Consume reactor-gated verdicts once at execution

call.id is reused for every Codex proxy inner posix op, so a
session-lifetime uniqueness set muted later JSONL records and
reset() could not recover. Middleware now consumes the prior
verdict and decides only on a cache miss.

Author: TheGreatAxios

CHANGELOG.md

@@ -18,7 +18,10 @@ parallel copies under `docs/` or `scripts/notes/`. At cut time: rename
 - Reactor-gated tool middleware still blocks policy denials. A `decide()` deny
   (authorization hard-deny, auto-shell deny, or headless deny) returns a
   blocked tool error and does not run the call. Ask and allow still skip the
-  middleware prompt so an approved re-dispatch never re-asks.
+  middleware prompt so an approved re-dispatch never re-asks. Middleware is
+  not a second copy of `env.authorize`: it consumes the prior verdict when one
+  exists, and decides only for inner posix runs whose outer tool is not
+  `run_shell` (Codex apply_patch proxy).
 
 ## [0.3.18] - 2026-09-08
 

docs/ARCHITECTURE.md

@@ -377,7 +377,7 @@ tool call
 - **command** — Splits chained commands for security classification and derives command-shape approval scopes. Multi-segment chains only offer an exact-command persist pattern (a prefix like `npm *` must not cover `npm i && rm -rf /` later).
 - **auto-shell-policy** — Constrains `run_shell` even when auto mode would otherwise rubber-stamp it. Before matching, `expandShellSubjects` peels `bash`/`sh`/`zsh -c`, `xargs` utility tails, and transparent prefixes (`env`, `nice`, `timeout`, …) so rules see the real payload; an unparseable wrapper (variable expansion or command substitution) sets an opaque flag that forces `ask`. Effects: `deny` blocks outright (file mutations through ad-hoc tooling — output redirection, `tee`, `sed -i`/`perl -i`, interpreter inline programs or heredocs — which must instead go through `write_file`/`edit_file`); `ask` declines to auto-allow and falls through to the operator prompt (recursive `rm`, dependency installs and remote runners: npm/yarn/pnpm/bun, pip, cargo, go, brew, npx/bunx, …, force or uncontained `git worktree` ops, shell that references a sensitive path such as `.env` or a private key, and opaque wrappers). Contained non-force `git worktree add`/`remove`/`prune` and read-only `list` auto-allow (sibling destinations like `../corbits-dispatch-wts/…` included; absolute outside, `~`, globs, and credential basenames still ask). Deny beats ask when multiple subjects match. Quoted spans are stripped before pattern matching so a quoted `>` or install word in an argument is not flagged, and program names are matched only in command position. Adding a table category is a one-line rule append in `AUTO_SHELL_RULES`.
 - **gate** — Evaluates a call: `skipPermissions` allows everything; `allow`-tier passes; for `ask`-tier, checks persisted approvals, otherwise requests operator approval. Shell security classifies each chain segment (`||` / `&&` / `|` / `;` / newlines), but the operator is prompted once for the full command block — any unapproved segment fails the whole block, and execution always runs the unsplit original. Safe pipeline tails and pure shell no-ops (`true` / `false` / `:` and bare control-flow keywords stranded by chain-splitting) skip without a prompt. In a non-interactive run an unresolved `ask` becomes a denial. In auto mode: non-shell built-ins in `AUTO_ALLOWED_TOOLS` (writes/edits/deletes, `manage_tasks`, `spawn_agent`, `wait_agents`, …) auto-allow when not path-restricted; for `run_shell` the gate consults the auto-shell policy — a `deny` rule fails the call, an `ask` rule skips the auto-allow shortcut and proceeds to the normal approval flow, and anything unmatched is auto-allowed. Paths outside the workspace and writes under the session state root (`~/.corbits/projects/...` and legacy `.agent-state`) still ask under auto mode. Under `--dangerously-skip-permissions` (forces this process) or `/yolo` (persists as the user-global default via `setSkipPermissions`), the gate auto-allows those same cases, and pre-gate sandboxes (path-escape, shell session cwd retention, `list_dir` / `delete_file` workspace bounds) honor `getSkipPermissions()` live so outside-workspace access is not hard-denied after the gate already allowed it — without rebuilding the plugin stack. Secret-guard path denies and authorization hard blocks still apply. Mutating MCP and unknown built-ins are not blanket-allowed outside skip. Newly granted scopes are appended in memory and persisted.
-  - **Reactor-gated sessions (main session; `reactorGated: true`).** The gate's decision logic lives in one `decide()` used by both consumers: `evaluate()` (the middleware path below, still used by sub-agents) and `authorizeCall()`, which expresses the decision as the vendored reactor's before-tool authz effect (`src/permission/reactor-authorize.ts` bridges it into `env.authorize`). An `ask` there suspends the call as a reactor `PendingOperation` keyed by a correlationId (persisted through the context store's existing `pendingOperations`); `send()` settles as `suspended` and `src/session/approval-resume.ts` rebuilds the operator request from the approval snapshot, resolves it through the same `requestApproval` seam the TUI overlay uses, and delivers the decision to the reactor on the correlationId signal channel — an approved decision grants a one-shot bypass and the exact parked call re-dispatches; a rejected one answers it with an error result. Under reactor gating the middleware/MCP `gateToolCall` still blocks a `decide()` deny (authz hard-deny, auto-shell deny, headless deny) and does not call `next`; an `ask` or `allow` skips the middleware prompt so an approved re-dispatch never re-asks. The headless denial and the stricter chained-command hard-deny are preserved as deny effects (upstream `block`s) decided inside the same `decide()`.
+  - **Reactor-gated sessions (main session; `reactorGated: true`).** The gate's decision logic lives in one `decide()` used by both consumers: `evaluate()` (the middleware path below, still used by sub-agents) and `authorizeCall()`, which expresses the decision as the vendored reactor's before-tool authz effect (`src/permission/reactor-authorize.ts` bridges it into `env.authorize`). An `ask` there suspends the call as a reactor `PendingOperation` keyed by a correlationId (persisted through the context store's existing `pendingOperations`); `send()` settles as `suspended` and `src/session/approval-resume.ts` rebuilds the operator request from the approval snapshot, resolves it through the same `requestApproval` seam the TUI overlay uses, and delivers the decision to the reactor on the correlationId signal channel — an approved decision grants a one-shot bypass and the exact parked call re-dispatches; a rejected one answers it with an error result. Under reactor gating the middleware/MCP `gateToolCall` is an execution backstop, not a second copy of `env.authorize`: it consumes the `authorizeCall` verdict when one exists and does not re-decide. Deny still blocks and does not call `next`; an `ask` or `allow` skips the middleware prompt so an approved re-dispatch never re-asks. The remaining hole is inner posix runs whose outer tool is not `run_shell` (Codex `apply_patch` proxy uses a reused `codex-proxy` call id): those never pass `env.authorize`, so `gateToolCall` decides only on that cache miss and still blocks a deny. The headless denial and the stricter chained-command hard-deny are preserved as deny effects (upstream `block`s) decided inside the same `decide()`.
 
 - **matcher** — Approval pattern matching via `@intx/authz` `matchPattern` (`*` wildcards). Exact-command grants store a backslash before each metacharacter; those patterns match by equality after unescape (the package has no escape syntax).
 - **authz-grants** — Maps stored approvals into `@intx/authz` `GrantRule`s and evaluates them with `evaluateGrants` (allow-only; Corbits cwd/provider-model filters applied first). Exact-escaped grants bypass the package path and use equality.

src/permission/gate.ts

@@ -307,17 +307,20 @@ export interface PermissionGateOptions {
   approvalLog?: ApprovalLog;
 }
 
+export type AuthorizeVerdict =
+  | { effect: "allow" }
+  | { effect: "deny"; reason: string }
+  | { effect: "ask"; request: PermissionRequest };
+
 export interface PermissionGate {
   evaluate: (call: ToolCall) => Promise<GateVerdict>;
   // Reactor-path policy: the same decision evaluate() makes, as the effect the
   // vendored before-tool authz hook consumes (see authorizeCall above).
-  authorizeCall: (
-    call: ToolCall,
-  ) => Promise<
-    | { effect: "allow" }
-    | { effect: "deny"; reason: string }
-    | { effect: "ask"; request: PermissionRequest }
-  >;
+  authorizeCall: (call: ToolCall) => Promise<AuthorizeVerdict>;
+  // Execution-time backstop for reactor-gated posix/MCP middleware: consume the
+  // authorizeCall verdict when one exists; decide only when there is no prior
+  // verdict (nested posix whose outer tool is not run_shell, and tests).
+  executionVerdict: (call: ToolCall) => Promise<AuthorizeVerdict>;
   // Resolve a suspended reactor approval against the operator (and mint the
   // outcome's grant). Returns undefined when no outcome arrived.
   resolveSuspended: (request: PermissionRequest) => Promise<ApprovalOutcome | undefined>;
@@ -471,20 +474,11 @@ export function createPermissionGate(options: PermissionGateOptions): Permission
   // settled all collapse to now. Interactive prompts use approvalLog.ask
   // directly (see below) so their real queued/displayed/settled timestamps
   // are captured.
-  //
-  // Recording owns uniqueness: reactor-gated calls run decide() twice (env.authorize
-  // then gateToolCall) and decide() is not otherwise idempotent. A second pass
-  // for the same call.id must still return deny, but must not append a second
-  // JSONL record.
-  const recordedCallIds = new Set<string>();
   const recordAutoDecision = (
-    callId: string,
     tool: string,
     rule: string | undefined,
     outcome: ApprovalOutcomeKind,
   ): void => {
-    if (recordedCallIds.has(callId)) return;
-    recordedCallIds.add(callId);
     approvalLog
       .ask({
         tool,
@@ -494,6 +488,12 @@ export function createPermissionGate(options: PermissionGateOptions): Permission
       .settle(outcome);
   };
 
+  // Consume-once handoff from env.authorize to execution-time middleware.
+  // Not session-lifetime uniqueness: call.id is reused for every Codex proxy
+  // inner posix op, so a lasting set would mute later JSONL records. reset()
+  // clears leftovers (outer tools that never hit posix middleware).
+  const authorizedByCallId = new Map<string, AuthorizeVerdict>();
+
   // Non-blocking policy decision for one tool call: everything the gate owns —
   // tier pre-filter, auto rules, pre-grant guards, grants, headless denial —
   // resolved WITHOUT waiting on an operator. `ask` carries the fully-built
@@ -555,15 +555,15 @@ export function createPermissionGate(options: PermissionGateOptions): Permission
         // a secret path is ask so an explicit one-time approval can pass it.
         const shellRule = autoShellRuleForCall(call, isRestrictedHere, effectiveCwd, rootsProvider);
         if (shellRule?.effect === "deny") {
-          recordAutoDecision(call.id, call.name, shellRule.name, "auto-deny");
+          recordAutoDecision(call.name, shellRule.name, "auto-deny");
           return { kind: "deny", reason: shellRule.reason };
         }
         if (shellRule === undefined) {
-          recordAutoDecision(call.id, call.name, undefined, "auto-allow");
+          recordAutoDecision(call.name, undefined, "auto-allow");
           return { kind: "allow" };
         }
       } else if (!restricted && AUTO_ALLOWED_TOOLS.has(call.name)) {
-        recordAutoDecision(call.id, call.name, "auto-allowed-tool", "auto-allow");
+        recordAutoDecision(call.name, "auto-allowed-tool", "auto-allow");
         return { kind: "allow" };
       }
       // Any other tool in auto mode (MCP or unknown built-in) is not
@@ -642,7 +642,7 @@ export function createPermissionGate(options: PermissionGateOptions): Permission
         const askRule = anySecret ? "sensitive-path" : undefined;
 
         if (!interactive || requestApproval === undefined) {
-          recordAutoDecision(call.id, request.tool, askRule ?? "non-interactive", "deny");
+          recordAutoDecision(request.tool, askRule ?? "non-interactive", "deny");
           return {
             kind: "deny",
             reason: anySecret
@@ -677,7 +677,7 @@ export function createPermissionGate(options: PermissionGateOptions): Permission
       }
 
       if (!interactive || requestApproval === undefined) {
-        recordAutoDecision(call.id, request.tool, "non-interactive", "deny");
+        recordAutoDecision(request.tool, "non-interactive", "deny");
         return {
           kind: "deny",
           reason: `${request.action} requires operator approval, which is unavailable in a non-interactive run. Re-run with --dangerously-skip-permissions to bypass, or narrow the action.`,
@@ -729,7 +729,7 @@ export function createPermissionGate(options: PermissionGateOptions): Permission
 
   // Middleware path: blocking evaluation used by tool-runner consumers whose
   // calls never pass through the reactor (sub-agents). When the gate is
-  // reactor-gated, gateToolCall uses authorizeCall instead of evaluate() so
+  // reactor-gated, gateToolCall uses executionVerdict instead of evaluate() so
   // deny still blocks and ask never re-prompts (see gateToolCall).
   const evaluate = async (call: ToolCall): Promise<GateVerdict> => {
     const decision = await decide(call);
@@ -751,14 +751,9 @@ export function createPermissionGate(options: PermissionGateOptions): Permission
   // vendored before-tool authz hook consumes. `allow` proceeds, `deny` becomes
   // an upstream `block`, and `ask` suspends the call as a PendingOperation
   // keyed by the hook-minted correlationId — no resolve closure is held here.
-  const authorizeCall = async (
-    call: ToolCall,
-  ): Promise<
-    | { effect: "allow" }
-    | { effect: "deny"; reason: string }
-    | { effect: "ask"; request: PermissionRequest }
-  > => {
-    const decision = await decide(call);
+  // Stashes the verdict for gateToolCall to consume so middleware is not a
+  // second copy of env.authorize.
+  const mapAuthorizeVerdict = (decision: GateDecision): AuthorizeVerdict => {
     switch (decision.kind) {
       case "allow":
         return { effect: "allow" };
@@ -769,6 +764,21 @@ export function createPermissionGate(options: PermissionGateOptions): Permission
     }
   };
 
+  const authorizeCall = async (call: ToolCall): Promise<AuthorizeVerdict> => {
+    const verdict = mapAuthorizeVerdict(await decide(call));
+    authorizedByCallId.set(call.id, verdict);
+    return verdict;
+  };
+
+  const executionVerdict = async (call: ToolCall): Promise<AuthorizeVerdict> => {
+    const cached = authorizedByCallId.get(call.id);
+    if (cached !== undefined) {
+      authorizedByCallId.delete(call.id);
+      return cached;
+    }
+    return mapAuthorizeVerdict(await decide(call));
+  };
+
   // Resolve a suspended reactor approval once the operator answers. The
   // request is the one authorizeCall built at decision time, so the ask log,
   // wait span, and grant minting are identical to the middleware path.
@@ -792,6 +802,7 @@ export function createPermissionGate(options: PermissionGateOptions): Permission
       if (index !== -1) approvals.splice(index, 1);
     }
     sessionGrants.length = 0;
+    authorizedByCallId.clear();
   };
 
   const sameApproval = (a: Approval, b: Approval): boolean =>
@@ -824,6 +835,7 @@ export function createPermissionGate(options: PermissionGateOptions): Permission
   return {
     evaluate,
     authorizeCall,
+    executionVerdict,
     resolveSuspended,
     isReactorGated: () => reactorGated,
     getApprovals: () => approvals,