Key reactor-gated verdict cache by call identity

A reused Codex proxy id could apply an outer shell allow to an
inner run_shell deny. Consume a cached verdict only when name
and arguments match as well as id.

Author: TheGreatAxios

CHANGELOG.md

@@ -19,9 +19,8 @@ parallel copies under `docs/` or `scripts/notes/`. At cut time: rename
   (authorization hard-deny, auto-shell deny, or headless deny) returns a
   blocked tool error and does not run the call. Ask and allow still skip the
   middleware prompt so an approved re-dispatch never re-asks. Middleware is
-  not a second copy of `env.authorize`: it consumes the prior verdict when one
-  exists, and decides only for inner posix runs whose outer tool is not
-  `run_shell` (Codex apply_patch proxy).
+  not a second copy of `env.authorize`: it consumes the prior verdict when the
+  same call (id, name, and arguments) is cached, and decides on a cache miss.
 
 ## [0.3.18] - 2026-09-08
 

docs/ARCHITECTURE.md

@@ -377,7 +377,7 @@ tool call
 - **command** — Splits chained commands for security classification and derives command-shape approval scopes. Multi-segment chains only offer an exact-command persist pattern (a prefix like `npm *` must not cover `npm i && rm -rf /` later).
 - **auto-shell-policy** — Constrains `run_shell` even when auto mode would otherwise rubber-stamp it. Before matching, `expandShellSubjects` peels `bash`/`sh`/`zsh -c`, `xargs` utility tails, and transparent prefixes (`env`, `nice`, `timeout`, …) so rules see the real payload; an unparseable wrapper (variable expansion or command substitution) sets an opaque flag that forces `ask`. Effects: `deny` blocks outright (file mutations through ad-hoc tooling — output redirection, `tee`, `sed -i`/`perl -i`, interpreter inline programs or heredocs — which must instead go through `write_file`/`edit_file`); `ask` declines to auto-allow and falls through to the operator prompt (recursive `rm`, dependency installs and remote runners: npm/yarn/pnpm/bun, pip, cargo, go, brew, npx/bunx, …, force or uncontained `git worktree` ops, shell that references a sensitive path such as `.env` or a private key, and opaque wrappers). Contained non-force `git worktree add`/`remove`/`prune` and read-only `list` auto-allow (sibling destinations like `../corbits-dispatch-wts/…` included; absolute outside, `~`, globs, and credential basenames still ask). Deny beats ask when multiple subjects match. Quoted spans are stripped before pattern matching so a quoted `>` or install word in an argument is not flagged, and program names are matched only in command position. Adding a table category is a one-line rule append in `AUTO_SHELL_RULES`.
 - **gate** — Evaluates a call: `skipPermissions` allows everything; `allow`-tier passes; for `ask`-tier, checks persisted approvals, otherwise requests operator approval. Shell security classifies each chain segment (`||` / `&&` / `|` / `;` / newlines), but the operator is prompted once for the full command block — any unapproved segment fails the whole block, and execution always runs the unsplit original. Safe pipeline tails and pure shell no-ops (`true` / `false` / `:` and bare control-flow keywords stranded by chain-splitting) skip without a prompt. In a non-interactive run an unresolved `ask` becomes a denial. In auto mode: non-shell built-ins in `AUTO_ALLOWED_TOOLS` (writes/edits/deletes, `manage_tasks`, `spawn_agent`, `wait_agents`, …) auto-allow when not path-restricted; for `run_shell` the gate consults the auto-shell policy — a `deny` rule fails the call, an `ask` rule skips the auto-allow shortcut and proceeds to the normal approval flow, and anything unmatched is auto-allowed. Paths outside the workspace and writes under the session state root (`~/.corbits/projects/...` and legacy `.agent-state`) still ask under auto mode. Under `--dangerously-skip-permissions` (forces this process) or `/yolo` (persists as the user-global default via `setSkipPermissions`), the gate auto-allows those same cases, and pre-gate sandboxes (path-escape, shell session cwd retention, `list_dir` / `delete_file` workspace bounds) honor `getSkipPermissions()` live so outside-workspace access is not hard-denied after the gate already allowed it — without rebuilding the plugin stack. Secret-guard path denies and authorization hard blocks still apply. Mutating MCP and unknown built-ins are not blanket-allowed outside skip. Newly granted scopes are appended in memory and persisted.
-  - **Reactor-gated sessions (main session; `reactorGated: true`).** The gate's decision logic lives in one `decide()` used by both consumers: `evaluate()` (the middleware path below, still used by sub-agents) and `authorizeCall()`, which expresses the decision as the vendored reactor's before-tool authz effect (`src/permission/reactor-authorize.ts` bridges it into `env.authorize`). An `ask` there suspends the call as a reactor `PendingOperation` keyed by a correlationId (persisted through the context store's existing `pendingOperations`); `send()` settles as `suspended` and `src/session/approval-resume.ts` rebuilds the operator request from the approval snapshot, resolves it through the same `requestApproval` seam the TUI overlay uses, and delivers the decision to the reactor on the correlationId signal channel — an approved decision grants a one-shot bypass and the exact parked call re-dispatches; a rejected one answers it with an error result. Under reactor gating the middleware/MCP `gateToolCall` is an execution backstop, not a second copy of `env.authorize`: it consumes the `authorizeCall` verdict when one exists and does not re-decide. Deny still blocks and does not call `next`; an `ask` or `allow` skips the middleware prompt so an approved re-dispatch never re-asks. The remaining hole is inner posix runs whose outer tool is not `run_shell` (Codex `apply_patch` proxy uses a reused `codex-proxy` call id): those never pass `env.authorize`, so `gateToolCall` decides only on that cache miss and still blocks a deny. The headless denial and the stricter chained-command hard-deny are preserved as deny effects (upstream `block`s) decided inside the same `decide()`.
+  - **Reactor-gated sessions (main session; `reactorGated: true`).** The gate's decision logic lives in one `decide()` used by both consumers: `evaluate()` (the middleware path below, still used by sub-agents) and `authorizeCall()`, which expresses the decision as the vendored reactor's before-tool authz effect (`src/permission/reactor-authorize.ts` bridges it into `env.authorize`). An `ask` there suspends the call as a reactor `PendingOperation` keyed by a correlationId (persisted through the context store's existing `pendingOperations`); `send()` settles as `suspended` and `src/session/approval-resume.ts` rebuilds the operator request from the approval snapshot, resolves it through the same `requestApproval` seam the TUI overlay uses, and delivers the decision to the reactor on the correlationId signal channel — an approved decision grants a one-shot bypass and the exact parked call re-dispatches; a rejected one answers it with an error result. Under reactor gating the middleware/MCP `gateToolCall` is an execution backstop, not a second copy of `env.authorize`: it consumes the `authorizeCall` verdict only when id, name, and arguments match, and does not re-decide. Deny still blocks and does not call `next`; an `ask` or `allow` skips the middleware prompt so an approved re-dispatch never re-asks. A reused `codex-proxy` id cannot apply an outer `shell` allow to an inner `run_shell` deny. Inner posix runs whose outer tool is not `run_shell` (Codex `apply_patch` proxy) never pass `env.authorize`, so `gateToolCall` decides on that cache miss and still blocks a deny. The headless denial and the stricter chained-command hard-deny are preserved as deny effects (upstream `block`s) decided inside the same `decide()`.
 
 - **matcher** — Approval pattern matching via `@intx/authz` `matchPattern` (`*` wildcards). Exact-command grants store a backslash before each metacharacter; those patterns match by equality after unescape (the package has no escape syntax).
 - **authz-grants** — Maps stored approvals into `@intx/authz` `GrantRule`s and evaluates them with `evaluateGrants` (allow-only; Corbits cwd/provider-model filters applied first). Exact-escaped grants bypass the package path and use equality.

src/permission/gate.ts

@@ -318,16 +318,18 @@ export interface PermissionGate {
   // vendored before-tool authz hook consumes (see authorizeCall above).
   authorizeCall: (call: ToolCall) => Promise<AuthorizeVerdict>;
   // Execution-time backstop for reactor-gated posix/MCP middleware: consume the
-  // authorizeCall verdict when one exists; decide only when there is no prior
-  // verdict (nested posix whose outer tool is not run_shell, and tests).
+  // authorizeCall verdict when the same call identity (id, name, arguments) is
+  // cached; decide only on a miss (nested posix whose outer tool is not
+  // run_shell, colliding reused ids, and tests).
   executionVerdict: (call: ToolCall) => Promise<AuthorizeVerdict>;
   // Resolve a suspended reactor approval against the operator (and mint the
   // outcome's grant). Returns undefined when no outcome arrived.
   resolveSuspended: (request: PermissionRequest) => Promise<ApprovalOutcome | undefined>;
-  // True when this gate's decisions are consumed by the reactor's authz seam
-  // (env.authorize) rather than by evaluate() in the tool-runner middleware.
-  // Under reactor gating, gateToolCall still blocks decide() deny; ask/allow
-  // skip the middleware prompt so an approved re-dispatch never re-asks.
+  // True when this gate's decisions go through env.authorize (authorizeCall)
+  // rather than evaluate() in the tool-runner middleware. Under reactor gating,
+  // gateToolCall is an execution backstop: it consumes a matching cached
+  // verdict and decides on a miss. Deny still blocks; ask/allow skip the
+  // middleware prompt so an approved re-dispatch never re-asks.
   isReactorGated: () => boolean;
   // The gate's current in-memory approvals, including any granted this session.
   getApprovals: () => readonly Approval[];
@@ -490,9 +492,15 @@ export function createPermissionGate(options: PermissionGateOptions): Permission
 
   // Consume-once handoff from env.authorize to execution-time middleware.
   // Not session-lifetime uniqueness: call.id is reused for every Codex proxy
-  // inner posix op, so a lasting set would mute later JSONL records. reset()
-  // clears leftovers (outer tools that never hit posix middleware).
-  const authorizedByCallId = new Map<string, AuthorizeVerdict>();
+  // inner posix op, so a lasting set would mute later JSONL records. A hit
+  // still requires matching name and arguments so a reused id cannot apply an
+  // outer allow to a different inner tool. Nested posix with the same id still
+  // consume-once when identity matches. reset() clears leftovers (outer tools
+  // that never hit posix middleware).
+  const authorizedByCallId = new Map<
+    string,
+    { name: string; arguments: ToolCall["arguments"]; verdict: AuthorizeVerdict }
+  >();
 
   // Non-blocking policy decision for one tool call: everything the gate owns —
   // tier pre-filter, auto rules, pre-grant guards, grants, headless denial —
@@ -766,15 +774,23 @@ export function createPermissionGate(options: PermissionGateOptions): Permission
 
   const authorizeCall = async (call: ToolCall): Promise<AuthorizeVerdict> => {
     const verdict = mapAuthorizeVerdict(await decide(call));
-    authorizedByCallId.set(call.id, verdict);
+    authorizedByCallId.set(call.id, {
+      name: call.name,
+      arguments: call.arguments,
+      verdict,
+    });
     return verdict;
   };
 
   const executionVerdict = async (call: ToolCall): Promise<AuthorizeVerdict> => {
     const cached = authorizedByCallId.get(call.id);
-    if (cached !== undefined) {
+    if (
+      cached !== undefined &&
+      cached.name === call.name &&
+      JSON.stringify(cached.arguments) === JSON.stringify(call.arguments)
+    ) {
       authorizedByCallId.delete(call.id);
-      return cached;
+      return cached.verdict;
     }
     return mapAuthorizeVerdict(await decide(call));
   };

src/plugins/permission-plugin.test.ts

@@ -312,7 +312,89 @@ describe("gateToolCall", () => {
     expect(records[1]?.outcome).toBe("auto-deny");
   });
 
-  test("reset does not mute a later auto-decision with a reused call.id", async () => {
+  test("colliding reused call.id does not inherit allow onto a different tool", async () => {
+    const dir = mkdtempSync(join(tmpdir(), "approval-log-reactor-"));
+    const cwd = mkdtempSync(join(tmpdir(), "gate-cwd-"));
+    const gate = createPermissionGate({
+      approvals: [{ tool: "shell", pattern: "shell" }],
+      interactive: true,
+      skipPermissions: false,
+      reactorGated: true,
+      auto: true,
+      cwd,
+      approvalLog: createApprovalLog(dir),
+      requestApproval: async () => {
+        throw new Error("requestApproval must not be invoked under reactor gating");
+      },
+    });
+    const outer: ToolCall = {
+      id: "codex-proxy",
+      name: "shell",
+      arguments: { command: "echo x | tee src/a.ts" },
+    };
+    const inner: ToolCall = {
+      id: "codex-proxy",
+      name: "run_shell",
+      arguments: { command: "echo x | tee src/a.ts" },
+    };
+    expect((await gate.authorizeCall(outer)).effect).toBe("allow");
+    const { next, wasCalled } = trackingNext();
+    const result = await gateToolCall(gate, inner, new AbortController().signal, next);
+    expect(result.isError).toBe(true);
+    expect(result.content).toContain(BLOCKED_BY_POLICY_PREFIX);
+    expect(wasCalled()).toBe(false);
+    await new Promise((r) => setTimeout(r, 10));
+    const records = readApprovalRecords(dir);
+    expect(records).toHaveLength(1);
+    expect(records[0]?.outcome).toBe("auto-deny");
+  });
+
+  test("authorizeCall apply_patch then nested posix with reused id each record", async () => {
+    const dir = mkdtempSync(join(tmpdir(), "approval-log-reactor-"));
+    const cwd = mkdtempSync(join(tmpdir(), "gate-cwd-"));
+    const gate = createPermissionGate({
+      approvals: [],
+      interactive: true,
+      skipPermissions: false,
+      reactorGated: true,
+      auto: true,
+      cwd,
+      approvalLog: createApprovalLog(dir),
+      requestApproval: async () => {
+        throw new Error("requestApproval must not be invoked under reactor gating");
+      },
+    });
+    const outer: ToolCall = {
+      id: "apply-1",
+      name: "apply_patch",
+      arguments: { input: "*** Begin Patch\n*** Add File: src/a.ts\n+x\n*** End Patch\n" },
+    };
+    const first: ToolCall = {
+      id: "codex-proxy",
+      name: "write_file",
+      arguments: { path: "src/a.ts", content: "x" },
+    };
+    const second: ToolCall = {
+      id: "codex-proxy",
+      name: "write_file",
+      arguments: { path: "src/b.ts", content: "y" },
+    };
+    expect((await gate.authorizeCall(outer)).effect).toBe("allow");
+    const { next, wasCalled } = trackingNext();
+    expect((await gateToolCall(gate, first, new AbortController().signal, next)).isError).not.toBe(
+      true,
+    );
+    expect((await gateToolCall(gate, second, new AbortController().signal, next)).isError).not.toBe(
+      true,
+    );
+    expect(wasCalled()).toBe(true);
+    await new Promise((r) => setTimeout(r, 10));
+    const records = readApprovalRecords(dir);
+    expect(records).toHaveLength(3);
+    expect(records.map((r) => r.outcome)).toEqual(["auto-allow", "auto-allow", "auto-allow"]);
+  });
+
+  test("leftover authorizeCall is cleared by reset so a later gateToolCall records", async () => {
     const dir = mkdtempSync(join(tmpdir(), "approval-log-reactor-"));
     const cwd = mkdtempSync(join(tmpdir(), "gate-cwd-"));
     const gate = createPermissionGate({
@@ -333,14 +415,11 @@ describe("gateToolCall", () => {
       arguments: { path: "src/a.ts", content: "x" },
     };
     expect((await gate.authorizeCall(call)).effect).toBe("allow");
-    const firstRun = trackingNext();
-    await gateToolCall(gate, call, new AbortController().signal, firstRun.next);
-    expect(firstRun.wasCalled()).toBe(true);
     gate.reset();
-    expect((await gate.authorizeCall(call)).effect).toBe("allow");
-    const secondRun = trackingNext();
-    await gateToolCall(gate, call, new AbortController().signal, secondRun.next);
-    expect(secondRun.wasCalled()).toBe(true);
+    const { next, wasCalled } = trackingNext();
+    const result = await gateToolCall(gate, call, new AbortController().signal, next);
+    expect(result.isError).not.toBe(true);
+    expect(wasCalled()).toBe(true);
     await new Promise((r) => setTimeout(r, 10));
     const records = readApprovalRecords(dir);
     expect(records).toHaveLength(2);

src/plugins/permission-plugin.ts

@@ -16,10 +16,11 @@ function blockedByPolicy(call: ToolCall, reason: string): ToolResult {
 // the posix runner the middleware wraps) so both produce the same denial result.
 //
 // Under reactor gating this is an execution backstop, not a second env.authorize.
-// Consume the prior authorizeCall verdict when one exists; decide only when there
-// is no prior verdict — nested posix whose outer tool is not run_shell (Codex
-// apply_patch proxy) and tests. Deny blocks next; ask/allow skip the middleware
-// prompt so an approved re-dispatch never re-asks.
+// Consume the prior authorizeCall verdict when the same call identity (id, name,
+// arguments) is cached; decide only on a miss — nested posix whose outer tool is
+// not run_shell (Codex apply_patch proxy), colliding reused ids, and tests. Deny
+// blocks next; ask/allow skip the middleware prompt so an approved re-dispatch
+// never re-asks.
 export async function gateToolCall(
   gate: PermissionGate,
   call: ToolCall,