Universal Code A16 terminal authorization and A14/A15 recovery follow-ups

go.sum

@@ -64,6 +64,8 @@ github.com/go-ole/go-ole v1.3.0 h1:Dt6ye7+vXGIKZ7Xtk4s6/xVdGDQynvom7xCFEdWr6uE=
 github.com/go-ole/go-ole v1.3.0/go.mod h1:5LS6F96DhAwUc7C+1HLexzMXY1xGRSryjyPPKW6zv78=
 github.com/godbus/dbus/v5 v5.1.0 h1:4KLkAxT3aOY8Li4FRJe/KvhoNFFxo0m6fNuFUO8QJUk=
 github.com/godbus/dbus/v5 v5.1.0/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
+github.com/golang-jwt/jwt/v5 v5.3.1 h1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY=
+github.com/golang-jwt/jwt/v5 v5.3.1/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
 github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 h1:f+oWsMOmNPc8JmEHVZIycC7hBoQxHH9pNKQORJNozsQ=
 github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8/go.mod h1:wcDNUvekVysuuOpQKo3191zZyTpiI6se1N1ULghS0sw=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
@@ -217,6 +219,8 @@ golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
 golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
 golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.48.0 h1:3+hClM1aLL5mjMKm5ovokw9epgRXPuu2tILgismM6RE=
+golang.org/x/tools v0.48.0/go.mod h1:08xX0orndb/F7jJxGDicx061tyd5pcMto75YMAXr6lk=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=

internal/desktop/agent_browser_wiring_test.go

@@ -119,20 +119,22 @@ func TestControlPlaneWiresOrdinaryAgentBrowserIntoModelRequests(t *testing.T) {
 	}
 
 	fullThread := createDesktopSourceWiringThread(t, plane, workspace.ID,
-		"Full Access ordinary browser wiring", "desktop-agent-browser-full-thread-0001")
+		"Full ordinary browser wiring", "desktop-agent-browser-full-thread-0001")
 	permission := desktopControlRequest(plane.Handler(), http.MethodPost,
 		"/api/v1/threads/"+fullThread.Thread.ID+"/execution-permission",
 		"desktop-agent-browser-full-permission-0001",
-		`{"mode":"full_access","reason":"inspect ordinary browser tools","confirm_danger_full_access":true}`)
+		`{"mode":"full","reason":"inspect ordinary browser tools","confirm_full":true}`)
 	if permission.Code != http.StatusAccepted {
-		t.Fatalf("Full Access selection status=%d body=%s", permission.Code, permission.Body.String())
+		t.Fatalf("Full selection status=%d body=%s", permission.Code, permission.Body.String())
 	}
+	assertDesktopCurrentApproval(t, plane, permissionCapabilities, fullThread.Run.ID, domain.RunExecutionPermissionFull)
 	completeDesktopSourceWiringTurn(t, plane, fullThread,
 		"Inspect the ordinary browser tools available to this Run",
 		"desktop-agent-browser-full-turn-0001")
 
 	restrictedThread := createDesktopSourceWiringThread(t, plane, workspace.ID,
-		"Conservative ordinary browser boundary", "desktop-agent-browser-restricted-thread-0001")
+		"Ask ordinary browser boundary", "desktop-agent-browser-restricted-thread-0001")
+	assertDesktopCurrentApproval(t, plane, permissionCapabilities, restrictedThread.Run.ID, domain.RunExecutionPermissionAsk)
 	completeDesktopSourceWiringTurn(t, plane, restrictedThread,
 		"Inspect tools without elevated execution permission",
 		"desktop-agent-browser-restricted-turn-0001")
@@ -141,22 +143,22 @@ func TestControlPlaneWiresOrdinaryAgentBrowserIntoModelRequests(t *testing.T) {
 	captured := append([]desktopSourceWiringRequest(nil), modelRequests...)
 	requestMu.Unlock()
 	if len(captured) != 2 {
-		t.Fatalf("Supervisor model request count=%d, want one Full Access and one conservative request", len(captured))
+		t.Fatalf("Supervisor model request count=%d, want one Full and one Ask request", len(captured))
 	}
 	fullTools := desktopSourceWiringToolsByName(captured[0].Tools)
 	restrictedTools := desktopSourceWiringToolsByName(captured[1].Tools)
 	for _, name := range []string{"browser_navigate", "browser_scroll", "browser_key"} {
 		_, fullFound := fullTools[name]
 		_, restrictedFound := restrictedTools[name]
 		if runtime.GOOS == "windows" && !fullFound {
-			t.Fatalf("Windows Full Access Provider tools omitted %s: %v", name,
+			t.Fatalf("Windows Full Provider tools omitted %s: %v", name,
 				desktopSourceWiringToolNames(captured[0].Tools))
 		}
 		if runtime.GOOS != "windows" && fullFound {
 			t.Fatalf("non-Windows host advertised unavailable ordinary browser tool %s", name)
 		}
 		if restrictedFound {
-			t.Fatalf("conservative Run received ordinary browser tool %s: %v", name,
+			t.Fatalf("Ask Run received ordinary browser tool %s: %v", name,
 				desktopSourceWiringToolNames(captured[1].Tools))
 		}
 	}

internal/desktop/control_plane_test.go

@@ -1,9 +1,15 @@
 package desktop
 
 import (
+	"bytes"
+	"compress/bzip2"
 	"context"
+	"crypto/sha256"
+	"database/sql"
+	_ "embed"
 	"encoding/json"
 	"fmt"
+	"io"
 	"net/http"
 	"net/http/httptest"
 	"net/url"
@@ -147,56 +153,11 @@ func TestControlPlanePublishesGoOwnedRunCapabilityReadiness(t *testing.T) {
 
 func TestControlPlaneReopenKeepsOldHighRiskIntentNonAuthorizing(t *testing.T) {
 	databasePath := filepath.Join(t.TempDir(), "desktop-upgrade-authority.db")
-	state, err := store.Open(databasePath)
-	if err != nil {
-		t.Fatal(err)
-	}
-	_, run, err := application.NewRunService(state).Create(t.Context(),
-		application.CreateRunRequest{Goal: "preserve rc.3 audit facts", Profile: "code",
-			Surface: "code", Phase: "deliver", Budget: domain.Budget{MaxTurns: 2}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	selected, err := application.NewRunExecutionPermissionService(state,
-		domain.ExecutionPermissionRuntimeCapabilities{
-			OperatorApprovalEnabled: true, DangerFullAccessEnabled: true,
-		}).Change(t.Context(), application.ChangeRunExecutionPermissionRequest{
-		RunID: run.ID, Mode: string(domain.RunExecutionPermissionFullAccess),
-		OperationKey: "desktop-upgrade-old-full-access", RequestedBy: "test_operator",
-		Reason: "seed an old explicit high-risk selection", ConfirmDangerFullAccess: true,
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-	oldToolRun, err := state.SaveToolRun(t.Context(), toolrun.ToolRun{
-		ID: "desktop-upgrade-old-approved-shell", SessionID: run.SessionID,
-		ToolName: toolrun.ShellTool, Command: "echo historical approval",
-		Status: toolrun.StatusProposed,
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-	oldApproval, err := state.DecideApproval(t.Context(), approval.DecisionRequest{
-		ProposalID: oldToolRun.ID, IdempotencyKey: "desktop-upgrade-old-approval",
-		Action: approval.ActionApprove, ReviewedBy: "old_desktop_operator",
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, err = application.NewRunService(state).Start(t.Context(), run.ID); err != nil {
-		t.Fatal(err)
-	}
-	acquired, err := state.AcquireRunExecutionLease(t.Context(),
-		domain.AcquireRunExecutionLeaseRequest{RunID: run.ID,
-			OwnerID: "desktop-upgrade-old-owner", TTL: time.Hour})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err = state.Close(); err != nil {
-		t.Fatal(err)
-	}
+	legacy := restoreDesktopLegacyPermissionFixture(t, databasePath)
+	run, oldToolRun := legacy.Run, legacy.ToolRun
+	oldApproval, acquired := legacy.Approval, legacy.Lease
 
-	// Reopen the same rc.3-style database with ordinary safe controls but no
+	// Upgrade the genuine v177 database with ordinary safe controls but no
 	// high-risk startup gates. Durable intent and lease rows remain audit facts;
 	// neither may become process-local execution authority in the new process.
 	plane, err := OpenControlPlane(ControlPlaneConfig{
@@ -212,14 +173,18 @@ func TestControlPlaneReopenKeepsOldHighRiskIntentNonAuthorizing(t *testing.T) {
 		t.Fatal(err)
 	}
 	t.Cleanup(func() { _ = plane.Close() })
+	if version, err := plane.stateStore.SchemaVersion(t.Context()); err != nil || version < 178 {
+		t.Fatalf("Desktop did not upgrade the genuine v177 fixture: version=%d err=%v", version, err)
+	}
 
 	persisted, err := plane.stateStore.GetRunExecutionPermission(t.Context(), run.ID)
 	if err != nil {
 		t.Fatal(err)
 	}
-	if persisted.ID != selected.Permission.ID ||
-		persisted.Revision != selected.Permission.Revision ||
+	if persisted.ID != legacy.Permission.ID ||
+		persisted.Revision != legacy.Permission.Revision ||
 		persisted.Mode != domain.RunExecutionPermissionFullAccess ||
+		persisted.ProtocolVersion != domain.RunExecutionPermissionProtocolVersion ||
 		persisted.ProcessEnabled || persisted.ExecutionAuthorized ||
 		persisted.CapabilityGrant {
 		t.Fatalf("Desktop reopen changed or authorized old permission intent: %#v", persisted)
@@ -264,12 +229,13 @@ func TestControlPlaneReopenKeepsOldHighRiskIntentNonAuthorizing(t *testing.T) {
 	}
 	var fullAccess httpapi.CapabilityReadinessOptionView
 	for _, option := range readiness.Permissions {
-		if option.Value == string(domain.RunExecutionPermissionFullAccess) {
+		if option.Value == string(domain.RunExecutionPermissionFull) {
 			fullAccess = option
 			break
 		}
 	}
-	if !fullAccess.Selected || fullAccess.RuntimeAvailable ||
+	if fullAccess.Value != string(domain.RunExecutionPermissionFull) ||
+		!fullAccess.Selected || fullAccess.RuntimeAvailable ||
 		!containsDesktopReadinessValue(fullAccess.BlockedBy,
 			string(application.CapabilityBlockerStartupGateClosed)) ||
 		readiness.CapabilityGrant || readiness.CommandRuntime.AdapterInstalled ||
@@ -280,6 +246,66 @@ func TestControlPlaneReopenKeepsOldHighRiskIntentNonAuthorizing(t *testing.T) {
 	}
 }
 
+//go:embed testdata/legacy-permission-v177.db.bz2
+var desktopLegacyPermissionV177 []byte
+
+//go:embed testdata/legacy-permission-v177.json
+var desktopLegacyPermissionV177Facts []byte
+
+type desktopLegacyPermissionFixture struct {
+	Run        domain.Run
+	Permission domain.RunExecutionPermissionSnapshot
+	ToolRun    toolrun.ToolRun
+	Approval   approval.DecisionResult
+	Lease      domain.RunExecutionLeaseAcquisition
+}
+
+// Restore a genuine old database; never manufacture old modes through a current
+// writer or weaken a current insertion trigger. See testdata's generator/source.
+func restoreDesktopLegacyPermissionFixture(t *testing.T, path string) desktopLegacyPermissionFixture {
+	t.Helper()
+	data, err := io.ReadAll(io.LimitReader(
+		bzip2.NewReader(bytes.NewReader(desktopLegacyPermissionV177)), 8*1024*1024))
+	if err != nil || len(data) != 7643136 ||
+		fmt.Sprintf("%x", sha256.Sum256(data)) != "130b22b8db230627cbc1838b6c0af81975c090d01cb872a0d86a926f635e9f5f" {
+		t.Fatalf("historical Desktop fixture bytes changed: size=%d err=%v", len(data), err)
+	}
+	var facts desktopLegacyPermissionFixture
+	if err := json.Unmarshal(desktopLegacyPermissionV177Facts, &facts); err != nil {
+		t.Fatal(err)
+	}
+	if facts.Permission.ProtocolVersion != domain.RunExecutionPermissionProtocolVersion ||
+		facts.Permission.Mode != domain.RunExecutionPermissionFullAccess ||
+		facts.Permission.RunID != facts.Run.ID {
+		t.Fatal("fixture is not retained v1 Full Access history")
+	}
+	if err := os.WriteFile(path, data, 0o600); err != nil {
+		t.Fatal(err)
+	}
+	db, err := sql.Open("sqlite3", path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer db.Close()
+	var first, last, count int
+	if err := db.QueryRowContext(t.Context(),
+		"SELECT MIN(version),MAX(version),COUNT(*) FROM schema_migrations").Scan(&first, &last, &count); err != nil || first != 1 || last != 177 || count != 177 {
+		t.Fatalf("fixture ledger is not exactly v1..v177: %d/%d/%d err=%v", first, last, count, err)
+	}
+	rows, err := db.QueryContext(t.Context(), "PRAGMA foreign_key_check")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer rows.Close()
+	if rows.Next() {
+		t.Fatal("historical Desktop fixture has a foreign-key violation")
+	}
+	if err := rows.Err(); err != nil {
+		t.Fatal(err)
+	}
+	return facts
+}
+
 func containsDesktopReadinessValue(values []string, want string) bool {
 	for _, value := range values {
 		if value == want {

internal/desktop/local_sandbox_windows_test.go

@@ -83,10 +83,19 @@ func TestWindowsControlPlaneConsumesValidatedLocalSandboxReadiness(t *testing.T)
 	if err := json.Unmarshal(envelope.Data, &projection); err != nil {
 		t.Fatal(err)
 	}
-	workspace := projection.Permissions[1]
-	if workspace.Value != string(domain.RunExecutionPermissionWorkspaceAccess) ||
-		!workspace.Selectable || !workspace.RuntimeAvailable || projection.CapabilityGrant {
-		t.Fatalf("Desktop did not consume Local readiness: %#v", workspace)
+	if len(projection.Permissions) != 3 {
+		t.Fatalf("Desktop did not expose the three approval modes: %#v", projection.Permissions)
+	}
+	var automatic httpapi.CapabilityReadinessOptionView
+	for _, option := range projection.Permissions {
+		if option.Value == string(domain.RunExecutionPermissionAuto) {
+			automatic = option
+			break
+		}
+	}
+	if automatic.Value != string(domain.RunExecutionPermissionAuto) ||
+		!automatic.Selectable || !automatic.RuntimeAvailable || projection.CapabilityGrant {
+		t.Fatalf("Desktop did not consume Local readiness for Auto: %#v", automatic)
 	}
 	if !plane.StandardCodePresetEnabled() {
 		t.Fatal("Desktop did not expose the Go-owned Standard Code preset")

internal/desktop/source_connector_wiring_test.go

@@ -89,8 +89,10 @@ func TestControlPlaneWiresDefaultSourceConnectorsIntoCurrentRunTools(t *testing.
 	t.Setenv("CYBERAGENT_ANTHROPIC_BASE_URL", provider.URL)
 	t.Setenv("CYBERAGENT_ANTHROPIC_MODEL", model)
 	permissionCapabilities := domain.ExecutionPermissionRuntimeCapabilities{
-		OperatorApprovalEnabled: true,
-		DangerFullAccessEnabled: true,
+		OperatorApprovalEnabled:        true,
+		DangerFullAccessEnabled:        true,
+		FullAccessRequiresRuntimeGrant: true,
+		RuntimeAuthority:               domain.NewExecutionPermissionRuntimeAuthority(),
 	}
 	plane, err := OpenControlPlane(ControlPlaneConfig{
 		DatabasePath: filepath.Join(t.TempDir(), "source-wiring.db"),
@@ -133,28 +135,30 @@ func TestControlPlaneWiresDefaultSourceConnectorsIntoCurrentRunTools(t *testing.
 	}
 
 	fullThread := createDesktopSourceWiringThread(t, plane, workspace.ID,
-		"Full Access source connector wiring", "desktop-source-wiring-full-thread-0001")
+		"Full source connector wiring", "desktop-source-wiring-full-thread-0001")
 	permission := desktopControlRequest(plane.Handler(), http.MethodPost,
 		"/api/v1/threads/"+fullThread.Thread.ID+"/execution-permission",
 		"desktop-source-wiring-full-permission-0001",
-		`{"mode":"full_access","reason":"exercise the current Run source connector authority","confirm_danger_full_access":true}`)
+		`{"mode":"full","reason":"exercise the current Run source connector authority","confirm_full":true}`)
 	if permission.Code != http.StatusAccepted {
-		t.Fatalf("Full Access selection status=%d body=%s", permission.Code, permission.Body.String())
+		t.Fatalf("Full selection status=%d body=%s", permission.Code, permission.Body.String())
 	}
 	var selected httpapi.ThreadExecutionPermissionControlView
 	decodeDesktopControlData(t, permission, &selected)
 	if selected.CurrentRunID != fullThread.Run.ID ||
 		selected.CurrentRunEffect != string(domain.ThreadExecutionPermissionApplied) ||
-		selected.CurrentRunMode != string(domain.RunExecutionPermissionFullAccess) ||
+		selected.CurrentRunMode != string(domain.RunExecutionPermissionFull) ||
 		!selected.CurrentRunSynchronized || !selected.ExecutionPermission.AppliesToCurrentRun {
-		t.Fatalf("Full Access did not bind to the current Run: %#v", selected)
+		t.Fatalf("Full did not bind to the current Run: %#v", selected)
 	}
+	assertDesktopCurrentApproval(t, plane, permissionCapabilities, fullThread.Run.ID, domain.RunExecutionPermissionFull)
 	completeDesktopSourceWiringTurn(t, plane, fullThread,
-		"Inspect the tools available to this Full Access Run",
+		"Inspect the tools available to this Full Run",
 		"desktop-source-wiring-full-turn-0001")
 
 	restrictedThread := createDesktopSourceWiringThread(t, plane, workspace.ID,
-		"Conservative source connector boundary", "desktop-source-wiring-restricted-thread-0001")
+		"Ask source connector boundary", "desktop-source-wiring-restricted-thread-0001")
+	assertDesktopCurrentApproval(t, plane, permissionCapabilities, restrictedThread.Run.ID, domain.RunExecutionPermissionAsk)
 	completeDesktopSourceWiringTurn(t, plane, restrictedThread,
 		"Inspect the tools available without network authority",
 		"desktop-source-wiring-restricted-turn-0001")
@@ -163,13 +167,13 @@ func TestControlPlaneWiresDefaultSourceConnectorsIntoCurrentRunTools(t *testing.
 	capturedRequests := append([]desktopSourceWiringRequest(nil), modelRequests...)
 	requestMu.Unlock()
 	if len(capturedRequests) != 2 {
-		t.Fatalf("Supervisor model request count=%d, want one Full Access and one conservative request",
+		t.Fatalf("Supervisor model request count=%d, want one Full and one Ask request",
 			len(capturedRequests))
 	}
 	fullTools := desktopSourceWiringToolsByName(capturedRequests[0].Tools)
 	sourceSearch, found := fullTools["source_search"]
 	if !found {
-		t.Fatalf("Full Access Provider tools omitted source_search: %v",
+		t.Fatalf("Full Provider tools omitted source_search: %v",
 			desktopSourceWiringToolNames(capturedRequests[0].Tools))
 	}
 	if !strings.Contains(sourceSearch.Description, "GitHub") ||
@@ -179,7 +183,7 @@ func TestControlPlaneWiresDefaultSourceConnectorsIntoCurrentRunTools(t *testing.
 	}
 	webFetch, found := fullTools["web_fetch"]
 	if !found {
-		t.Fatalf("Full Access Provider tools omitted web_fetch: %v",
+		t.Fatalf("Full Provider tools omitted web_fetch: %v",
 			desktopSourceWiringToolNames(capturedRequests[0].Tools))
 	}
 	webFetchSchema := string(webFetch.InputSchema)
@@ -190,7 +194,7 @@ func TestControlPlaneWiresDefaultSourceConnectorsIntoCurrentRunTools(t *testing.
 	}
 	restrictedTools := desktopSourceWiringToolsByName(capturedRequests[1].Tools)
 	if _, found := restrictedTools["source_search"]; found {
-		t.Fatalf("network-disabled conservative Run received source_search: %v",
+		t.Fatalf("network-disabled Ask Run received source_search: %v",
 			desktopSourceWiringToolNames(capturedRequests[1].Tools))
 	}
 }
@@ -245,3 +249,25 @@ func desktopSourceWiringToolNames(tools []desktopSourceWiringTool) []string {
 	}
 	return names
 }
+
+// The current writer must bind the v2 preference to this process's authority.
+// Historical Full Access/Debug rows cannot stand in for this explicit action.
+func assertDesktopCurrentApproval(t *testing.T, plane *ControlPlane,
+	capabilities domain.ExecutionPermissionRuntimeCapabilities, runID string,
+	want domain.RunExecutionPermissionMode,
+) {
+	t.Helper()
+	permission, err := plane.stateStore.GetRunExecutionPermission(t.Context(), runID)
+	if err != nil || permission.ProtocolVersion != domain.RunApprovalPermissionProtocolVersion ||
+		permission.Mode != want || permission.ProcessEnabled || permission.ExecutionAuthorized ||
+		permission.CapabilityGrant {
+		t.Fatalf("current Desktop approval=%#v want=%s err=%v", permission, want, err)
+	}
+	if capabilities.RuntimeAuthority == nil {
+		t.Fatal("Desktop fixture omitted the shared runtime authority")
+	}
+	_, activated := capabilities.RuntimeAuthority.AllowsFullAccess(permission)
+	if activated != (want == domain.RunExecutionPermissionFull) {
+		t.Fatalf("Desktop approval activation=%t want mode=%s", activated, want)
+	}
+}