Add the admin messages, approval ids as numbers, and two turn events

Implemented-By: OpenCode session (model recorded in docs/implementer-log.md)

crates/proto/src/lib.rs

@@ -17,6 +17,7 @@ pub use hash::{HashError, Sha256, sha256};
 pub use ids::{CallId, Epoch, Hash32, SessionId, Timestamp, ValueError};
 pub use log::{LogRecord, ToolCall, Usage};
 pub use wire::{
-    DenyReason, Envelope, ErrorCode, Message, PROTOCOL_VERSION, ToolRequest, ToolResponse, Turn,
-    TurnDone, TurnEvent, WireError,
+    ApprovalList, Approve, ApproveResult, DenyReason, Empty, Envelope, ErrorCode, GrantProblem,
+    GrantsReport, Message, PROTOCOL_VERSION, PendingApproval, Refuse, ToolRequest, ToolResponse,
+    Turn, TurnDone, TurnEvent, WireError,
 };

crates/proto/src/wire.rs

@@ -1,6 +1,6 @@
 use serde::{Deserialize, Serialize};
 
-use crate::{CallId, DataClass, SessionId, Timestamp, Usage};
+use crate::{CallId, DataClass, DecisionRecord, SessionId, Timestamp, Usage};
 
 pub const PROTOCOL_VERSION: u32 = 1;
 
@@ -27,6 +27,14 @@ pub enum Message {
     Turn(Turn),
     TurnEvent(TurnEvent),
     TurnDone(TurnDone),
+    Approvals(Empty),
+    ApprovalList(ApprovalList),
+    Approve(Approve),
+    ApproveResult(ApproveResult),
+    Refuse(Refuse),
+    Ok(Empty),
+    CheckGrants(Empty),
+    GrantsReport(GrantsReport),
 }
 
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
@@ -49,6 +57,8 @@ pub enum ErrorCode {
     NoSuchSession,
     SessionExists,
     Inference,
+    Forbidden,
+    NoSuchApproval,
 }
 
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
@@ -64,7 +74,7 @@ pub struct ToolRequest {
 #[serde(tag = "status", deny_unknown_fields, rename_all = "snake_case")]
 pub enum ToolResponse {
     PendingApproval {
-        approval: String,
+        approval: u64,
         expires: Timestamp,
     },
     Result {
@@ -90,6 +100,10 @@ pub enum DenyReason {
     DeniedByGrant,
     ApprovalRefused,
     ApprovalExpired,
+    GrantsInvalid,
+    AuditUnavailable,
+    InvalidArguments,
+    StateUnreadable,
 }
 
 // JSON: {"kind":"turn","body":{"session":"…","content":"…","resume":false}}
@@ -142,6 +156,15 @@ pub enum TurnEvent {
         expected: u64,
         got: u64,
     },
+    ApprovalPending {
+        approval: u64,
+        tool: String,
+        expires: Timestamp,
+    },
+    ToolDenied {
+        name: String,
+        reason: DenyReason,
+    },
 }
 
 // JSON: {"kind":"turn_done","body":{"content":"…","usage":{…}}}
@@ -151,3 +174,61 @@ pub struct TurnDone {
     pub content: String,
     pub usage: Usage,
 }
+
+// The admin messages on admin.sock. JSON: {"kind":"approvals","body":{}}
+#[derive(Debug, Clone, PartialEq, Eq, Default, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct Empty {}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct PendingApproval {
+    pub approval: u64,
+    pub session: SessionId,
+    pub call: CallId,
+    pub tool: String,
+    pub arguments: String,
+    pub grant: String,
+    pub taint: DataClass,
+    pub created: Timestamp,
+    pub expires: Timestamp,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct ApprovalList {
+    pub items: Vec<PendingApproval>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct Approve {
+    pub approval: u64,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct ApproveResult {
+    pub outcome: DecisionRecord,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct Refuse {
+    pub approval: u64,
+    pub reason: Option<String>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct GrantProblem {
+    pub file: String,
+    pub line: Option<u64>,
+    pub problem: String,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct GrantsReport {
+    pub problems: Vec<GrantProblem>,
+}