Fail closed when ask overlay accept is not id-keyed

Author: TheGreatAxios

src/tui/gate-wire.test.ts

@@ -458,6 +458,74 @@ describe("wireGates", () => {
     });
   });
 
+  test("sequential permission.gate asks paint B's labels and id-scoped values, not A's", async () => {
+    await withTestRenderer(async (h) => {
+      const shell = createAppShell(h.renderer, {
+        terminal: { columns: 80, rows: 24 },
+        run: "idle",
+      });
+      const emitter = new EventEmitter();
+      let resolvedA: unknown;
+      let resolvedB: unknown;
+      try {
+        const dispose = wireGates(emitter, shell);
+        emitter.emit("permission.gate", {
+          request: baseRequest({
+            id: "req-a",
+            subject: "git status",
+            scopes: [{ id: "scope-a", label: "Allow git A", pattern: "git A*" }],
+          }),
+          resolve: (outcome: unknown) => {
+            resolvedA = outcome;
+          },
+        });
+        expect(shell.overlayKind).toBe("permissions");
+        expect(shell.overlayList?.select.options.map((option) => option.name)).toEqual([
+          "Reject",
+          "Accept once",
+          "Allow git A",
+        ]);
+
+        closeInsetOverlay(shell);
+        expect(resolvedA).toEqual({ allow: false });
+        expect(shell.overlayList).toBeNull();
+
+        emitter.emit("permission.gate", {
+          request: baseRequest({
+            id: "req-b",
+            subject: "git push",
+            scopes: [{ id: "scope-b", label: "Allow git B", pattern: "git B*" }],
+          }),
+          resolve: (outcome: unknown) => {
+            resolvedB = outcome;
+          },
+        });
+        expect(shell.overlayKind).toBe("permissions");
+        const painted = shell.overlayList?.select.options ?? [];
+        expect(painted.map((option) => option.name)).toEqual([
+          "Reject",
+          "Accept once",
+          "Allow git B",
+        ]);
+        expect(painted.map((option) => option.value)).toEqual([
+          `req-b:${PERMISSION_DENY_ID}`,
+          `req-b:${PERMISSION_ONCE_ID}`,
+          "req-b:scope-b",
+        ]);
+        expect(painted.map((option) => option.value)).not.toContain(`req-a:${PERMISSION_DENY_ID}`);
+        expect(painted.map((option) => option.value)).not.toContain(`req-a:${PERMISSION_ONCE_ID}`);
+        expect(painted.map((option) => option.value)).not.toContain("req-a:scope-a");
+
+        acceptOverlaySelection(shell);
+        expect(resolvedB).toEqual({ allow: false });
+
+        dispose();
+      } finally {
+        shell.dispose();
+      }
+    });
+  });
+
   test("operator.gate without id cancels without opening", async () => {
     await withTestRenderer(async (h) => {
       const shell = createAppShell(h.renderer, {

src/tui/overlays.test.ts

@@ -321,6 +321,46 @@ describe("overlay accept callbacks", () => {
     );
   });
 
+  test("gate accept with a painted value missing from live itemIds denies instead of remapping by index", async () => {
+    await withTestRenderer(
+      async (h) => {
+        const shell = createAppShell(h.renderer, {
+          terminal: { columns: 80, rows: 24 },
+          wireKeys: false,
+        });
+        try {
+          const accepted: OverlaySelection[] = [];
+          let cancelled = 0;
+          openPermissionsOverlay(shell, {
+            items: ["Reject", "Accept once"],
+            itemIds: ["req-b:__deny__", "req-b:__once__"],
+            isGate: true,
+            echoChoice: false,
+            onAccept: (s) => accepted.push(s),
+            onCancel: () => {
+              cancelled += 1;
+            },
+          });
+          moveOverlaySelection(shell, 1);
+          const list = shell.overlayList;
+          if (!list) throw new Error("expected an open overlay list");
+          list.select.options = [
+            { name: "Reject", description: "", value: "req-a:__deny__" },
+            { name: "Accept once", description: "", value: "req-a:__once__" },
+          ];
+          list.select.setSelectedIndex(1);
+          acceptOverlaySelection(shell);
+          expect(accepted).toEqual([]);
+          expect(cancelled).toBe(1);
+          expect(shell.overlayList).toBeNull();
+        } finally {
+          shell.dispose();
+        }
+      },
+      { width: 80, height: 24 },
+    );
+  });
+
   test("sequential operator opens paint B's labels and ids, not A's", async () => {
     await withTestRenderer(
       async (h) => {

src/tui/shell/overlay-host.ts

@@ -776,7 +776,15 @@ export function acceptOverlaySelection(shell: AppShell): void {
 
   const painted = shell.overlayList.select.getSelectedOption()?.value;
   const itemIds = bag?.primaryBindings.itemIds ?? [];
-  const id = typeof painted === "string" && itemIds.includes(painted) ? painted : itemIds[idx];
+  const idKeyed = typeof painted === "string" && itemIds.includes(painted);
+  // Gate accept is id-keyed. A painted Select value missing from the live
+  // itemIds is a stale or mismatched row — remapping via index would bind
+  // Enter to the new question's same-index choice. Fail closed instead.
+  if (bag?.primaryBindings.isGate === true && !idKeyed) {
+    closeInsetOverlay(shell);
+    return;
+  }
+  const id = idKeyed ? painted : itemIds[idx];
   // Type-to-filter plants "(no matches)" with an empty-id sentinel. Stay open.
   if (id === "") return;
   const value = bag?.primaryBindings.itemValues[idx];