@vellumai/vellum-gateway 0.12.3 → 0.12.4-staging.2

package/ARCHITECTURE.md

@@ -469,11 +469,11 @@ The inbound message handler (`inbound-message-handler.ts`) accepts verification
 
 #### Explicit Rebind Policy
 
-Creating a new guardian challenge when a binding already exists for the `(assistantId, channel)` pair requires explicit `rebind: true` in the HTTP request. Without it, the daemon returns `already_bound` to the caller. This prevents accidental guardian replacement -- the desktop UI must explicitly acknowledge that it is replacing an existing guardian before a new challenge is issued. On the verification side, `validateAndConsumeVerification` always revokes any existing active binding before creating the new one, so the actual binding swap is atomic.
+Creating a new guardian challenge when a binding already exists for the `(assistantId, channel)` pair requires explicit `rebind: true` in the HTTP request. Without it, the daemon returns `already_bound` to the caller. This prevents accidental guardian replacement -- the desktop UI must explicitly acknowledge that it is replacing an existing guardian before a new challenge is issued. Minting is all it permits on a text channel: a code never swaps the guardian's linked identity when it is redeemed (see below), so changing it means revoking the existing binding and then verifying again. An outbound phone verification is the exception: it is guardian-initiated by design, and its code replaces the bound number (`applyPhoneGuardianBindingGatewayWrites` in `gateway/src/verification/session-service.ts`).
 
 #### Guardian Takeover Prevention
 
-`validateAndConsumeVerification` rejects verification when an active binding exists for a _different_ external user. This prevents an attacker who intercepts a verification code from hijacking an established guardian binding. Same-user re-verification (e.g., re-verifying after a session timeout) is allowed, since the external user ID matches the existing binding.
+Text-channel redemption (`applyGuardianSideEffects` in `gateway/src/verification/text-verification.ts`) rejects a guardian code when any active guardian binding on the channel belongs to a _different_ external user: the code is spent, the sender is told it was invalid or expired, and they are made neither guardian nor contact. This prevents an attacker who intercepts a verification code from hijacking an established guardian binding. Same-user re-verification (e.g., re-verifying after a session timeout) is allowed, since the external user ID matches the existing binding. A guardian who revoked their binding can verify the same account again: their own revoked row is reactivated when it belongs to the guardian contact, its stored address is exactly the redeeming one, and no other identity is linked on the channel. A revoked row that belonged to any other contact stays revoked. A blocked row is never reactivated.
 
 #### Guardian Verification Flow
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/vellum-gateway",
-  "version": "0.12.3",
+  "version": "0.12.4-staging.2",
   "license": "MIT",
   "type": "module",
   "exports": {

package/src/__tests__/text-verification-guardian-conflict.test.ts

@@ -0,0 +1,405 @@
+/**
+ * The guardian is one person, and a channel holds at most one linked identity
+ * for them. On a text channel a guardian code never swaps that identity for
+ * another, and a guardian who removed their identity can link the same one
+ * again.
+ *
+ * The gateway DB and session store are real; the assistant mirror IPC is
+ * acknowledged and otherwise inert.
+ */
+
+import {
+  afterAll,
+  beforeAll,
+  beforeEach,
+  describe,
+  expect,
+  mock,
+  test,
+} from "bun:test";
+
+import { hashVerificationSecret } from "@vellumai/gateway-client";
+
+/** The daemon's answer to every IPC call; a test swaps it to fail. */
+let ipcCallAssistantImpl: () => Promise<unknown> = async () => ({});
+
+// Spread the actual module so untouched exports stay importable by
+// later-loaded files when suites share a bun process.
+const actualAssistantClient = await import("../ipc/assistant-client.js");
+mock.module("../ipc/assistant-client.js", () => ({
+  ...actualAssistantClient,
+  ipcCallAssistant: () => ipcCallAssistantImpl(),
+}));
+
+await import("./test-preload.js");
+const { getGatewayDb, initGatewayDb, resetGatewayDb } =
+  await import("../db/connection.js");
+const { channelVerificationSessions, contactChannels, contacts } =
+  await import("../db/schema.js");
+const { createInboundSession, createOutboundSession, getSessionById } =
+  await import("../db/session-store.js");
+const { tryTextVerificationIntercept } =
+  await import("../verification/text-verification.js");
+
+const CHANNEL = "slack";
+const OLD_ACCOUNT = "U0OLD00001";
+const NEW_ACCOUNT = "U0NEW00002";
+const OTHER_ACCOUNT = "U0OTHER003";
+const CODE = "123456";
+const GUARDIAN_PRINCIPAL = "principal-guardian";
+const INVALID_OR_EXPIRED = "The verification code is invalid or has expired.";
+
+type ChannelStatus = "active" | "revoked" | "blocked";
+
+function seedContact(id: string, role: "guardian" | "contact"): void {
+  const now = Date.now();
+  getGatewayDb()
+    .insert(contacts)
+    .values({
+      id,
+      displayName: id,
+      role,
+      principalId: role === "guardian" ? GUARDIAN_PRINCIPAL : null,
+      createdAt: now,
+      updatedAt: now,
+    })
+    .run();
+}
+
+function seedChannel(row: {
+  id: string;
+  contactId: string;
+  type: string;
+  address: string;
+  status: ChannelStatus;
+}): void {
+  getGatewayDb()
+    .insert(contactChannels)
+    .values({
+      ...row,
+      externalChatId: row.address,
+      policy: row.status === "active" ? "allow" : "deny",
+      interactionCount: 0,
+      createdAt: Date.now(),
+    })
+    .run();
+}
+
+/** The guardian's own row on the channel, in the given state. */
+function seedGuardianAccount(
+  address: string,
+  status: ChannelStatus = "active",
+): void {
+  seedChannel({
+    id: `guardian-${address}`,
+    contactId: "guardian",
+    type: CHANNEL,
+    address,
+    status,
+  });
+}
+
+function channelOf(address: string) {
+  return getGatewayDb()
+    .select()
+    .from(contactChannels)
+    .all()
+    .find((c) => c.type === CHANNEL && c.address === address);
+}
+
+function activeGuardianAccounts(): string[] {
+  return getGatewayDb()
+    .select()
+    .from(contactChannels)
+    .all()
+    .filter(
+      (c) =>
+        c.type === CHANNEL &&
+        c.contactId === "guardian" &&
+        c.status === "active",
+    )
+    .map((c) => c.address)
+    .sort();
+}
+
+/** A guardian code bound to an account. */
+function mintCodeFor(
+  account: string,
+  session: { id: string; code: string } = { id: "session-1", code: CODE },
+): void {
+  createOutboundSession({
+    id: session.id,
+    channel: CHANNEL,
+    challengeHash: hashVerificationSecret(session.code),
+    expiresAt: Date.now() + 10 * 60 * 1000,
+    status: "awaiting_response",
+    expectedExternalUserId: account,
+    identityBindingStatus: "bound",
+    destinationAddress: account,
+    verificationPurpose: "guardian",
+  });
+}
+
+function redeem(code: string, from: string) {
+  // No callback URL: the reply comes back as text, as it does for email.
+  return tryTextVerificationIntercept({
+    sourceChannel: CHANNEL,
+    messageContent: code,
+    actorExternalUserId: from,
+    actorChatId: from,
+    isDirectMessage: true,
+  });
+}
+
+function expectRefused(result: Awaited<ReturnType<typeof redeem>>): void {
+  expect(result).toMatchObject({
+    intercepted: true,
+    outcome: "failed",
+    pendingReplyText: expect.stringContaining(INVALID_OR_EXPIRED),
+  });
+  // The code matched and is spent, so it cannot be tried again.
+  expect(getSessionById("session-1")?.status).toBe("consumed");
+}
+
+beforeAll(async () => {
+  await initGatewayDb();
+});
+
+beforeEach(() => {
+  ipcCallAssistantImpl = async () => ({});
+  getGatewayDb().delete(channelVerificationSessions).run();
+  getGatewayDb().delete(contactChannels).run();
+  getGatewayDb().delete(contacts).run();
+  seedContact("guardian", "guardian");
+  seedChannel({
+    id: "guardian-vellum",
+    contactId: "guardian",
+    type: "vellum",
+    address: GUARDIAN_PRINCIPAL,
+    status: "active",
+  });
+});
+
+afterAll(() => {
+  resetGatewayDb();
+});
+
+describe("a guardian code from an identity other than the one linked on the channel", () => {
+  beforeEach(() => {
+    seedGuardianAccount(OLD_ACCOUNT);
+  });
+
+  test("is refused, and the sender becomes neither guardian nor contact", async () => {
+    mintCodeFor(NEW_ACCOUNT);
+
+    expectRefused(await redeem(CODE, NEW_ACCOUNT));
+
+    expect(activeGuardianAccounts()).toEqual([OLD_ACCOUNT]);
+    expect(channelOf(NEW_ACCOUNT)).toBeUndefined();
+  });
+
+  test("is refused when it is an inbound challenge too", async () => {
+    const secret = "a".repeat(64);
+    createInboundSession({
+      id: "session-1",
+      channel: CHANNEL,
+      challengeHash: hashVerificationSecret(secret),
+      expiresAt: Date.now() + 10 * 60 * 1000,
+    });
+
+    expectRefused(await redeem(secret, NEW_ACCOUNT));
+
+    expect(activeGuardianAccounts()).toEqual([OLD_ACCOUNT]);
+    expect(channelOf(NEW_ACCOUNT)).toBeUndefined();
+  });
+
+  test("is refused even when the sender holds a second active guardian row", async () => {
+    // Two active guardian rows is not a state the product creates, and it is
+    // the one where reading a single row could pick the sender's own and
+    // then revoke the other.
+    seedGuardianAccount(OTHER_ACCOUNT);
+    mintCodeFor(OTHER_ACCOUNT);
+
+    expectRefused(await redeem(CODE, OTHER_ACCOUNT));
+
+    expect(activeGuardianAccounts()).toEqual([OLD_ACCOUNT, OTHER_ACCOUNT]);
+  });
+
+  test("leaves the sender's own revoked row revoked while another identity is linked", async () => {
+    seedContact("former", "contact");
+    seedChannel({
+      id: "former-channel",
+      contactId: "former",
+      type: CHANNEL,
+      address: NEW_ACCOUNT,
+      status: "revoked",
+    });
+    mintCodeFor(NEW_ACCOUNT);
+
+    expectRefused(await redeem(CODE, NEW_ACCOUNT));
+
+    expect(activeGuardianAccounts()).toEqual([OLD_ACCOUNT]);
+    expect(channelOf(NEW_ACCOUNT)?.status).toBe("revoked");
+  });
+
+  test("refuses without the daemon when another identity is linked", async () => {
+    ipcCallAssistantImpl = async () => {
+      throw new Error("assistant unreachable");
+    };
+    mintCodeFor(NEW_ACCOUNT);
+
+    expectRefused(await redeem(CODE, NEW_ACCOUNT));
+
+    expect(activeGuardianAccounts()).toEqual([OLD_ACCOUNT]);
+  });
+
+  test("still lets the current guardian verify their own account again", async () => {
+    mintCodeFor(OLD_ACCOUNT);
+
+    expect(await redeem(CODE, OLD_ACCOUNT)).toMatchObject({
+      outcome: "verified",
+      trustClass: "guardian",
+    });
+    expect(activeGuardianAccounts()).toEqual([OLD_ACCOUNT]);
+  });
+});
+
+describe("a guardian code on a channel with no linked identity", () => {
+  test("binds a new account", async () => {
+    mintCodeFor(NEW_ACCOUNT);
+
+    expect(await redeem(CODE, NEW_ACCOUNT)).toMatchObject({
+      outcome: "verified",
+      trustClass: "guardian",
+    });
+    expect(activeGuardianAccounts()).toEqual([NEW_ACCOUNT]);
+  });
+
+  test("links only one identity when two codes are redeemed at once", async () => {
+    // Both redemptions are in flight before either binds. The second to
+    // reach the refusal check has to see the first one's binding.
+    mintCodeFor(NEW_ACCOUNT, { id: "session-1", code: "111111" });
+    mintCodeFor(OTHER_ACCOUNT, { id: "session-2", code: "222222" });
+
+    const results = await Promise.all([
+      redeem("111111", NEW_ACCOUNT),
+      redeem("222222", OTHER_ACCOUNT),
+    ]);
+
+    expect(
+      results
+        .map((r) => (r.intercepted ? r.outcome : "not intercepted"))
+        .sort(),
+    ).toEqual(["failed", "verified"]);
+    expect(activeGuardianAccounts()).toHaveLength(1);
+  });
+
+  test("binds with the name the channel gave when the daemon cannot answer", async () => {
+    ipcCallAssistantImpl = async () => {
+      throw new Error("assistant unreachable");
+    };
+    mintCodeFor(NEW_ACCOUNT);
+
+    expect(await redeem(CODE, NEW_ACCOUNT)).toMatchObject({
+      outcome: "verified",
+      trustClass: "guardian",
+    });
+    expect(activeGuardianAccounts()).toEqual([NEW_ACCOUNT]);
+  });
+
+  test("reconnects the account the guardian removed", async () => {
+    seedGuardianAccount(OLD_ACCOUNT, "revoked");
+    mintCodeFor(OLD_ACCOUNT);
+
+    expect(await redeem(CODE, OLD_ACCOUNT)).toMatchObject({
+      outcome: "verified",
+      trustClass: "guardian",
+    });
+    expect(activeGuardianAccounts()).toEqual([OLD_ACCOUNT]);
+  });
+
+  describe("from an address whose revoked row belonged to a contact, not the guardian", () => {
+    // Nothing else refuses here: no identity is linked, the row is revoked
+    // (not blocked) and its address matches exactly. Only the owner of the
+    // row separates this sender from the guardian reconnecting.
+    beforeEach(() => {
+      seedContact("former", "contact");
+      seedChannel({
+        id: "former-channel",
+        contactId: "former",
+        type: CHANNEL,
+        address: NEW_ACCOUNT,
+        status: "revoked",
+      });
+    });
+
+    function expectStillARevokedContact(): void {
+      expect(activeGuardianAccounts()).toEqual([]);
+      expect(channelOf(NEW_ACCOUNT)).toMatchObject({
+        contactId: "former",
+        status: "revoked",
+      });
+    }
+
+    test("a code bound to that address is refused", async () => {
+      mintCodeFor(NEW_ACCOUNT);
+
+      expectRefused(await redeem(CODE, NEW_ACCOUNT));
+
+      expectStillARevokedContact();
+    });
+
+    test("an inbound challenge, which is bound to no identity, is refused", async () => {
+      const secret = "b".repeat(64);
+      createInboundSession({
+        id: "session-1",
+        channel: CHANNEL,
+        challengeHash: hashVerificationSecret(secret),
+        expiresAt: Date.now() + 10 * 60 * 1000,
+      });
+
+      expectRefused(await redeem(secret, NEW_ACCOUNT));
+
+      expectStillARevokedContact();
+    });
+  });
+
+  test("connects a new account after the old one was removed", async () => {
+    seedGuardianAccount(OLD_ACCOUNT, "revoked");
+    mintCodeFor(NEW_ACCOUNT);
+
+    expect(await redeem(CODE, NEW_ACCOUNT)).toMatchObject({
+      outcome: "verified",
+    });
+    expect(activeGuardianAccounts()).toEqual([NEW_ACCOUNT]);
+  });
+
+  test("does not reconnect a revoked row stored under a different spelling of the address", async () => {
+    // The row is found case-insensitively, and reactivated only when its
+    // stored address is exactly the redeeming one.
+    seedGuardianAccount(OLD_ACCOUNT.toLowerCase(), "revoked");
+    mintCodeFor(OLD_ACCOUNT);
+
+    expectRefused(await redeem(CODE, OLD_ACCOUNT));
+
+    expect(activeGuardianAccounts()).toEqual([]);
+    expect(channelOf(OLD_ACCOUNT.toLowerCase())?.status).toBe("revoked");
+  });
+
+  test("never binds a blocked account", async () => {
+    seedContact("blocked", "contact");
+    seedChannel({
+      id: "blocked-channel",
+      contactId: "blocked",
+      type: CHANNEL,
+      address: NEW_ACCOUNT,
+      status: "blocked",
+    });
+    mintCodeFor(NEW_ACCOUNT);
+
+    expectRefused(await redeem(CODE, NEW_ACCOUNT));
+
+    expect(activeGuardianAccounts()).toEqual([]);
+    expect(channelOf(NEW_ACCOUNT)?.status).toBe("blocked");
+  });
+});

package/src/feature-flag-registry.json

@@ -170,14 +170,6 @@
       "description": "Enable Anthropic fast mode for Opus models (4.6, 4.7, 4.8), delivering up to 2.5x higher output tokens per second at premium pricing",
       "defaultEnabled": false
     },
-    {
-      "id": "teleport",
-      "scope": "client",
-      "key": "teleport",
-      "label": "Teleport",
-      "description": "Enable the local-to-platform teleport UI in General settings. Platform-to-local teleport is GA and not gated by this flag",
-      "defaultEnabled": false
-    },
     {
       "id": "apple-container",
       "scope": "client",
@@ -559,6 +551,14 @@
       "label": "Assistant Inbox",
       "description": "Shows an Assistant Inbox entry above Preferences in the web sidebar and the /assistant/inbox page it opens: a mailbox for the assistant's managed vellum.me address (received and sent, with a reading pane), the inline email setup card for entitled orgs with no address yet, and an upgrade card for orgs without the managed_email entitlement. Off hides the entry and redirects the route to chat.",
       "defaultEnabled": false
+    },
+    {
+      "id": "sidebar-done",
+      "scope": "both",
+      "key": "sidebar-done",
+      "label": "Sidebar Done",
+      "description": "Turns archiving a chat into marking it done: the sidebar row carries a Done check instead of the overflow menu, an Old chats page lists the full history, and done chats stay findable in search by default. Off keeps today's Archive wording, the overflow menu, and search that hides archived rows unless the query asks for them.",
+      "defaultEnabled": false
     }
   ]
 }

package/src/ipc/risk-classification-handlers.test.ts

@@ -351,7 +351,7 @@ describe("file classification", () => {
     expect(result.reason).toContain("tools");
   });
 
-  test("file_write to routes dir is high risk", async () => {
+  test("file_write to routes dir is medium risk", async () => {
     const result = await classify({
       tool: "file_write",
       path: "/workspace/routes/evil.ts",
@@ -366,7 +366,7 @@ describe("file classification", () => {
         skillSourceDirs: ["/workspace/.vellum/skills"],
       },
     });
-    expect(result.risk).toBe("high");
+    expect(result.risk).toBe("medium");
     expect(result.reason).toContain("routes");
   });
 

package/src/risk/file-risk-classifier.test.ts

@@ -246,21 +246,21 @@ describe("FileRiskClassifier", () => {
       expect(result.reason).toBe("Writes to hooks directory");
     });
 
-    // Plugins directory escalation. The external plugin loader auto-imports
-    // register.{ts,js} on daemon startup, so a routine file_write here could
-    // plant persistent code execution.
-    test("plugins directory itself is high", async () => {
+    // Plugins and routes are app authoring sinks: a sandbox file write there is
+    // Medium, which auto-approves at the default threshold while building apps
+    // and still prompts at a stricter one.
+    test("plugins directory itself is medium", async () => {
       testSkillSourceDirs = [];
       const result = await classifyInput({
         toolName: "file_write",
         filePath: MOCK_PLUGINS_DIR,
         workingDir: "/",
       });
-      expect(result.riskLevel).toBe("high");
+      expect(result.riskLevel).toBe("medium");
       expect(result.reason).toBe("Writes to plugins directory");
     });
 
-    test("register.ts inside plugins directory is high", async () => {
+    test("register.ts inside plugins directory is medium", async () => {
       testSkillSourceDirs = [];
       const registerFile = join(MOCK_PLUGINS_DIR, "evil-plugin", "register.ts");
       const result = await classifyInput({
@@ -268,11 +268,11 @@ describe("FileRiskClassifier", () => {
         filePath: registerFile,
         workingDir: "/",
       });
-      expect(result.riskLevel).toBe("high");
+      expect(result.riskLevel).toBe("medium");
       expect(result.reason).toBe("Writes to plugins directory");
     });
 
-    test("package.json inside plugins directory is high", async () => {
+    test("package.json inside plugins directory is medium", async () => {
       testSkillSourceDirs = [];
       const pkgFile = join(MOCK_PLUGINS_DIR, "evil-plugin", "package.json");
       const result = await classifyInput({
@@ -280,7 +280,7 @@ describe("FileRiskClassifier", () => {
         filePath: pkgFile,
         workingDir: "/",
       });
-      expect(result.riskLevel).toBe("high");
+      expect(result.riskLevel).toBe("medium");
       expect(result.reason).toBe("Writes to plugins directory");
     });
 
@@ -343,20 +343,18 @@ describe("FileRiskClassifier", () => {
       expect(result.riskLevel).toBe("low");
     });
 
-    // Routes directory escalation. The user-route dispatcher dynamic-imports
-    // handler modules here and executes their exported HTTP-method functions.
-    test("routes directory itself is high", async () => {
+    test("routes directory itself is medium", async () => {
       testSkillSourceDirs = [];
       const result = await classifyInput({
         toolName: "file_write",
         filePath: MOCK_ROUTES_DIR,
         workingDir: "/",
       });
-      expect(result.riskLevel).toBe("high");
+      expect(result.riskLevel).toBe("medium");
       expect(result.reason).toBe("Writes to routes directory");
     });
 
-    test("handler inside routes directory is high", async () => {
+    test("handler inside routes directory is medium", async () => {
       testSkillSourceDirs = [];
       const routeFile = join(MOCK_ROUTES_DIR, "evil.ts");
       const result = await classifyInput({
@@ -364,7 +362,7 @@ describe("FileRiskClassifier", () => {
         filePath: routeFile,
         workingDir: "/",
       });
-      expect(result.riskLevel).toBe("high");
+      expect(result.riskLevel).toBe("medium");
       expect(result.reason).toBe("Writes to routes directory");
     });
 
@@ -437,14 +435,14 @@ describe("FileRiskClassifier", () => {
       expect(result.reason).toBe("Writes to tools directory");
     });
 
-    test("/workspace-prefixed routes path is remapped and high", async () => {
+    test("/workspace-prefixed routes path is remapped and medium", async () => {
       testSkillSourceDirs = [];
       const result = await classifyInput({
         toolName: "file_write",
         filePath: "/workspace/routes/evil.ts",
         workingDir: MOCK_WORKSPACE_DIR,
       });
-      expect(result.riskLevel).toBe("high");
+      expect(result.riskLevel).toBe("medium");
       expect(result.reason).toBe("Writes to routes directory");
     });
 
@@ -546,7 +544,7 @@ describe("FileRiskClassifier", () => {
       expect(result.reason).toBe("Writes to hooks directory");
     });
 
-    test("plugins directory path is high", async () => {
+    test("plugins directory path is medium", async () => {
       testSkillSourceDirs = [];
       const registerFile = join(MOCK_PLUGINS_DIR, "evil-plugin", "register.ts");
       const result = await classifyInput({
@@ -554,7 +552,7 @@ describe("FileRiskClassifier", () => {
         filePath: registerFile,
         workingDir: "/",
       });
-      expect(result.riskLevel).toBe("high");
+      expect(result.riskLevel).toBe("medium");
       expect(result.reason).toBe("Writes to plugins directory");
     });
 
@@ -570,7 +568,7 @@ describe("FileRiskClassifier", () => {
       expect(result.reason).toBe("Writes to tools directory");
     });
 
-    test("routes directory path is high", async () => {
+    test("routes directory path is medium", async () => {
       testSkillSourceDirs = [];
       const routeFile = join(MOCK_ROUTES_DIR, "evil.ts");
       const result = await classifyInput({
@@ -578,9 +576,20 @@ describe("FileRiskClassifier", () => {
         filePath: routeFile,
         workingDir: "/",
       });
-      expect(result.riskLevel).toBe("high");
+      expect(result.riskLevel).toBe("medium");
       expect(result.reason).toBe("Writes to routes directory");
     });
+
+    test("/workspace-prefixed plugin app source is remapped and medium", async () => {
+      testSkillSourceDirs = [];
+      const result = await classifyInput({
+        toolName: "file_edit",
+        filePath: "/workspace/plugins/my-plugin/apps/tracker/src/App.tsx",
+        workingDir: MOCK_WORKSPACE_DIR,
+      });
+      expect(result.riskLevel).toBe("medium");
+      expect(result.reason).toBe("Writes to plugins directory");
+    });
   });
 
   // -- host_file_read ---------------------------------------------------------
@@ -964,10 +973,36 @@ describe("FileRiskClassifier", () => {
         workingDir: WORKING_DIR,
         resolvedPath: join(MOCK_PLUGINS_DIR, "evil-plugin", "register.ts"),
       });
-      expect(result.riskLevel).toBe("high");
+      expect(result.riskLevel).toBe("medium");
       expect(result.reason).toBe("Writes to plugins directory");
     });
 
+    // An app authoring sink on one side must not mask a High sink on the
+    // other: the higher-risk match wins.
+    test("file_write through a plugins-dir symlink into hooks is high", async () => {
+      testSkillSourceDirs = [];
+      const result = await classifyInput({
+        toolName: "file_write",
+        filePath: join(MOCK_PLUGINS_DIR, "my-plugin", "link.ts"),
+        workingDir: "/",
+        resolvedPath: join(MOCK_HOOKS_DIR, "pre-tool-use.sh"),
+      });
+      expect(result.riskLevel).toBe("high");
+      expect(result.reason).toBe("Writes to hooks directory");
+    });
+
+    test("file_edit through a hooks-dir symlink into plugins is high", async () => {
+      testSkillSourceDirs = [];
+      const result = await classifyInput({
+        toolName: "file_edit",
+        filePath: join(MOCK_HOOKS_DIR, "pre-tool-use.sh"),
+        workingDir: "/",
+        resolvedPath: join(MOCK_PLUGINS_DIR, "my-plugin", "register.ts"),
+      });
+      expect(result.riskLevel).toBe("high");
+      expect(result.reason).toBe("Writes to hooks directory");
+    });
+
     test("file_edit escalates when resolvedPath lands in skill source", async () => {
       const skillDir = "/home/user/skills/victim-skill";
       testSkillSourceDirs = [skillDir];
@@ -1133,12 +1168,12 @@ describe("FileRiskClassifier", () => {
       testSkillSourceDirs = [];
       const result = await classifyInput({
         toolName: "file_write",
-        filePath: join(MOCK_PLUGINS_DIR, "evil", "register.ts"),
-        resolvedPath: join(MOCK_PLUGINS_DIR, "evil", "register.ts"),
+        filePath: join(MOCK_HOOKS_DIR, "pre-tool-use.sh"),
+        resolvedPath: join(MOCK_HOOKS_DIR, "pre-tool-use.sh"),
         resolvedWorkingDir: WORKING_DIR,
       });
       expect(result.riskLevel).toBe("high");
-      expect(result.reason).toBe("Writes to plugins directory");
+      expect(result.reason).toBe("Writes to hooks directory");
     });
 
     test("in-workspace symlink whose real target escapes is medium", async () => {

package/src/risk/file-risk-classifier.ts

@@ -11,11 +11,11 @@
  *   targeting the actor token signing key or the monitoring data directory
  *   (snapshot files may contain secrets).
  * - file_write / file_edit: Low by default, Medium when the target resolves
- *   outside the sandbox working directory on a non-containerized install,
- *   High if targeting skill source code, the workspace hooks directory, the
- *   user plugins directory, the workspace tools directory, the workspace
- *   routes directory, the workspace workflows directory, or the monitoring
- *   data directory.
+ *   outside the sandbox working directory on a non-containerized install or
+ *   lands in an app authoring sink (the user plugins directory or the
+ *   workspace routes directory), High if targeting skill source code, the
+ *   workspace hooks directory, the workspace tools directory, the workspace
+ *   workflows directory, or the monitoring data directory.
  * - host_file_read: Medium (tool registry default; no special escalation).
  * - host_file_write / host_file_edit: Medium by default, High if targeting
  *   skill source code, the workspace hooks directory, the user plugins
@@ -28,19 +28,28 @@
  *   routes directory, the workspace workflows directory, or the monitoring
  *   data directory.
  *
- * The tools and routes directories are escalated for the same reason as
- * plugins: any file written under `<workspace>/tools/` is dynamic-imported
- * and executed as a registered tool by the workspace-tool loader (and its
- * live file watcher), and any file under `<workspace>/routes/` is
- * dynamic-imported and executed as an HTTP route handler. A write to either
- * is a code-injection sink, so it must clear the same High-risk approval gate
- * as hooks and plugins.
+ * The tools and routes directories are code-injection sinks for the same
+ * reason as plugins: any file written under `<workspace>/tools/` is
+ * dynamic-imported and executed as a registered tool by the workspace-tool
+ * loader (and its live file watcher), and any file under `<workspace>/routes/`
+ * is dynamic-imported and executed as an HTTP route handler.
  *
  * The workflows directory is escalated for the same reason: any file under
  * `<workspace>/workflows/` is a saved workflow whose source is executed (in the
  * sandbox, and unattended when triggered by a schedule), so it must clear the
  * same High-risk gate.
  *
+ * The plugins and routes directories are where apps are built: a plugin
+ * bundles its apps and their backing routes, and a workspace app's backend
+ * lives under `<workspace>/routes/`. Building and iterating on an app writes
+ * them on every turn, so a sandbox file write there classifies Medium: it
+ * auto-approves at the default threshold and still prompts at a stricter one.
+ * The same write through bash (`cat >`, `tee`, `sed -i`) classifies Medium or
+ * lower, so High on the file tools would gate only the well-behaved path.
+ * Host file tools keep High for every sink, and non-guardian actors stay on
+ * the assistant's capability floor for all of them
+ * (`isControlPlaneWorkspaceWrite`).
+ *
  * Gateway adaptation: accepts a FileClassificationContext parameter instead
  * of importing assistant platform utilities directly. The assistant is
  * responsible for constructing the context from its config/platform modules
@@ -458,12 +467,19 @@ function buildFileAllowlistOptions(
   return options;
 }
 
+/**
+ * Which file tools are writing: the sandbox file tools (`file_write`,
+ * `file_edit`) or the host file tools (`host_file_write`, `host_file_edit`,
+ * `host_file_transfer`). Sets the level of an app authoring sink.
+ */
+type SinkLane = "sandbox" | "host";
+
 /**
  * Classify a resolved (absolute) path against the code-injection sink
- * directories: skill source, hooks, plugins, tools, routes, and workflows. A
- * write to any of these plants code the daemon later executes, so it must clear
- * the High-risk approval gate. Returns a High assessment when the path lands in
- * a sink, or `null` when it doesn't.
+ * directories: skill source, hooks, plugins, tools, routes, workflows, and
+ * monitoring. A write to any of these plants code the daemon later executes.
+ * Every sink is High except the app authoring sinks (plugins and routes) in the
+ * sandbox lane, which are Medium. Returns `null` when the path lands in no sink.
  *
  * `verb` distinguishes the user-facing reason: "Writes" for write/edit tools,
  * "Transfers" for host_file_transfer.
@@ -472,33 +488,49 @@ function classifyCodeInjectionSink(
   resolvedPath: string,
   context: FileClassificationContext,
   verb: "Writes" | "Transfers",
+  lane: SinkLane,
   allowlistOptions: AllowlistOption[],
 ): RiskAssessment | null {
-  const high = (target: string): RiskAssessment => ({
-    riskLevel: "high",
+  const sink = (
+    target: string,
+    riskLevel: "medium" | "high" = "high",
+  ): RiskAssessment => ({
+    riskLevel,
     reason: `${verb} to ${target}`,
     scopeOptions: [],
     matchType: "registry",
     allowlistOptions,
   });
-  if (isSkillSourcePath(resolvedPath, context))
-    return high("skill source code");
-  if (isHooksPath(resolvedPath, context)) return high("hooks directory");
-  if (isPluginsPath(resolvedPath, context)) return high("plugins directory");
-  if (isToolsPath(resolvedPath, context)) return high("tools directory");
-  if (isRoutesPath(resolvedPath, context)) return high("routes directory");
-  if (isWorkflowsPath(resolvedPath, context))
-    return high("workflows directory");
-  if (isMonitoringPath(resolvedPath, context))
-    return high("monitoring directory");
+  const appAuthoringRisk = lane === "sandbox" ? "medium" : "high";
+  if (isSkillSourcePath(resolvedPath, context)) {
+    return sink("skill source code");
+  }
+  if (isHooksPath(resolvedPath, context)) {
+    return sink("hooks directory");
+  }
+  if (isPluginsPath(resolvedPath, context)) {
+    return sink("plugins directory", appAuthoringRisk);
+  }
+  if (isToolsPath(resolvedPath, context)) {
+    return sink("tools directory");
+  }
+  if (isRoutesPath(resolvedPath, context)) {
+    return sink("routes directory", appAuthoringRisk);
+  }
+  if (isWorkflowsPath(resolvedPath, context)) {
+    return sink("workflows directory");
+  }
+  if (isMonitoringPath(resolvedPath, context)) {
+    return sink("monitoring directory");
+  }
   return null;
 }
 
 /**
  * Run {@link classifyCodeInjectionSink} against both the lexical and the
- * symlink-resolved path, escalating if EITHER lands in a sink. A symlink can
- * mask a protected target two ways — a benign name pointing into a protected
- * dir (caught by the real path), or a path lexically inside a protected dir
+ * symlink-resolved path, returning the higher-risk match. A symlink can mask a
+ * protected target two ways: a benign name pointing into a protected dir
+ * (caught by the real path), or a path lexically inside a protected dir
  * pointing elsewhere, where the loader still executes the file through the
  * protected location (caught by the lexical path). When the two paths are
  * equal the check runs once.
@@ -508,17 +540,30 @@ function classifyCodeInjectionSinkEither(
   realPath: string,
   context: FileClassificationContext,
   verb: "Writes" | "Transfers",
+  lane: SinkLane,
   allowlistOptions: AllowlistOption[],
 ): RiskAssessment | null {
   const lexicalSink = classifyCodeInjectionSink(
     lexicalPath,
     context,
     verb,
+    lane,
     allowlistOptions,
   );
-  if (lexicalSink) return lexicalSink;
-  if (realPath === lexicalPath) return null;
-  return classifyCodeInjectionSink(realPath, context, verb, allowlistOptions);
+  if (realPath === lexicalPath) {
+    return lexicalSink;
+  }
+  const realSink = classifyCodeInjectionSink(
+    realPath,
+    context,
+    verb,
+    lane,
+    allowlistOptions,
+  );
+  if (!realSink || lexicalSink?.riskLevel === "high") {
+    return lexicalSink;
+  }
+  return realSink;
 }
 
 // -- Classifier ---------------------------------------------------------------
@@ -528,7 +573,7 @@ function classifyCodeInjectionSinkEither(
  *
  * Classifies all seven file tool types by risk level, with escalation paths
  * for the code-injection sinks (skill source, hooks, plugins, tools, routes,
- * and workflows) and the actor token signing key.
+ * workflows, and monitoring) and the actor token signing key.
  *
  * Unlike the assistant version, this classifier accepts a
  * FileClassificationContext parameter on classify() instead of importing
@@ -634,6 +679,7 @@ export class FileRiskClassifier implements RiskClassifier<
             realPath,
             context,
             "Writes",
+            "sandbox",
             allowlistOptions,
           );
           if (sink) {
@@ -701,6 +747,7 @@ export class FileRiskClassifier implements RiskClassifier<
             realDest,
             context,
             "Transfers",
+            "host",
             allowlistOptions,
           );
           if (destSink) {
@@ -720,6 +767,7 @@ export class FileRiskClassifier implements RiskClassifier<
             realPath,
             context,
             actionVerb,
+            "host",
             allowlistOptions,
           );
           if (sink) {

package/src/verification/binding-helpers.ts

@@ -47,6 +47,31 @@ export function getExistingGuardianBinding(
   return row ? { address: row.address } : null;
 }
 
+/**
+ * Every address actively linked as the guardian's identity on a channel. The
+ * guardian is one person with at most one identity per channel, so this is
+ * normally zero or one address; a caller refusing to swap that identity reads
+ * them all.
+ */
+export function activeGuardianAddresses(channel: string): string[] {
+  return getGatewayDb()
+    .select({ address: gwContactChannels.address })
+    .from(gwContacts)
+    .innerJoin(
+      gwContactChannels,
+      eq(gwContactChannels.contactId, gwContacts.id),
+    )
+    .where(
+      and(
+        eq(gwContacts.role, "guardian"),
+        eq(gwContactChannels.type, channel),
+        eq(gwContactChannels.status, "active"),
+      ),
+    )
+    .all()
+    .map((row) => row.address);
+}
+
 /**
  * Return the most recent `contact_channels.updated_at` across any guardian
  * binding for a channel — active OR revoked. Returns `null` when no binding

package/src/verification/contact-helpers.ts

@@ -370,9 +370,31 @@ export function gatewayChannelStatus(
   type: string,
   address: string,
 ): string | null {
+  return gatewayChannelRow(type, address)?.status ?? null;
+}
+
+/**
+ * The authoritative gateway row behind {@link gatewayChannelStatus}, with the
+ * address as stored, for a caller that has to compare it exactly, and the
+ * role of the contact that owns it, for a caller that has to know whether the
+ * row is the guardian's.
+ *
+ * A left join: the status is reported for the row whatever its contact, so a
+ * blocked row reads as blocked even if its owner cannot be found, and such a
+ * row carries a null role, which is not the guardian's.
+ */
+export function gatewayChannelRow(
+  type: string,
+  address: string,
+): { status: string; address: string; contactRole: string | null } | null {
   const row = getGatewayDb()
-    .select({ status: gwContactChannels.status })
+    .select({
+      status: gwContactChannels.status,
+      address: gwContactChannels.address,
+      contactRole: gwContacts.role,
+    })
     .from(gwContactChannels)
+    .leftJoin(gwContacts, eq(gwContactChannels.contactId, gwContacts.id))
     .where(
       and(
         eq(gwContactChannels.type, type),
@@ -380,7 +402,7 @@ export function gatewayChannelStatus(
       ),
     )
     .get();
-  return row?.status ?? null;
+  return row ?? null;
 }
 
 export interface VerifiedChannelRow {

package/src/verification/text-verification.ts

@@ -26,7 +26,7 @@ import {
 import { getLogger } from "../logger.js";
 
 import {
-  getExistingGuardianBinding,
+  activeGuardianAddresses,
   resolveCanonicalPrincipal,
   revokeExistingChannelGuardian,
 } from "./binding-helpers.js";
@@ -37,7 +37,7 @@ import {
 } from "./code-parsing.js";
 import {
   findContactChannelByAddress,
-  gatewayChannelStatus,
+  gatewayChannelRow,
   upsertVerifiedContactChannel,
 } from "./contact-helpers.js";
 import { canonicalizeInboundIdentity } from "./identity.js";
@@ -252,7 +252,9 @@ export async function tryTextVerificationIntercept(
       : "guardian";
 
   // 7. Apply side effects. A blocked/revoked authoritative gateway row rejects
-  //    the verification: the actor must not regain trusted status nor see a
+  //    the verification, and so does a guardian code from an identity other
+  //    than the one linked on the channel: the actor must not gain trusted
+  //    status nor see a
   //    success reply, even though the code matched and the session consumed.
   const sideEffectsVerified =
     trustClass === "guardian"
@@ -274,7 +276,7 @@ export async function tryTextVerificationIntercept(
   if (!sideEffectsVerified) {
     log.warn(
       { sourceChannel, actorExternalUserId: canonicalUserId, trustClass },
-      "Verification rejected: authoritative gateway channel is blocked/revoked",
+      "Verification rejected: the consumed code granted nothing",
     );
     const pendingReplyText = await replyWithFailure(
       replyCallbackUrl,
@@ -341,27 +343,50 @@ async function applyGuardianSideEffects(params: {
     actorUsername,
   } = params;
 
-  // Check for binding conflict — another user already holds guardian
-  const existing = getExistingGuardianBinding(sourceChannel);
-  if (existing?.address && existing.address !== canonicalUserId) {
+  // The only await before the binding is written, so it runs first. From the
+  // refusal check below to the gateway writes inside createGuardianBinding
+  // (a synchronous transaction, ahead of that function's own first await)
+  // nothing yields, so two codes redeemed at once cannot both pass the check.
+  // A sender verifying again keeps the name their contact already has. The
+  // read is for that name only: a daemon that cannot answer falls back to the
+  // name the channel gave, so no outcome below depends on the daemon.
+  let existingContact: Awaited<ReturnType<typeof findContactChannelByAddress>> =
+    null;
+  try {
+    existingContact = await findContactChannelByAddress(
+      sourceChannel,
+      canonicalUserId,
+    );
+  } catch (err) {
+    log.warn(
+      { err, sourceChannel },
+      "Guardian display name lookup failed; using the name the channel gave",
+    );
+  }
+  const displayName = existingContact?.displayName?.trim().length
+    ? existingContact.displayName
+    : (actorDisplayName ?? actorUsername ?? canonicalUserId);
+
+  // The guardian is one person, and a channel holds at most one linked
+  // identity for them. A guardian code links an identity where none is linked,
+  // or links the same one again. It never swaps one identity for another, and
+  // grants nothing in its place: swapping is two explicit acts, remove the
+  // link and then connect again. Every active row is read, so a second one is
+  // weighed and not hidden behind a LIMIT 1. This is the text-channel rule; an
+  // outbound phone code replaces the bound number (session-service.ts).
+  const otherLinkedIdentities = activeGuardianAddresses(sourceChannel).filter(
+    (address) => address !== canonicalUserId,
+  );
+  if (otherLinkedIdentities.length > 0) {
     log.warn(
       {
         sourceChannel,
-        existingGuardian: existing.address,
+        linkedIdentities: otherLinkedIdentities,
         newActor: canonicalUserId,
       },
-      "Guardian binding conflict: another user already holds this channel",
+      "Guardian code refused: a different identity is linked as the guardian on this channel",
     );
-    // Still upsert the contact channel so the sender is a known contact,
-    // but skip guardian binding creation.
-    const { verified } = await upsertVerifiedContactChannel({
-      sourceChannel,
-      externalUserId: canonicalUserId,
-      externalChatId: actorChatId,
-      displayName: actorDisplayName,
-      username: actorUsername,
-    });
-    return verified;
+    return false;
   }
 
   // The gateway is the source of truth: a blocked/revoked gateway row rejects
@@ -369,13 +394,27 @@ async function applyGuardianSideEffects(params: {
   // re-verifying guardian (whose current row is active) isn't blocked by their
   // own about-to-be-revoked row. createGuardianBinding writes "active"
   // unconditionally, so this guard is the only thing stopping a blocked actor.
-  const gwStatus = gatewayChannelStatus(sourceChannel, canonicalUserId);
+  //
+  // One revoked row gets past it: the guardian's own, on a channel with no
+  // other linked identity. That is the guardian linking again the identity
+  // they removed. The row has to belong to the guardian contact: a contact the
+  // guardian revoked stays revoked whatever code they hold. A blocked row
+  // never gets past it.
+  const gwRow = gatewayChannelRow(sourceChannel, canonicalUserId);
+  const gwStatus = gwRow?.status ?? null;
   if (gwStatus === "blocked" || gwStatus === "revoked") {
-    log.warn(
-      { sourceChannel, address: canonicalUserId, status: gwStatus },
-      "Skipping guardian binding: authoritative gateway channel is blocked or revoked",
-    );
-    return false;
+    const reconnectsOwnRevokedRow =
+      gwStatus === "revoked" &&
+      gwRow?.contactRole === "guardian" &&
+      gwRow?.address === canonicalUserId &&
+      otherLinkedIdentities.length === 0;
+    if (!reconnectsOwnRevokedRow) {
+      log.warn(
+        { sourceChannel, address: canonicalUserId, status: gwStatus },
+        "Skipping guardian binding: authoritative gateway channel is blocked or revoked",
+      );
+      return false;
+    }
   }
 
   // Revoke existing binding (same-user re-verification)
@@ -384,15 +423,6 @@ async function applyGuardianSideEffects(params: {
   // Resolve canonical principal — unify all channel bindings
   const canonicalPrincipal = resolveCanonicalPrincipal(canonicalUserId);
 
-  // Determine display name — preserve existing if user is re-verifying
-  const existingContact = await findContactChannelByAddress(
-    sourceChannel,
-    canonicalUserId,
-  );
-  const displayName = existingContact?.displayName?.trim().length
-    ? existingContact.displayName
-    : (actorDisplayName ?? actorUsername ?? canonicalUserId);
-
   // Create guardian binding (dual-writes to both DBs)
   await createGuardianBinding({
     channel: sourceChannel,