refactor(app): make auto-accept permissions an app-level setting

packages/app/e2e/regression/remote-session-settings.spec.ts

@@ -13,9 +13,14 @@ const sessionB = session("ses_server_b", directoryB, "Server B session")
 
 test("session settings use the remote server context", async ({ page }) => {
   const permissionRequests: string[] = []
+  const permissionResponses: PermissionResponse[] = []
   await installSseTransport(page, { server: serverA })
   await installSseTransport(page, { server: serverB })
-  await mockServers(page, permissionRequests)
+  // Server A has no tab and is never visited: a pending request there proves
+  // one toggle sweeps every connected server, not just the focused one.
+  await mockServers(page, permissionRequests, permissionResponses, {
+    pending: { [serverA]: [pendingPermission("permission-pending-a", sessionA.id)] },
+  })
   await configureServers(page)
 
   await page.goto(`/server/${base64Encode(serverB)}/session/${sessionB.id}`)
@@ -38,7 +43,17 @@ test("session settings use the remote server context", async ({ page }) => {
       }),
     )
     .toBe(true)
-  expect(permissionRequests.every((request) => new URL(request).origin === serverB)).toBe(true)
+  await expect
+    .poll(() => permissionResponses)
+    .toEqual([
+      {
+        origin: serverA,
+        directory: undefined,
+        sessionID: sessionA.id,
+        permissionID: "permission-pending-a",
+        body: { reply: "once" },
+      },
+    ])
 
   await dialog.getByRole("tab", { name: "Models" }).click()
   await expect(dialog.getByRole("switch", { name: "Server B Model" })).toBeEnabled()
@@ -143,6 +158,99 @@ test("auto-accept responds for an unfocused server session", async ({ page }) =>
     ])
 })
 
+test("auto-accept sweeps again after a reconnect", async ({ page }) => {
+  const permissionRequests: string[] = []
+  const permissionResponses: PermissionResponse[] = []
+  const pendingA: MockPermission[] = []
+  const listFailures: Record<string, number> = {}
+  const sessionGets: string[] = []
+  await installSseTransport(page, { server: serverB })
+  const transport = await installSseTransport(page, { server: serverA, retry: 20 })
+  await mockServers(page, permissionRequests, permissionResponses, {
+    pending: { [serverA]: pendingA },
+    listFailures,
+    sessionGets,
+  })
+  await configureServers(page, [{ type: "session", server: serverA, sessionId: sessionA.id }])
+
+  await page.goto(`/server/${base64Encode(serverA)}/session/${sessionA.id}`)
+  await expect(page.getByRole("heading", { name: sessionA.title, exact: true })).toBeVisible()
+  const first = await transport.waitForConnection()
+
+  await page.keyboard.press("Control+,")
+  const autoAccept = page.locator(".settings-dialog").locator('[data-action="settings-auto-accept-permissions"]')
+  await autoAccept.locator('[data-slot="switch-control"]').click()
+  await expect(autoAccept.getByRole("switch")).toBeChecked()
+  await expect
+    .poll(() =>
+      permissionRequests.some((request) => {
+        const url = new URL(request)
+        return url.origin === serverA && url.searchParams.get("location[directory]") === directoryA
+      }),
+    )
+    .toBe(true)
+  await page.keyboard.press("Escape")
+
+  // This request is asked while the client is disconnected, so it is never
+  // delivered as an event and only a reconnect sweep can find it. The first
+  // listing after the reconnect fails, so only the bounded sweep retry can
+  // deliver the reply.
+  pendingA.push(pendingPermission("permission-offline-a", sessionA.id))
+  listFailures[serverA] = 1
+  const syncsBeforeReconnect = sessionGets.length
+  await transport.disconnect()
+  await transport.waitForConnection({ after: first.id })
+
+  await expect
+    .poll(() => permissionResponses)
+    .toEqual([
+      {
+        origin: serverA,
+        directory: undefined,
+        sessionID: sessionA.id,
+        permissionID: "permission-offline-a",
+        body: { reply: "once" },
+      },
+    ])
+  // The reconnect sweep must resync active sessions instead of trusting
+  // cached locations, since another client may have moved them meanwhile.
+  expect(sessionGets.slice(syncsBeforeReconnect)).toContain(sessionA.id)
+})
+
+test("auto-accept approves a request discovered by opening a session", async ({ page }) => {
+  const permissionRequests: string[] = []
+  const permissionResponses: PermissionResponse[] = []
+  await installSseTransport(page, { server: serverA })
+  await installSseTransport(page, { server: serverB })
+  // The request is only served from the per-session permission list, so it
+  // reaches the client through the store sync when the session view opens,
+  // never through a location sweep or an event.
+  await mockServers(page, permissionRequests, permissionResponses, {
+    sessionPending: { [sessionA.id]: [pendingPermission("permission-synced-a", sessionA.id)] },
+  })
+  await configureServers(page, [{ type: "session", server: serverA, sessionId: sessionA.id }])
+
+  await page.goto(`/server/${base64Encode(serverA)}/session/${sessionA.id}`)
+  await expect(page.getByRole("heading", { name: sessionA.title, exact: true })).toBeVisible()
+
+  await page.keyboard.press("Control+,")
+  const autoAccept = page.locator(".settings-dialog").locator('[data-action="settings-auto-accept-permissions"]')
+  await autoAccept.locator('[data-slot="switch-control"]').click()
+  await expect(autoAccept.getByRole("switch")).toBeChecked()
+
+  await expect
+    .poll(() => permissionResponses)
+    .toEqual([
+      {
+        origin: serverA,
+        directory: undefined,
+        sessionID: sessionA.id,
+        permissionID: "permission-synced-a",
+        body: { reply: "once" },
+      },
+    ])
+})
+
 type PermissionResponse = {
   origin: string
   directory?: string
@@ -151,6 +259,19 @@ type PermissionResponse = {
   body: unknown
 }
 
+type MockPermission = {
+  id: string
+  sessionID: string
+  action: string
+  resources: string[]
+  metadata: Record<string, unknown>
+  save: unknown[]
+}
+
+function pendingPermission(id: string, sessionID: string): MockPermission {
+  return { id, sessionID, action: "shell", resources: ["git status"], metadata: {}, save: [] }
+}
+
 async function configureServers(page: Page, tabs: { type: "session"; server: string; sessionId: string }[] = []) {
   await page.addInitScript(
     ({ serverB, tabs }) => {
@@ -161,7 +282,23 @@ async function configureServers(page: Page, tabs: { type: "session"; server: str
   )
 }
 
-async function mockServers(page: Page, permissionRequests: string[], permissionResponses: PermissionResponse[] = []) {
+type MockServerOptions = {
+  // Pending requests served from /api/permission/request, keyed by origin.
+  pending?: Record<string, MockPermission[]>
+  // Pending requests served from /api/session/:id/permission, keyed by session ID.
+  sessionPending?: Record<string, MockPermission[]>
+  // Counts of /api/permission/request calls to fail with a 500, keyed by origin.
+  listFailures?: Record<string, number>
+  // Records /api/session/:id GETs so tests can assert session resyncs.
+  sessionGets?: string[]
+}
+
+async function mockServers(
+  page: Page,
+  permissionRequests: string[],
+  permissionResponses: PermissionResponse[] = [],
+  options: MockServerOptions = {},
+) {
   await page.route("**/*", async (route) => {
     const url = new URL(route.request().url())
     if (url.origin !== serverA && url.origin !== serverB) return route.fallback()
@@ -178,8 +315,12 @@ async function mockServers(page: Page, permissionRequests: string[], permissionR
         permissionID: response[2]!,
         body: route.request().postDataJSON(),
       })
-      return json(route, true)
+      // The generated client requires exactly 204 for a successful reply.
+      return route.fulfill({ status: 204, headers: { "access-control-allow-origin": "*" } })
     }
+    const sessionPermission = url.pathname.match(/^\/api\/session\/([^/]+)\/permission$/)
+    if (route.request().method() === "GET" && sessionPermission)
+      return json(route, { data: options.sessionPending?.[sessionPermission[1]!] ?? [] })
     if (requestDirectory && requestDirectory !== directory) return json(route, { name: "InvalidDirectory" }, 500)
     if (url.pathname === "/api/provider")
       return json(route, {
@@ -197,7 +338,12 @@ async function mockServers(page: Page, permissionRequests: string[], permissionR
     if (url.pathname === "/api/agent") return json(route, { location: { directory }, data: [] })
     if (url.pathname === "/api/permission/request") {
       permissionRequests.push(url.toString())
-      return json(route, { location: { directory }, data: [] })
+      const failures = options.listFailures?.[url.origin] ?? 0
+      if (failures > 0) {
+        options.listFailures![url.origin] = failures - 1
+        return json(route, { name: "Internal" }, 500)
+      }
+      return json(route, { location: { directory }, data: options.pending?.[url.origin] ?? [] })
     }
     if (["/api/command", "/api/reference", "/api/question/request"].includes(url.pathname))
       return json(route, { location: { directory }, data: [] })
@@ -219,9 +365,13 @@ async function mockServers(page: Page, permissionRequests: string[], permissionR
       return json(route, { id: remote ? sessionB.projectID : "project-server-a", directory, canonical: directory })
     if (url.pathname === "/api/session")
       return json(route, { data: sessions.map((session) => currentSession(session)), cursor: {} })
-    if (url.pathname === "/api/session/active") return json(route, { data: {} })
+    if (url.pathname === "/api/session/active")
+      return json(route, { data: Object.fromEntries(sessions.map((session) => [session.id, { type: "running" }])) })
     const currentSessionInfo = sessions.find((session) => url.pathname === `/api/session/${session.id}`)
-    if (currentSessionInfo) return json(route, { data: currentSession(currentSessionInfo) })
+    if (currentSessionInfo) {
+      options.sessionGets?.push(currentSessionInfo.id)
+      return json(route, { data: currentSession(currentSessionInfo) })
+    }
     if (sessions.some((session) => url.pathname === `/api/session/${session.id}/message`))
       return json(route, { data: [], cursor: {} })
     if (sessions.some((session) => url.pathname === `/api/session/${session.id}/inbox`))

packages/app/src/home/sessions/controller.tsx

@@ -373,7 +373,6 @@ export function HomeSessionStatusController(props: {
 }) {
   const avatar = useSessionTabAvatarState(
     () => props.server,
-    () => props.record.session.location.directory,
     () => props.record.session.id,
     () => true,
   )

packages/app/src/new-session/composer-adapter.ts

@@ -8,7 +8,6 @@ import { createComposerControls, createComposerModelSelection } from "@/composer
 import { createComposerProjectControls } from "./project/controller"
 import { useLanguage } from "@/runtime/i18n/language"
 import { useLocal } from "@/providers/models/selection"
-import { usePermission } from "@/session/requests/permission"
 import { useData, useServer } from "@/runtime/server/current"
 import { type ServerSDK, useServerSDK } from "@/runtime/server/client"
 import { useTabs } from "@/shell/tabs/tabs"
@@ -30,7 +29,6 @@ export function createNewSessionComposerAdapter(props: {
   const data = useData()
   const server = useServer()
   const serverSDK = useServerSDK()
-  const permission = usePermission()
   const tabs = useTabs()
   const location = useWorkspaceLocation()
   const language = useLanguage()
@@ -86,9 +84,6 @@ export function createNewSessionComposerAdapter(props: {
       )
       const cleanupReady = startTransition(() => {
         tabs.updateDraft(props.draftID, { worktree: undefined })
-        if (permission.isAutoAcceptingDirectory(projectDirectory)) {
-          permission.enableAutoAccept(created.id, sessionDirectory)
-        }
         local.session.promote(sessionDirectory, created.id, {
           agent: selection.agent,
           model: selection.model,

packages/app/src/runtime/server/runtime.tsx

@@ -8,7 +8,7 @@ import { createServerSdkContext } from "./client"
 import { createServerSyncContext } from "./sync"
 import { createData } from "@opencode-ai/client/solid"
 import type { ServerScope } from "@/runtime/server/scope"
-import { createServerPermissionState } from "@/session/requests/server-permission"
+import { createPermissionAutoApprover } from "@/session/requests/auto-approve"
 import { createServerNotificationState } from "@/shell/notifications/notification"
 import { Persist, persisted } from "@/runtime/persistence/storage"
 
@@ -144,7 +144,7 @@ function createServerController(
     directory: "",
   })
   const sync = createServerSyncContext(sdk, data)
-  const permission = createServerPermissionState({ sdk, sync, data })
+  createPermissionAutoApprover({ sdk, data })
   const notification = createServerNotificationState({ sdk, data, key: connKey })
 
   function enrich(project: { worktree: string; expanded: boolean }) {
@@ -187,7 +187,6 @@ function createServerController(
       list: projectsList,
       recentlyClosed: recentlyClosedList,
     },
-    permission,
     notification,
   }
 }

packages/app/src/session/commands/use-session-commands.tsx

@@ -4,9 +4,7 @@ import { previewSelectedLines } from "@opencode-ai/session-ui/pierre/selection-b
 import { useFile, selectionFromLines, type FileSelection, type SelectedLineRange } from "@/workspaces/files/model"
 import { useLanguage } from "@/runtime/i18n/language"
 import { useLayout } from "@/shell/state/layout"
-import { usePermission } from "@/session/requests/permission"
 import { useComposerState } from "@/composer/persistence"
-import { useWorkspaceLocation } from "@/workspaces/location"
 import { useServerSDK } from "@/runtime/server/client"
 import { useSettings } from "@/settings/model"
 import { useTerminal } from "@/session/terminal/context"
@@ -47,9 +45,7 @@ export const useSessionCommands = (actions: SessionCommandContext) => {
   const dialog = useDialog()
   const file = useFile()
   const language = useLanguage()
-  const permission = usePermission()
   const prompt = useComposerState()
-  const sdk = useWorkspaceLocation()
   const serverSDK = useServerSDK()
   const settings = useSettings()
   const terminal = useTerminal()
@@ -97,11 +93,6 @@ export const useSessionCommands = (actions: SessionCommandContext) => {
   const mcpCommand = withCategory(language.t("command.category.mcp"))
   const permissionsCommand = withCategory(language.t("command.category.permissions"))
 
-  const isAutoAcceptActive = () => {
-    const sessionID = actions.session.identity.params.id
-    if (sessionID) return permission.isAutoAccepting(sessionID, sdk().directory)
-    return permission.isAutoAcceptingDirectory(sdk().directory)
-  }
   const exportSession = async () => {
     const sessionID = actions.session.identity.params.id
     if (!sessionID) return
@@ -221,13 +212,8 @@ export const useSessionCommands = (actions: SessionCommandContext) => {
   }
 
   const toggleAutoAccept = () => {
-    const sessionID = actions.session.identity.params.id
-    if (sessionID) permission.toggleAutoAccept(sessionID, sdk().directory)
-    else permission.toggleAutoAcceptDirectory(sdk().directory)
-
-    const active = sessionID
-      ? permission.isAutoAccepting(sessionID, sdk().directory)
-      : permission.isAutoAcceptingDirectory(sdk().directory)
+    const active = !settings.permissions.autoApprove()
+    settings.permissions.setAutoApprove(active)
     showToast({
       title: active
         ? language.t("toast.permissions.autoaccept.on.title")
@@ -452,7 +438,7 @@ export const useSessionCommands = (actions: SessionCommandContext) => {
   const permissionsCmds = () => [
     permissionsCommand({
       id: "permissions.autoaccept",
-      title: isAutoAcceptActive()
+      title: settings.permissions.autoApprove()
         ? language.t("command.permissions.autoaccept.disable")
         : language.t("command.permissions.autoaccept.enable"),
       keybind: "mod+shift+a",