Enforce inherited permissions for spawned workers

Author: TheGreatAxios

docs/ARCHITECTURE.md

@@ -377,7 +377,8 @@ tool call
 - **command** — Splits chained commands for security classification and derives command-shape approval scopes. Multi-segment chains only offer an exact-command persist pattern (a prefix like `npm *` must not cover `npm i && rm -rf /` later).
 - **auto-shell-policy** — Constrains `run_shell` even when auto mode would otherwise rubber-stamp it. Before matching, `expandShellSubjects` peels `bash`/`sh`/`zsh -c`, `xargs` utility tails, and transparent prefixes (`env`, `nice`, `timeout`, …) so rules see the real payload; an unparseable wrapper (variable expansion or command substitution) sets an opaque flag that forces `ask`. Effects: `deny` blocks outright (file mutations through ad-hoc tooling — output redirection, `tee`, `sed -i`/`perl -i`, interpreter inline programs or heredocs — which must instead go through `write_file`/`edit_file`); `ask` declines to auto-allow and falls through to the operator prompt (recursive `rm`, dependency installs and remote runners: npm/yarn/pnpm/bun, pip, cargo, go, brew, npx/bunx, …, force or uncontained `git worktree` ops, shell that references a sensitive path such as `.env` or a private key, and opaque wrappers). Contained non-force `git worktree add`/`remove`/`prune` and read-only `list` auto-allow (sibling destinations like `../corbits-dispatch-wts/…` included; absolute outside, `~`, globs, and credential basenames still ask). Deny beats ask when multiple subjects match. Quoted spans are stripped before pattern matching so a quoted `>` or install word in an argument is not flagged, and program names are matched only in command position. Adding a table category is a one-line rule append in `AUTO_SHELL_RULES`.
 - **gate** — Evaluates a call: `skipPermissions` allows everything; `allow`-tier passes; for `ask`-tier, checks persisted approvals, otherwise requests operator approval. Shell security classifies each chain segment (`||` / `&&` / `|` / `;` / newlines), but the operator is prompted once for the full command block — any unapproved segment fails the whole block, and execution always runs the unsplit original. Safe pipeline tails and pure shell no-ops (`true` / `false` / `:` and bare control-flow keywords stranded by chain-splitting) skip without a prompt. In a non-interactive run an unresolved `ask` becomes a denial. In auto mode: non-shell built-ins in `AUTO_ALLOWED_TOOLS` (writes/edits/deletes, `manage_tasks`, `spawn_agent`, `wait_agents`, …) auto-allow when not path-restricted; for `run_shell` the gate consults the auto-shell policy — a `deny` rule fails the call, an `ask` rule skips the auto-allow shortcut and proceeds to the normal approval flow, and anything unmatched is auto-allowed. Paths outside the workspace and writes under the session state root (`~/.corbits/projects/...` and legacy `.agent-state`) still ask under auto mode. Under `--dangerously-skip-permissions` (forces this process) or `/yolo` (persists as the user-global default via `setSkipPermissions`), the gate auto-allows those same cases, and pre-gate sandboxes (path-escape, shell session cwd retention, `list_dir` / `delete_file` workspace bounds) honor `getSkipPermissions()` live so outside-workspace access is not hard-denied after the gate already allowed it — without rebuilding the plugin stack. Secret-guard path denies and authorization hard blocks still apply. Mutating MCP and unknown built-ins are not blanket-allowed outside skip. Newly granted scopes are appended in memory and persisted.
-  - **Reactor-gated sessions (main session; `reactorGated: true`).** The gate's decision logic lives in one `decide()` used by both consumers: `evaluate()` (the middleware path below, still used by sub-agents) and `authorizeCall()`, which expresses the decision as the vendored reactor's before-tool authz effect (`src/permission/reactor-authorize.ts` bridges it into `env.authorize`). An `ask` there suspends the call as a reactor `PendingOperation` keyed by a correlationId (persisted through the context store's existing `pendingOperations`); `send()` settles as `suspended` and `src/session/approval-resume.ts` rebuilds the operator request from the approval snapshot, resolves it through the same `requestApproval` seam the TUI overlay uses, and delivers the decision to the reactor on the correlationId signal channel — an approved decision grants a one-shot bypass and the exact parked call re-dispatches; a rejected one answers it with an error result. Under reactor gating the middleware/MCP `gateToolCall` bypasses the gate so an approved re-dispatch never re-asks. The headless denial and the stricter chained-command hard-deny are preserved as deny effects (upstream `block`s) decided inside the same `decide()`.
+  - **Reactor-gated main session (`reactorGated: true`).** The gate's decision logic lives in one `decide()` used by both consumers: `evaluate()` (the middleware path) and `authorizeCall()`, which expresses the decision as the vendored reactor's before-tool authz effect (`src/permission/reactor-authorize.ts` bridges it into `env.authorize`). An `ask` there suspends the call as a reactor `PendingOperation` keyed by a correlationId (persisted through the context store's existing `pendingOperations`); `send()` settles as `suspended` and `src/session/approval-resume.ts` rebuilds the operator request from the approval snapshot, resolves it through the same `requestApproval` seam the TUI overlay uses, and delivers the decision to the reactor on the correlationId signal channel — an approved decision grants a one-shot bypass and the exact parked call re-dispatches; a rejected one answers it with an error result. Under reactor gating the middleware/MCP `gateToolCall` bypasses the gate so an approved re-dispatch never re-asks. The headless denial and the stricter chained-command hard-deny are preserved as deny effects (upstream `block`s) decided inside the same `decide()`.
+  - **Worker reactor ownership.** `createWorkerAuthorize` reuses the validated reactor authorization bridge to the parent's live permission gate: grants and policy are shared, not copied or toggled. Authorization and tool execution run under the same async-local worker identity and cwd. A worker-local reactor ownership marker suppresses duplicate middleware evaluation even when the shared parent gate has `reactorGated: false`. Unresolved `ask` decisions become denials without invoking an approval callback or suspending, even with an interactive parent; the parent can obtain a grant and retry. Fleet authority remains an independent restriction, not an alternative permission grant.
 
 - **matcher** — Approval pattern matching via `@intx/authz` `matchPattern` (`*` wildcards). Exact-command grants store a backslash before each metacharacter; those patterns match by equality after unescape (the package has no escape syntax).
 - **authz-grants** — Maps stored approvals into `@intx/authz` `GrantRule`s and evaluates them with `evaluateGrants` (allow-only; Corbits cwd/provider-model filters applied first). Exact-escaped grants bypass the package path and use equality.

docs/IMPLEMENTATION.md

@@ -392,6 +392,19 @@ Session runtime state lives under the global projects tree (not in the repo):
 - Migration: if a session exists only under in-repo `.agent-state/<session-id>/`, it is moved into the global tree on open/list
 - Atomic JSON writes with schema validation on load
 
+**Worker audit persistence.** Workers initialize a real `@intx/storage-isogit`
+`AuditStore` at `<worker-workdir>/audit-store` (`src/subagent/run.ts`), separate
+from the native context store's Git index. Initialization failure prevents worker
+execution. The existing agent-owned audit and error collectors persist at
+checkpoint and shutdown; retained worker sessions flush at checkpoint/resume and
+close. The parent still supplies `noopAuditStore()`: collectors exist there too,
+but the parent does not durably store their records.
+
+Audit storage is not transactional with tool execution. A runtime `commitAudit`
+failure after an authorized side effect can lose the drained audit record while
+allowing the worker to complete. It emits a reactor error persisted by the existing
+error collector; there is no added retry subsystem or side-effect rollback.
+
 `createOptimizedContextStore` (`src/session/optimized-context-store.ts`) wraps the
 Interchange git store to keep per-checkpoint cost independent of session length.
 Checkpoint commits go through system git and use the operator's global
@@ -464,15 +477,15 @@ Corbits Code v0.3 memory and stall hardening is implemented under `src/`, `tests
 
 ### Bounded audit collector retention between checkpoints
 
-| Field                                           | Detail                                                                                                                                                                                                                                                                                    |
-| ----------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| **Status**                                      | Not applicable on the default path; deferred until real audit persistence is enabled                                                                                                                                                                                                      |
-| **Risk**                                        | A live audit collector that buffers full tool results in memory until `flush()` on checkpoint/shutdown can grow without bound on long, checkpoint-sparse runs.                                                                                                                            |
-| **Why Corbits Code-only scope cannot close it** | Production agent setup wires `noopAuditStore()` from `@intx/agent/testing` in `src/tui/runner.ts` and `src/subagent/index.ts`. No `AuditCollector` from `@intx/inference` is instantiated, so bounding `completed` retention in `audit-collector` does not change shipped behavior today. |
-| **Upstream owner**                              | `@intx/inference` audit collector (`audit-collector` module): opportunistic flush or capped result bodies while preserving metadata.                                                                                                                                                      |
-| **Future Corbits Code work**                    | If settings later select a persistent audit store, add a bounded wrapper or configuration in `src/` and re-run hardening tests; until then, document the noop path only.                                                                                                                  |
+Agent-owned audit collectors buffer completed tool results until checkpoint or
+shutdown flush, including when a noop store is supplied. Workers use the durable
+store described under State Persistence; the parent's noop store does not make
+collector retention inapplicable. Long, checkpoint-sparse runs can retain
+unbounded results. Bounded retention remains owned by the `@intx/inference`
+audit collector: opportunistic flushing or capped result bodies must preserve
+metadata.
 
-Other wave items (read bounds, shell truncation, process-group kill, grep caps, plugin spawn mitigation, per-tool watchdog, inference retry UX) are implemented or partially mitigated in `src/` with co-located tests; only the two rows above remain upstream or product-gated.
+Other wave items (read bounds, shell truncation, process-group kill, grep caps, plugin spawn mitigation, per-tool watchdog, inference retry UX) are implemented or partially mitigated in `src/` with co-located tests; the two items above remain upstream-owned.
 
 ## Build and Validation
 

src/permission/gate.ts

@@ -296,9 +296,9 @@ export interface PermissionGateOptions {
   telemetry?: Telemetry | undefined;
   // This gate's decisions are consumed by the reactor's before-tool authz
   // seam (env.authorize) instead of the tool-runner middleware. Set for the
-  // main session so approved re-dispatches skip the middleware gate; kept
-  // false for sub-agents, which still gate in the middleware. Required so a
-  // caller cannot silently fall back to middleware gating by omitting it.
+  // main session so approved re-dispatches skip the middleware gate. Workers
+  // own reactor enforcement via their execution identity regardless of this flag.
+  // Required so callers cannot silently fall back to middleware by omitting it.
   reactorGated: boolean;
   // Ask/settle event log (see approval-log.ts): one record per consequential
   // decision, auto or interactive. Defaults to a no-op so nothing depends on

src/permission/reactor-authorize.test.ts

@@ -0,0 +1,98 @@
+import { expect, test } from "bun:test";
+import { createPermissionGate } from "./gate.js";
+import { createReactorAuthorize, createWorkerAuthorize } from "./reactor-authorize.js";
+import { runWithSubAgentIdentity, getSubAgentIdentity } from "../subagent/identity-context.js";
+import { gateToolCall } from "../plugins/permission-plugin.js";
+import type { ToolCall } from "@intx/types/runtime";
+
+const call: ToolCall = {
+  id: "write-1",
+  name: "write_file",
+  arguments: { path: "probe.txt", content: "data" },
+};
+const gate = () =>
+  createPermissionGate({
+    cwd: process.cwd(),
+    approvals: [],
+    interactive: true,
+    auto: false,
+    skipPermissions: false,
+    reactorGated: false,
+    requestApproval: async () => {
+      throw new Error("worker must never ask");
+    },
+  });
+
+test("worker maps unresolved ask to deny while main reactor suspends", async () => {
+  const policy = gate();
+  expect((await createReactorAuthorize(policy)("tool:write_file", "invoke", call)).effect).toBe(
+    "ask",
+  );
+  expect((await createWorkerAuthorize(policy)("tool:write_file", "invoke", call)).effect).toBe(
+    "deny",
+  );
+  policy.setAuto(true);
+  expect((await createWorkerAuthorize(policy)("tool:write_file", "invoke", call)).effect).toBe(
+    "allow",
+  );
+  policy.setAuto(false);
+  expect((await createWorkerAuthorize(policy)("tool:write_file", "invoke", call)).effect).toBe(
+    "deny",
+  );
+});
+
+test("worker bridge rejects malformed context, resource, and action", async () => {
+  const authorize = createWorkerAuthorize(gate());
+  await expect(authorize("tool:write_file", "invoke", {})).rejects.toThrow("ToolCall");
+  await expect(authorize("tool:read_file", "invoke", call)).rejects.toThrow("does not match");
+  await expect(authorize("tool:write_file", "read", call)).rejects.toThrow("unexpected action");
+});
+
+test("worker reactor is sole owner even if parent middleware mode changes policy before runner", async () => {
+  const policy = gate();
+  policy.setAuto(true);
+  const identity = { description: "worker", cwd: process.cwd(), reactorOwnsPermissions: true };
+  const authorize = createWorkerAuthorize(policy);
+  expect(
+    (await runWithSubAgentIdentity(identity, () => authorize("tool:write_file", "invoke", call)))
+      .effect,
+  ).toBe("allow");
+  policy.setAuto(false);
+  const result = await runWithSubAgentIdentity(identity, () =>
+    gateToolCall(policy, call, new AbortController().signal, async () => ({
+      callId: call.id,
+      content: "executed",
+      isError: false,
+    })),
+  );
+  expect(result.isError).toBe(false);
+  expect(policy.isReactorGated()).toBe(false);
+  expect(
+    (await runWithSubAgentIdentity(identity, () => authorize("tool:write_file", "invoke", call)))
+      .effect,
+  ).toBe("deny");
+  expect(getSubAgentIdentity()).toBeUndefined();
+});
+
+test("concurrent authorization preserves each worker cwd across awaited policy evaluation", async () => {
+  const policy = gate();
+  const seen: string[] = [];
+  const realAuthorize = policy.authorizeCall;
+  policy.authorizeCall = async (toolCall) => {
+    await new Promise((resolve) => setTimeout(resolve, 2));
+    const identity = getSubAgentIdentity();
+    if (identity === undefined) throw new Error("missing worker identity");
+    seen.push(identity.cwd);
+    return realAuthorize(toolCall);
+  };
+  const authorize = createWorkerAuthorize(policy);
+  await Promise.all(
+    ["/worker-a", "/worker-b"].map((cwd) =>
+      runWithSubAgentIdentity({ description: cwd, cwd, reactorOwnsPermissions: true }, () =>
+        authorize("tool:write_file", "invoke", call),
+      ),
+    ),
+  );
+  expect(seen.sort()).toEqual(["/worker-a", "/worker-b"]);
+  expect(getSubAgentIdentity()).toBeUndefined();
+});

src/permission/reactor-authorize.ts

@@ -18,6 +18,7 @@ import { type } from "arktype";
 
 import type { AuthzCallResult } from "@intx/inference";
 import type { PermissionGate } from "./gate.js";
+import { getSubAgentIdentity } from "../subagent/identity-context.js";
 
 const logger = getLogger([LOG_NAMESPACE_ROOT, "authz"]);
 
@@ -55,3 +56,13 @@ export function createReactorAuthorize(
     }
   };
 }
+
+export function createWorkerAuthorize(gate: PermissionGate) {
+  const authorize = createReactorAuthorize(gate);
+  return async (resource: string, action: string, context: unknown): Promise<AuthzCallResult> => {
+    const verdict = await authorize(resource, action, context);
+    if (verdict.effect !== "ask") return verdict;
+    logger.warn`worker authz denied unresolved approval worker=${getSubAgentIdentity()} resource=${resource}; parent must grant permission and retry`;
+    return { ...verdict, effect: "deny" };
+  };
+}

src/plugins/permission-plugin.ts

@@ -2,6 +2,7 @@ import type { ToolPlugin } from "@intx/tools-posix";
 import type { ToolCall, ToolResult } from "@intx/types/runtime";
 import { BLOCKED_BY_POLICY_PREFIX } from "../permission/decline-markers.js";
 import type { PermissionGate } from "../permission/gate.js";
+import { getSubAgentIdentity } from "../subagent/identity-context.js";
 
 // Run a tool call past the gate, invoking `next` only if it is allowed. Shared by
 // the posix middleware and the late-connected MCP tools (which are not part of
@@ -18,7 +19,7 @@ export async function gateToolCall(
   signal: AbortSignal,
   next: (call: ToolCall, signal: AbortSignal) => Promise<ToolResult>,
 ): Promise<ToolResult> {
-  if (gate.isReactorGated()) {
+  if (gate.isReactorGated() || getSubAgentIdentity()?.reactorOwnsPermissions === true) {
     return next(call, signal);
   }
   const verdict = await gate.evaluate(call);

src/subagent/identity-context.ts

@@ -1,14 +1,12 @@
 import { AsyncLocalStorage } from "node:async_hooks";
 
-// Identifies which sub-agent a tool call belongs to, so the permission gate
-// can attribute an approval prompt to the agent that raised it (its dispatch
-// description) and the working directory it is operating in. Set once per
-// sub-agent around its own tool-call dispatch (see run.ts's toolsFactory) so
-// every awaited call within that sub-agent's turn — including the permission
-// gate and its operator prompt — can read it back via getSubAgentIdentity().
+// Authorization and tool dispatch share this async-local identity so concurrent
+// workers resolve relative permission subjects against their own cwd.
 export interface SubAgentIdentity {
   description: string;
   cwd: string;
+  // Worker reactor authorization must not be repeated by parent middleware.
+  reactorOwnsPermissions?: boolean;
 }
 
 const subAgentIdentityAls = new AsyncLocalStorage<SubAgentIdentity>();