Drop operator approval when session identity changes

Author: TheGreatAxios

CHANGELOG.md

@@ -39,6 +39,10 @@ parallel copies under `docs/` or `scripts/notes/`. At cut time: rename
   can grant and retry, without hanging on operator approval.
 - Operator approval resume late-binds to the live agent and keeps the TUI
   busy across the overlay so a reload cannot drop the parked tool call.
+- Operator approval drops on session identity change. inFlight occupancy
+  owns idle rebuild; delivery generation owns session identity, so interrupt,
+  /clear, and /new abort the outstanding overlay, skip minting a grant, and
+  notify the operator instead of delivering into a rebuilt agent.
 
 ### Changed
 

docs/ARCHITECTURE.md

@@ -382,7 +382,7 @@ tool call
 - **command** — Splits chained commands for security classification and derives command-shape approval scopes. Multi-segment chains only offer an exact-command persist pattern (a prefix like `npm *` must not cover `npm i && rm -rf /` later).
 - **auto-shell-policy** — Constrains `run_shell` even when auto mode would otherwise rubber-stamp it. Before matching, `expandShellSubjects` peels `bash`/`sh`/`zsh -c`, `xargs` utility tails, and transparent prefixes (`env`, `nice`, `timeout`, …) so rules see the real payload; an unparseable wrapper (variable expansion or command substitution) sets an opaque flag that forces `ask`. Effects: `deny` blocks outright (file mutations through ad-hoc tooling — output redirection, `tee`, `sed -i`/`perl -i`, interpreter inline programs or heredocs — which must instead go through `write_file`/`edit_file`); `ask` declines to auto-allow and falls through to the operator prompt (recursive `rm`, dependency installs and remote runners: npm/yarn/pnpm/bun, pip, cargo, go, brew, npx/bunx, …, force or uncontained `git worktree` ops, shell that references a sensitive path such as `.env` or a private key, and opaque wrappers). Contained non-force `git worktree add`/`remove`/`prune` and read-only `list` auto-allow (sibling destinations like `../corbits-dispatch-wts/…` included; absolute outside, `~`, globs, and credential basenames still ask). Deny beats ask when multiple subjects match. Quoted spans are stripped before pattern matching so a quoted `>` or install word in an argument is not flagged, and program names are matched only in command position. Adding a table category is a one-line rule append in `AUTO_SHELL_RULES`.
 - **gate** — Evaluates a call: `skipPermissions` allows everything; `allow`-tier passes; for `ask`-tier, checks persisted approvals, otherwise requests operator approval. Shell security classifies each chain segment (`||` / `&&` / `|` / `;` / newlines), but the operator is prompted once for the full command block — any unapproved segment fails the whole block, and execution always runs the unsplit original. Safe pipeline tails and pure shell no-ops (`true` / `false` / `:` and bare control-flow keywords stranded by chain-splitting) skip without a prompt. In a non-interactive run an unresolved `ask` becomes a denial. In auto mode: non-shell built-ins in `AUTO_ALLOWED_TOOLS` (writes/edits/deletes, `manage_tasks`, `spawn_agent`, `wait_agents`, …) auto-allow when not path-restricted; for `run_shell` the gate consults the auto-shell policy — a `deny` rule fails the call, an `ask` rule skips the auto-allow shortcut and proceeds to the normal approval flow, and anything unmatched is auto-allowed. Paths outside the workspace and writes under the session state root (`~/.corbits/projects/...` and legacy `.agent-state`) still ask under auto mode. Under `--dangerously-skip-permissions` (forces this process) or `/yolo` (persists as the user-global default via `setSkipPermissions`), the gate auto-allows those same cases, and pre-gate sandboxes (path-escape, shell session cwd retention, `list_dir` / `delete_file` workspace bounds) honor `getSkipPermissions()` live so outside-workspace access is not hard-denied after the gate already allowed it — without rebuilding the plugin stack. Secret-guard path denies and authorization hard blocks still apply. Mutating MCP and unknown built-ins are not blanket-allowed outside skip. Newly granted scopes are appended in memory and persisted.
-  - **Reactor-gated sessions (main session; `reactorGated: true`).** The gate's decision logic lives in one `decide()` used by both consumers: `evaluate()` (the middleware path below, still used by sub-agents) and `authorizeCall()`, which expresses the decision as the vendored reactor's before-tool authz effect (`src/permission/reactor-authorize.ts` bridges it into `env.authorize`). An `ask` there suspends the call as a reactor `PendingOperation` keyed by a correlationId (persisted through the context store's existing `pendingOperations`); `send()` settles as `suspended` and `src/session/approval-resume.ts` rebuilds the operator request from the approval snapshot, resolves it through the same `requestApproval` seam the TUI overlay uses, and delivers the decision to the reactor on the correlationId signal channel — an approved decision grants a one-shot bypass and the exact parked call re-dispatches; a rejected one answers it with an error result. The TUI stays busy across the overlay and late-binds deliver through the live agent / session queue. Under reactor gating the middleware/MCP `gateToolCall` is an execution backstop, not a second copy of `env.authorize`: it consumes the `authorizeCall` verdict only when id, name, and arguments match, and does not re-decide. Deny still blocks and does not call `next`; an `ask` or `allow` skips the middleware prompt so an approved re-dispatch never re-asks. A reused `codex-proxy` id cannot apply an outer `shell` allow to an inner `run_shell` deny. Inner posix runs whose outer tool is not `run_shell` (Codex `apply_patch` proxy) never pass `env.authorize`, so `gateToolCall` decides on that cache miss and still blocks a deny. The headless denial and the stricter chained-command hard-deny are preserved as deny effects (upstream `block`s) decided inside the same `decide()`.
+  - **Reactor-gated sessions (main session; `reactorGated: true`).** The gate's decision logic lives in one `decide()` used by both consumers: `evaluate()` (the middleware path below, still used by sub-agents) and `authorizeCall()`, which expresses the decision as the vendored reactor's before-tool authz effect (`src/permission/reactor-authorize.ts` bridges it into `env.authorize`). An `ask` there suspends the call as a reactor `PendingOperation` keyed by a correlationId (persisted through the context store's existing `pendingOperations`); `send()` settles as `suspended` and `src/session/approval-resume.ts` rebuilds the operator request from the approval snapshot, resolves it through the same `requestApproval` seam the TUI overlay uses, and delivers the decision to the reactor on the correlationId signal channel — an approved decision grants a one-shot bypass and the exact parked call re-dispatches; a rejected one answers it with an error result. `inFlight` occupancy owns idle rebuild: the TUI stays busy across the overlay and waits until the correlated resume is accepted (`message.received` / `message.correlated`) or a generation bump `settleAll`s the waiter. Delivery generation owns session identity: interrupt, `/clear`, and `/new` abort the outstanding overlay, skip minting a grant, drop the decision, and surface an operator notice rather than delivering into a rebuilt agent. Under reactor gating the middleware/MCP `gateToolCall` is an execution backstop, not a second copy of `env.authorize`: it consumes the `authorizeCall` verdict only when id, name, and arguments match, and does not re-decide. Deny still blocks and does not call `next`; an `ask` or `allow` skips the middleware prompt so an approved re-dispatch never re-asks. A reused `codex-proxy` id cannot apply an outer `shell` allow to an inner `run_shell` deny. Inner posix runs whose outer tool is not `run_shell` (Codex `apply_patch` proxy) never pass `env.authorize`, so `gateToolCall` decides on that cache miss and still blocks a deny. The headless denial and the stricter chained-command hard-deny are preserved as deny effects (upstream `block`s) decided inside the same `decide()`.
   - **Worker reactor ownership.** `workerPermissionGate` is a reactor-gated view over the parent's live permission gate: grants and policy are shared, not copied or toggled. Worker posix plugins and inherited MCP tools are bound to that view at worker start, so they take the reactor-gated `gateToolCall` path because the view reports `isReactorGated()` — they do not close over the parent's middleware-gated `isReactorGated()`. Deny still blocks; ask/allow skip the middleware prompt. `authorizeCall` on the view never emits `ask` — unresolved approvals become denials that name the permission subject, without invoking an approval callback or suspending, even with an interactive parent; the parent can obtain a grant and retry. Worker control-plane tools (`submit_result`, `ask_director`, and nested fleet verbs other than `spawn_agent`) allow without a parent grant. Authorization and tool execution run under the same async-local worker identity and cwd. Fleet authority remains an independent restriction, not an alternative permission grant.
 
 - **matcher** — Approval pattern matching via `@intx/authz` `matchPattern` (`*` wildcards). Exact-command grants store a backslash before each metacharacter; those patterns match by equality after unescape (the package has no escape syntax).

src/permission/gate.ts

@@ -67,7 +67,9 @@ function classifyOutcome(outcome: ApprovalOutcome | undefined): ApprovalOutcomeK
   if (!outcome.allow) {
     const message = outcome.message ?? "";
     if (message.includes("timed out")) return "timeout";
-    if (message.includes("no longer running")) return "abort";
+    if (message.includes("no longer running") || message.includes("identity changed")) {
+      return "abort";
+    }
     return "deny";
   }
   return outcome.persist !== undefined ? "allow-with-scope" : "allow-once";
@@ -325,8 +327,12 @@ export interface PermissionGate {
   // run_shell, colliding reused ids, and tests).
   executionVerdict: (call: ToolCall) => Promise<AuthorizeVerdict>;
   // Resolve a suspended reactor approval against the operator (and mint the
-  // outcome's grant). Returns undefined when no outcome arrived.
-  resolveSuspended: (request: PermissionRequest) => Promise<ApprovalOutcome | undefined>;
+  // outcome's grant when the session identity is still current). Returns
+  // undefined when no outcome arrived.
+  resolveSuspended: (
+    request: PermissionRequest,
+    stillCurrent?: () => boolean,
+  ) => Promise<ApprovalOutcome | undefined>;
   // True when this gate's decisions go through env.authorize (authorizeCall)
   // rather than evaluate() in the tool-runner middleware. Under reactor gating,
   // gateToolCall is an execution backstop: it consumes a matching cached
@@ -724,7 +730,10 @@ export function createPermissionGate(options: PermissionGateOptions): Permission
   // span, await the requestApproval seam, settle the log/span, and mint any
   // grant the outcome carries (never for secret-path shell). Returns undefined
   // when no outcome arrived (timeout/abort auto-deny paths).
-  const resolveInteractiveAsk = async (decision: Extract<GateDecision, { kind: "ask" }>) => {
+  const resolveInteractiveAsk = async (
+    decision: Extract<GateDecision, { kind: "ask" }>,
+    stillCurrent?: () => boolean,
+  ) => {
     const { request, anySecret, segmentCount } = decision;
     const askRule = anySecret ? "sensitive-path" : undefined;
     const ask = approvalLog.ask({
@@ -752,7 +761,7 @@ export function createPermissionGate(options: PermissionGateOptions): Permission
       finishApprovalWait(telemetry, waitSpanId, request.tool, outcome);
       ask.settle(classifyOutcome(outcome));
     }
-    if (outcome !== undefined && outcome.allow && !anySecret) {
+    if (outcome !== undefined && outcome.allow && !anySecret && (stillCurrent?.() ?? true)) {
       mintGrant(request.tool, outcome);
     }
     return outcome;
@@ -823,18 +832,21 @@ export function createPermissionGate(options: PermissionGateOptions): Permission
   // Resolve a suspended reactor approval once the operator answers. The
   // request is the one authorizeCall built at decision time, so the ask log,
   // wait span, and grant minting are identical to the middleware path.
-  const resolveSuspended = (request: PermissionRequest) => {
+  const resolveSuspended = (request: PermissionRequest, stillCurrent?: () => boolean) => {
     const anySecret =
       request.tool === "run_shell" && commandReferencesSensitivePath(request.subject) !== undefined;
-    return resolveInteractiveAsk({
-      kind: "ask",
-      request,
-      anySecret,
-      segmentCount:
-        request.tool === "run_shell"
-          ? splitChainedCommand(request.subject).filter((s) => !isShellCommentOnly(s)).length
-          : 0,
-    });
+    return resolveInteractiveAsk(
+      {
+        kind: "ask",
+        request,
+        anySecret,
+        segmentCount:
+          request.tool === "run_shell"
+            ? splitChainedCommand(request.subject).filter((s) => !isShellCommentOnly(s)).length
+            : 0,
+      },
+      stillCurrent,
+    );
   };
 
   const reset = (): void => {

src/session/approval-resume.ts

@@ -26,6 +26,8 @@ import type { PermissionRequest } from "../permission/types.js";
 
 const logger = getLogger([LOG_NAMESPACE_ROOT, "approval-resume"]);
 
+export const APPROVAL_DROPPED_NOTICE = "Approval dropped because the session changed.";
+
 const ApprovalSnapshotShape = type({
   name: "string",
   "arguments?": "Record<string, unknown>",
@@ -108,16 +110,19 @@ function decisionMessage(
 }
 
 export function createApprovalResume(args: {
-  // Late-bound: the live agent is read at history/deliver time so rebuilds
-  // (/clear, model switch) deliver through the current instance, not a
-  // snapshot taken at handle() start.
+  // Live agent at history/deliver time. TUI occupancy holds this identity
+  // until the correlated resume is accepted; a generation bump aborts the
+  // gate rather than retargeting a rebuilt agent.
   getAgent: () => Pick<Agent, "deliver" | "history"> | undefined;
   // TUI session queue. When present, each decision is awaited through this
   // seam; exec omits it and uses getAgent().deliver.
   deliver?: (message: InboundMessage, stillCurrent: () => boolean) => void | Promise<void>;
-  // TUI: capture at handle() start so /clear or interrupt during the overlay
-  // drops the decision instead of delivering into the rebuilt agent. Exec omits this.
+  // TUI: capture at handle() start so interrupt, /clear, or /new during the
+  // overlay aborts the gate and drops the decision. Exec omits this.
   captureGeneration?: () => () => boolean;
+  // TUI: operator-visible notice when an overlay decision is dropped after
+  // a generation bump.
+  onDropped?: (text: string) => void;
   gate: PermissionGate;
 }): ApprovalResume {
   const { getAgent, gate } = args;
@@ -149,6 +154,7 @@ export function createApprovalResume(args: {
       // out" tool result appended after this point means the reactor settled
       // this very correlation before our decision lands.
       const turnsAtSuspend = (await requireAgent().history()).length;
+      if (!stillCurrent()) return true;
 
       if (approvalSnapshot === undefined) {
         // A suspension without a snapshot cannot be surfaced; fail closed by
@@ -168,8 +174,11 @@ export function createApprovalResume(args: {
         return true;
       }
 
-      const outcome = await gate.resolveSuspended(request);
-      if (!stillCurrent()) return true;
+      const outcome = await gate.resolveSuspended(request, stillCurrent);
+      if (!stillCurrent()) {
+        args.onDropped?.(APPROVAL_DROPPED_NOTICE);
+        return true;
+      }
       if (settledAfterSuspend(await requireAgent().history(), turnsAtSuspend)) {
         // The reactor already answered the parked call (its approval timeout
         // fired while the surface was still up). Delivering now would append

src/tui/correlation-acceptance.test.ts

@@ -0,0 +1,25 @@
+import { describe, test } from "bun:test";
+
+import { createCorrelationAcceptance } from "./correlation-acceptance.js";
+
+describe("createCorrelationAcceptance", () => {
+  test("settle resolves the waiter for that correlation id", async () => {
+    const acceptance = createCorrelationAcceptance();
+    const pending = acceptance.wait("corr-1");
+    acceptance.settle("corr-1");
+    await pending;
+  });
+
+  test("settleAll releases every outstanding waiter", async () => {
+    const acceptance = createCorrelationAcceptance();
+    const first = acceptance.wait("a");
+    const second = acceptance.wait("b");
+    acceptance.settleAll();
+    await Promise.all([first, second]);
+  });
+
+  test("settle of an unknown id is a no-op", () => {
+    const acceptance = createCorrelationAcceptance();
+    acceptance.settle("missing");
+  });
+});

src/tui/correlation-acceptance.ts

@@ -0,0 +1,33 @@
+/**
+ * Occupancy wait for a fire-and-forget Agent.deliver of a correlated
+ * approval. The reactor accepts the resume asynchronously after deliver
+ * returns; inFlight must not drop until that acceptance (or an uncorrelated
+ * pass-through / identity bump) settles the waiter.
+ */
+
+export function createCorrelationAcceptance() {
+  const waiters = new Map<string, () => void>();
+
+  const settle = (correlationId: string): void => {
+    const resolve = waiters.get(correlationId);
+    if (resolve === undefined) return;
+    waiters.delete(correlationId);
+    resolve();
+  };
+
+  return {
+    wait(correlationId: string): Promise<void> {
+      const pending = waiters.get(correlationId);
+      return new Promise<void>((resolve) => {
+        waiters.set(correlationId, () => {
+          pending?.();
+          resolve();
+        });
+      });
+    },
+    settle,
+    settleAll(): void {
+      for (const correlationId of [...waiters.keys()]) settle(correlationId);
+    },
+  };
+}

src/tui/gate-wire.test.ts

@@ -19,6 +19,7 @@ import {
 import { moveOverlaySelection, toggleOverlayExpand } from "./shell/overlay-list.js";
 import { streamRowGutter } from "./stream.js";
 import { APPROVAL_UNAVAILABLE_MESSAGE } from "./gate-events.js";
+import { SESSION_IDENTITY_ABORT_REASON } from "./queued-delivery.js";
 import {
   approvalOutcomeFromSelection,
   operatorCancelResult,
@@ -1204,6 +1205,40 @@ describe("permission.gate auto-deny", () => {
     });
   });
 
+  test("identity abort reason auto-denies and closes the overlay", async () => {
+    await withTestRenderer(async (h) => {
+      const shell = createAppShell(h.renderer, {
+        terminal: { columns: 80, rows: 24 },
+        run: "idle",
+      });
+      const emitter = new EventEmitter();
+      const controller = new AbortController();
+      let resolved: unknown;
+      try {
+        wireGates(emitter, shell);
+        emitter.emit("permission.gate", {
+          id: "req-1",
+          request: baseRequest(),
+          resolve: (outcome: unknown) => {
+            resolved = outcome;
+          },
+          signal: controller.signal,
+        });
+        expect(shell.overlayKind).toBe("permissions");
+
+        controller.abort(SESSION_IDENTITY_ABORT_REASON);
+
+        expect(resolved).toEqual({
+          allow: false,
+          message: SESSION_IDENTITY_ABORT_REASON,
+        });
+        expect(shell.overlayList).toBeNull();
+      } finally {
+        shell.dispose();
+      }
+    });
+  });
+
   test("resolving normally clears the timer instead of firing it later", async () => {
     await withTestRenderer(async (h) => {
       const shell = createAppShell(h.renderer, {

src/tui/gate-wire.ts

@@ -412,10 +412,15 @@ export function wireGates(
       settle({ allow: false, message });
     };
     function onAbort(): void {
-      autoDeny("tool no longer running; permission request denied");
+      const reason = ev.signal?.reason;
+      autoDeny(
+        typeof reason === "string" && reason.length > 0
+          ? reason
+          : "tool no longer running; permission request denied",
+      );
     }
     if (ev.signal?.aborted === true) {
-      autoDeny("tool no longer running; permission request denied");
+      onAbort();
       return;
     }
     ev.signal?.addEventListener("abort", onAbort, { once: true });