Fail closed stale ask accept as unavailable not reject

Overlay ask ids mint on the gate event at emit, not on
PermissionRequest. Escape still denies. An empty or mismatched
Enter cannot impersonate Reject.

Author: TheGreatAxios

CHANGELOG.md

@@ -16,8 +16,9 @@ parallel copies under `docs/` or `scripts/notes/`. At cut time: rename
 ### Fixed
 
 - Sequential TUI ask and permission selectors paint the live question's option
-  labels. Rows bind by ask and request id rather than render-order index, so a
-  later question cannot keep the previous question's choices.
+  labels. Overlay rows bind by an ask id minted at emit, not render-order
+  index. A stale or empty accept fail-closes as unavailable rather than
+  impersonating Reject; Escape still denies.
 
 ## [0.3.18] - 2026-09-08
 

docs/TUI.md

@@ -342,9 +342,13 @@ viewport kit: shared windowing, keep-active-visible, and page/jump behavior.
 There is exactly one scroll lease at a time; keyboard paging and the mouse
 wheel both follow whichever surface currently holds it, so a modal open on
 top of the transcript never lets the wheel move the transcript underneath it.
-Ask and permission rows bind by ask/request id, never render-order index;
-painted labels are the live payload, and stale rows whose ids are not in the
-new payload are dropped.
+Ask and permission rows are namespaced by the ask id minted when the overlay
+opens. Paint replaces the whole options array (labels and ids together);
+there is no drop-by-id merge. Enter binds by the painted id against the live
+bag — a painted value that is not in that bag, or Enter on an empty gate
+with no answer field, fail-closes the accept as unavailable rather than
+remapping by index or treating it as Reject. Escape still denies a
+permission and cancels an operator question through the dismiss path.
 
 "Current" is never inferred. For the model picker, the row marked
 `(current)` is read live from the session's actual active provider/model on

src/permission/gate.test.ts

@@ -236,39 +236,3 @@ describe("standing grant covers a later git worktree command (CL-5638)", () => {
     expect(prompts).toBe(1);
   });
 });
-
-describe("ask decision mints request.id", () => {
-  test("the copy handed to requestApproval has a non-empty id", async () => {
-    let captured: PermissionRequest | undefined;
-    const gate = createPermissionGate({
-      approvals: [],
-      interactive: true,
-      skipPermissions: false,
-      reactorGated: false,
-      requestApproval: async (request) => {
-        captured = request;
-        return { allow: true };
-      },
-    });
-    const verdict = await gate.evaluate(shellCall("npm test || true"));
-    expect(verdict.allowed).toBe(true);
-    expect(captured?.id).toEqual(expect.any(String));
-    expect(captured?.id?.length).toBeGreaterThan(0);
-  });
-
-  test("authorizeCall ask request carries a minted id", async () => {
-    const gate = createPermissionGate({
-      approvals: [],
-      interactive: true,
-      skipPermissions: false,
-      reactorGated: false,
-      requestApproval: async () => ({ allow: true }),
-    });
-    const result = await gate.authorizeCall(shellCall("npm test || true"));
-    expect(result.effect).toBe("ask");
-    if (result.effect !== "ask") throw new Error("expected ask");
-    const id = result.request.id;
-    expect(id).toEqual(expect.any(String));
-    expect(id?.length).toBeGreaterThan(0);
-  });
-});

src/permission/gate.ts

@@ -1,6 +1,5 @@
 import type { ToolCall } from "@intx/types/runtime";
 import { isAbsolute, resolve } from "node:path";
-import { randomUUID } from "node:crypto";
 import type {
   Approval,
   ApprovalOutcome,
@@ -43,17 +42,25 @@ import { NOOP_APPROVAL_LOG, type ApprovalLog, type ApprovalOutcomeKind } from ".
 // Closes out an operator prompt: ends the wait span and records the outcome.
 // buildRequests yields at most one request per tool call, and the two prompt
 // sites below are mutually exclusive, so this runs once per prompt shown.
+function finishApprovalWait(
+  telemetry: Telemetry,
+  waitSpanId: string,
+  tool: string,
+  outcome: ApprovalOutcome | undefined,
+): void {
+  const decision = outcome !== undefined && outcome.allow ? "allow" : "deny";
+  end(waitSpanId, outcome !== undefined ? { decision } : undefined);
+  telemetry.capture("permission_prompt", {
+    decision,
+    permission_kind: classifyPermissionKind(tool),
+  });
+}
+
 // Classifies a settled ApprovalOutcome into the approval-log taxonomy.
 // gate-wire.ts's timeout/abort auto-denies carry a fixed message text (see
 // autoDeny in gate-wire.ts and the timeout branch in tui/request-approval.ts's
 // finish() usage); anything else that denies is a plain operator/unavailable
 // decision.
-function withRequestId(request: PermissionRequest): PermissionRequest {
-  return request.id !== undefined && request.id.length > 0
-    ? request
-    : { ...request, id: randomUUID() };
-}
-
 function classifyOutcome(outcome: ApprovalOutcome | undefined): ApprovalOutcomeKind {
   if (outcome === undefined) return "deny";
   if (!outcome.allow) {
@@ -65,20 +72,6 @@ function classifyOutcome(outcome: ApprovalOutcome | undefined): ApprovalOutcomeK
   return outcome.persist !== undefined ? "allow-with-scope" : "allow-once";
 }
 
-function finishApprovalWait(
-  telemetry: Telemetry,
-  waitSpanId: string,
-  tool: string,
-  outcome: ApprovalOutcome | undefined,
-): void {
-  const decision = outcome !== undefined && outcome.allow ? "allow" : "deny";
-  end(waitSpanId, outcome !== undefined ? { decision } : undefined);
-  telemetry.capture("permission_prompt", {
-    decision,
-    permission_kind: classifyPermissionKind(tool),
-  });
-}
-
 export type GateVerdict = { allowed: true } | { allowed: false; reason: string };
 
 // One shell segment's forced-ask guard: a secret-path reference or a
@@ -653,7 +646,7 @@ export function createPermissionGate(options: PermissionGateOptions): Permission
         const requestForOperator = anySecret ? { ...request, scopes: [] } : request;
         return {
           kind: "ask",
-          request: withRequestId(requestForOperator),
+          request: requestForOperator,
           anySecret,
           segmentCount: segments.length,
         };
@@ -681,7 +674,7 @@ export function createPermissionGate(options: PermissionGateOptions): Permission
         };
       }
 
-      return { kind: "ask", request: withRequestId(request), anySecret: false, segmentCount: 0 };
+      return { kind: "ask", request, anySecret: false, segmentCount: 0 };
     }
     return { kind: "allow" };
   };

src/permission/types.ts

@@ -56,10 +56,6 @@ export interface PermissionRequest {
   // withheld for a reason beyond the ordinary "no persistent option exists
   // yet" case. Plain literal text, never model-authored.
   notice?: string;
-  // Set by the gate on the copy handed to requestApproval, never on
-  // buildRequests matching/display copies. Overlay rows bind by this id
-  // rather than render-order index (see gate-wire.ts).
-  id?: string;
   // Set by the gate right before handing this request to requestApproval, so
   // whichever surface actually renders it (see gate-wire.ts's overlay host)
   // can report the moment it reached the operator's screen — distinct from

src/tui/decision-truncation.test.ts

@@ -33,7 +33,6 @@ const hintRequest: PermissionRequest = {
       hint: HINT,
     },
   ],
-  id: "req-1",
 };
 
 function bodySelect(view: ReturnType<typeof createOverlayView>): SelectRenderable {
@@ -91,6 +90,7 @@ describe("decision choice rendering", () => {
       const emitter = new EventEmitter();
       const dispose = wireGates(emitter, shell);
       emitter.emit("permission.gate", {
+        id: "req-1",
         request: hintRequest,
         resolve: () => {},
       });

src/tui/gate-events.ts

@@ -1,6 +1,9 @@
 import type { ApprovalOutcome, PermissionRequest } from "../permission/types.js";
 import type { OperatorResult } from "../agent/tools.js";
 
+/** Fail-closed settle when no approval UI can bind the operator's accept. */
+export const APPROVAL_UNAVAILABLE_MESSAGE = "no approval UI available; request denied" as const;
+
 export interface OperatorGateEvent {
   /** Minted by the session emitter, never by the TUI overlay. */
   id: string;
@@ -23,6 +26,8 @@ export interface OperatorGateEvent {
 }
 
 export interface PermissionGateEvent {
+  /** Minted at overlay-open by the TUI emitter, never on PermissionRequest. */
+  id: string;
   request: PermissionRequest;
   resolve: (outcome: ApprovalOutcome) => void;
   /**