approvals: session read-only command grant; enable on consent card

'Allow read-only commands' on shell cards — fail-closed classifier (local reads + pipelines only; no network/interpreters/writes), session-scoped, persisted with grants.
Consent cards get an in-place Enable button.
This commit is contained in:
Rohit C Prasad
2026-08-11 15:07:46 -07:00
committed by Rohit P
parent 110a8ae8ce
commit 06a4365132
13 changed files with 425 additions and 7 deletions
+5 -1
View File
@@ -50,9 +50,13 @@ test("zip import: trust warning leads, tools collapse behind a chevron, replaces
await expect(card.getByTestId("replaces-note")).toContainText("MORE capabilities");
await expect(card.getByText(/github.*(recommended).*open fix PRs/)).toBeVisible();
// Imported coworker landed disabled in the list above, pending consent.
// Imported coworker landed disabled in the list above, pending consent
// and the card itself carries the Enable action (no hunting back up the list).
const row = page.locator(".divide-y > div").filter({ hasText: "Team Security Coworker" });
await expect(row.getByRole("checkbox", { name: "Enabled" })).not.toBeChecked();
await card.getByTestId("consent-enable-team-sec").click();
await expect(card.getByTestId("consent-enabled")).toContainText("it's in your coworker picker");
await expect(row.getByRole("checkbox", { name: "Enabled" })).toBeChecked();
});
test("Export… zips an installed coworker's bundle to a chosen folder", async ({ page }) => {