[waleedlatif1]

Summary

• The approval gate read only the catalog's requiresApproval flag, which no browser_* tool declares, so browser actions that act on a page (navigate, click, type, fill and submit forms, upload files) ran as the user in their signed-in browser without an approval card, even with tool permissions enabled
• toolRequiresApproval now gates every browser tool that BROWSER_TOOL_OBSERVES_ONLY does not mark observe-only; reads (snapshot, read_text, screenshot, find, list_*, wait_for) stay ungated, the same act/observe split the terminal gate makes between run and read
• Derived from the Sim-owned map rather than the generated catalog, so a browser tool added later is gated by default, and the dispatch gate and the in-band lane read one answer
• "Don't ask again" answers for browser tools are stored under one shared key (browser_*), so one answer covers the browser instead of one prompt per kind of action; the card's menu says "Browser actions in this chat" / "in every chat" for browser tools
• No behavior change while COPILOT_TOOL_PERMISSIONS_ENABLED is off: the gate returns before reading any of this

Type of Change

• Bug fix

Testing

• desktop-tool-authorization.integration.ts (real Postgres + Redis, production pre-persist, authorize, and tool-permission routes): new browser cases; the gating case fails on the pre-fix code (desktop claims browser_click with no approval) and passes after; 16/16 passing locally
• permission.test.ts: new allow-for-this-chat case fails when the shared key is neutralized, passes after
• handlers, permission, router, run, tool-permission route, and tools/execute route suites: 256/256 passing
• bun run lint clean; check:file-names, check:test-patterns, check:boundaries, check:source-conventions, check:comment-hygiene, check:explicit-any, check:utils passing

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Nov 2, 2026 8:54pm UTC

[cubic-dev-ai]

No issues found across 7 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no actionable new issues were found.

Summary

Browser actions now require approval when tool permissions are enabled. Browser reads remain ungated.

• Browser actions wait for approval before the desktop app runs them.
• One remembered browser approval covers browser actions as a group.

No actionable new issues were found. The previous-review merge bases differed, so the full PR was reviewed. No previous findings were supplied.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Browser tool call] --> B{Permissions enabled?}
  B -- No --> C[Existing execution path]
  B -- Yes --> D{Observe-only tool?}
  D -- Yes --> C
  D -- No --> E{Saved browser approval allowed?}
  E -- Yes --> C
  E -- No --> F[Show approval card]
  F --> G{User decision}
  G -- Allow --> C
  G -- Remember --> H[Save browser_* in chosen scope]
  H --> C
  G -- Skip or timeout --> I[Do not execute]

Loading

_{Reviews (2) · Last reviewed commit: "fix(mothership): require approval before..." · Reviewed by Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 7 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}