merge: per-device agent consent for simulators (#277)

Author: AprilNEA

apps/daemon/src/__tests__/sim-mcp-endpoint.test.ts

@@ -1,5 +1,5 @@
 import type { SimulatorBackend } from '@linkcode/engine';
-import { SimulatorService } from '@linkcode/engine';
+import { SimulatorConsentService, SimulatorService } from '@linkcode/engine';
 import type { McpServer, SessionId } from '@linkcode/schema';
 // eslint-disable-next-line import-x/no-unresolved -- the SDK's exports-map subpaths defeat the resolver; tsc resolves them fine
 import { Client } from '@modelcontextprotocol/sdk/client/index.js';
@@ -53,6 +53,13 @@ function fakeBackend(): SimulatorBackend {
   };
 }
 
+/** Consent pre-granted for the fixture device, so a test exercises the tools and not the gate. */
+async function granted(udid = 'U-1'): Promise<SimulatorConsentService> {
+  const consent = new SimulatorConsentService();
+  await consent.decide(udid, 'granted');
+  return consent;
+}
+
 function urlOf(entry: McpServer | undefined): string {
   if (entry?.type !== 'http') throw new Error('expected an http MCP endpoint');
   return entry.url;
@@ -74,11 +81,15 @@ describe('SimulatorMcpEndpoint', () => {
 
   it('serves session-scoped tools over MCP streamable http', async () => {
     const activity: string[] = [];
-    endpoint = await SimulatorMcpEndpoint.create(new SimulatorService(fakeBackend()), {
-      activity(a) {
-        activity.push(`${a.tool}:${a.phase}:${a.sessionId}`);
+    endpoint = await SimulatorMcpEndpoint.create(
+      new SimulatorService(fakeBackend()),
+      await granted(),
+      {
+        activity(a) {
+          activity.push(`${a.tool}:${a.phase}:${a.sessionId}`);
+        },
       },
-    });
+    );
     const entry = endpoint.endpointFor(S1);
     expect(entry).toMatchObject({ type: 'http', name: 'linkcode-sim' });
 
@@ -117,7 +128,7 @@ describe('SimulatorMcpEndpoint', () => {
 
   it('enforces cross-session ownership through the shared service', async () => {
     const service = new SimulatorService(fakeBackend());
-    endpoint = await SimulatorMcpEndpoint.create(service);
+    endpoint = await SimulatorMcpEndpoint.create(service, await granted());
     const first = await connect(urlOf(endpoint.endpointFor(S1)));
     const second = await connect(urlOf(endpoint.endpointFor(S2)));
 
@@ -137,8 +148,80 @@ describe('SimulatorMcpEndpoint', () => {
     await second.close();
   });
 
+  it('suspends an agent tool on an unknown device until the user answers', async () => {
+    const consent = new SimulatorConsentService();
+    const asked: string[] = [];
+    consent.setHooks({
+      ask(_sessionId, udid, tool) {
+        asked.push(`${tool}:${udid}`);
+        return true;
+      },
+      publish: noop,
+    });
+    endpoint = await SimulatorMcpEndpoint.create(new SimulatorService(fakeBackend()), consent);
+    const client = await connect(urlOf(endpoint.endpointFor(S1)));
+
+    const call = client.callTool({ name: 'sim_boot', arguments: { udid: 'U-1' } });
+    // The tool must still be in flight: it is waiting on the prompt, not failing fast.
+    await vi.waitFor(() => expect(asked).toEqual(['sim_boot:U-1']));
+    await consent.decide('U-1', 'granted');
+    expect((await call).isError).toBeFalsy();
+
+    // The decision is remembered, so the next call goes straight through without asking again.
+    const second = await client.callTool({ name: 'sim_boot', arguments: { udid: 'U-1' } });
+    expect(second.isError).toBeFalsy();
+    expect(asked).toEqual(['sim_boot:U-1']);
+    await client.close();
+  });
+
+  it('refuses a denied device and tells the agent not to retry', async () => {
+    const consent = new SimulatorConsentService();
+    await consent.decide('U-1', 'denied');
+    endpoint = await SimulatorMcpEndpoint.create(new SimulatorService(fakeBackend()), consent);
+    const client = await connect(urlOf(endpoint.endpointFor(S1)));
+
+    const refused = await client.callTool({ name: 'sim_boot', arguments: { udid: 'U-1' } });
+    expect(refused.isError).toBe(true);
+    expect(JSON.stringify(refused.content)).toContain('do not retry');
+    await client.close();
+  });
+
+  it('refuses everything while the global kill switch is off, including device-less tools', async () => {
+    const consent = await granted();
+    await consent.setAgentToolsEnabled(false);
+    endpoint = await SimulatorMcpEndpoint.create(new SimulatorService(fakeBackend()), consent);
+    const client = await connect(urlOf(endpoint.endpointFor(S1)));
+
+    const listed = await client.callTool({ name: 'sim_list_devices', arguments: {} });
+    expect(listed.isError).toBe(true);
+    expect(JSON.stringify(listed.content)).toContain('disabled for agents');
+
+    // And it lifts again without a restart.
+    await consent.setAgentToolsEnabled(true);
+    expect(
+      (await client.callTool({ name: 'sim_list_devices', arguments: {} })).isError,
+    ).toBeFalsy();
+    await client.close();
+  });
+
+  it('refuses an unknown device outright when no client is attached to ask', async () => {
+    // `ask` reporting false is the daemon's "nobody is listening" signal; blocking for the full
+    // timeout there would look like a hang to the agent.
+    const consent = new SimulatorConsentService();
+    consent.setHooks({ ask: () => false, publish: noop });
+    endpoint = await SimulatorMcpEndpoint.create(new SimulatorService(fakeBackend()), consent);
+    const client = await connect(urlOf(endpoint.endpointFor(S1)));
+
+    const refused = await client.callTool({ name: 'sim_boot', arguments: { udid: 'U-1' } });
+    expect(refused.isError).toBe(true);
+    await client.close();
+  });
+
   it('rejects unknown tokens and released sessions', async () => {
-    endpoint = await SimulatorMcpEndpoint.create(new SimulatorService(fakeBackend()));
+    endpoint = await SimulatorMcpEndpoint.create(
+      new SimulatorService(fakeBackend()),
+      await granted(),
+    );
     const url = urlOf(endpoint.endpointFor(S1));
     endpoint.release(S1);
     await expect(connect(url)).rejects.toThrow();

apps/daemon/src/config.ts

@@ -2,12 +2,13 @@ import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { daemonRuntimeFilePath } from '@linkcode/common/node';
-import type { Accounts, ProvidersConfig } from '@linkcode/schema';
+import type { Accounts, ProvidersConfig, SimulatorConsentState } from '@linkcode/schema';
 import {
   AccountSchema,
   AgentKindSchema,
   DAEMON_DEFAULT_PORT,
   ProviderConfigSchema,
+  SimulatorConsentStateSchema,
 } from '@linkcode/schema';
 import { WORKSPACES_DIRNAME } from '@linkcode/schema/product';
 import type { TransportServerOptions } from '@linkcode/transport/server';
@@ -29,6 +30,8 @@ export interface DaemonConfig {
   providers?: ProvidersConfig;
   /** Global account pool (data plane); undefined when nothing is configured. */
   accounts?: Accounts;
+  /** Which simulators agents may drive, plus the global agent-tools switch (CODE-420). */
+  simulatorConsent: SimulatorConsentState;
 }
 
 const DEFAULT_PORT = DAEMON_DEFAULT_PORT;
@@ -40,6 +43,7 @@ interface ConfigFile {
   listeners?: unknown;
   providers?: unknown;
   accounts?: unknown;
+  simulatorConsent?: unknown;
 }
 
 function configPath(): string {
@@ -101,9 +105,30 @@ export function loadConfig(): DaemonConfig {
     ),
     providers: parseProviders(file.providers),
     accounts: parseAccounts(file.accounts),
+    simulatorConsent: parseSimulatorConsent(file.simulatorConsent),
   };
 }
 
+/**
+ * A malformed blob falls back to "nothing decided yet", which re-asks rather than silently
+ * granting: consent is the one field where losing state must fail closed.
+ */
+function parseSimulatorConsent(raw: unknown): SimulatorConsentState {
+  const empty: SimulatorConsentState = { entries: [], agentToolsEnabled: true };
+  if (raw === undefined) return empty;
+  const parsed = SimulatorConsentStateSchema.safeParse(raw);
+  if (!parsed.success) {
+    logger.warn({ operation: 'config.load' }, 'Dropping invalid simulator consent config');
+    return empty;
+  }
+  return parsed.data;
+}
+
+/** Persist simulator agent-consent to config.json, preserving its other fields; `0600`. */
+export function saveSimulatorConsent(state: SimulatorConsentState): void {
+  writeConfigField('simulatorConsent', state);
+}
+
 /**
  * Parse element by element: an invalid account is dropped and logged, never blanking the pool —
  * `saveAccounts` would persist that loss on the next write. Mirrors {@link parseProviders}.
@@ -167,7 +192,10 @@ export function saveAccounts(accounts: Accounts): void {
 }
 
 /** Read-modify-write a single top-level field of config.json, preserving the rest; `0600`. */
-function writeConfigField(key: 'providers' | 'accounts', value: unknown): void {
+function writeConfigField(
+  key: 'providers' | 'accounts' | 'simulatorConsent',
+  value: unknown,
+): void {
   const path = configPath();
   let file: Record<string, unknown> = {};
   try {

apps/daemon/src/index.ts

@@ -8,6 +8,7 @@ import {
   EngineService,
   makeEngineInfrastructureLayer,
   PreviewRouteRegistry,
+  SimulatorConsentService,
   SimulatorService,
 } from '@linkcode/engine';
 import type { DaemonIdentity, DaemonListenerInfo, DaemonRuntimeInfo } from '@linkcode/schema';
@@ -27,7 +28,13 @@ import { extractErrorMessage } from 'foxts/extract-error-message';
 import { createAiGatewaySidecar } from './ai-gateway';
 import { installAsarSpawnFix } from './asar-spawn';
 import type { DaemonConfig } from './config';
-import { chatWorkspaceRoot, daemonProfile, databasePath, loadConfig } from './config';
+import {
+  chatWorkspaceRoot,
+  daemonProfile,
+  databasePath,
+  loadConfig,
+  saveSimulatorConsent,
+} from './config';
 import { runLoginCommand, runLogoutCommand } from './hq/login';
 import { startHqUplink } from './hq/uplink';
 import { DaemonLoggerLive, logger } from './logger';
@@ -225,9 +232,29 @@ async function main(): Promise<void> {
       const simulators = simSidecarPath
         ? new SimulatorService(new SimSidecarClient(simSidecarPath))
         : undefined;
+      // Decisions persist in config.json, so a grant outlives the session that earned it. The ask
+      // hook reports whether anyone is attached: with no client there is nobody to answer, and
+      // suspending the agent for two minutes would just look like a hang.
+      const simulatorConsent = new SimulatorConsentService({
+        load: () => Promise.resolve(config.simulatorConsent),
+        save: (state) => Promise.resolve(saveSimulatorConsent(state)),
+      });
+      yield* Effect.promise(() => simulatorConsent.init());
+      simulatorConsent.setHooks({
+        ask(sessionId, udid, tool) {
+          if (hub.size === 0) return false;
+          hub.send(
+            createWireMessage({ kind: 'simulator.consent.required', sessionId, udid, tool }),
+          );
+          return true;
+        },
+        publish(state) {
+          hub.send(createWireMessage({ kind: 'simulator.consent.changed', state }));
+        },
+      });
       const simulatorMcp = simulators
         ? yield* Effect.promise(() =>
-            SimulatorMcpEndpoint.create(simulators, {
+            SimulatorMcpEndpoint.create(simulators, simulatorConsent, {
               activity(activity) {
                 hub.send(createWireMessage({ kind: 'simulator.activity', ...activity }));
               },
@@ -245,6 +272,7 @@ async function main(): Promise<void> {
         ptyBackend: new SidecarPtyBackend(resolveSidecarPath()),
         simulators,
         simulatorMcp,
+        simulatorConsent,
         sessionStore: createSessionStore(databasePath()),
         // After sessionStore so its migration-ledger reconcile runs before this store migrates.
         scheduleStore: createScheduleStore(databasePath()),

apps/daemon/src/sim/mcp-endpoint.ts

@@ -1,7 +1,11 @@
 import { randomUUID } from 'node:crypto';
 import type { IncomingMessage, Server, ServerResponse } from 'node:http';
 import { createServer } from 'node:http';
-import type { SimulatorMcpProvider, SimulatorService } from '@linkcode/engine';
+import type {
+  SimulatorConsentService,
+  SimulatorMcpProvider,
+  SimulatorService,
+} from '@linkcode/engine';
 import type { McpServer as McpServerEntry, SessionId } from '@linkcode/schema';
 // eslint-disable-next-line import-x/no-unresolved -- the SDK's exports-map subpaths (./server/*.js) defeat the resolver; tsc resolves them fine
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
@@ -47,12 +51,14 @@ export class SimulatorMcpEndpoint implements SimulatorMcpProvider {
   private constructor(
     private readonly server: Server,
     private readonly simulators: SimulatorService,
+    private readonly consent: SimulatorConsentService,
     private readonly notify?: SimulatorMcpNotifications,
   ) {}
 
   static create(
     this: void,
     simulators: SimulatorService,
+    consent: SimulatorConsentService,
     notify?: SimulatorMcpNotifications,
   ): Promise<SimulatorMcpEndpoint> {
     return new Promise((resolve, reject) => {
@@ -61,7 +67,7 @@ export class SimulatorMcpEndpoint implements SimulatorMcpProvider {
         // handle() never rejects (it catches internally); the catch is stream-error paranoia.
         endpoint?.handle(req, res).catch(noop);
       });
-      endpoint = new SimulatorMcpEndpoint(server, simulators, notify);
+      endpoint = new SimulatorMcpEndpoint(server, simulators, consent, notify);
       server.once('error', reject);
       // Loopback only, ephemeral port: the endpoint carries no auth beyond its per-session
       // token path, so it must never be reachable off-host.
@@ -158,8 +164,11 @@ export class SimulatorMcpEndpoint implements SimulatorMcpProvider {
       udid: string | undefined,
       op: () => Promise<string>,
     ): Promise<{ content: [{ type: 'text'; text: string }]; isError?: true }> => {
+      // Announced before the consent gate on purpose: a tool suspended waiting for the user is
+      // exactly when the panel should be showing this device.
       this.notify?.activity?.({ sessionId, udid, tool, phase: 'started' });
       try {
+        await this.consent.require(sessionId, udid, tool);
         return { content: [{ type: 'text', text: await op() }] };
       } catch (err) {
         return {
@@ -289,6 +298,7 @@ export class SimulatorMcpEndpoint implements SimulatorMcpProvider {
         const tool = 'sim_screenshot';
         this.notify?.activity?.({ sessionId, udid, tool, phase: 'started' });
         try {
+          await this.consent.require(sessionId, udid, tool);
           const chosen = format ?? 'jpeg';
           const image = await simulators.screenshot(sessionId, udid, chosen);
           return {

apps/desktop/e2e/simulator-panel.e2e.mts

@@ -39,7 +39,7 @@ const PORT = 43000 + (process.pid % 1000);
 
 /** Must match `WIRE_PROTOCOL_VERSION` (node can't load the raw-TS schema barrel); a mismatch is
  * silently discarded by the daemon, surfacing here as the session.start timeout. */
-const WIRE_VERSION = 53;
+const WIRE_VERSION = 54;
 
 function fail(message: string): never {
   console.error(`FAIL: ${message}`);