Gate spawned workers through a reactor-gated permission view

An identity-store ownership flag made the permission plugin
worker-aware. A view over the parent gate reports isReactorGated
and maps unresolved asks to denials that name the subject.

Author: TheGreatAxios

CHANGELOG.md

@@ -11,6 +11,14 @@ matching `## [X.Y.Z]` section (plus install instructions). Do not maintain
 parallel copies under `docs/` or `scripts/notes/`. At cut time: rename
 `## [Unreleased]` to `## [X.Y.Z] - YYYY-MM-DD`, then run the release script.
 
+## [Unreleased]
+
+### Fixed
+
+- Spawned workers enforce the parent permission gate. Unresolved worker
+  approvals deny with a reason that names the permission subject so the parent
+  can grant and retry, without hanging on operator approval.
+
 ## [0.3.18] - 2026-09-08
 
 ### Added

docs/ARCHITECTURE.md

@@ -378,7 +378,7 @@ tool call
 - **auto-shell-policy** — Constrains `run_shell` even when auto mode would otherwise rubber-stamp it. Before matching, `expandShellSubjects` peels `bash`/`sh`/`zsh -c`, `xargs` utility tails, and transparent prefixes (`env`, `nice`, `timeout`, …) so rules see the real payload; an unparseable wrapper (variable expansion or command substitution) sets an opaque flag that forces `ask`. Effects: `deny` blocks outright (file mutations through ad-hoc tooling — output redirection, `tee`, `sed -i`/`perl -i`, interpreter inline programs or heredocs — which must instead go through `write_file`/`edit_file`); `ask` declines to auto-allow and falls through to the operator prompt (recursive `rm`, dependency installs and remote runners: npm/yarn/pnpm/bun, pip, cargo, go, brew, npx/bunx, …, force or uncontained `git worktree` ops, shell that references a sensitive path such as `.env` or a private key, and opaque wrappers). Contained non-force `git worktree add`/`remove`/`prune` and read-only `list` auto-allow (sibling destinations like `../corbits-dispatch-wts/…` included; absolute outside, `~`, globs, and credential basenames still ask). Deny beats ask when multiple subjects match. Quoted spans are stripped before pattern matching so a quoted `>` or install word in an argument is not flagged, and program names are matched only in command position. Adding a table category is a one-line rule append in `AUTO_SHELL_RULES`.
 - **gate** — Evaluates a call: `skipPermissions` allows everything; `allow`-tier passes; for `ask`-tier, checks persisted approvals, otherwise requests operator approval. Shell security classifies each chain segment (`||` / `&&` / `|` / `;` / newlines), but the operator is prompted once for the full command block — any unapproved segment fails the whole block, and execution always runs the unsplit original. Safe pipeline tails and pure shell no-ops (`true` / `false` / `:` and bare control-flow keywords stranded by chain-splitting) skip without a prompt. In a non-interactive run an unresolved `ask` becomes a denial. In auto mode: non-shell built-ins in `AUTO_ALLOWED_TOOLS` (writes/edits/deletes, `manage_tasks`, `spawn_agent`, `wait_agents`, …) auto-allow when not path-restricted; for `run_shell` the gate consults the auto-shell policy — a `deny` rule fails the call, an `ask` rule skips the auto-allow shortcut and proceeds to the normal approval flow, and anything unmatched is auto-allowed. Paths outside the workspace and writes under the session state root (`~/.corbits/projects/...` and legacy `.agent-state`) still ask under auto mode. Under `--dangerously-skip-permissions` (forces this process) or `/yolo` (persists as the user-global default via `setSkipPermissions`), the gate auto-allows those same cases, and pre-gate sandboxes (path-escape, shell session cwd retention, `list_dir` / `delete_file` workspace bounds) honor `getSkipPermissions()` live so outside-workspace access is not hard-denied after the gate already allowed it — without rebuilding the plugin stack. Secret-guard path denies and authorization hard blocks still apply. Mutating MCP and unknown built-ins are not blanket-allowed outside skip. Newly granted scopes are appended in memory and persisted.
   - **Reactor-gated main session (`reactorGated: true`).** The gate's decision logic lives in one `decide()` used by both consumers: `evaluate()` (the middleware path) and `authorizeCall()`, which expresses the decision as the vendored reactor's before-tool authz effect (`src/permission/reactor-authorize.ts` bridges it into `env.authorize`). An `ask` there suspends the call as a reactor `PendingOperation` keyed by a correlationId (persisted through the context store's existing `pendingOperations`); `send()` settles as `suspended` and `src/session/approval-resume.ts` rebuilds the operator request from the approval snapshot, resolves it through the same `requestApproval` seam the TUI overlay uses, and delivers the decision to the reactor on the correlationId signal channel — an approved decision grants a one-shot bypass and the exact parked call re-dispatches; a rejected one answers it with an error result. Under reactor gating the middleware/MCP `gateToolCall` bypasses the gate so an approved re-dispatch never re-asks. The headless denial and the stricter chained-command hard-deny are preserved as deny effects (upstream `block`s) decided inside the same `decide()`.
-  - **Worker reactor ownership.** `createWorkerAuthorize` reuses the validated reactor authorization bridge to the parent's live permission gate: grants and policy are shared, not copied or toggled. Authorization and tool execution run under the same async-local worker identity and cwd. A worker-local reactor ownership marker suppresses duplicate middleware evaluation even when the shared parent gate has `reactorGated: false`. Unresolved `ask` decisions become denials without invoking an approval callback or suspending, even with an interactive parent; the parent can obtain a grant and retry. Fleet authority remains an independent restriction, not an alternative permission grant.
+  - **Worker reactor ownership.** `workerPermissionGate` is a reactor-gated view over the parent's live permission gate: grants and policy are shared, not copied or toggled. Worker posix/MCP plugins skip middleware because that view reports `isReactorGated()`. `authorizeCall` on the view never emits `ask` — unresolved approvals become denials that name the permission subject, without invoking an approval callback or suspending, even with an interactive parent; the parent can obtain a grant and retry. Worker control-plane tools (`submit_result`, `ask_director`, and nested fleet verbs other than `spawn_agent`) allow without a parent grant. Authorization and tool execution run under the same async-local worker identity and cwd. Fleet authority remains an independent restriction, not an alternative permission grant.
 
 - **matcher** — Approval pattern matching via `@intx/authz` `matchPattern` (`*` wildcards). Exact-command grants store a backslash before each metacharacter; those patterns match by equality after unescape (the package has no escape syntax).
 - **authz-grants** — Maps stored approvals into `@intx/authz` `GrantRule`s and evaluates them with `evaluateGrants` (allow-only; Corbits cwd/provider-model filters applied first). Exact-escaped grants bypass the package path and use equality.

src/permission/decline-markers.ts

@@ -31,3 +31,6 @@ export const APPROVER_REJECTION_MARKER = "denied by approver";
 
 /** vendor/intx-inference reactor.ts — timed-out approval suspension result. */
 export const APPROVAL_TIMEOUT_RESULT_TEXT = "approval timed out";
+
+/** Worker unresolved-ask deny — parent grants the named subject and retries. */
+export const WORKER_CANNOT_COMPLETE_APPROVAL = "workers cannot complete operator approval.";

src/permission/gate.ts

@@ -297,7 +297,7 @@ export interface PermissionGateOptions {
   // This gate's decisions are consumed by the reactor's before-tool authz
   // seam (env.authorize) instead of the tool-runner middleware. Set for the
   // main session so approved re-dispatches skip the middleware gate. Workers
-  // own reactor enforcement via their execution identity regardless of this flag.
+  // receive a reactor-gated view over this same policy (see workerPermissionGate).
   // Required so callers cannot silently fall back to middleware by omitting it.
   reactorGated: boolean;
   // Ask/settle event log (see approval-log.ts): one record per consequential
@@ -718,7 +718,7 @@ export function createPermissionGate(options: PermissionGateOptions): Permission
   };
 
   // Middleware path: blocking evaluation used by tool-runner consumers whose
-  // calls never pass through the reactor (sub-agents, late MCP wrappers).
+  // calls never pass through the reactor (late MCP wrappers).
   // When the gate is reactor-gated this is bypassed entirely — the reactor's
   // before-tool authz hook owns the decision (see authorizeCall / gateToolCall).
   const evaluate = async (call: ToolCall): Promise<GateVerdict> => {

src/permission/reactor-authorize.test.ts

@@ -1,21 +1,31 @@
 import { expect, test } from "bun:test";
 import { createPermissionGate } from "./gate.js";
-import { createReactorAuthorize, createWorkerAuthorize } from "./reactor-authorize.js";
+import {
+  createReactorAuthorize,
+  createWorkerAuthorize,
+  workerPermissionGate,
+} from "./reactor-authorize.js";
 import { runWithSubAgentIdentity, getSubAgentIdentity } from "../subagent/identity-context.js";
 import { gateToolCall } from "../plugins/permission-plugin.js";
+import { WORKER_CANNOT_COMPLETE_APPROVAL } from "./decline-markers.js";
 import type { ToolCall } from "@intx/types/runtime";
 
 const call: ToolCall = {
   id: "write-1",
   name: "write_file",
   arguments: { path: "probe.txt", content: "data" },
 };
-const gate = () =>
+const namedCall = (name: string, args: Record<string, unknown> = {}): ToolCall => ({
+  id: `${name}-1`,
+  name,
+  arguments: args,
+});
+const gate = (opts?: { interactive?: boolean; auto?: boolean }) =>
   createPermissionGate({
     cwd: process.cwd(),
     approvals: [],
-    interactive: true,
-    auto: false,
+    interactive: opts?.interactive ?? true,
+    auto: opts?.auto ?? false,
     skipPermissions: false,
     reactorGated: false,
     requestApproval: async () => {
@@ -31,6 +41,14 @@ test("worker maps unresolved ask to deny while main reactor suspends", async ()
   expect((await createWorkerAuthorize(policy)("tool:write_file", "invoke", call)).effect).toBe(
     "deny",
   );
+  const denied = await workerPermissionGate(policy).authorizeCall(call);
+  expect(denied.effect).toBe("deny");
+  if (denied.effect !== "deny") throw new Error("expected deny");
+  expect(denied.reason).toContain("probe.txt");
+  expect(denied.reason).toContain(WORKER_CANNOT_COMPLETE_APPROVAL);
+  const workerDenied = await createWorkerAuthorize(policy)("tool:write_file", "invoke", call);
+  expect(workerDenied.effect).toBe("deny");
+  expect(workerDenied.reason).toBe(denied.reason);
   policy.setAuto(true);
   expect((await createWorkerAuthorize(policy)("tool:write_file", "invoke", call)).effect).toBe(
     "allow",
@@ -41,6 +59,54 @@ test("worker maps unresolved ask to deny while main reactor suspends", async ()
   );
 });
 
+test("leaf worker control-plane tools allow with empty parent approvals", async () => {
+  for (const mode of [
+    { interactive: true, auto: false },
+    { interactive: false, auto: true },
+  ] as const) {
+    const policy = gate(mode);
+    const authorize = createWorkerAuthorize(policy);
+    expect(
+      (await authorize("tool:submit_result", "invoke", namedCall("submit_result"))).effect,
+    ).toBe("allow");
+    expect((await authorize("tool:ask_director", "invoke", namedCall("ask_director"))).effect).toBe(
+      "allow",
+    );
+    expect((await authorize("tool:wait_agents", "invoke", namedCall("wait_agents"))).effect).toBe(
+      "allow",
+    );
+  }
+});
+
+test("nested orchestrator wait_agents allows with only a spawn_agent grant", async () => {
+  const policy = gate({ interactive: true, auto: false });
+  policy.setSeededApprovals([{ tool: "spawn_agent", pattern: "*" }]);
+  const authorize = createWorkerAuthorize(policy);
+  expect((await authorize("tool:wait_agents", "invoke", namedCall("wait_agents"))).effect).toBe(
+    "allow",
+  );
+  expect((await authorize("tool:list_agents", "invoke", namedCall("list_agents"))).effect).toBe(
+    "allow",
+  );
+  expect((await authorize("tool:spawn_agent", "invoke", namedCall("spawn_agent"))).effect).toBe(
+    "allow",
+  );
+});
+
+test("worker spawn_agent still needs a parent grant", async () => {
+  const policy = gate({ interactive: true, auto: false });
+  expect(
+    (await createWorkerAuthorize(policy)("tool:spawn_agent", "invoke", namedCall("spawn_agent")))
+      .effect,
+  ).toBe("deny");
+});
+
+test("worker authorizeCall never emits ask", async () => {
+  const policy = gate({ interactive: true, auto: false });
+  expect((await workerPermissionGate(policy).authorizeCall(call)).effect).not.toBe("ask");
+  expect((await policy.authorizeCall(call)).effect).toBe("ask");
+});
+
 test("worker bridge rejects malformed context, resource, and action", async () => {
   const authorize = createWorkerAuthorize(gate());
   await expect(authorize("tool:write_file", "invoke", {})).rejects.toThrow("ToolCall");
@@ -51,22 +117,24 @@ test("worker bridge rejects malformed context, resource, and action", async () =
 test("worker reactor is sole owner even if parent middleware mode changes policy before runner", async () => {
   const policy = gate();
   policy.setAuto(true);
-  const identity = { description: "worker", cwd: process.cwd(), reactorOwnsPermissions: true };
+  const identity = { description: "worker", cwd: process.cwd() };
+  const workerGate = workerPermissionGate(policy);
   const authorize = createWorkerAuthorize(policy);
   expect(
     (await runWithSubAgentIdentity(identity, () => authorize("tool:write_file", "invoke", call)))
       .effect,
   ).toBe("allow");
   policy.setAuto(false);
   const result = await runWithSubAgentIdentity(identity, () =>
-    gateToolCall(policy, call, new AbortController().signal, async () => ({
+    gateToolCall(workerGate, call, new AbortController().signal, async () => ({
       callId: call.id,
       content: "executed",
       isError: false,
     })),
   );
   expect(result.isError).toBe(false);
   expect(policy.isReactorGated()).toBe(false);
+  expect(workerGate.isReactorGated()).toBe(true);
   expect(
     (await runWithSubAgentIdentity(identity, () => authorize("tool:write_file", "invoke", call)))
       .effect,
@@ -88,7 +156,7 @@ test("concurrent authorization preserves each worker cwd across awaited policy e
   const authorize = createWorkerAuthorize(policy);
   await Promise.all(
     ["/worker-a", "/worker-b"].map((cwd) =>
-      runWithSubAgentIdentity({ description: cwd, cwd, reactorOwnsPermissions: true }, () =>
+      runWithSubAgentIdentity({ description: cwd, cwd }, () =>
         authorize("tool:write_file", "invoke", call),
       ),
     ),