Bind inherited MCP tools to the worker permission gate

Parent MCP handlers closed over a middleware-gated isReactorGated of
false, so an allowed worker call re-entered evaluate and hung on
requestApproval. Workers now wrap inherited MCP tools with the same
reactor-gated view as posix.

Author: TheGreatAxios

docs/ARCHITECTURE.md

@@ -378,7 +378,7 @@ tool call
 - **auto-shell-policy** — Constrains `run_shell` even when auto mode would otherwise rubber-stamp it. Before matching, `expandShellSubjects` peels `bash`/`sh`/`zsh -c`, `xargs` utility tails, and transparent prefixes (`env`, `nice`, `timeout`, …) so rules see the real payload; an unparseable wrapper (variable expansion or command substitution) sets an opaque flag that forces `ask`. Effects: `deny` blocks outright (file mutations through ad-hoc tooling — output redirection, `tee`, `sed -i`/`perl -i`, interpreter inline programs or heredocs — which must instead go through `write_file`/`edit_file`); `ask` declines to auto-allow and falls through to the operator prompt (recursive `rm`, dependency installs and remote runners: npm/yarn/pnpm/bun, pip, cargo, go, brew, npx/bunx, …, force or uncontained `git worktree` ops, shell that references a sensitive path such as `.env` or a private key, and opaque wrappers). Contained non-force `git worktree add`/`remove`/`prune` and read-only `list` auto-allow (sibling destinations like `../corbits-dispatch-wts/…` included; absolute outside, `~`, globs, and credential basenames still ask). Deny beats ask when multiple subjects match. Quoted spans are stripped before pattern matching so a quoted `>` or install word in an argument is not flagged, and program names are matched only in command position. Adding a table category is a one-line rule append in `AUTO_SHELL_RULES`.
 - **gate** — Evaluates a call: `skipPermissions` allows everything; `allow`-tier passes; for `ask`-tier, checks persisted approvals, otherwise requests operator approval. Shell security classifies each chain segment (`||` / `&&` / `|` / `;` / newlines), but the operator is prompted once for the full command block — any unapproved segment fails the whole block, and execution always runs the unsplit original. Safe pipeline tails and pure shell no-ops (`true` / `false` / `:` and bare control-flow keywords stranded by chain-splitting) skip without a prompt. In a non-interactive run an unresolved `ask` becomes a denial. In auto mode: non-shell built-ins in `AUTO_ALLOWED_TOOLS` (writes/edits/deletes, `manage_tasks`, `spawn_agent`, `wait_agents`, …) auto-allow when not path-restricted; for `run_shell` the gate consults the auto-shell policy — a `deny` rule fails the call, an `ask` rule skips the auto-allow shortcut and proceeds to the normal approval flow, and anything unmatched is auto-allowed. Paths outside the workspace and writes under the session state root (`~/.corbits/projects/...` and legacy `.agent-state`) still ask under auto mode. Under `--dangerously-skip-permissions` (forces this process) or `/yolo` (persists as the user-global default via `setSkipPermissions`), the gate auto-allows those same cases, and pre-gate sandboxes (path-escape, shell session cwd retention, `list_dir` / `delete_file` workspace bounds) honor `getSkipPermissions()` live so outside-workspace access is not hard-denied after the gate already allowed it — without rebuilding the plugin stack. Secret-guard path denies and authorization hard blocks still apply. Mutating MCP and unknown built-ins are not blanket-allowed outside skip. Newly granted scopes are appended in memory and persisted.
   - **Reactor-gated main session (`reactorGated: true`).** The gate's decision logic lives in one `decide()` used by both consumers: `evaluate()` (the middleware path) and `authorizeCall()`, which expresses the decision as the vendored reactor's before-tool authz effect (`src/permission/reactor-authorize.ts` bridges it into `env.authorize`). An `ask` there suspends the call as a reactor `PendingOperation` keyed by a correlationId (persisted through the context store's existing `pendingOperations`); `send()` settles as `suspended` and `src/session/approval-resume.ts` rebuilds the operator request from the approval snapshot, resolves it through the same `requestApproval` seam the TUI overlay uses, and delivers the decision to the reactor on the correlationId signal channel — an approved decision grants a one-shot bypass and the exact parked call re-dispatches; a rejected one answers it with an error result. Under reactor gating the middleware/MCP `gateToolCall` bypasses the gate so an approved re-dispatch never re-asks. The headless denial and the stricter chained-command hard-deny are preserved as deny effects (upstream `block`s) decided inside the same `decide()`.
-  - **Worker reactor ownership.** `workerPermissionGate` is a reactor-gated view over the parent's live permission gate: grants and policy are shared, not copied or toggled. Worker posix/MCP plugins skip middleware because that view reports `isReactorGated()`. `authorizeCall` on the view never emits `ask` — unresolved approvals become denials that name the permission subject, without invoking an approval callback or suspending, even with an interactive parent; the parent can obtain a grant and retry. Worker control-plane tools (`submit_result`, `ask_director`, and nested fleet verbs other than `spawn_agent`) allow without a parent grant. Authorization and tool execution run under the same async-local worker identity and cwd. Fleet authority remains an independent restriction, not an alternative permission grant.
+  - **Worker reactor ownership.** `workerPermissionGate` is a reactor-gated view over the parent's live permission gate: grants and policy are shared, not copied or toggled. Worker posix plugins and inherited MCP tools are bound to that view at worker start, so they skip middleware because the view reports `isReactorGated()` — they do not close over the parent's middleware-gated `isReactorGated()`. `authorizeCall` on the view never emits `ask` — unresolved approvals become denials that name the permission subject, without invoking an approval callback or suspending, even with an interactive parent; the parent can obtain a grant and retry. Worker control-plane tools (`submit_result`, `ask_director`, and nested fleet verbs other than `spawn_agent`) allow without a parent grant. Authorization and tool execution run under the same async-local worker identity and cwd. Fleet authority remains an independent restriction, not an alternative permission grant.
 
 - **matcher** — Approval pattern matching via `@intx/authz` `matchPattern` (`*` wildcards). Exact-command grants store a backslash before each metacharacter; those patterns match by equality after unescape (the package has no escape syntax).
 - **authz-grants** — Maps stored approvals into `@intx/authz` `GrantRule`s and evaluates them with `evaluateGrants` (allow-only; Corbits cwd/provider-model filters applied first). Exact-escaped grants bypass the package path and use equality.

src/agent/tools.ts

@@ -32,8 +32,9 @@ import {
   EXA_MCP_SERVER_NAME,
   isBuiltinExaMCPServer,
 } from "../mcp/exa.js";
-import { mcpClientToAgentTools } from "../mcp/plugin.js";
+import { mcpClientTools } from "../mcp/plugin.js";
 import { parseMcpToolName } from "../mcp/tool-name.js";
+import { gateAgentTools } from "../plugins/permission-plugin.js";
 import { createDynamicToolRunner, type DynamicToolRunner } from "../tui/dynamic-tool-runner.js";
 import type { MCPServerConfig, Settings } from "../config/settings.js";
 import {
@@ -402,7 +403,7 @@ export async function createAgentToolset(args: AgentToolsetArgs): Promise<AgentT
       fleetSessionsForDispose = fleetSessions;
       const fleetDeps = {
         permissionGate,
-        inheritMcpTools: () => inheritedMcpTools,
+        inheritMcpTools: (gate: PermissionGate) => gateAgentTools(inheritedMcpTools, gate),
         ...(shellTimeout !== undefined ? { shellTimeout } : {}),
         ...(shellEnv !== undefined ? { shellEnv } : {}),
         ...(extraToolPlugins.length > 0 ? { extraToolPlugins } : {}),
@@ -798,12 +799,12 @@ export async function createAgentToolset(args: AgentToolsetArgs): Promise<AgentT
           return;
         }
         permissionGate.registerMcpClient(result.client);
-        const mcpTools = mcpClientToAgentTools(result.client, permissionGate, {
+        const mcpTools = mcpClientTools(result.client, {
           ...(getBlobWriter !== undefined ? { getBlobWriter } : {}),
           ...(getContextDir !== undefined ? { getContextDir } : {}),
           ...(isBuiltinExaMCPServer(config) ? { excludeToolNames: ["web_fetch_exa"] } : {}),
         });
-        dynamicRunner.addTools(mcpTools);
+        dynamicRunner.addTools(gateAgentTools(mcpTools, permissionGate));
         inheritedMcpTools.push(...mcpTools);
         connectedClients.set(config.name, result.client);
       } catch (err) {

src/mcp/plugin.ts

@@ -1,7 +1,7 @@
 import type { AgentTool } from "@intx/agent";
 import type { ToolCall, ToolResult } from "@intx/types/runtime";
 import type { PermissionGate } from "../permission/gate.js";
-import { gateToolCall } from "../plugins/permission-plugin.js";
+import { gateAgentTools } from "../plugins/permission-plugin.js";
 import { scrubSecretShapedContent } from "../plugins/tool-result-secret-scrub.js";
 import {
   truncateToolResultContent,
@@ -27,14 +27,7 @@ function sanitizeMcpResultContent(
   return truncateToolResultContent(scrubSecretShapedContent(content), undefined, spill);
 }
 
-// Convert a connected client's tools into AgentTools for the dynamic runner used
-// by the TUI. These tools live in a separate runner from the posix tool plugin
-// chain, so each handler is wrapped with the permission gate directly.
-export function mcpClientToAgentTools(
-  client: MCPClient,
-  gate: PermissionGate,
-  spillOptions: McpSpillOptions = {},
-): AgentTool[] {
+export function mcpClientTools(client: MCPClient, spillOptions: McpSpillOptions = {}): AgentTool[] {
   const { getBlobWriter, getContextDir, excludeToolNames = [] } = spillOptions;
   const excluded = new Set(excludeToolNames);
 
@@ -47,28 +40,38 @@ export function mcpClientToAgentTools(
         description: `[${client.serverName}] ${tool.description}`,
         inputSchema: tool.inputSchema,
       },
-      handler: (call: ToolCall, signal: AbortSignal): Promise<ToolResult> =>
-        gateToolCall(gate, call, signal, async () => {
-          try {
-            const content = await client.call(tool.name, call.arguments, signal);
-            const writeBlob = getBlobWriter?.();
-            const contextDir = getContextDir?.();
-            const spill =
-              writeBlob !== undefined
-                ? {
-                    callId: call.id,
-                    writeBlob,
-                    ...(contextDir !== undefined ? { contextDir } : {}),
-                  }
-                : undefined;
-            return { callId: call.id, content: await sanitizeMcpResultContent(content, spill) };
-          } catch (err) {
-            return {
-              callId: call.id,
-              content: err instanceof Error ? err.message : String(err),
-              isError: true,
-            };
-          }
-        }),
+      handler: async (call: ToolCall, signal: AbortSignal): Promise<ToolResult> => {
+        try {
+          const content = await client.call(tool.name, call.arguments, signal);
+          const writeBlob = getBlobWriter?.();
+          const contextDir = getContextDir?.();
+          const spill =
+            writeBlob !== undefined
+              ? {
+                  callId: call.id,
+                  writeBlob,
+                  ...(contextDir !== undefined ? { contextDir } : {}),
+                }
+              : undefined;
+          return { callId: call.id, content: await sanitizeMcpResultContent(content, spill) };
+        } catch (err) {
+          return {
+            callId: call.id,
+            content: err instanceof Error ? err.message : String(err),
+            isError: true,
+          };
+        }
+      },
     }));
 }
+
+// Convert a connected client's tools into AgentTools for the dynamic runner used
+// by the TUI. These tools live in a separate runner from the posix tool plugin
+// chain, so each handler is wrapped with the permission gate directly.
+export function mcpClientToAgentTools(
+  client: MCPClient,
+  gate: PermissionGate,
+  spillOptions: McpSpillOptions = {},
+): AgentTool[] {
+  return gateAgentTools(mcpClientTools(client, spillOptions), gate);
+}

src/plugins/permission-plugin.ts

@@ -1,3 +1,4 @@
+import type { AgentTool } from "@intx/agent";
 import type { ToolPlugin } from "@intx/tools-posix";
 import type { ToolCall, ToolResult } from "@intx/types/runtime";
 import { BLOCKED_BY_POLICY_PREFIX } from "../permission/decline-markers.js";
@@ -32,6 +33,19 @@ export async function gateToolCall(
   return next(call, signal);
 }
 
+// Bind full AgentTools to a gate. Workers pass workerPermissionGate so inherited
+// MCP handlers skip middleware the same way posix plugins do.
+export function gateAgentTools(tools: readonly AgentTool[], gate: PermissionGate): AgentTool[] {
+  return tools.map((tool) => {
+    if (tool.kind !== "full") return tool;
+    const inner = tool.handler;
+    return {
+      ...tool,
+      handler: (call: ToolCall, signal: AbortSignal) => gateToolCall(gate, call, signal, inner),
+    };
+  });
+}
+
 // Gate consequential tool calls on operator approval. Runs after the
 // authorization plugin (which hard-denies catastrophic commands), so by the time
 // a call reaches here it is at worst "consequential but legitimate" — the gate

src/subagent/run.ts

@@ -523,7 +523,7 @@ async function runSubAgentInner(
       ),
     }));
 
-    const inherited = params.inheritMcpTools?.() ?? [];
+    const inherited = params.inheritMcpTools?.(permissionGate) ?? [];
     tools = [...tools, ...coreSubAgentWebTools(inherited)];
 
     if (inherited.length > 0) {

src/subagent/types.ts

@@ -42,7 +42,7 @@ export interface SubAgentProvider {
 // recursion bottoms out at one hop of orchestration.
 export interface SubAgentSandboxDeps {
   permissionGate: PermissionGate;
-  inheritMcpTools?: () => readonly AgentTool[];
+  inheritMcpTools?: (gate: PermissionGate) => readonly AgentTool[];
   shellTimeout?: ShellTimeoutConfig;
   extraToolPlugins?: ToolPlugin[];
   /** Parent session blob store for bounded tool-output:// reads in workers. */

tests/integration/subagent-permission.test.ts

@@ -264,8 +264,7 @@ test.serial(
           close: async () => undefined,
         };
         params.permissionGate.registerMcpClient(client);
-        const tools = mcpClientToAgentTools(client, params.permissionGate);
-        params.inheritMcpTools = () => tools;
+        params.inheritMcpTools = (gate) => mcpClientToAgentTools(client, gate);
         harness.scenario.replyOnce("openai", {
           toolCalls: [{ name: "mcp__probe__mutate", args: {} }],
         });
@@ -293,6 +292,66 @@ test.serial(
   20000,
 );
 
+test.serial(
+  "allowed inherited MCP call with middleware-gated parent does not requestApproval",
+  async () => {
+    let asks = 0;
+    await withWorker(
+      async ({ harness, params, audit }) => {
+        let calls = 0;
+        const client = {
+          serverName: "probe",
+          tools: [
+            {
+              name: "mutate",
+              description: "mutates",
+              inputSchema: { type: "object", properties: {} },
+            },
+          ],
+          call: async () => {
+            calls++;
+            return "changed";
+          },
+          close: async () => undefined,
+        };
+        params.permissionGate.registerMcpClient(client);
+        params.permissionGate.setSeededApprovals([
+          { tool: "mcp__probe__mutate", pattern: "mcp__probe__mutate" },
+        ]);
+        const authorize = params.permissionGate.authorizeCall;
+        params.permissionGate.authorizeCall = async (call) => {
+          const result = await authorize(call);
+          params.permissionGate.setSeededApprovals([]);
+          return result;
+        };
+        params.inheritMcpTools = (gate) => mcpClientToAgentTools(client, gate);
+        harness.scenario.replyOnce("openai", {
+          toolCalls: [{ name: "mcp__probe__mutate", args: {} }],
+        });
+        harness.scenario.replyOnce("openai", { text: report });
+        await Promise.all([runSubAgent(params), harness.run({ wallClockBudgetMs: 15000 })]);
+        expect(calls).toBe(1);
+        expect(asks).toBe(0);
+        expect((await audit())[0]?.authz?.effect).toBe("allow");
+      },
+      (cwd) =>
+        createPermissionGate({
+          cwd,
+          approvals: [],
+          interactive: true,
+          auto: false,
+          skipPermissions: false,
+          reactorGated: false,
+          requestApproval: async () => {
+            asks++;
+            return { allow: true };
+          },
+        }),
+    );
+  },
+  20000,
+);
+
 test.serial(
   "live worker authorization is not evaluated again after policy revocation before runner",
   async () => {

tests/unit/tui/agent-tools.test.ts

@@ -73,6 +73,7 @@ await withMockedModule(
 );
 
 await withMockedModule(import.meta.resolve("../../../src/mcp/plugin.js"), () => ({
+  mcpClientTools: () => [],
   mcpClientToAgentTools: () => [],
 }));
 
@@ -90,6 +91,7 @@ await withMockedModule(import.meta.resolve("../../../src/plugins/verify-plugin.j
 
 await withMockedModule(import.meta.resolve("../../../src/plugins/permission-plugin.js"), () => ({
   permissionPlugin: () => ({}),
+  gateAgentTools: (tools: unknown) => tools,
   gateToolCall: async (
     _gate: unknown,
     call: ToolCall,