk specification for a single command (or subcommand).
- *
- * The registry is a `Record<string, CommandRiskSpec>` mapping program names
- * to their specs. Subcommands nest recursively.
- */
-export interface CommandRiskSpec {
-  /** Base risk when no arg rules match. */
-  baseRisk: RegistryRisk;
-  /**
-   * Subcommand-level overrides. Keys are subcommand names
-   * (e.g. `{ push: { baseRisk: "medium", ... } }` under `git`).
-   * Subcommands can nest further (e.g. `git stash drop`).
-   */
-  subcommands?: Record<string, CommandRiskSpec>;
-  /** Arg-level rules, evaluated per arg. First match per arg wins. */
-  argRules?: ArgRule[];
-  /**
-   * Is this a wrapper command? (sudo, env, nice, etc.)
-   * When true, the classifier unwraps to find the inner command and
-   * takes the max of the wrapper's baseRisk and the inner command's risk.
-   */
-  isWrapper?: boolean;
-  /**
-   * Flags that put a wrapper into a non-exec mode (e.g. command -v, env -0).
-   * When the first arg matches a non-exec flag, skip unwrapping and classify
-   * the wrapper standalone against its own arg rules.
-   */
-  nonExecFlags?: string[];
-  /**
-   * Does this command have non-standard syntax where intermediate scope
-   * options would be confusing? (find, xargs, awk, etc.)
-   * When true, the scope ladder only offers exact match and command-level wildcard.
-   */
-  complexSyntax?: boolean;
-  /** Human-readable reason for the base risk (shown when no arg rule matches). */
-  reason?: string;
-  /**
-   * When true, this command auto-approves in the assistant's workspace
-   * without consulting the user's autoApproveUpTo threshold.
-   */
-  sandboxAutoApprove?: boolean;
-  /**
-   * Arg-parsing schema for extracting structured argument information.
-   * Used by `parseArgs()` to classify args into flags, positionals, and
-   * path arguments for downstream path-based policy checks.
-   */
-  argSchema?: ArgSchema;
-}
-
-// ── Arg schema types ─────────────────────────────────────────────────────────
-
-/** Describes the role of a positional argument in a command. */
-export interface PositionalDesc {
-  /** The semantic role of this positional argument. */
-  role: "path" | "pattern" | "script" | "value" | "command";
-  /**
-   * When true, this descriptor applies to all subsequent positionals too
-   * (i.e. the remaining args are all of this role).
-   */
-  rest?: boolean;
-}
-
-/**
- * Schema for parsing a command's arguments into structured data.
- *
- * Drives the `parseArgs()` utility to classify each token as a flag,
- * positional, or path argument.
- */
-export interface ArgSchema {
-  /** Flags that consume the next token as a value (e.g. `-o`, `--output`). */
-  valueFlags?: string[];
-  /**
-   * Describes how positional arguments should be interpreted:
-   * - `"paths"` (or omitted): all positionals are filesystem paths
-   * - `"none"`: no positionals are filesystem paths
-   * - `PositionalDesc[]`: per-index role descriptors
-   */
-  positionals?: "paths" | "none" | PositionalDesc[];
-  /** Flag names whose consumed values are filesystem paths (e.g. `{ "-t": true }`). */
-  pathFlags?: Record<string, true>;
-  /**
-   * Whether `--` ends flag parsing (everything after is positional).
-   * Defaults to `true` when omitted.
-   */
-  respectsDoubleDash?: boolean;
-}
-
-/**
- * The result of parsing a command's arguments via `parseArgs()`.
- */
-export interface ParsedArgs {
-  /** Flag name to value (`true` for boolean flags, string for value-consuming flags). */
-  flags: Map<string, string | true>;
-  /** All positional arguments in order. */
-  positionals: string[];
-  /** Subset of positionals and flag values that are filesystem paths. */
-  pathArgs: string[];
-  /** Whether a `--` double-dash terminator was encountered. */
-  sawDoubleDash: boolean;
-}
-
-// ── User rule types ──────────────────────────────────────────────────────────
-
-/**
- * A user-created risk classification rule.
- *
- * Created via the scope ladder UI (from permission prompts) or manually
- * in settings. Stored in the user's DB.
- */
-export interface UserRule {
-  /** Auto-generated unique ID. */
-  id: string;
-  /** Regex pattern (converted from glob at creation time). */
-  pattern: string;
-  /** User-assigned risk level. */
-  risk: RegistryRisk;
-  /** Human-readable label (shown in settings UI). */
-  label: string;
-  /** ISO 8601 timestamp of when the rule was created. */
-  createdAt: string;
-  /** How the rule was created. */
-  source: "scope_ladder" | "manual";
-}
-
-// ── Risk → RiskLevel mapping ─────────────────────────────────────────────────
-
-/**
- * Map a classifier `Risk` value to the permission system's `RiskLevel` enum.
- *
- * `"unknown"` maps to `RiskLevel.Medium` — matching the existing checker.ts
- * behavior where unrecognized commands are treated as medium-risk.
- */
-export function riskToRiskLevel(risk: Risk): RiskLevel {
-  switch (risk) {
-    case "low":
-      return RiskLevel.Low;
-    case "medium":
-      return RiskLevel.Medium;
-    case "high":
-      return RiskLevel.High;
-    case "unknown":
-      return RiskLevel.Medium;
-  }
+  resolvedPaths?: string[];
 }