fix(agent): seal document approval content

tests/test_external_context_tool_gate.py

@@ -1000,6 +1000,75 @@ def test_tainted_document_edit_without_active_target_cannot_be_approved(monkeypa
     assert "ask_user" not in blocked[0]
 
 
+def test_tainted_document_approval_seals_current_content(monkeypatch):
+    from types import SimpleNamespace
+
+    from src.prompt_security import untrusted_context_message
+    from src.tool_approvals import document_content_digest
+
+    import src.agent_loop as agent_loop
+
+    monkeypatch.setattr(
+        agent_loop,
+        "get_setting",
+        lambda key, default=None: default,
+        raising=False,
+    )
+    monkeypatch.setattr(agent_loop, "get_mcp_manager", lambda: None, raising=False)
+    monkeypatch.setattr(agent_loop, "estimate_tokens", lambda *args, **kwargs: 10)
+
+    async def fake_stream(*args, **kwargs):
+        yield "data: " + json.dumps({
+            "delta": "```update_document\nreplacement\n```",
+        }) + "\n\n"
+        yield "data: [DONE]\n\n"
+
+    async def should_not_execute(*args, **kwargs):
+        raise AssertionError("unapproved document edit reached executor")
+
+    monkeypatch.setattr(agent_loop, "stream_llm_with_fallback", fake_stream)
+    monkeypatch.setattr(agent_loop, "execute_tool_block", should_not_execute)
+    active_document = SimpleNamespace(
+        id="document-7",
+        title="Draft",
+        language="markdown",
+        current_content="original",
+        version_count=4,
+    )
+    events = _collect_agent_events(
+        agent_loop.stream_agent_loop(
+            "http://local.test/v1",
+            "small-local-model",
+            [
+                {"role": "user", "content": "update this document"},
+                untrusted_context_message("stored context", "untrusted"),
+            ],
+            active_document=active_document,
+            session_id="document-approval-session",
+            owner="alice",
+            max_rounds=1,
+            relevant_tools={"update_document"},
+        )
+    )
+
+    approval = next(
+        event["ask_user"]
+        for event in events
+        if event.get("ask_user", {}).get("kind") == "tool_approval"
+    )
+    pending = agent_loop.tool_approval_store.peek(approval["approval_id"])
+    assert pending is not None
+    assert pending.document_id == "document-7"
+    assert pending.document_version == 4
+    assert pending.document_digest == document_content_digest("original")
+    agent_loop.tool_approval_store.consume(
+        pending.approval_id,
+        decision="deny",
+        owner="alice",
+        session_id="document-approval-session",
+    )
+
+
 def test_approval_pause_does_not_trigger_teacher_takeover(monkeypatch):
     from src.prompt_security import untrusted_context_message
 

tests/test_foreground_model_routing.py

@@ -16,6 +16,7 @@ import routes.chat_routes as chat_routes
 import routes.chat_helpers as chat_helpers
 import routes.prefs_routes as prefs_routes
 from src.request_models import ChatRequest
+from src.tool_approvals import document_content_digest
 from src.foreground_model_routing import (
     FOREGROUND_AVAILABILITY_STATUSES,
     MAX_FOREGROUND_FALLBACKS,
@@ -276,6 +277,7 @@ async def test_chat_stream_consumes_exact_tool_approval_for_own_session(monkeypa
         workspace=None,
         document_id="document-7",
         document_version=4,
+        document_digest=document_content_digest("original"),
         external_untrusted_context_seen=True,
         capabilities=capabilities_for_action("update_document", tool_content),
     )

tests/test_tool_approvals.py

@@ -5,7 +5,7 @@ from collections import namedtuple
 
 import pytest
 
-from src.tool_approvals import ToolApprovalStore
+from src.tool_approvals import ToolApprovalStore, document_content_digest
 from src.tool_capabilities import ToolRunSecurityContext, capabilities_for_action
 
 
@@ -121,6 +121,7 @@ def test_public_payload_shows_complete_action_but_not_authority_fields():
         content="printf safe\nSECOND_LINE",
         document_id="document-7",
         document_version=4,
+        document_digest=document_content_digest("original"),
     )
 
     payload = pending.public_payload()
@@ -184,6 +185,7 @@ async def test_dispatcher_uses_sealed_document_target(monkeypatch):
         content=content,
         document_id="document-7",
         document_version=4,
+        document_digest=document_content_digest("original"),
         capabilities=capabilities_for_action("update_document", content),
     )
     grant = store.consume(
@@ -199,6 +201,7 @@ async def test_dispatcher_uses_sealed_document_target(monkeypatch):
             (
                 kwargs.get("approved_document_id"),
                 kwargs.get("approved_document_version"),
+                kwargs.get("approved_document_digest"),
             )
         )
         return "update_document", {"output": "ok", "exit_code": 0}
@@ -220,7 +223,9 @@ async def test_dispatcher_uses_sealed_document_target(monkeypatch):
     )
 
     assert result["exit_code"] == 0
-    assert captured == [("document-7", 4)]
+    assert captured == [
+        ("document-7", 4, document_content_digest("original"))
+    ]
 
 
 @pytest.mark.asyncio
@@ -268,7 +273,11 @@ async def test_dispatcher_rejects_approved_document_action_without_target(monkey
 def test_approved_document_version_guard_rejects_changed_target():
     from src.agent_tools.document_tools import _approved_document_version_error
 
-    doc = type("Document", (), {"version_count": 5})()
+    doc = type(
+        "Document",
+        (),
+        {"version_count": 5, "current_content": "original"},
+    )()
 
     assert _approved_document_version_error(
         doc,
@@ -276,8 +285,18 @@ def test_approved_document_version_guard_rejects_changed_target():
     )["document_changed"] is True
     assert _approved_document_version_error(
         doc,
-        {"expected_document_version": 5},
+        {
+            "expected_document_version": 5,
+            "expected_document_digest": document_content_digest("original"),
+        },
     ) is None
+    assert _approved_document_version_error(
+        doc,
+        {
+            "expected_document_version": 5,
+            "expected_document_digest": document_content_digest("changed"),
+        },
+    )["document_changed"] is True
     assert _approved_document_version_error(
         None,
         {"expected_document_version": 5},