feat: expose bounded wallet review intent

Author: Gini

docs/SECURITY.md

@@ -19,6 +19,7 @@
 - ordered events include `previousHash` and `eventHash`;
 - runtime mode and non-production limitations are visible in the UI.
 - local wallet decisions produce HMAC receipts for integration testing; each pending approval is bound to a SHA-256 digest of its task, action, expiry, and current evidence head, and that digest is carried into the receipt. The wallet secret is never serialized into task state or evidence. This is still not an OpenVTC asymmetric proof.
+- the separately authenticated wallet listing exposes only a bounded intent-review document (title, action, expiry, evidence head, and intent digest). It never exposes the browser session, raw prompt, sandbox handle, connector credential, or mutable workspace capability.
 - ONEComputer mode executes Claude through the sandbox API, rejects unsafe artifact paths, caps extraction at 100 files/10 MiB, and deletes the sandbox by default.
 - ONEComputer-mode Claude journals remain in the disposable sandbox. ONEVibe stores only bounded projections of tool and transcript events after redacting credential-like fields; the raw `stream-json` journal is excluded from artifact extraction.
 - The managed sandbox journal is capped at 4 MiB and must write a terminal exit code. ONEVibe fails the task rather than ingesting an oversized or indeterminate journal; sandbox teardown remains the cancellation backstop.

server/wallet-approval-service.test.ts

@@ -24,7 +24,7 @@ describe('WalletApprovalService', () => {
     const wallet = new WalletApprovalService(store, token)
 
     expect(() => wallet.authorize('Bearer wrong')).toThrow('authorization failed')
-    expect(wallet.listPending()).toHaveLength(1)
+    expect(wallet.listPending()).toMatchObject([{ taskId: task.id, intent: { version: 1, taskId: task.id, action: 'share_artifact', evidenceHash, intentHash } }])
     const result = await wallet.decide('approval-test', 'approved', 'test-vti-wallet')
 
     expect(result.share?.id.length).toBeGreaterThan(20)

server/wallet-approval-service.ts

@@ -14,9 +14,27 @@ export class WalletApprovalService {
   }
 
   listPending() {
-    return this.store.listTasks().filter((task) => task.approval?.state === 'pending').map((task) => ({
-      taskId: task.id, title: task.title, approval: task.approval,
-    }))
+    return this.store.listTasks().flatMap((task) => {
+      const approval = task.approval
+      if (!approval || approval.state !== 'pending') return []
+      return [{
+        taskId: task.id,
+        title: task.title,
+        approval,
+        // This is intentionally the entire wallet-facing review surface. The
+        // wallet receives no browser session, sandbox handle, raw task prompt,
+        // connector credential, or mutable workspace capability.
+        intent: approval.intentHash && approval.evidenceHash ? {
+          version: 1 as const,
+          taskId: task.id,
+          title: task.title,
+          action: approval.action,
+          expiresAt: approval.expiresAt,
+          evidenceHash: approval.evidenceHash,
+          intentHash: approval.intentHash,
+        } : undefined,
+      }]
+    })
   }
 
   async decide(approvalId: string, decision: 'approved' | 'denied', signer: string) {