fix(serve): address post-approval suggestions — editMode stuck, type cast, approvalMode deny-set

- Clear editMode when setting disappears from rows during SSE reload
- Use isRecord guard instead of unsafe type cast in normalizeSettingsChanged
- Add SECURITY_SENSITIVE_SETTINGS deny-set to block tools.approvalMode
  from generic write path (must go through trust-gated session route)
- Remove tools.approvalMode from SUB_DIALOG_KEYS (no longer in list)

Author: doudouOUC

packages/cli/src/serve/routes/workspaceSettings.ts

@@ -62,9 +62,13 @@ interface SettingsResponse {
   settings: SettingDescriptor[];
 }
 
+const SECURITY_SENSITIVE_SETTINGS = new Set(['tools.approvalMode']);
+
 function getAllowedKeys(): Set<string> {
   return new Set(
-    getDialogSettingKeys().filter((k) => !TUI_ONLY_SETTINGS.has(k)),
+    getDialogSettingKeys().filter(
+      (k) => !TUI_ONLY_SETTINGS.has(k) && !SECURITY_SENSITIVE_SETTINGS.has(k),
+    ),
   );
 }
 

packages/sdk-typescript/src/daemon/ui/normalizer.ts

@@ -989,7 +989,7 @@ function normalizeSettingsChanged(
       type: 'workspace.settings.changed',
       key,
       scope: scope ?? 'workspace',
-      value: (event.data as Record<string, unknown>)?.['value'],
+      value: isRecord(event.data) ? event.data['value'] : undefined,
     },
   ];
 }

packages/web-shell/client/components/dialogs/SettingsDialog.tsx

@@ -12,11 +12,7 @@ interface SettingsDialogProps {
   onSubDialog: (settingKey: string) => void;
 }
 
-const SUB_DIALOG_KEYS = new Set([
-  'ui.theme',
-  'fastModel',
-  'tools.approvalMode',
-]);
+const SUB_DIALOG_KEYS = new Set(['ui.theme', 'fastModel']);
 
 type Scope = 'user' | 'workspace';
 
@@ -253,7 +249,10 @@ export function SettingsDialog({ onClose, onSubDialog }: SettingsDialogProps) {
       (r) => r.type === 'setting' && r.setting?.key === editMode.key,
     );
     const setting = row?.setting;
-    if (!setting) return;
+    if (!setting) {
+      setEditMode(null);
+      return;
+    }
     let parsed: unknown = editMode.draft;
     if (setting.type === 'number') {
       const trimmed = editMode.draft.trim();