Add builtin.help and system.intent to AllowedActions / ValidateActionIDs
Harden system.intent: Entrance=button matches only (no nested write dispatch)
Red tests for allowlist and button-only match
Why: First B-class allowlist entries per U5 r2 independent review.
Evidence: go test ./internal/genui/ ./internal/surfacesvc/ ./internal/server/
Impact: Surface buttons may bind help/intent safely.
Refs: Documents proposal 2026-10-12-generative-ui-bclass-help-intent
## Summary
- Add `builtin.help` and `system.intent` to AllowedActions / ValidateActionIDs
- Harden system.intent: Entrance=button matches only (no nested write dispatch)
- Red tests for allowlist and button-only match
Why: First B-class allowlist entries per U5 r2 independent review.
Evidence: go test ./internal/genui/ ./internal/surfacesvc/ ./internal/server/
Impact: Surface buttons may bind help/intent safely.
Refs: Documents proposal 2026-10-12-generative-ui-bclass-help-intent
Why: Generative UI U5 left the B-class action allowlist empty; owner
authorized first entries builtin.help and system.intent.
Evidence: go test ./internal/genui/ ./internal/surfacesvc/ ./internal/server/
Impact: Surface buttons may bind help/intent; button-entrance intent
matches only and does not nest-dispatch write commands.
Refs: docs/proposals/2026-10-12-generative-ui-bclass-help-intent.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Summary
builtin.helpandsystem.intentto AllowedActions / ValidateActionIDsWhy: First B-class allowlist entries per U5 r2 independent review.
Evidence: go test ./internal/genui/ ./internal/surfacesvc/ ./internal/server/
Impact: Surface buttons may bind help/intent safely.
Refs: Documents proposal 2026-10-12-generative-ui-bclass-help-intent