zarvis: auto-approve batched widget-dir edits; teach reviewer the widget dir

[edwin-zvs]

Goal

Make sure file operations on a session's own widget directory (the agent's session-UI scratch space) are auto-approved, so they don't bounce to the user under auto-review.

What I found

The daemon already adds the session widget dir to the auto-approve policy (AGENTD_AUTO_APPROVE_PATHS, session.rs), and effective_risk already downgrades widget-dir edit_file writes to Safe. But auto_approve_covers only inspected the top-level path — so the batched edits[] form (which the model is encouraged to use) wasn't covered and still hit the approval gate.

Fix

Part A — deterministic (tools/mod.rs): auto_approve_covers now covers both edit_file forms. A call is auto-approved (Safe) only when every target path — the single top-level path, or each edits[].path falling back to the top-level one — is inside an allowed directory. A single out-of-policy target keeps the whole call gated. So creating/updating widget files is now auto-approved in every mode, single-hunk or batched. Extended the existing effective_risk_downgrades_widget_dir_writes test with multi-edit cases (all-inside → Safe, one-outside → Risky).

Part B — reviewer hint (agent.rs): The auto-review reviewer now sees the session widget directory and is told that maintaining its files is routine, so residual cases that still reach the reviewer (chiefly shell-based reads/removals of widget files) are approved rather than bounced.

Coverage

• create / edit → Part A, deterministic guarantee.
• read → read-only shell reads are already Safe; non-read-only reads get the reviewer hint.
• delete → shell rm can't be deterministically scoped without parsing shell commands (which this codebase deliberately avoids — the read_only opt-in design), so it's handled by the reviewer hint, not a hard guarantee.

Test

• agentd-adapter-zarvis: 149 passed, 0 failed; workspace builds clean.

Relevant binary: agentd-adapter-zarvis (only crate touched).

🤖 Generated with Claude Code