@vellumai/assistant 0.7.0 → 0.7.2

package/src/permissions/approval-provenance.test.ts

@@ -0,0 +1,184 @@
+import { describe, expect, test } from "bun:test";
+
+import { mapApprovalProvenance } from "./approval-provenance.js";
+import type { ApprovalMode, RiskThreshold } from "./types.js";
+import { RISK_ORDINAL, THRESHOLD_ORDINAL } from "./types.js";
+
+// ── mapApprovalProvenance — one test per row of the decision mapping table ────
+
+describe("mapApprovalProvenance", () => {
+  test("platform_auto_approve → auto / platform_auto_approve", () => {
+    const r = mapApprovalProvenance("platform_auto_approve", {});
+    expect(r.approvalMode).toBe("auto");
+    expect(r.approvalReason).toBe("platform_auto_approve");
+  });
+
+  test("guardian_auto_approve → auto / within_threshold", () => {
+    const r = mapApprovalProvenance("guardian_auto_approve", {});
+    expect(r.approvalMode).toBe("auto");
+    expect(r.approvalReason).toBe("within_threshold");
+  });
+
+  test("allow + sandbox → auto / sandbox_auto_approve", () => {
+    const r = mapApprovalProvenance("allow", { hasSandboxAutoApprove: true });
+    expect(r.approvalMode).toBe("auto");
+    expect(r.approvalReason).toBe("sandbox_auto_approve");
+  });
+
+  test("allow + trust rule → auto / trust_rule_allowed", () => {
+    const r = mapApprovalProvenance("allow", { matchedTrustRuleId: "rule-abc" });
+    expect(r.approvalMode).toBe("auto");
+    expect(r.approvalReason).toBe("trust_rule_allowed");
+  });
+
+  test("allow (no trust rule, no sandbox) → auto / within_threshold", () => {
+    const r = mapApprovalProvenance("allow", {});
+    expect(r.approvalMode).toBe("auto");
+    expect(r.approvalReason).toBe("within_threshold");
+  });
+
+  test("allow + wasPrompted → prompted / user_approved", () => {
+    const r = mapApprovalProvenance("allow", { wasPrompted: true });
+    expect(r.approvalMode).toBe("prompted");
+    expect(r.approvalReason).toBe("user_approved");
+  });
+
+  test("deny (user pressed deny) → prompted / user_denied", () => {
+    const r = mapApprovalProvenance("deny", {});
+    expect(r.approvalMode).toBe("prompted");
+    expect(r.approvalReason).toBe("user_denied");
+  });
+
+  test("deny + wasTimeout → prompted / timed_out", () => {
+    const r = mapApprovalProvenance("deny", { wasTimeout: true });
+    expect(r.approvalMode).toBe("prompted");
+    expect(r.approvalReason).toBe("timed_out");
+  });
+
+  test("deny + wasSystemCancel → prompted / system_cancelled", () => {
+    const r = mapApprovalProvenance("deny", { wasSystemCancel: true });
+    expect(r.approvalMode).toBe("prompted");
+    expect(r.approvalReason).toBe("system_cancelled");
+  });
+
+  test("wasSystemCancel takes priority over wasTimeout", () => {
+    const r = mapApprovalProvenance("deny", { wasSystemCancel: true, wasTimeout: true });
+    expect(r.approvalReason).toBe("system_cancelled");
+  });
+
+  test("denied + matchedTrustRuleId → blocked / trust_rule_denied", () => {
+    const r = mapApprovalProvenance("denied", { matchedTrustRuleId: "rule-abc" });
+    expect(r.approvalMode).toBe("blocked");
+    expect(r.approvalReason).toBe("trust_rule_denied");
+  });
+
+  test("denied (no matchedTrustRuleId) → blocked / no_interactive_client", () => {
+    const r = mapApprovalProvenance("denied", {});
+    expect(r.approvalMode).toBe("blocked");
+    expect(r.approvalReason).toBe("no_interactive_client");
+  });
+
+  test("unknown decision → unknown / unknown", () => {
+    const r = mapApprovalProvenance("something_unexpected", {});
+    expect(r.approvalMode).toBe("unknown");
+    expect(r.approvalReason).toBe("unknown");
+  });
+
+  test("sandbox takes priority over trust rule when both present", () => {
+    const r = mapApprovalProvenance("allow", {
+      hasSandboxAutoApprove: true,
+      matchedTrustRuleId: "rule-xyz",
+    });
+    expect(r.approvalReason).toBe("sandbox_auto_approve");
+  });
+
+  test("wasPrompted takes priority over sandbox when both set", () => {
+    const r = mapApprovalProvenance("allow", {
+      wasPrompted: true,
+      hasSandboxAutoApprove: true,
+    });
+    expect(r.approvalMode).toBe("prompted");
+    expect(r.approvalReason).toBe("user_approved");
+  });
+});
+
+// ── RISK_ORDINAL — unknown riskLevel must not map to a safe value ─────────────
+
+describe("RISK_ORDINAL semantics", () => {
+  test("known risk levels have expected ordinals", () => {
+    expect(RISK_ORDINAL["low"]).toBe(0);
+    expect(RISK_ORDINAL["medium"]).toBe(1);
+    expect(RISK_ORDINAL["high"]).toBe(2);
+  });
+
+  test("unknown riskLevel is absent so callers fall through to ?? 2 (high)", () => {
+    expect(RISK_ORDINAL["unknown"]).toBeUndefined();
+  });
+});
+
+// ── wasExpected derivation — all combinations ─────────────────────────────────
+
+function wasExpected(
+  approvalMode: ApprovalMode,
+  riskLevel: string,
+  riskThreshold: RiskThreshold,
+): boolean {
+  if (approvalMode !== "auto") return true;
+  return RISK_ORDINAL[riskLevel] <= THRESHOLD_ORDINAL[riskThreshold];
+}
+
+describe("wasExpected derivation", () => {
+  test("prompted outcomes are always expected", () => {
+    expect(wasExpected("prompted", "high", "none")).toBe(true);
+    expect(wasExpected("prompted", "high", "low")).toBe(true);
+  });
+
+  test("blocked outcomes are always expected", () => {
+    expect(wasExpected("blocked", "high", "none")).toBe(true);
+    expect(wasExpected("blocked", "medium", "low")).toBe(true);
+  });
+
+  test("unknown (legacy) outcomes are always expected", () => {
+    expect(wasExpected("unknown", "high", "none")).toBe(true);
+  });
+
+  test("auto: risk within threshold → expected", () => {
+    expect(wasExpected("auto", "low", "low")).toBe(true);
+    expect(wasExpected("auto", "low", "medium")).toBe(true);
+    expect(wasExpected("auto", "medium", "medium")).toBe(true);
+    expect(wasExpected("auto", "high", "high")).toBe(true);
+  });
+
+  test("auto: risk above threshold → unexpected", () => {
+    expect(wasExpected("auto", "high", "low")).toBe(false);
+    expect(wasExpected("auto", "high", "medium")).toBe(false);
+    expect(wasExpected("auto", "medium", "low")).toBe(false);
+    expect(wasExpected("auto", "high", "none")).toBe(false);
+    expect(wasExpected("auto", "medium", "none")).toBe(false);
+    expect(wasExpected("auto", "low", "none")).toBe(false);
+  });
+});
+
+// ── Invariant: new records must not emit approvalMode: "unknown" ──────────────
+
+describe("approvalMode unknown invariant", () => {
+  const knownDecisions = [
+    "allow",
+    "deny",
+    "denied",
+    "platform_auto_approve",
+    "guardian_auto_approve",
+  ];
+
+  test("every known decision produces a non-unknown approvalMode", () => {
+    for (const decision of knownDecisions) {
+      const r = mapApprovalProvenance(decision, {});
+      expect(r.approvalMode).not.toBe("unknown");
+    }
+  });
+
+  test("only unrecognised decision strings emit unknown", () => {
+    const r = mapApprovalProvenance("__legacy_unknown__", {});
+    expect(r.approvalMode).toBe("unknown");
+  });
+});

package/src/permissions/approval-provenance.ts

@@ -0,0 +1,70 @@
+import type { ApprovalMode, ApprovalReason } from "./types.js";
+
+/**
+ * Map a raw permission decision string (from permission-checker.ts) and
+ * optional context discriminants to a stable (approvalMode, approvalReason)
+ * pair for persistence and client display.
+ *
+ * Decision strings:
+ *   "allow"                 — auto-allowed by policy (sandbox, trust rule, or threshold)
+ *   "deny"                  — user denied via interactive prompt
+ *   "denied"                — system denied (no interactive client, or trust rule deny)
+ *   "platform_auto_approve" — guardian bash in platform-hosted session
+ *   "guardian_auto_approve" — non-interactive guardian session within background threshold
+ */
+export function mapApprovalProvenance(
+  decision: string,
+  opts: {
+    hasSandboxAutoApprove?: boolean;
+    matchedTrustRuleId?: string;
+    wasPrompted?: boolean;
+    wasTimeout?: boolean;
+    wasSystemCancel?: boolean;
+    wasAbort?: boolean;
+  },
+): { approvalMode: ApprovalMode; approvalReason: ApprovalReason } {
+  if (decision === "platform_auto_approve") {
+    return { approvalMode: "auto", approvalReason: "platform_auto_approve" };
+  }
+
+  if (decision === "guardian_auto_approve") {
+    return { approvalMode: "auto", approvalReason: "within_threshold" };
+  }
+
+  if (decision === "allow") {
+    if (opts.wasPrompted) {
+      return { approvalMode: "prompted", approvalReason: "user_approved" };
+    }
+    if (opts.hasSandboxAutoApprove) {
+      return { approvalMode: "auto", approvalReason: "sandbox_auto_approve" };
+    }
+    if (opts.matchedTrustRuleId) {
+      return { approvalMode: "auto", approvalReason: "trust_rule_allowed" };
+    }
+    return { approvalMode: "auto", approvalReason: "within_threshold" };
+  }
+
+  // "deny" — interactive prompt denied, timed out, or system-cancelled
+  if (decision === "deny") {
+    if (opts.wasSystemCancel) {
+      return { approvalMode: "prompted", approvalReason: "system_cancelled" };
+    }
+    if (opts.wasAbort) {
+      return { approvalMode: "prompted", approvalReason: "system_cancelled" };
+    }
+    if (opts.wasTimeout) {
+      return { approvalMode: "prompted", approvalReason: "timed_out" };
+    }
+    return { approvalMode: "prompted", approvalReason: "user_denied" };
+  }
+
+  // "denied" — system denied without user interaction
+  if (decision === "denied") {
+    if (opts.matchedTrustRuleId) {
+      return { approvalMode: "blocked", approvalReason: "trust_rule_denied" };
+    }
+    return { approvalMode: "blocked", approvalReason: "no_interactive_client" };
+  }
+
+  return { approvalMode: "unknown", approvalReason: "unknown" };
+}

package/src/permissions/checker.test.ts

@@ -25,7 +25,6 @@ mock.module("../config/loader.js", () => ({
   getConfig: () => testConfig,
   loadConfig: () => testConfig,
   invalidateConfigCache: () => {},
-  saveConfig: () => {},
   loadRawConfig: () => ({}),
   saveRawConfig: () => {},
   getNestedValue: () => undefined,

package/src/permissions/checker.ts

@@ -2,7 +2,6 @@ import { createHash } from "node:crypto";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 
-import { isAssistantFeatureFlagEnabled } from "../config/assistant-feature-flags.js";
 import { getIsContainerized } from "../config/env-registry.js";
 import { getConfig } from "../config/loader.js";
 import { loadSkillCatalog, resolveSkillSelector } from "../config/skills.js";
@@ -198,7 +197,7 @@ function canonicalizeWebFetchUrl(parsed: URL): URL {
   return parsed;
 }
 
-export function normalizeWebFetchUrl(rawUrl: string): URL | null {
+function normalizeWebFetchUrl(rawUrl: string): URL | null {
   const trimmed = rawUrl.trim();
   if (!trimmed) return null;
 
@@ -268,23 +267,17 @@ function resolveSkillMetadata(selector: string): SkillMetadata | undefined {
   const resolved = resolveSkillIdAndHash(selector);
   if (!resolved) return undefined;
 
-  const config = getConfig();
-  const inlineEnabled = isAssistantFeatureFlagEnabled(
-    "inline-skill-commands",
-    config,
-  );
   const inlineExpansions = hasInlineExpansions(resolved.id);
-  const isDynamic = inlineEnabled && inlineExpansions;
 
   return {
     skillId: resolved.id,
     selector,
     versionHash: resolved.versionHash ?? "",
-    transitiveHash: isDynamic
+    transitiveHash: inlineExpansions
       ? computeTransitiveHashSafe(resolved.id)
       : undefined,
     hasInlineExpansions: inlineExpansions,
-    isDynamic,
+    isDynamic: inlineExpansions,
   };
 }
 
@@ -558,6 +551,9 @@ export async function check(
     decision: approvalDecision.decision,
     reason: enrichedReason,
     matchedRule: approvalDecision.matchedRule,
+    hasSandboxAutoApprove:
+      approvalDecision.reason ===
+        "Workspace filesystem operation (sandbox auto-approve)" || undefined,
   };
 }
 
@@ -723,14 +719,7 @@ function skillLoadAllowlistStrategy(
   if (rawSelector) {
     const resolved = resolveSkillIdAndHash(rawSelector);
 
-    // Check whether this is a dynamic (inline-command) skill load
-    const config = getConfig();
-    const inlineEnabled = isAssistantFeatureFlagEnabled(
-      "inline-skill-commands",
-      config,
-    );
-
-    if (resolved && inlineEnabled && hasInlineExpansions(resolved.id)) {
+    if (resolved && hasInlineExpansions(resolved.id)) {
       const transitiveHash = computeTransitiveHashSafe(resolved.id);
       const options: AllowlistOption[] = [];
       if (transitiveHash) {

package/src/permissions/gateway-threshold-reader.ts

@@ -20,6 +20,7 @@ type Threshold = "none" | "low" | "medium" | "high";
 interface GlobalThresholds {
   interactive: string;
   autonomous: string;
+  headless: string;
 }
 
 interface ConversationThreshold {
@@ -58,6 +59,7 @@ function mapExecutionContextToField(
   executionContext: ExecutionContext,
 ): keyof GlobalThresholds {
   if (executionContext === "conversation") return "interactive";
+  if (executionContext === "headless") return "headless";
   return "autonomous";
 }
 
@@ -141,7 +143,10 @@ export async function getAutoApproveThreshold(
       return value;
     }
     // Unexpected value from gateway — default to "none" (Strict).
-    log.warn({ field, value }, "Gateway returned unexpected threshold value, defaulting to none");
+    log.warn(
+      { field, value },
+      "Gateway returned unexpected threshold value, defaulting to none",
+    );
     return "none";
   } catch (err) {
     // Gateway unreachable — default to "none" (Strict) so no tools are

package/src/permissions/prompter.ts

@@ -2,6 +2,7 @@ import { v4 as uuid } from "uuid";
 
 import { getConfig } from "../config/loader.js";
 import type { ServerMessage } from "../daemon/message-protocol.js";
+import * as pendingInteractions from "../runtime/pending-interactions.js";
 import { redactSensitiveFields } from "../security/redaction.js";
 import type { ExecutionTarget } from "../tools/types.js";
 import { AssistantError, ErrorCode } from "../util/errors.js";
@@ -16,6 +17,8 @@ interface PendingPrompt {
     selectedPattern?: string;
     selectedScope?: string;
     decisionContext?: string;
+    wasTimeout?: boolean;
+    wasSystemCancel?: boolean;
   }) => void;
   reject: (reason: Error) => void;
   timer: ReturnType<typeof setTimeout>;
@@ -71,15 +74,44 @@ export class PermissionPrompter {
     selectedPattern?: string;
     selectedScope?: string;
     decisionContext?: string;
+    wasTimeout?: boolean;
+    wasSystemCancel?: boolean;
+    wasAbort?: boolean;
   }> {
-    if (signal?.aborted) return { decision: "deny" };
+    if (signal?.aborted) return { decision: "deny", wasAbort: true };
 
     const requestId = uuid();
 
+    // Self-register in pendingInteractions so /v1/confirm can route the
+    // response to this conversation without going through broadcastMessage.
+    if (conversationId) {
+      pendingInteractions.register(requestId, {
+        conversationId,
+        kind: "confirmation",
+        confirmationDetails: {
+          toolName,
+          input: redactSensitiveFields(input),
+          riskLevel,
+          executionTarget,
+          allowlistOptions: allowlistOptions.map((o) => ({
+            label: o.label,
+            description: o.description,
+            pattern: o.pattern,
+          })),
+          scopeOptions: scopeOptions.map((o) => ({
+            label: o.label,
+            scope: o.scope,
+          })),
+          persistentDecisionsAllowed: persistentDecisionsAllowed ?? true,
+        },
+      });
+    }
+
     return new Promise((resolve, reject) => {
       const timeoutMs = getConfig().timeouts.permissionTimeoutSec * 1000;
       const timer = setTimeout(() => {
         this.pending.delete(requestId);
+        pendingInteractions.resolve(requestId);
         log.warn(
           { requestId, toolName },
           "Permission prompt timed out, defaulting to deny",
@@ -87,6 +119,7 @@ export class PermissionPrompter {
         this.onStateChanged?.(requestId, "timed_out", "timeout", toolUseId);
         resolve({
           decision: "deny",
+          wasTimeout: true,
           decisionContext: `The permission prompt for the "${toolName}" tool timed out. The user did not explicitly deny this request — they may have been away or busy. You may retry this tool call if it is still needed for the current task.`,
         });
       }, timeoutMs);
@@ -103,7 +136,8 @@ export class PermissionPrompter {
           if (this.pending.has(requestId)) {
             clearTimeout(timer);
             this.pending.delete(requestId);
-            resolve({ decision: "deny" });
+            pendingInteractions.resolve(requestId);
+            resolve({ decision: "deny", wasAbort: true });
           }
         };
         signal.addEventListener("abort", onAbort, { once: true });
@@ -168,6 +202,9 @@ export class PermissionPrompter {
     }
     clearTimeout(pending.timer);
     this.pending.delete(requestId);
+    // Idempotent — approval-routes already calls pendingInteractions.resolve()
+    // before routing here, but we call it defensively for non-route paths.
+    pendingInteractions.resolve(requestId);
     pending.resolve({
       decision,
       selectedPattern,
@@ -185,8 +222,10 @@ export class PermissionPrompter {
     for (const [requestId, pending] of this.pending) {
       clearTimeout(pending.timer);
       this.pending.delete(requestId);
+      pendingInteractions.resolve(requestId);
       pending.resolve({
         decision: "deny",
+        wasSystemCancel: true,
         decisionContext:
           "The user sent a new message instead of responding to this permission prompt. Stop what you are doing and respond to the user's new message. Do NOT retry this tool or request permission again until the user asks you to.",
       });
@@ -198,8 +237,9 @@ export class PermissionPrompter {
   }
 
   dispose(): void {
-    for (const [, pending] of this.pending) {
+    for (const [requestId, pending] of this.pending) {
       clearTimeout(pending.timer);
+      pendingInteractions.resolve(requestId);
       pending.reject(
         new AssistantError("Prompter disposed", ErrorCode.INTERNAL_ERROR),
       );

package/src/permissions/secret-prompter.ts

@@ -2,6 +2,8 @@ import { v4 as uuid } from "uuid";
 
 import { getConfig } from "../config/loader.js";
 import type { ServerMessage } from "../daemon/message-protocol.js";
+import { broadcastMessage } from "../runtime/assistant-event-hub.js";
+import * as pendingInteractions from "../runtime/pending-interactions.js";
 import { AssistantError, ErrorCode } from "../util/errors.js";
 import { getLogger } from "../util/logger.js";
 
@@ -33,38 +35,22 @@ export interface SecretPrompterChannelContext {
 
 export class SecretPrompter {
   private pending = new Map<string, PendingSecretPrompt>();
-  private sendToClient: (msg: ServerMessage) => void;
-  private broadcastToAllClients?: (msg: ServerMessage) => void;
   private channelContext?: SecretPrompterChannelContext;
 
-  constructor(
-    sendToClient: (msg: ServerMessage) => void,
-    broadcastToAllClients?: (msg: ServerMessage) => void,
-  ) {
-    this.sendToClient = sendToClient;
-    this.broadcastToAllClients = broadcastToAllClients;
-  }
-
-  updateSender(sendToClient: (msg: ServerMessage) => void): void {
-    this.sendToClient = sendToClient;
-  }
-
-  updateBroadcast(broadcastToAllClients?: (msg: ServerMessage) => void): void {
-    this.broadcastToAllClients = broadcastToAllClients;
-  }
-
   setChannelContext(ctx: SecretPrompterChannelContext | undefined): void {
     this.channelContext = ctx;
   }
 
   /**
-   * Send a secret_request to the client and wait for the response.
+   * Broadcast a secret_request to all connected clients and wait for a
+   * response.
    *
-   * When the conversation originates from a channel that cannot render secure
-   * prompts (e.g. Slack), the request is broadcast to all connected clients
-   * via the SSE hub so the desktop app can display it. If no broadcast path
-   * is available and the channel doesn't support dynamic UI, the method
-   * fails fast with an error result rather than hanging until timeout.
+   * The request is always published to the SSE hub via
+   * {@link broadcastMessage} so any connected client (desktop, web) can
+   * display the secure prompt dialog.
+   *
+   * Pending interaction registration is handled by {@link broadcastMessage}
+   * when the secret_request event is published to the hub.
    *
    * SECURITY: Logs only metadata (requestId, service, field) — never the
    * returned secret value. The timeout path also returns a null value
@@ -81,32 +67,27 @@ export class SecretPrompter {
     allowedTools?: string[],
     allowedDomains?: string[],
   ): Promise<SecretPromptResult> {
-    // Determine whether the originating channel can render secure prompts.
-    const channelSupportsPrompt =
-      this.channelContext?.supportsDynamicUi !== false;
-
-    // If the channel cannot render the prompt and there's no broadcast path
-    // to reach a desktop client, fail fast instead of hanging for 5 minutes.
-    if (!channelSupportsPrompt && !this.broadcastToAllClients) {
-      log.warn(
-        { service, field, channel: this.channelContext?.channel },
-        "Secret prompt requested from a channel that cannot render it and no broadcast path is available",
-      );
-      return { value: null, delivery: "store", error: "unsupported_channel" };
-    }
-
     const requestId = uuid();
+    const effectiveConversationId = conversationId ?? "unknown";
 
     return new Promise((resolve, reject) => {
       const timeoutMs = getConfig().timeouts.permissionTimeoutSec * 1000;
       const timer = setTimeout(() => {
         this.pending.delete(requestId);
+        pendingInteractions.resolve(requestId);
         log.warn({ requestId, service, field }, "Secret prompt timed out");
         resolve({ value: null, delivery: "store" });
       }, timeoutMs);
 
       this.pending.set(requestId, { resolve, reject, timer });
 
+      // Self-register in pendingInteractions so /v1/secret can route the
+      // response to this conversation without relying on broadcastMessage.
+      pendingInteractions.register(requestId, {
+        conversationId: effectiveConversationId,
+        kind: "secret",
+      });
+
       const config = getConfig();
       const msg: SecretRequestMessage = {
         type: "secret_request",
@@ -116,21 +97,14 @@ export class SecretPrompter {
         label,
         description,
         placeholder,
-        conversationId,
+        conversationId: effectiveConversationId,
         purpose,
         allowedTools,
         allowedDomains,
         allowOneTimeSend: config.secretDetection.allowOneTimeSend,
       };
 
-      // Use broadcastToAllClients when the originating channel cannot render
-      // secure prompts — this routes the request to the SSE hub where a
-      // connected desktop client can pick it up.
-      if (!channelSupportsPrompt && this.broadcastToAllClients) {
-        this.broadcastToAllClients(msg);
-      } else {
-        this.sendToClient(msg);
-      }
+      broadcastMessage(msg);
     });
   }
 
@@ -157,12 +131,15 @@ export class SecretPrompter {
     }
     clearTimeout(pending.timer);
     this.pending.delete(requestId);
+    // Clean up the global map (may already be removed by approval-routes).
+    pendingInteractions.resolve(requestId);
     pending.resolve({ value: value ?? null, delivery: delivery ?? "store" });
   }
 
   dispose(): void {
-    for (const [, pending] of this.pending) {
+    for (const [requestId, pending] of this.pending) {
       clearTimeout(pending.timer);
+      pendingInteractions.resolve(requestId);
       pending.reject(
         new AssistantError("Prompter disposed", ErrorCode.INTERNAL_ERROR),
       );

package/src/permissions/types.ts

@@ -4,6 +4,37 @@ export type {
 } from "@vellumai/skill-host-contracts";
 export { RiskLevel } from "@vellumai/skill-host-contracts";
 
+export type ApprovalMode = "prompted" | "auto" | "blocked" | "unknown";
+
+export type ApprovalReason =
+  | "user_approved"
+  | "user_denied"
+  | "timed_out"
+  | "within_threshold"
+  | "trust_rule_allowed"
+  | "trust_rule_denied"
+  | "sandbox_auto_approve"
+  | "platform_auto_approve"
+  | "no_interactive_client"
+  | "grant_scoped_consumed"
+  | "system_cancelled"
+  | "unknown";
+
+export type RiskThreshold = "none" | "low" | "medium" | "high";
+
+export const RISK_ORDINAL: Record<string, number> = {
+  low: 0,
+  medium: 1,
+  high: 2,
+};
+
+export const THRESHOLD_ORDINAL: Record<string, number> = {
+  none: -1,
+  low: 0,
+  medium: 1,
+  high: 2,
+};
+
 /** A persistent trust rule stored on disk and used for permission matching. */
 export interface TrustRule {
   id: string;
@@ -27,6 +58,8 @@ export interface PermissionCheckResult {
   decision: "allow" | "deny" | "prompt";
   reason: string;
   matchedRule?: TrustRule;
+  /** True when the decision was taken via the sandbox auto-approve path. */
+  hasSandboxAutoApprove?: boolean;
 }
 
 /** Contextual information passed alongside a permission check for policy decisions. */

package/src/permissions/workspace-policy.ts

@@ -68,11 +68,6 @@ const HOST_TOOLS = new Set([
   "computer_use_run_applescript",
 ]);
 
-/** Check whether a tool name is a host-level tool. */
-export function isHostTool(toolName: string): boolean {
-  return HOST_TOOLS.has(toolName);
-}
-
 /** Safe local-only tools that are always workspace-scoped. */
 const ALWAYS_SCOPED_TOOLS = new Set([
   "skill_load",

package/src/platform/sync-identity.ts

@@ -119,11 +119,3 @@ function clearRequestedIfLatest(requestSeq: number): void {
     lastRequestedName = lastSyncedName;
   }
 }
-
-/** Reset cached state (for testing). */
-export function _resetSyncState(): void {
-  lastSyncedName = null;
-  lastRequestedName = null;
-  seq = 0;
-  pending = Promise.resolve();
-}