fix: restrict AI Workspace denial text to explicit denies

services/ai-workspace-assistant/src/scripts/smoke-run-profile.mjs

@@ -97,6 +97,11 @@ const deniedByLauncher = mergeRunAppGrants(appGrants, normalizeEntitlementAdapte
   },
 }, launcherAdapter));
 const deniedMcpServers = runProfileMcpServersFromAppGrants({}, deniedByLauncher);
+const explicitDeniedCatalog = buildRunProfileAppCatalog({
+  appGrants: deniedByLauncher,
+  mcpServers: deniedMcpServers,
+  assistantActions,
+});
 const runProfile = {
   schemaVersion: "ai-workspace.run-profile.v1",
   runId: randomUUID(),
@@ -141,6 +146,7 @@ const runProfile = {
     appCatalogIds: appCatalog.map((app) => app.appId).sort(),
     grantedAppIds: appAccess.grantedAppIds,
     deniedAppIds: appAccess.deniedAppIds,
+    notGrantedAppIds: appAccess.notGrantedAppIds,
   },
 };
 runProfile.diagnostics.profileHash = runProfileHash(runProfile);
@@ -172,17 +178,23 @@ assert.equal(publicProfile.toolProfile.assistantActions.gatewayUrl, "https://ai-
 assert.equal(publicProfile.toolProfile.assistantActions.gatewayToken, "<redacted>");
 assert.deepEqual(publicProfile.toolProfile.assistantActions.actionIds, ["hub.access_request.list_pending", "hub.user.read_admin_summary"]);
 assert.equal(runProfile.appCatalog.find((app) => app.appId === "ops")?.status, "granted");
+assert.equal(runProfile.appCatalog.find((app) => app.appId === "ops")?.denied, false);
 assert.deepEqual(runProfile.appCatalog.find((app) => app.appId === "ops")?.mcpServerNames, ["nodedc_ops_agent"]);
 assert.equal(runProfile.appCatalog.find((app) => app.appId === "launcher")?.status, "not-granted");
-assert.equal(runProfile.appCatalog.find((app) => app.appId === "launcher")?.deniedText, ACCESS_DENIED_TEXT);
+assert.equal(runProfile.appCatalog.find((app) => app.appId === "launcher")?.denied, false);
+assert.equal(runProfile.appCatalog.find((app) => app.appId === "launcher")?.notGranted, true);
+assert.equal(runProfile.appCatalog.find((app) => app.appId === "launcher")?.deniedText, null);
 assert.equal(launcherGrants.launcher.appId, "launcher");
 assert.equal(launcherGrants.hub, undefined);
 assert.deepEqual(catalogWithLauncherGrant.find((app) => app.appId === "launcher")?.actionIds, ["hub.access_request.list_pending", "hub.user.read_admin_summary"]);
 assert.equal(deniedByLauncher.ops.status, "denied");
 assert.deepEqual(deniedByLauncher.ops.mcpServers, []);
 assert.deepEqual(deniedMcpServers, []);
+assert.equal(explicitDeniedCatalog.find((app) => app.appId === "ops")?.denied, true);
+assert.equal(explicitDeniedCatalog.find((app) => app.appId === "ops")?.deniedText, ACCESS_DENIED_TEXT);
 assert.deepEqual(runProfile.appAccess.grantedAppIds, ["ops"]);
-assert.deepEqual(runProfile.appAccess.deniedAppIds, ["engine", "launcher"]);
+assert.deepEqual(runProfile.appAccess.deniedAppIds, []);
+assert.deepEqual(runProfile.appAccess.notGrantedAppIds, ["engine", "launcher"]);
 assert.equal(JSON.stringify(publicProfile).includes(SECRET_TOKEN), false);
 assert.match(runProfile.diagnostics.profileHash, /^[a-f0-9]{16}$/);
 
@@ -195,7 +207,8 @@ console.log(JSON.stringify({
     "app_routing_catalog_in_run_profile",
     "hub_actions_route_to_launcher",
     "launcher_denial_removes_ops_mcp",
-    "denied_apps_have_standard_text",
+    "only_explicit_denied_apps_have_standard_text",
+    "not_granted_apps_do_not_claim_denied_access",
     "public_run_profile_redacts_mcp_headers",
     "public_run_profile_redacts_assistant_action_gateway_token",
     "stable_public_profile_hash",
@@ -366,8 +379,9 @@ function buildRunProfileAppCatalog({ appGrants, mcpServers, assistantActions })
       skillId: entry.skillId,
       status,
       granted: status === "granted",
-      denied: status !== "granted",
-      deniedText: status !== "granted" ? entry.deniedText : null,
+      denied: status === "denied",
+      notGranted: status === "not-granted",
+      deniedText: status === "denied" ? entry.deniedText : null,
       actionIds: actionIds.filter((actionId) => actionIdPrefixesForEntry(entry).some((prefix) => String(actionId || "").startsWith(prefix))),
       mcpServerNames: status === "granted"
         ? uniqueStrings([
@@ -393,9 +407,9 @@ function summarizeRunAppAccess(appCatalog) {
   return {
     schemaVersion: "ai-workspace.app-access.v1",
     grantedAppIds: apps.filter((app) => app?.granted === true).map((app) => app.appId).sort(),
-    deniedAppIds: apps.filter((app) => app?.granted !== true).map((app) => app.appId).sort(),
+    deniedAppIds: apps.filter((app) => app?.status === "denied" || app?.denied === true).map((app) => app.appId).sort(),
+    notGrantedAppIds: apps.filter((app) => app?.status === "not-granted").map((app) => app.appId).sort(),
     availableSkillIds: apps.filter((app) => app?.granted === true).map((app) => app.skillId).filter(Boolean).sort(),
-    deniedText: ACCESS_DENIED_TEXT,
   };
 }