Align inherit tests with middleware deny and grant retry

Workers deny without asking when parent-gated MCP tools are wrapped
again. A later call id after a parent grant must still pass
gateToolCall instead of reusing the prior deny.

Author: TheGreatAxios

src/permission/reactor-authorize.test.ts

@@ -1,4 +1,7 @@
 import { expect, test } from "bun:test";
+import { mkdtempSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
 import { createPermissionGate } from "./gate.js";
 import {
   createReactorAuthorize,
@@ -33,6 +36,43 @@ const gate = (opts?: { interactive?: boolean; auto?: boolean }) =>
     },
   });
 
+test("worker grant after a denied write allows a later call id through gateToolCall", async () => {
+  const cwd = mkdtempSync(join(tmpdir(), "worker-grant-"));
+  const path = join(cwd, "probe.txt");
+  const policy = createPermissionGate({
+    cwd,
+    approvals: [],
+    interactive: false,
+    auto: false,
+    skipPermissions: false,
+    reactorGated: true,
+    requestApproval: async () => {
+      throw new Error("worker must never ask");
+    },
+  });
+  const workerGate = workerPermissionGate(policy);
+  const first: ToolCall = {
+    id: "call_auto_0",
+    name: "write_file",
+    arguments: { path, content: "unauthorized" },
+  };
+  const second: ToolCall = {
+    id: "call_auto_1",
+    name: "write_file",
+    arguments: { path, content: "unauthorized" },
+  };
+  expect((await workerGate.authorizeCall(first)).effect).toBe("deny");
+  policy.setSeededApprovals([{ tool: "write_file", pattern: path }]);
+  expect((await workerGate.authorizeCall(second)).effect).toBe("allow");
+  let called = false;
+  const result = await gateToolCall(workerGate, second, new AbortController().signal, async () => {
+    called = true;
+    return { callId: second.id, content: "executed", isError: false };
+  });
+  expect(result.isError).toBe(false);
+  expect(called).toBe(true);
+});
+
 test("worker maps unresolved ask to deny while main reactor suspends", async () => {
   const policy = gate();
   expect((await createReactorAuthorize(policy)("tool:write_file", "invoke", call)).effect).toBe(

tests/integration/subagent-permission.test.ts

@@ -485,7 +485,7 @@ test.serial(
   20000,
 );
 
-test("storing parent-gated MCP tools then wrapping again still calls requestApproval", async () => {
+test("storing parent-gated MCP tools then wrapping again denies without requestApproval", async () => {
   const cwd = await mkdtemp(join(tmpdir(), "worker-permission-"));
   let asks = 0;
   let calls = 0;
@@ -522,12 +522,13 @@ test("storing parent-gated MCP tools then wrapping again still calls requestAppr
     const doubleWrapped = gateAgentTools(parentGated, workerPermissionGate(parent));
     const tool = doubleWrapped[0];
     if (tool?.kind !== "full") throw new Error("expected full inherited MCP tool");
-    await tool.handler(
+    const result = await tool.handler(
       { id: "c1", name: "mcp__probe__mutate", arguments: {} },
       new AbortController().signal,
     );
-    expect(asks).toBe(1);
-    expect(calls).toBe(1);
+    expect(asks).toBe(0);
+    expect(calls).toBe(0);
+    expect(result.isError).toBe(true);
   } finally {
     await rm(cwd, { recursive: true, force: true });
   }