Messenger (SimpleX): bridge, gateway, provisioning, forum and per-session chats with scoped phone approvals

delfin/agent/api_client.py

@@ -8430,6 +8430,8 @@ def _is_grantable_read_dir(path: Path | str | None) -> bool:
     # The account key and the pins beside it (trust_store): DELFIN's own
     # processes outside agent sessions read them, no agent route does.
     "trust_store", "trust_store/**", "**/trust_store", "**/trust_store/**",
+    "messenger_sessions", "messenger_sessions/**",
+    "**/messenger_sessions", "**/messenger_sessions/**",
 )
 
 # Self-modification protection: paths that are still WRITABLE, but always

delfin/agent/boundaries.py

@@ -562,6 +562,8 @@ def _rules_summary(workspace: Path) -> dict:
     ".delfin/credentials.json",
     ".delfin/approval_codes",
     ".delfin/trust_store",
+    # Which sessions the phone may reach (delfin.messenger.activation).
+    ".delfin/messenger_sessions",
 )
 
 

delfin/agent/kit_confirm.py

@@ -660,17 +660,11 @@ def _refresh_panel(self) -> None:
         except Exception:
             pass
 
-    def _build_request_row(self, req: _ConfirmRequest, widgets):
-        # ---- 1. Classify the request and compute what (if anything) can
-        # be persisted. The "Allow + Permanent" button must be actionable
-        # when it makes sense, and CLEARLY explain why it is unavailable
-        # when it isn't. ----------------------------------------------
+    def persistence_for(self, req):
+        """The same permanent option for the widget and the paired phone."""
         tool = req.tool_name
         cmd = req.args.get("command", "") if tool == "bash" else ""
         path_arg = req.args.get("path", "") if tool != "bash" else ""
-        rationale = (req.args.get("rationale", "")
-                     or req.args.get("description", "")).strip()
-
         persist_pat = ""
         persist_kind = ""        # 'allow_pattern' / 'extra_dir' / ''
         persist_disabled_reason = ""
@@ -732,6 +726,21 @@ def _build_request_row(self, req: _ConfirmRequest, widgets):
                 "it."
             )
 
+        return persist_pat, persist_kind, persist_disabled_reason
+
+    def _build_request_row(self, req: _ConfirmRequest, widgets):
+        # ---- 1. Classify the request and compute what (if anything) can
+        # be persisted. The "Allow + Permanent" button must be actionable
+        # when it makes sense, and CLEARLY explain why it is unavailable
+        # when it isn't. ----------------------------------------------
+        tool = req.tool_name
+        cmd = req.args.get("command", "") if tool == "bash" else ""
+        path_arg = req.args.get("path", "") if tool != "bash" else ""
+        rationale = (req.args.get("rationale", "")
+                     or req.args.get("description", "")).strip()
+
+        persist_pat, persist_kind, persist_disabled_reason = self.persistence_for(req)
+
         # ---- 2. Header: tool name + path/cmd snippet + rationale ----
         if tool == "bash":
             subtitle = f'$&nbsp;<code>{_html_escape(cmd[:200])}</code>'

delfin/agent/repl_commands.py

@@ -138,6 +138,12 @@ def expand_at_references(text: str, workspace: Path) -> str:
 # The builtin handlers
 # ---------------------------------------------------------------------------
 
+def _sync(ctx, args: str) -> CommandResult:
+    from delfin.messenger.activation import configure
+    sid = str(ctx.session_id or getattr(ctx.engine, "session_id", "") or "")
+    return CommandResult(output=configure(sid, args, endpoint=""))
+
+
 def _status(ctx, _args: str) -> CommandResult:
     engine = ctx.engine
     try:
@@ -2018,6 +2024,7 @@ def _isolation(engine) -> str:
                     _keys),
         ReplCommand("/editor", "session", "Write the next prompt in "
                     "$VISUAL or $EDITOR", _editor, True),
+        ReplCommand("/sync", "session", "SimpleX für diese Sitzung on|off|status", _sync, True),
         ReplCommand("/status", "session", "Model, mode, tokens, cost", _status),
         ReplCommand("/cost", "session", "What this session has cost", _cost),
         ReplCommand("/usage", "session", "Token and cost detail, with the rate",

delfin/agent/sandbox.py

@@ -1013,6 +1013,7 @@ def _unsandboxed_argv(cmd: str, repo_dir: Path, mode: str, *,
     # The account key and the MCP pins (trust_store): read by DELFIN's
     # own processes, never by a command an agent runs.
     ".delfin/trust_store",
+    ".delfin/messenger_sessions",
 )
 
 
@@ -1037,6 +1038,12 @@ def runtime_masked_dirs() -> list[str]:
             out.append(str(d.resolve()))
     except Exception:
         pass
+    # Not the messenger's activation records: they live in
+    # ~/.delfin/messenger_sessions, masked with the other home secrets
+    # (_HOME_SECRET_DIRS) and refused by the path deny globs, like the trust
+    # store. As a runtime mask the directory was created on every cage build,
+    # and a workspace containing it (a workspace at $HOME) lost its write
+    # root under Landlock, which cannot carve a hole into an allowed tree.
     return out