Avoid expanding Rust permission result API

Preserve approve-all fail-closed behavior by logging and returning the existing user-not-available decision instead of adding a public enum variant.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: joshspicer

rust/src/handler.rs

@@ -45,8 +45,6 @@ pub enum PermissionResult {
     /// Decline to respond to this request, allowing another connected
     /// client to answer instead. The SDK suppresses the response.
     NoResult,
-    /// The handler could not safely decide the request.
-    Error(String),
 }
 
 impl PermissionResult {
@@ -85,6 +83,11 @@ impl From<PermissionDecision> for PermissionResult {
     }
 }
 
+pub(crate) fn permission_handler_failure(message: &str) -> PermissionResult {
+    tracing::error!(error = message, "permission handler failed");
+    PermissionResult::user_not_available()
+}
+
 /// Response to a user input request.
 #[derive(Debug, Clone)]
 pub struct UserInputResponse {
@@ -288,8 +291,8 @@ impl PermissionHandler for ApproveAllHandler {
         data: PermissionRequestData,
     ) -> PermissionResult {
         if data.managed_settings_enabled {
-            PermissionResult::Error(
-                "ApproveAllHandler cannot be used when managed settings are enabled".into(),
+            permission_handler_failure(
+                "ApproveAllHandler cannot be used when managed settings are enabled",
             )
         } else {
             PermissionResult::approve_once()
@@ -333,7 +336,7 @@ mod tests {
     }
 
     #[tokio::test]
-    async fn approve_all_handler_errors_when_managed_settings_enabled() {
+    async fn approve_all_handler_fails_when_managed_settings_enabled() {
         let result = ApproveAllHandler
             .handle(
                 SessionId::from("s1"),
@@ -344,7 +347,10 @@ mod tests {
                 },
             )
             .await;
-        assert!(matches!(result, PermissionResult::Error(_)));
+        assert!(matches!(
+            result,
+            PermissionResult::Decision(PermissionDecision::UserNotAvailable(_))
+        ));
     }
 
     #[tokio::test]

rust/src/permission.rs

@@ -16,7 +16,7 @@ use std::sync::Arc;
 
 use async_trait::async_trait;
 
-use crate::handler::{PermissionHandler, PermissionResult};
+use crate::handler::{PermissionHandler, PermissionResult, permission_handler_failure};
 use crate::types::{PermissionRequestData, RequestId, SessionId};
 
 /// Return a [`PermissionHandler`] that approves ordinary requests.
@@ -120,8 +120,8 @@ impl PermissionHandler for PolicyHandler {
         };
         if approved {
             if matches!(self.policy, Policy::ApproveAll) && data.managed_settings_enabled {
-                PermissionResult::Error(
-                    "approve-all policy cannot be used when managed settings are enabled".into(),
+                permission_handler_failure(
+                    "approve-all policy cannot be used when managed settings are enabled",
                 )
             } else {
                 PermissionResult::approve_once()
@@ -154,14 +154,14 @@ mod tests {
     }
 
     #[tokio::test]
-    async fn approve_all_errors_when_managed_settings_enabled() {
+    async fn approve_all_fails_when_managed_settings_enabled() {
         let h = approve_all();
         let mut request = data();
         request.managed_settings_enabled = true;
         assert!(matches!(
             h.handle(SessionId::from("s"), RequestId::new("1"), request)
                 .await,
-            PermissionResult::Error(_)
+            PermissionResult::Decision(crate::types::PermissionDecision::UserNotAvailable(_))
         ));
     }
 

rust/src/session.rs

@@ -1557,10 +1557,6 @@ fn permission_request_data(
 fn notification_permission_payload(result: &PermissionResult) -> Option<Value> {
     match result {
         PermissionResult::NoResult => None,
-        PermissionResult::Error(message) => {
-            tracing::error!(error = %message, "permission handler failed");
-            Some(serde_json::json!({ "kind": "user-not-available" }))
-        }
         PermissionResult::Decision(decision) => Some(
             serde_json::to_value(decision).expect("serializing permission decision should succeed"),
         ),