[Taskmaster-1]

Phase 2 of making SynapseAI stronger. Approvals stop being a chore while staying in your hands. The three features were built in parallel and integrated here.

Approve the plan, not every step

• The new built-in propose_plan tool lets the agent list the exact calls it intends to make. You see a checklist, untick what you don't want, and approve once.
• Each kept step becomes a single-use grant tied to the exact tool and input. When the agent makes that call it runs without asking, even in a tainted run, because you saw that exact payload. A different input still asks, and a block rule still wins.
• Grants only come from a human sign-off: a plan auto-approved by a rule grants nothing.
• Batch decisions: several pending calls from one step show as one "This task wants to do 3 things" card. New endpoint: POST /api/runs/:id/tool-calls/decisions. It is all or nothing and uses compare-and-set.

Approvals that learn

• After 5 or more unedited approvals of a tool, with no denial or edit in the last 10, Synapse suggests an ordinary allow rule. You can see it, edit it and remove it.
• Recipients generalize through a new emailsEndWith condition: every email address anywhere in the call must match. The suggested rule says "every address ends with @acme.com", so an added Bcc to an outsider still asks. Public mail domains never generalize.
• Send and destructive tools are never suggested tool-wide.
• Tainted runs still ask, whatever the rules say.
• It shows in the Inbox and after an approval, with Allow or Not now.

Undo window

• Person-approved send and destructive actions wait undo_seconds (default 10; Off, 5, 10 or 30 in Settings) with a live "Sending in 9s · Undo".
• The run is parked with its lease at the deadline, so nothing spins.
• Undo is a compare-and-set race with the worker's approved → executing transition, so exactly one wins and nothing runs twice.
• Auto-allowed calls and plain writes are not delayed.

Fixed along the way

• Live updates were held back by the web proxy. Next's rewrite proxy gzips responses and buffered small SSE writes, so status changes after an approval didn't reach the page until something else was sent. Run event streams now send Cache-Control: no-cache, no-transform, and a regression assertion covers it. This affected live updates app-wide, not just Phase 2.
• Field name: batch approval takes edited input as input, like the single route.
• Index: added on tool_calls (user_id, decided_at) for the suggestions query.

Schema

One migration, 0004_trust_that_grows:

• runs.plan_grants
• tool_calls.execute_after
• user_settings.dismissed_suggestions
• user_settings.undo_seconds
• the new index

Breaking changes

• POST .../tool-calls/:id/decision now returns 200 { executeAfter } instead of 204.

Testing

• 143 tests pass, plus lint, typecheck and the web build. New tests cover:
  • plan grants (exact match, single use, block beats grant, tainted runs);
  • batch decisions;
  • the suggestion engine (thresholds, domains, Bcc, dismissals, ids);
  • the undo window (timing, a single run, undo, races, cancel).
• Clicked through in the browser against a scripted-model server with fake Gmail, in light and dark, on desktop and mobile. Checked: approving a plan with a step unticked, Approve all, the live countdowns, Undo on one email, and the suggestion appearing after six approvals. No console errors and no overflow.

🤖 Generated with Claude Code