mirror of
https://github.com/pewdiepie-archdaemon/odysseus.git
synced 2026-09-10 18:22:20 +02:00
RaresKeYandLéo
981652358e
* fix(agent): allow remaining actions for an approved task * fix(agent): make approval continuation control-only * fix(ci): preserve approval taint and cache-buster contract * fix(ui): keep tool approvals in current chat * fix(ui): route tool approvals through chat submit * test(ui): pin approval submit routing * fix(agent): complete approval denial flow * fix(ui): avoid duplicate ask-user close icon * fix(agent): retain approved tool in continuation set * revert(ui): keep PR 6113 scoped to approval continuation * fix(agent): add task and chat approval scopes * fix(ui): prevent duplicate ask-user close icon * feat(ui): add ask-user option shortcuts * fix(compare): route ask-user choices per pane * fix(agent): keep skill-test approvals to a single action The chat card now reuses the wire value `approve` to mean chat-session scope, and `consume()` returned `allow_remaining_actions=True` for it unconditionally. The skill-test approval route was never updated: it still sends `approve` meaning "once", and its button still reads "Allow once", but the grant it got back set `approval_gate_bypassed` for the rest of the resumed run. That surface wraps the skill body and every transcript byte as untrusted context, so it is the last place where one click should ungate everything that follows. Give `consume()` an explicit `allow_continuation` flag. Callers that own a resumable chat keep the scope the user picked; callers that do not — the skill tester, unattended audits — get SINGLE_ACTION and the gate re-arms behind the sealed action, which is what their label promises. * fix(ui): cache-bust every module the approval click depends on chatStream.js, compare/index.js and compare/stream.js all changed behaviour but kept their old `?v=`, while chat.js and chatRenderer.js were bumped. A returning browser therefore serves the new chat.js — which now deliberately leaves the composer empty and clicks the send button — next to the cached chatStream.js that has no interceptor. With an empty composer that button sits at `data-mode="newchat"`, so the click opens a new chat and the approval is dropped. Bump the three, and version compare/stream.js's chatRenderer import to match everyone else's so the ask_user keydown listener binds to one module instance instead of two. * fix(ui): keep the digit shortcuts off tool approval cards With an approval card on screen and focus anywhere outside an input, a bare `1` fired `approve_task` — the widest of the three grants — with no modifier and no confirmation. That card is the one control whose entire purpose is deliberate consent after untrusted context influenced the run, and Deny sits at 3. Label the card with its kind and skip the shortcut for approvals. Ordinary ask_user questions keep 1-3. * fix(compare): restore a pane's ask_user card instead of dropping the choice renderAskUserCard removes the card as soon as onSubmit accepts, but the resume loop gave up silently after 10s if the originating stream still owned the pane. The user saw the click land, the card vanish, and nothing happen, with no way to get it back. Re-render the card on that deadline and say why. The reroll case still returns without sending — that choice belongs to a stream that no longer exists. * refactor(chat): drop the unreachable deny branch `if decision != "deny"` is always true — the deny path returns a StreamingResponse a few lines above. It reads as if deny still falls through to the toggle restore. --------- Co-authored-by: Léo <leograndcontact@gmail.com>
104 lines
4.8 KiB
Python
104 lines
4.8 KiB
Python
from pathlib import Path
|
||
|
||
|
||
def test_tool_approval_bypasses_polymorphic_send_button_actions():
|
||
root = Path(__file__).resolve().parents[1]
|
||
chat = (root / "static/js/chat.js").read_text(encoding="utf-8")
|
||
stream = (root / "static/js/chatStream.js").read_text(encoding="utf-8")
|
||
|
||
# chat.js still defers the sealed approval through a synthetic button click.
|
||
assert "if (sendButton) sendButton.click();" in chat
|
||
|
||
# The capture listener must intercept only that synthetic click and route it
|
||
# through the chat form submit path, before app.js can reinterpret an empty
|
||
# composer as New chat or Record voice.
|
||
assert "if (event.isTrusted) return;" in stream
|
||
assert "event.stopImmediatePropagation();" in stream
|
||
assert "chatForm.requestSubmit()" in stream
|
||
assert "sendButton.dataset.mode = ''" not in stream
|
||
|
||
|
||
def test_ask_user_close_button_uses_one_css_glyph():
|
||
root = Path(__file__).resolve().parents[1]
|
||
renderer = (root / "static/js/chatRenderer.js").read_text(encoding="utf-8")
|
||
styles = (root / "static/style.css").read_text(encoding="utf-8")
|
||
|
||
assert "closeBtn.className = 'modal-close ask-user-close';" in renderer
|
||
assert "closeBtn.setAttribute('aria-label', 'Dismiss question');" in renderer
|
||
assert "closeBtn.textContent = '×';" not in renderer
|
||
assert ".modal-close::before" in styles
|
||
|
||
|
||
def test_ask_user_number_shortcuts_reuse_option_click_path():
|
||
root = Path(__file__).resolve().parents[1]
|
||
renderer = (root / "static/js/chatRenderer.js").read_text(encoding="utf-8")
|
||
start = renderer.index("function _handleAskUserShortcut(event)")
|
||
end = renderer.index("document.addEventListener('keydown', _handleAskUserShortcut);", start)
|
||
shortcut = renderer[start:end]
|
||
|
||
assert "if (!/^[1-3]$/.test(event.key)) return;" in shortcut
|
||
assert "event.repeat" in shortcut
|
||
assert "event.ctrlKey" in shortcut
|
||
assert "event.altKey" in shortcut
|
||
assert "event.metaKey" in shortcut
|
||
assert "event.shiftKey" in shortcut
|
||
assert "input, textarea, select, [contenteditable=\"true\"]" in shortcut
|
||
assert "card.querySelectorAll('.ask-user-option')[Number(event.key) - 1]" in shortcut
|
||
assert "event.preventDefault();" in shortcut
|
||
assert "option.click();" in shortcut
|
||
|
||
|
||
def test_digit_shortcuts_never_answer_a_tool_approval_card():
|
||
"""A stray digit must not grant a scope the user did not deliberately pick."""
|
||
|
||
root = Path(__file__).resolve().parents[1]
|
||
renderer = (root / "static/js/chatRenderer.js").read_text(encoding="utf-8")
|
||
start = renderer.index("function _handleAskUserShortcut(event)")
|
||
end = renderer.index("document.addEventListener('keydown', _handleAskUserShortcut);", start)
|
||
shortcut = renderer[start:end]
|
||
|
||
assert "if (card.dataset.askUserKind === 'tool_approval') return;" in shortcut
|
||
# The renderer has to label the card for that guard to ever fire.
|
||
assert (
|
||
"card.dataset.askUserKind = isToolApproval ? 'tool_approval' : 'question';"
|
||
in renderer
|
||
)
|
||
|
||
|
||
def test_ask_user_renderer_accepts_scoped_root_and_submit_callback():
|
||
root = Path(__file__).resolve().parents[1]
|
||
renderer = (root / "static/js/chatRenderer.js").read_text(encoding="utf-8")
|
||
|
||
assert "const chatBox = renderOptions.root || document.getElementById('chat-history');" in renderer
|
||
assert "const onSubmit = typeof renderOptions.onSubmit === 'function'" in renderer
|
||
assert "kind: 'answer'" in renderer
|
||
assert "kind: 'tool_approval'" in renderer
|
||
assert "if (accepted !== false) card.remove();" in renderer
|
||
assert "document.dispatchEvent(new CustomEvent('odysseus:tool-approval', { detail }))" in renderer
|
||
|
||
|
||
def test_every_changed_approval_module_is_cache_busted_together():
|
||
"""A stale module here silently reinterprets the approval click.
|
||
|
||
chat.js leaves the composer empty and clicks the polymorphic send button,
|
||
so a browser that pairs the new chat.js with a cached chatStream.js has no
|
||
interceptor and lands on the New chat branch instead. The same holds for
|
||
the compare pane modules, which chatRenderer now shares a keydown listener
|
||
with.
|
||
"""
|
||
|
||
root = Path(__file__).resolve().parents[1]
|
||
version = "20260819approvalcontrol1"
|
||
index = (root / "static/index.html").read_text(encoding="utf-8")
|
||
app = (root / "static/app.js").read_text(encoding="utf-8")
|
||
chat = (root / "static/js/chat.js").read_text(encoding="utf-8")
|
||
compare_index = (root / "static/js/compare/index.js").read_text(encoding="utf-8")
|
||
compare_stream = (root / "static/js/compare/stream.js").read_text(encoding="utf-8")
|
||
|
||
assert f"chatStream.js?v={version}" in index
|
||
assert f"chatStream.js?v={version}" in chat
|
||
assert f"compare/index.js?v={version}" in app
|
||
assert f"stream.js?v={version}" in compare_index
|
||
# One chatRenderer instance, so the ask_user keydown listener binds once.
|
||
assert f"chatRenderer.js?v={version}" in compare_stream
|