Before You Let Siri Run an Agent-Written App Intent — Classify by Side Effect and Gate the Destructive Ones

struct ReplaceCollectionIntent: ClassifiedIntent {
    static let title: LocalizedStringResource = "Swap collection for today's picks"
    static let sideEffect: SideEffect = .irreversible
 
    // Do not let the assistant complete this silently; confirmation is mandatory
    static let openAppWhenRun: Bool = false
 
    @Parameter(title: "Target collection")
    var collection: CollectionEntity
 
    @MainActor
    func perform() async throws -> some IntentResult & ProvidesDialog {
        let store = CollectionStore.shared
        let current = try store.count(in: collection.id)
 
        // Take explicit confirmation, with the count, before the destructive act
        try await requestConfirmation(
            result: .result(dialog: "This replaces your current \(current) items with today's picks. It cannot be undone."),
            confirmationActionName: .go
        )
 
        let snapshot = try store.snapshot(collection.id)   // stash for restore
        do {
            try await store.replaceWithDailyPicks(collection.id)
        } catch {
            try? store.restore(snapshot)                    // always roll back on failure
            throw error
        }
        return .result(dialog: "Done. You can restore the previous state from history.")
    }
}

struct BulkDeleteIntent: ClassifiedIntent {
    static let title: LocalizedStringResource = "Select and bulk delete"
    static let sideEffect: SideEffect = .irreversible
 
    // A destructive op with ambiguous targets is not completed in-assistant
    static let openAppWhenRun: Bool = true
 
    @MainActor
    func perform() async throws -> some IntentResult {
        // Delete nothing here. Open the manager with candidates narrowed
        AppRouter.shared.route(to: .collectionManager(mode: .deletionReview))
        return .result()
    }
}

struct CollectionEntity: AppEntity {
    let id: String
    let name: String
 
    static let typeDisplayRepresentation: TypeDisplayRepresentation = "Collection"
    var displayRepresentation: DisplayRepresentation { .init(title: "\(name)") }
 
    static let defaultQuery = CollectionQuery()
}
 
struct CollectionQuery: EntityQuery {
    func entities(for ids: [String]) async throws -> [CollectionEntity] {
        // Do not take the IDs at face value; keep only ones that exist
        try CollectionStore.shared.existing(ids: ids)
    }
 
    func suggestedEntities() async throws -> [CollectionEntity] {
        // Never surface system collections as candidates for destructive ops
        try CollectionStore.shared.userEditableCollections()
    }
}

@Parameter(title: "Number to delete")
var count: Int
 
func validate() throws {
    guard count > 0 else {
        throw $count.needsValueError("Specify 1 or more")
    }
    guard count <= 200 else {
        // Even if the assistant misreads a digit, do not allow a mass delete in one shot
        throw $count.needsValueError("You can delete at most 200 at once")
    }
}

// scripts/check-intent-gates.mjs
import { readFileSync, readdirSync } from "node:fs";
import { join } from "node:path";
 
function swiftFiles(dir) {
  return readdirSync(dir, { withFileTypes: true }).flatMap((e) => {
    const p = join(dir, e.name);
    if (e.isDirectory()) return swiftFiles(p);
    return e.name.endsWith(".swift") ? [p] : [];
  });
}
 
// Crude struct split. Not a real parser, but enough to detect a missing gate
function structs(src) {
  const out = [];
  const re = /struct\s+(\w+)\s*:\s*[^{]*ClassifiedIntent[^{]*\{/g;
  let m;
  while ((m = re.exec(src))) {
    let depth = 1, i = re.lastIndex;
    for (; i < src.length && depth > 0; i++) {
      if (src[i] === "{") depth++;
      else if (src[i] === "}") depth--;
    }
    out.push({ name: m[1], body: src.slice(m.index, i) });
  }
  return out;
}
 
const violations = [];
for (const file of swiftFiles("Sources")) {
  const src = readFileSync(file, "utf8");
  for (const s of structs(src)) {
    const irreversible = /sideEffect\s*:\s*SideEffect\s*=\s*\.irreversible/.test(s.body);
    if (!irreversible) continue;
    const gated =
      /requestConfirmation\s*\(/.test(s.body) ||
      /openAppWhenRun\s*(:\s*Bool)?\s*=\s*true/.test(s.body);
    if (!gated) {
      violations.push(`${file}: ${s.name} is irreversible but has no confirmation gate`);
    }
  }
}
 
if (violations.length) {
  console.error("❌ Missing confirmation gate:\n" + violations.join("\n"));
  process.exit(1);
}
console.log("✅ Every irreversible intent has a confirmation gate");