fix(tess): enforce command authorization approvals (#718)

packages/types/src/chat/events.ts

@@ -1,5 +1,6 @@
 import type {
   CommandManifestPayload,
+  SlashCommandApprovalResultPayload,
   SlashCommandPayload,
   SlashCommandResultPayload,
   SystemReloadPayload,
@@ -116,6 +117,7 @@ export interface ServerToClientEvents {
   'session:info': (payload: SessionInfoPayload) => void;
   'commands:manifest': (payload: CommandManifestPayload) => void;
   'command:result': (payload: SlashCommandResultPayload) => void;
+  'command:approval': (payload: SlashCommandApprovalResultPayload) => void;
   'system:reload': (payload: SystemReloadPayload) => void;
   error: (payload: ErrorPayload) => void;
 }
@@ -125,5 +127,6 @@ export interface ClientToServerEvents {
   message: (data: ChatMessagePayload) => void;
   'set:thinking': (data: SetThinkingPayload) => void;
   'command:execute': (data: SlashCommandPayload) => void;
+  'command:approve': (data: SlashCommandPayload) => void;
   abort: (data: AbortPayload) => void;
 }

packages/types/src/commands/index.ts

@@ -63,6 +63,18 @@ export interface SlashCommandPayload {
   conversationId: string;
   command: string;
   args?: string;
+  /** One-time server-issued approval for a privileged command execution. */
+  approvalId?: string;
+}
+
+/** Server response to a request to approve a privileged slash command. */
+export interface SlashCommandApprovalResultPayload {
+  conversationId: string;
+  command: string;
+  success: boolean;
+  approvalId?: string;
+  expiresAt?: string;
+  message?: string;
 }
 
 /** Server response to a slash command */