feat(llm): integrate GitLab DWS tool approval with permission system

Wire approvalHandler and sessionPreapprovedTools on GitLabWorkflowLanguageModel so that DWS tool-call approval checkpoints surface as opencode permission prompts. - Set sessionPreapprovedTools from the merged agent+session ruleset so tools without an explicit 'ask' rule are pre-approved for the DWS session - Set approvalHandler (wrapped with Instance.bind to restore ALS context) that delegates to Permission.ask with permission type 'workflow_tool_approval' - Capture the Bus Replied event to detect 'always' replies and extend sessionPreapprovedTools for subsequent DWS turns - Return { approved: true/false } so approveAndResume reconnects with the correct approval or rejection payload - Bump gitlab-ai-provider to 6.1.0 which includes the approvalPending stream-close deferral and rejection forwarding fixes - Add preapprovedWorkflowTools helper (exported for testing) that filters tools using findLast rule precedence matching ask-only exclusion
rekram1-node · Apr 9, 2026 · Mar 29, 2026 · Mar 29, 2026 · Mar 30, 2026 · Mar 30, 2026
commit 60be8377a3d782dbabfffd549c4452883a88ee8b
diff --git a/bun.lock b/bun.lock
diff --git a/packages/opencode/package.json b/packages/opencode/package.json
@@ -122,7 +122,7 @@
     "drizzle-orm": "catalog:",
     "effect": "catalog:",
     "fuzzysort": "3.1.0",
-    "gitlab-ai-provider": "6.0.0",
+    "gitlab-ai-provider": "6.1.0",
     "glob": "13.0.5",
     "google-auth-library": "10.5.0",
     "gray-matter": "4.0.3",

diff --git a/packages/opencode/src/session/llm.ts b/packages/opencode/src/session/llm.ts
@@ -14,6 +14,10 @@ import { Plugin } from "@/plugin"
 import { SystemPrompt } from "./system"
 import { Flag } from "@/flag/flag"
 import { Permission } from "@/permission"
+import { PermissionID } from "@/permission/schema"
+import { Bus } from "@/bus"
+import { Wildcard } from "@/util/wildcard"
+import { SessionID } from "@/session/schema"
 import { Auth } from "@/auth"
 import { Installation } from "@/installation"
 
@@ -235,6 +239,40 @@ export namespace LLM {
           return { result: "", error: e.message ?? String(e) }
         }
       }
+
+      const ruleset = Permission.merge(input.agent.permission ?? [], input.permission ?? [])
+      workflowModel.sessionPreapprovedTools = preapprovedWorkflowTools(Object.keys(tools), ruleset)
+
+      workflowModel.approvalHandler = Instance.bind(async (approvalTools) => {
+        const id = PermissionID.ascending()
+        let reply: Permission.Reply | undefined
+        let unsub: (() => void) | undefined
+        try {
+          unsub = Bus.subscribe(Permission.Event.Replied, (evt) => {
+            if (evt.properties.requestID === id) reply = evt.properties.reply
+          })
+          await Permission.ask({
+            id,
+            sessionID: SessionID.zod.parse(input.sessionID),
+            permission: "workflow_tool_approval",
+            patterns: approvalTools.map((t) => t.name),
+            metadata: { tools: approvalTools },
+            always: approvalTools.map((t) => t.name),
+            ruleset: [],
+          })
+          if (reply === "always") {
+            workflowModel.sessionPreapprovedTools = [
+              ...workflowModel.sessionPreapprovedTools,
+              ...approvalTools.map((t) => t.name),
+            ]
+          }
+          return { approved: true }
+        } catch {
+          return { approved: false }
+        } finally {
+          unsub?.()
+        }
+      })
     }
 
     return streamText({
@@ -327,6 +365,13 @@ export namespace LLM {
     return input.tools
   }
 
+  export function preapprovedWorkflowTools(tools: string[], ruleset: Permission.Ruleset): string[] {
+    return tools.filter((name) => {
+      const match = ruleset.findLast((rule) => Wildcard.match(name, rule.permission))
+      return !match || match.action !== "ask"
+    })
+  }
+
   // Check if messages contain any tool-call content
   // Used to determine if a dummy tool should be added for LiteLLM proxy compatibility
   export function hasToolCalls(messages: ModelMessage[]): boolean {

diff --git a/packages/opencode/test/session/gitlab-llm-workflow-approval.test.ts b/packages/opencode/test/session/gitlab-llm-workflow-approval.test.ts
@@ -0,0 +1,44 @@
+import { describe, expect, test } from "bun:test"
+import { LLM } from "../../src/session/llm"
+import type { Permission } from "../../src/permission"
+
+describe("LLM.preapprovedWorkflowTools", () => {
+  test("returns all tools when ruleset is empty", () => {
+    const tools = ["read_file", "write_file", "run_command"]
+    const result = LLM.preapprovedWorkflowTools(tools, [])
+    expect(result).toEqual(tools)
+  })
+
+  test("excludes tools with explicit ask rule", () => {
+    const tools = ["read_file", "run_command", "write_file"]
+    const ruleset: Permission.Ruleset = [{ permission: "run_command", pattern: "*", action: "ask" }]
+    const result = LLM.preapprovedWorkflowTools(tools, ruleset)
+    expect(result).not.toContain("run_command")
+    expect(result).toContain("read_file")
+    expect(result).toContain("write_file")
+  })
+
+  test("excludes tools matched by wildcard ask rule", () => {
+    const tools = ["read_file", "write_file", "run_command"]
+    const ruleset: Permission.Ruleset = [{ permission: "*", pattern: "*", action: "ask" }]
+    const result = LLM.preapprovedWorkflowTools(tools, ruleset)
+    expect(result).toEqual([])
+  })
+
+  test("allows tools with allow rule overriding ask", () => {
+    const tools = ["run_command"]
+    const ruleset: Permission.Ruleset = [
+      { permission: "*", pattern: "*", action: "ask" },
+      { permission: "run_command", pattern: "*", action: "allow" },
+    ]
+    const result = LLM.preapprovedWorkflowTools(tools, ruleset)
+    expect(result).toContain("run_command")
+  })
+
+  test("preapproves tools with only deny rules (deny is handled by resolveTools, not here)", () => {
+    const tools = ["read_file"]
+    const ruleset: Permission.Ruleset = [{ permission: "read_file", pattern: "*", action: "deny" }]
+    const result = LLM.preapprovedWorkflowTools(tools, ruleset)
+    expect(result).toContain("read_file")
+  })
+})