Add backend Smart Approval, context diagnostics and confined tool orchestration

[Obed0101]

Summary

Move Smart Approval decisions and review history into the backend, then reduce repeated model context with per-turn memory snapshots and bounded tool discovery. Add a mendcode context report that distinguishes token estimates from provider-reported cache usage, and an opt-in confined Code Mode that composes existing tools while keeping intermediate results out of model input.

This beta candidate also adds discoverable macOS screenshot capture with real image attachments and a narrowly targeted navigation-key tool. The initial two commits separate Smart Approval primitives/review controls from context/tool integration. The branch includes the latest dev at 4d80b13c and does not replace or omit the preceding Smart Approval work.

• Smart Approval: causal user authority, action fingerprints and exact scoped grants; backend review/revoke endpoints with SDK and ACP integration; TUI details/history and removal of client-owned approval decisions.
• Context: completed-step composition/timing metadata, unknown usage preserved as unknown, CLI report, frozen synthetic memory at user boundaries, secondary-tool discovery with a complete-catalog fallback.
• Code Mode: pinned MIT-licensed OpenCode v2 interpreter and integrity-verified Acorn source; host-owned tool dispatch, nested audit records, cancellation cleanup, and final-output-only model history. Source, calls, retained output and wall time are bounded. It remains off by default.
• Computer tools: native macOS screenshots, crop/window targeting, bounded preview/artifacts and duplicate-image references. Navigation keys require a fresh single-use capture in the same session and unchanged foreground process on a single-display Mac.
• Public documentation records support and limits. No SQL migration, dependency install, release, deployment or model-selection change is included.

Release dependency correction

Pin Drizzle ORM and Kit to 1.0.0-beta.20 to fix GHSA-gpj5-g38j-94v9. The old pinned dialect failed an embedded-quote reproduction; the corrected dependency passes direct escaping and in-memory SQL-shaped alias regression tests. Typecheck and 24 storage/session tests passed with the new dependencies. No schema migration was generated. These tests and the new context/Smart Approval suites are included in the runtime CI gate.

Type

• Feature
• Documentation
• Security hardening

Verification

Completed local checks (counts overlap where a focused test was rerun):

• OpenCode package typecheck passed; SDK typecheck passed during the Smart Approval phase.
• Context/discovery, provider transport fixtures, Code Mode and Smart/action-fact tests: 36 passed. Expanded Code Mode suite: 7 passed, including invalid input, host denial, output budget, synchronous deadline and cancellation cleanup.
• Integrated session test verifies a nested file read is persisted while its private intermediate payload is absent from serialized model requests.
• Focused session cancellation/glob/Code Mode slice: 24 passed. Earlier context integration ran the complete prompt file: 113 passed.
• Worker bundle compiled successfully; source CLI context --help passed. The compiled macOS ARM64 executable reports 0.1.44-beta.3 and completed Code Mode with a nested file read through an isolated backend/local HTTP provider; the expected result reached the CLI. This does not establish other-platform or paid-provider behavior.
• Native screencapture plus resize succeeded on macOS and the resulting PNG was visually decoded locally.
• Outgoing diff whitespace and scoped publication/privacy checks passed.
• Reused Smart Approval evidence for unchanged boundaries: permission 89 passed, shell/action facts 31 passed, TUI unit tests 10 passed. HTTP bridge checks had 17 passes and two previously documented parity failures: /global/release-channel availability and /usage.days schema drift.

Representative commands, run from the OpenCode package with the existing isolated test preload:

bun run typecheck
MENDCODE_DB=contracts.db bun test --timeout 30000 test/mend/code-mode.test.ts
MENDCODE_DB=contracts.db bun test --timeout 30000 --test-name-pattern 'Code Mode|cancel|glob tool' test/session/prompt.test.ts
bun src/index.ts context --help

One attempted check was rejected before execution by the test database-isolation guard because the shell PID differed from Bun's preload PID. It was rerun successfully using a relative database name under the preload's isolated data directory; no real database was used.

Screenshots or Recordings

Native capture was inspected locally. No personal desktop image is published. Smart Approval TUI visual/PTY acceptance and interactive keyboard control remain unverified.

Experimental beta limits

This candidate targets 0.1.44-beta.3 from dev, not promotion of these features to the stable channel. Code Mode remains disabled by default. The limits below remain explicit in the release notes.

• Native provider compaction is not implemented/enabled: the installed OpenAI SDK supports encrypted reasoning replay but does not expose /responses/compact replacement windows. The portable summarizer remains unchanged. Durable native replay/model compatibility and interruption fixtures are still required.
• Smart Approval still needs the planned broader authority corpus, queue/restart/CAS/lifecycle coverage, PTY/visual acceptance and live-provider proof.
• Computer keyboard control needs a controlled interactive application test. Windows/Linux native adapters, pointer control, arbitrary typing and browser DOM automation are not included.
• Code Mode still needs packaged-worker validation on platforms other than macOS ARM64 and broader resource/permission integration validation. Worker confinement is not an OS sandbox or a hard heap quota.
• No measured cache savings or equivalence to another harness, and no paid/live provider coverage, is claimed.

Checklist

• Scoped to the authorized Smart Approval and context/computer-tool work.
• All extended acceptance gates completed (see experimental beta limits above).
• Updated public behavior documentation.
• Excluded secrets, private planning artifacts, desktop captures and local dependency symlinks.
• Reviewed packaging impact: worker entrypoint added; no release assets or installer published.