Merge remote-tracking branch 'origin/main' into cl-7303-vendor-the-past-head-intx-packages-step-1-needs-with-ledger

# Conflicts:
#	docs/VENDORING.md

Author: TheGreatAxios

CHANGELOG.md

@@ -16,6 +16,7 @@ parallel copies under `docs/` or `scripts/notes/`. At cut time: rename
 ### Changed
 
 - ChatGPT Codex uses the Corbits system prompt as Responses `instructions`, without fetching or injecting the official GPT-5 Codex prompt.
+- Main-session permission approvals ride the reactor's approval-suspend primitive: an ask-tier call parks as a PendingOperation and the operator's decision resumes it (previously held open through the middleware gate). Ask denials now surface as `denied by approver: <reason>`, and the model responds to the reason; policy hard-denies remain plain tool errors the model adapts to. Late decisions arriving after the approval timed out are dropped instead of being injected into the conversation, and gate deny reasons are written to the structured authz log.
 - Builder now bakes compact Ponytail guidance with default lite mode and uses a smaller native-runtime skill instead of the broad native-integration and TypeScript bodies by default.
 
 ## [0.3.17] - 2026-09-05

docs/ARCHITECTURE.md

@@ -377,6 +377,7 @@ tool call
 - **command** — Splits chained commands for security classification and derives command-shape approval scopes. Multi-segment chains only offer an exact-command persist pattern (a prefix like `npm *` must not cover `npm i && rm -rf /` later).
 - **auto-shell-policy** — Constrains `run_shell` even when auto mode would otherwise rubber-stamp it. Before matching, `expandShellSubjects` peels `bash`/`sh`/`zsh -c`, `xargs` utility tails, and transparent prefixes (`env`, `nice`, `timeout`, …) so rules see the real payload; an unparseable wrapper (variable expansion or command substitution) sets an opaque flag that forces `ask`. Effects: `deny` blocks outright (file mutations through ad-hoc tooling — output redirection, `tee`, `sed -i`/`perl -i`, interpreter inline programs or heredocs — which must instead go through `write_file`/`edit_file`); `ask` declines to auto-allow and falls through to the operator prompt (recursive `rm`, dependency installs and remote runners: npm/yarn/pnpm/bun, pip, cargo, go, brew, npx/bunx, …, force or uncontained `git worktree` ops, shell that references a sensitive path such as `.env` or a private key, and opaque wrappers). Contained non-force `git worktree add`/`remove`/`prune` and read-only `list` auto-allow (sibling destinations like `../corbits-dispatch-wts/…` included; absolute outside, `~`, globs, and credential basenames still ask). Deny beats ask when multiple subjects match. Quoted spans are stripped before pattern matching so a quoted `>` or install word in an argument is not flagged, and program names are matched only in command position. Adding a table category is a one-line rule append in `AUTO_SHELL_RULES`.
 - **gate** — Evaluates a call: `skipPermissions` allows everything; `allow`-tier passes; for `ask`-tier, checks persisted approvals, otherwise requests operator approval. Shell security classifies each chain segment (`||` / `&&` / `|` / `;` / newlines), but the operator is prompted once for the full command block — any unapproved segment fails the whole block, and execution always runs the unsplit original. Safe pipeline tails and pure shell no-ops (`true` / `false` / `:` and bare control-flow keywords stranded by chain-splitting) skip without a prompt. In a non-interactive run an unresolved `ask` becomes a denial. In auto mode: non-shell built-ins in `AUTO_ALLOWED_TOOLS` (writes/edits/deletes, `manage_tasks`, `spawn_agent`, `wait_agents`, …) auto-allow when not path-restricted; for `run_shell` the gate consults the auto-shell policy — a `deny` rule fails the call, an `ask` rule skips the auto-allow shortcut and proceeds to the normal approval flow, and anything unmatched is auto-allowed. Paths outside the workspace and writes under the session state root (`~/.corbits/projects/...` and legacy `.agent-state`) still ask under auto mode. Under `--dangerously-skip-permissions` (forces this process) or `/yolo` (persists as the user-global default via `setSkipPermissions`), the gate auto-allows those same cases, and pre-gate sandboxes (path-escape, shell session cwd retention, `list_dir` / `delete_file` workspace bounds) honor `getSkipPermissions()` live so outside-workspace access is not hard-denied after the gate already allowed it — without rebuilding the plugin stack. Secret-guard path denies and authorization hard blocks still apply. Mutating MCP and unknown built-ins are not blanket-allowed outside skip. Newly granted scopes are appended in memory and persisted.
+  - **Reactor-gated sessions (main session; `reactorGated: true`).** The gate's decision logic lives in one `decide()` used by both consumers: `evaluate()` (the middleware path below, still used by sub-agents) and `authorizeCall()`, which expresses the decision as the vendored reactor's before-tool authz effect (`src/permission/reactor-authorize.ts` bridges it into `env.authorize`). An `ask` there suspends the call as a reactor `PendingOperation` keyed by a correlationId (persisted through the context store's existing `pendingOperations`); `send()` settles as `suspended` and `src/session/approval-resume.ts` rebuilds the operator request from the approval snapshot, resolves it through the same `requestApproval` seam the TUI overlay uses, and delivers the decision to the reactor on the correlationId signal channel — an approved decision grants a one-shot bypass and the exact parked call re-dispatches; a rejected one answers it with an error result. Under reactor gating the middleware/MCP `gateToolCall` bypasses the gate so an approved re-dispatch never re-asks. The headless denial and the stricter chained-command hard-deny are preserved as deny effects (upstream `block`s) decided inside the same `decide()`.
 
 - **matcher** — Approval pattern matching via `@intx/authz` `matchPattern` (`*` wildcards). Exact-command grants store a backslash before each metacharacter; those patterns match by equality after unescape (the package has no escape syntax).
 - **authz-grants** — Maps stored approvals into `@intx/authz` `GrantRule`s and evaluates them with `evaluateGrants` (allow-only; Corbits cwd/provider-model filters applied first). Exact-escaped grants bypass the package path and use equality.

docs/VENDORING.md

@@ -205,11 +205,12 @@ the old root export had, so this is an import-path change, not a
 behavioral one. The package also picked up two new dependencies
 (`@isomorphic-git/lightning-fs`, `buffer`, both used only by the new
 `./browser` runtime, which nothing here imports) and a new
-`@intx/crypto` dev dependency for its own test suite, pinned to `0.2.2` —
+`@intx/crypto` dev dependency for its own test suite, pinned to `0.3.0` —
 the same "stay on published npm for a package we don't vendor" pattern as
-the `@intx/log` dependency on the other vendored packages; `@intx/mime`
-joined the vendored set in the 2026-09-07 step-1 pass, and its consumers
-now resolve it through the root `workspace:*` override.
+the `@intx/log` dependency on the other vendored packages, kept aligned
+with the root's published `0.3.0` pin so the lockfile never nests duplicate
+copies; `@intx/mime` joined the vendored set in the 2026-09-07 step-1 pass,
+and its consumers now resolve it through the root `workspace:*` override.
 
 One new upstream test, `browser-bundle.test.ts`, is excluded via
 `bunfig.toml`'s `pathIgnorePatterns`. It bundles `browser.ts` with

src/agent/apply-patch-diff.test.ts

@@ -32,6 +32,7 @@ async function makeApplyPatch(
     approvals: [],
     interactive: false,
     skipPermissions: options.skipPermissions ?? true,
+    reactorGated: false,
     auto: false,
     cwd,
   });

src/agent/director.ts

@@ -21,6 +21,12 @@ import { isInternalRecoveryAbortRaw } from "../inference-abort.js";
 import { LOG_NAMESPACE_ROOT } from "../branding.js";
 import { resolveModelFamilyPolicy, type ModelFamilyPolicy } from "./model-family-policy.js";
 import { PRESENT_VIEW_PRIMITIVES_GUIDANCE } from "./tool-schema-normalize.js";
+import {
+  APPROVER_REJECTION_MARKER,
+  DENIED_BY_POLICY_MARKER,
+  NO_MATCHING_GRANTS_MARKER,
+  OPERATOR_DECLINED_MARKER,
+} from "../permission/decline-markers.js";
 
 const logger = getLogger([LOG_NAMESPACE_ROOT, "agent", "director"]);
 
@@ -269,16 +275,52 @@ export const submitOutputDefinition: ToolDefinition = {
   },
 };
 
-function isOperatorDeclinedToolResult(result: { content: unknown; isError?: boolean }): boolean {
-  return (
-    result.isError === true &&
-    typeof result.content === "string" &&
-    result.content.includes("Blocked by permission policy: Operator declined:")
-  );
+// Classification of a failed tool call's model-facing text. Two flows produce
+// these texts: the middleware path (permission-plugin prefixing the gate's
+// "Operator declined: …" reason, still used by sub-agents) and the reactor
+// path, where a rejected approval decision answers the parked call with
+// upstream's "denied by approver…" error result and a deny/no-grant effect
+// arrives as a block ("Denied by policy: …" / "No matching grants for …"). A
+// policy deny is not an operator decision at all — the model adapts to the
+// deny text as it would to any tool error — while an approver rejection
+// either carries a reason the model should respond to or doesn't (canned
+// reply stands). The marker strings themselves live in
+// permission/decline-markers.ts alongside their producing seams.
+type DeclinedToolResult = { kind: "approver-rejection"; reason?: string } | { kind: "policy-deny" };
+
+const POLICY_DENY_MARKERS = [DENIED_BY_POLICY_MARKER, NO_MATCHING_GRANTS_MARKER] as const;
+
+function isPolicyDeny(content: string): boolean {
+  return POLICY_DENY_MARKERS.some((marker) => content.includes(marker));
 }
 
-function operatorDeclinedHasMessage(result: { content: unknown }): boolean {
-  return typeof result.content === "string" && / — .+/.test(result.content);
+// The middleware path appends the operator's reason after an em-dash; the
+// reactor path after "denied by approver: ". Both are undefined when the
+// operator declined without a reason.
+function approverRejectionReason(content: string): string | undefined {
+  const reactor = content.match(new RegExp(`${APPROVER_REJECTION_MARKER}: (.+)`));
+  if (reactor !== null) return reactor[1];
+  if (content.includes(OPERATOR_DECLINED_MARKER)) {
+    const separator = content.indexOf(" — ");
+    if (separator !== -1) return content.slice(separator + 3);
+  }
+  return undefined;
+}
+
+function classifyDeclinedToolResult(result: {
+  content: unknown;
+  isError?: boolean;
+}): DeclinedToolResult | null {
+  if (result.isError !== true || typeof result.content !== "string") return null;
+  const content = result.content;
+  if (isPolicyDeny(content)) return { kind: "policy-deny" };
+  if (content.includes(APPROVER_REJECTION_MARKER) || content.includes(OPERATOR_DECLINED_MARKER)) {
+    const reason = approverRejectionReason(content);
+    return reason === undefined
+      ? { kind: "approver-rejection" }
+      : { kind: "approver-rejection", reason };
+  }
+  return null;
 }
 
 const CODE_FILE_EXT =
@@ -715,24 +757,32 @@ class ChatDirectorImpl extends DefaultDirector {
       if (!event.result.isError) this.onActivateTools?.(["lsp"]);
     }
 
-    if (event.type === "tool.done" && isOperatorDeclinedToolResult(event.result)) {
-      if (operatorDeclinedHasMessage(event.result)) {
-        return super.decide(event, state, capabilities);
-      }
-      if (hasActiveTasks(this.tasks)) {
-        if (this.declinedTerminationNudges < MAX_DECLINED_OPEN_TASK_NUDGES) {
-          this.declinedTerminationNudges++;
-          return [
-            capabilities.checkpoint("operator-declined"),
-            inferWithNudge(capabilities, DECLINED_OPEN_TASK_NUDGE),
-          ];
+    if (event.type === "tool.done") {
+      const declined = classifyDeclinedToolResult(event.result);
+      // Reason-less approver rejections are the only canned case: the model
+      // has no reason to respond to. Reason-bearing approver rejections and
+      // policy denies re-infer below — the model responds to the reason or
+      // adapts to the deny text.
+      if (
+        declined !== null &&
+        declined.kind === "approver-rejection" &&
+        declined.reason === undefined
+      ) {
+        if (hasActiveTasks(this.tasks)) {
+          if (this.declinedTerminationNudges < MAX_DECLINED_OPEN_TASK_NUDGES) {
+            this.declinedTerminationNudges++;
+            return [
+              capabilities.checkpoint("operator-declined"),
+              inferWithNudge(capabilities, DECLINED_OPEN_TASK_NUDGE),
+            ];
+          }
+          this.logTerminationWithOpenTasks("operator-declined");
         }
-        this.logTerminationWithOpenTasks("operator-declined");
+        return [
+          capabilities.checkpoint("operator-declined"),
+          capabilities.reply("Tool call rejected by operator."),
+        ];
       }
-      return [
-        capabilities.checkpoint("operator-declined"),
-        capabilities.reply("Tool call rejected by operator."),
-      ];
     }
 
     // Keep the running local estimate current on every cycle (tool results and

src/agent/exa-web-fetch-alias.test.ts

@@ -96,7 +96,12 @@ const { resolveMcpServers } = await import("../config/index.js");
 const { coreSubAgentWebTools } = await import("../subagent/run.js");
 
 function permissionGate() {
-  return createPermissionGate({ approvals: [], interactive: false, skipPermissions: true });
+  return createPermissionGate({
+    approvals: [],
+    interactive: false,
+    skipPermissions: true,
+    reactorGated: false,
+  });
 }
 
 async function makeToolset(

src/agent/posix-tool-plugins.test.ts

@@ -39,6 +39,7 @@ describe("buildCorePosixToolPlugins", () => {
         approvals: [],
         interactive: false,
         skipPermissions: false,
+        reactorGated: false,
         auto: false,
         cwd,
       });
@@ -58,6 +59,7 @@ describe("buildCorePosixToolPlugins", () => {
         approvals: [],
         interactive: false,
         skipPermissions: true,
+        reactorGated: false,
         cwd,
       });
       const allowedRunner = createPosixTools({
@@ -88,6 +90,7 @@ describe("buildCorePosixToolPlugins", () => {
         approvals: [],
         interactive: false,
         skipPermissions: true,
+        reactorGated: false,
         cwd,
       });
       const runner = createPosixTools({
@@ -116,6 +119,7 @@ describe("buildCorePosixToolPlugins", () => {
         approvals: [],
         interactive: false,
         skipPermissions: false,
+        reactorGated: false,
         auto: true,
         cwd,
       });
@@ -145,6 +149,7 @@ describe("buildCorePosixToolPlugins", () => {
         approvals: [],
         interactive: false,
         skipPermissions: false,
+        reactorGated: false,
         auto: true,
         cwd,
       });
@@ -187,6 +192,7 @@ describe("buildCorePosixToolPlugins", () => {
         approvals: [],
         interactive: false,
         skipPermissions: true,
+        reactorGated: false,
         cwd,
       });
       const runner = createPosixTools({
@@ -234,6 +240,7 @@ describe("buildCorePosixToolPlugins", () => {
         approvals: [],
         interactive: false,
         skipPermissions: true,
+        reactorGated: false,
         cwd,
       });
       const runner = createPosixTools({
@@ -299,6 +306,7 @@ describe("buildCorePosixToolPlugins", () => {
         approvals: [],
         interactive: false,
         skipPermissions: true,
+        reactorGated: false,
         cwd,
       });
       const plugins = buildCorePosixToolPlugins({ cwd, permissionGate: gate });
@@ -324,6 +332,7 @@ describe("buildCorePosixToolPlugins", () => {
         approvals: [],
         interactive: false,
         skipPermissions: true,
+        reactorGated: false,
         cwd,
       });
       const runner = createPosixTools({
@@ -403,6 +412,7 @@ describe("buildCorePosixToolPlugins", () => {
         approvals: [],
         interactive: false,
         skipPermissions: true,
+        reactorGated: false,
         cwd,
       });
       const runner = createPosixTools({
@@ -455,6 +465,7 @@ describe("buildCorePosixToolPlugins", () => {
       approvals: [],
       interactive: false,
       skipPermissions: true,
+      reactorGated: false,
       cwd: "/tmp",
     });
     const plugins = buildCorePosixToolPlugins({ cwd: "/tmp", permissionGate: gate });
@@ -511,6 +522,7 @@ describe("buildCorePosixToolPlugins", () => {
       approvals: [],
       interactive: false,
       skipPermissions: true,
+      reactorGated: false,
       cwd: "/tmp",
     });
     const plugins = buildCorePosixToolPlugins({ cwd: "/tmp", permissionGate: gate });

src/agent/tools-mcp-disconnect.test.ts

@@ -60,7 +60,12 @@ const { createAgentToolset } = await import("./tools.js");
 const { resolveMcpServers } = await import("../config/index.js");
 
 function permissionGate() {
-  return createPermissionGate({ approvals: [], interactive: false, skipPermissions: true });
+  return createPermissionGate({
+    approvals: [],
+    interactive: false,
+    skipPermissions: true,
+    reactorGated: false,
+  });
 }
 
 async function makeToolset() {

src/director.test.ts

@@ -114,6 +114,69 @@ describe("operator declined tool calls", () => {
     expect(hasDone(actions)).toBe(false);
     expect(hasInfer(actions)).toBe(false);
   });
+
+  // Reactor path: a reason-bearing approver rejection must re-infer so the
+  // model can respond to the reason — never the canned decline.
+  test("reason-bearing approver rejection re-infers on the reason", async () => {
+    const director = createChatDirector("", [], { onTasksChange: () => {} });
+    const actions = actionsArray(
+      await director.decide(
+        makeToolErrorEvent("c", "denied by approver: never touch /etc"),
+        mockState,
+        mockCapabilities,
+      ),
+    );
+    expect(hasInfer(actions)).toBe(true);
+    expect(hasDeclineReply(actions)).toBe(false);
+    expect(hasCheckpoint(actions)).toBe(false);
+  });
+
+  test("middleware rejection with a reason re-infers on the reason", async () => {
+    const director = createChatDirector("", [], { onTasksChange: () => {} });
+    const actions = actionsArray(
+      await director.decide(
+        makeToolErrorEvent("c", `${declined} — only run it in the build sandbox`),
+        mockState,
+        mockCapabilities,
+      ),
+    );
+    expect(hasInfer(actions)).toBe(true);
+    expect(hasDeclineReply(actions)).toBe(false);
+    expect(hasCheckpoint(actions)).toBe(false);
+  });
+
+  // Reactor path: a reason-less approver rejection has nothing for the model
+  // to respond to; the canned reply stands.
+  test("reason-less approver rejection takes the canned path", async () => {
+    const director = createChatDirector("", [], { onTasksChange: () => {} });
+    const actions = actionsArray(
+      await director.decide(
+        makeToolErrorEvent("c", "denied by approver"),
+        mockState,
+        mockCapabilities,
+      ),
+    );
+    expect(hasCheckpoint(actions)).toBe(true);
+    expect(hasDeclineReply(actions)).toBe(true);
+    expect(hasInfer(actions)).toBe(false);
+  });
+
+  // Policy denies and no-grant blocks are not operator decisions: the model
+  // adapts to the deny text like any tool error.
+  test("policy deny is not classified as an operator decline", async () => {
+    const director = createChatDirector("", [], { onTasksChange: () => {} });
+    for (const content of [
+      "Denied by policy: tool:run_shell/invoke",
+      "No matching grants for tool:run_shell/invoke",
+    ]) {
+      const actions = actionsArray(
+        await director.decide(makeToolErrorEvent("c", content), mockState, mockCapabilities),
+      );
+      expect(hasInfer(actions)).toBe(true);
+      expect(hasDeclineReply(actions)).toBe(false);
+      expect(hasCheckpoint(actions)).toBe(false);
+    }
+  });
 });
 
 describe("open-task termination guard", () => {
@@ -753,6 +816,7 @@ describe("updateToolDefinitions rewrites infer tools", () => {
         approvals: [],
         interactive: false,
         skipPermissions: true,
+        reactorGated: false,
       }),
       onOperatorGate: async () => ({ kind: "cancel" }),
     });
@@ -836,6 +900,7 @@ describe("submit_output workflow handler", () => {
         approvals: [],
         interactive: false,
         skipPermissions: true,
+        reactorGated: false,
       }),
       onOperatorGate: async () => ({ kind: "cancel" }),
       isWorkflowActive: opts.isWorkflowActive,