Repository navigation
feat(assistant): Keiki Face ID approval for write tools, 0.email link as fallback - #2089
Merged
Merged
Conversation
… as fallback - write tools set approval: ask, approvalProof: verified, approvalFallback: tool - a call Keiki signed as approved on a verified surface (keiki_vault, slack, dashboard) runs directly; otherwise the 0.email review link is returned as before - /actions/:id and the approved webhook share decideAction
Contributor
Author
|
I'll fix CI failures and address comments from users with write access that start with 'Devin'.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This PR is written by Devin (AI). I reviewed each line.
Zero's mutating assistant tools now use Keiki's approval. Where Keiki can show its Face ID approval card (Keiki Vault, on a direct iMessage chat on a Photon line), the owner approves there. Everywhere else the 0.email review link works as it does today.
assistantTools):{ requiredScopes: ['mail:request_action'], approval: 'ask', approvalProof: 'verified', approvalFallback: 'tool' }.verified: Keiki won't let a chat "yes" approve. Only a Face ID-signed Vault card, a Slack button or the Keiki dashboard can approve.tool: when Keiki can't show a card, it calls the tool unapproved. Zero then returns its 0.email confirmation URL, as before./hooks/tools/:tool:context.approval = { actionId, decidedVia, decidedBy }to calls that were approved. It sits inside the HMAC-signed body thatverifyWebhookalready checks.decidedViaiskeiki_vault,slackordashboard, Zero creates the pendingassistantActionas usual (same draft preparation), then claims and runs it straight away. It does not return a second review link.chat, or no approval at all, keeps today's flow.decideAction: the atomic claim-and-run code is moved out of/actions/:idinto this helper, so the web approval and the Keiki approval share one path.Depends on Mail-0/sms-kit#1763 (server and SDK fields).
apps/servertypecheck needs@onkeiki/agentswith the newCloudTool.policyfields. 0.1.3 rejectsapprovalProof/approvalFallback, so the SDK bump lands here once that version is published. After merge, rerunapps/server/scripts/setup-assistant.tsso the Zero Shared Gateway picks up the policies.Type of Change
Areas Affected
Testing Done
assistant.test.tschecks that write tools carry the approval policy and read tools don't (56 pass), andassistant-approval.test.tspasses.Security Considerations
authorizedAssistantContextstill resolves the owner, and the claim is atomic (pending→running, once).context.approval).Link to Devin session: https://app.devin.ai/sessions/ad8b701418a840aaad66962915c09059
Open in Devin Desktop: https://app.devin.ai/desktop/session/ad8b701418a840aaad66962915c09059?variant=devin
Requested by: @MrgSub