Bind project grant confirmations to the confirmed cwd

Author: TheGreatAxios

src/permission/project-approvals-trust.test.ts

@@ -4,6 +4,7 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { generateSessionId } from "../session/index.js";
 import { loadSeededApprovals } from "../session/runtime-assembly.js";
+import { runWithSubAgentIdentity } from "../subagent/identity-context.js";
 import { trustProjectGrants } from "../trust/project-trust.js";
 import { createPermissionGate } from "./gate.js";
 import type { Approval, PermissionRequest } from "./types.js";
@@ -206,4 +207,102 @@ describe("CL-7782: project approvals require grant trust", () => {
     expect((await gate.evaluate({ ...NPM_TEST })).allowed).toBe(true);
     expect(asked).toEqual([]);
   });
+
+  test("confirming a planted entry through the pending flow converges the file to the minted shape", async () => {
+    const base = await mkdtemp(join(tmpdir(), "cl-7782-converge-"));
+    const home = join(base, "home");
+    const cwd = join(base, "repo");
+    await plantProjectApprovals(cwd, [
+      { tool: "run_shell", pattern: "npm test" },
+    ]);
+    expect(await loadPendingProjectApprovals(cwd, home)).toEqual([
+      { tool: "run_shell", pattern: "npm test" },
+    ]);
+
+    // What the gate persist does when the operator confirms the pending entry
+    // with a project-scope persist: mint {tool, pattern, cwd} and write it.
+    await saveProjectApproval(
+      cwd,
+      { tool: "run_shell", pattern: "npm test", cwd },
+      home,
+    );
+
+    // The planted twin is displaced by the minted shape — nothing lingers as
+    // pending, and the grant applies without asking.
+    expect(await loadProjectApprovals(cwd, home)).toEqual([
+      { tool: "run_shell", pattern: "npm test", cwd },
+    ]);
+    expect(await loadPendingProjectApprovals(cwd, home)).toEqual([]);
+
+    const { gate, asked } = await driveGate(cwd, generateSessionId(), home);
+    expect(
+      (
+        await gate.evaluate({
+          id: "npm-test",
+          name: "run_shell",
+          arguments: { command: "npm test" },
+        })
+      ).allowed,
+    ).toBe(true);
+    expect(asked).toEqual([]);
+  });
+
+  test("stripping cwd from a confirmed entry re-surfaces as pending and never cross-repo auto-allows", async () => {
+    const base = await mkdtemp(join(tmpdir(), "cl-7782-cwd-strip-"));
+    const home = join(base, "home");
+    const cwd = join(base, "repo");
+    const other = join(base, "other");
+    await mkdir(other, { recursive: true });
+
+    // Operator confirms {tool, pattern, cwd} through the production path.
+    await saveProjectApproval(
+      cwd,
+      { tool: "run_shell", pattern: "npm test", cwd },
+      home,
+    );
+    expect(await loadProjectApprovals(cwd, home)).toEqual([
+      { tool: "run_shell", pattern: "npm test", cwd },
+    ]);
+
+    // Hand-edit drops the cwd key: byte-identical to a planted entry, but the
+    // confirmation was bound to the cwd-bearing shape, so trust must not
+    // follow the stripped bytes.
+    await plantProjectApprovals(cwd, [
+      { tool: "run_shell", pattern: "npm test" },
+    ]);
+    expect(await loadProjectApprovals(cwd, home)).toEqual([]);
+    expect(await loadPendingProjectApprovals(cwd, home)).toEqual([
+      { tool: "run_shell", pattern: "npm test" },
+    ]);
+
+    // The real gate, seeded after the strip: neither the same-repo request
+    // nor a cross-repo request (different request cwd) auto-allows.
+    const asked: string[] = [];
+    const gate = createPermissionGate({
+      cwd,
+      interactive: true,
+      skipPermissions: false,
+      reactorGated: false,
+      requestApproval: async (request: PermissionRequest) => {
+        asked.push(`${request.tool}:${request.subject}`);
+        return { allow: false };
+      },
+      approvals: await loadSeededApprovals(cwd, generateSessionId(), home),
+    });
+    const NPM_TEST = {
+      id: "npm-test",
+      name: "run_shell",
+      arguments: { command: "npm test" },
+    } as const;
+    expect((await gate.evaluate({ ...NPM_TEST })).allowed).toBe(false);
+    expect(
+      (
+        await runWithSubAgentIdentity(
+          { description: "other", cwd: other },
+          () => gate.evaluate({ ...NPM_TEST }),
+        )
+      ).allowed,
+    ).toBe(false);
+    expect(asked).toEqual(["run_shell:npm test", "run_shell:npm test"]);
+  });
 });

src/permission/store.ts

@@ -68,6 +68,20 @@ function parseApprovalList(raw: unknown): Approval[] {
 }
 
 function sameApproval(a: Approval, b: Approval): boolean {
+  // Removal equality deliberately ignores cwd: revocation targets arrive
+  // cwd-less (see admin.ts toApproval), so a strict comparison would silently
+  // keep a confined twin live. Removing the file entry is the revocation;
+  // the next load's reconcile prunes the cwd-bound fingerprint with it.
+  return (
+    a.tool === b.tool &&
+    a.pattern === b.pattern &&
+    a.providerModel === b.providerModel
+  );
+}
+
+// Equality on every confirmed dimension except cwd: a planted file entry and
+// the gate's minted confirmation of it differ only in cwd.
+function sameGrantModuloCwd(a: Approval, b: Approval): boolean {
   return (
     a.tool === b.tool &&
     a.pattern === b.pattern &&
@@ -192,7 +206,19 @@ export async function saveProjectApproval(
 ): Promise<void> {
   await chainObjectWrite(projectStorePath(cwd), (current) => ({
     ...current,
-    approvals: [...parseApprovalList(current.approvals), approval],
+    approvals: [
+      // A planted entry carries no cwd; confirming it through the pending flow
+      // mints {tool, pattern, cwd} and writes that shape back here. Displace
+      // its twin instead of stacking a duplicate that would linger as pending
+      // forever — the dropped twin never applied, so nothing confirmed is
+      // lost. A save without cwd keeps the plain append path and never
+      // displaces a confined entry.
+      ...parseApprovalList(current.approvals).filter(
+        (entry) =>
+          approval.cwd === undefined || !sameGrantModuloCwd(entry, approval),
+      ),
+      approval,
+    ],
   }));
   // The only production writer is the interactive grant path (an operator
   // answering a prompt with a project-scope persist), so writing an entry is

src/trust/project-trust.ts

@@ -325,25 +325,38 @@ export async function trustMcpServer(
  * Stable fingerprint for one project-approval entry: tool + pattern, with the
  * provider-model binding folded in when set, so switching models invalidates a
  * prior confirmation exactly the way the gate's providerModel check does.
- * The fingerprint deliberately excludes the file's cwd — the trust record is
- * already keyed per project (realpath-keyed filename plus the repo guard).
+ * The entry's cwd is folded in too (absent → ""): Approval has four enforced
+ * dimensions and a cwd-less grant matches any request cwd (see
+ * cwdMatchesGrant), so a fingerprint that ignored cwd would let a hand-edit
+ * dropping `cwd` from a confirmed entry keep its confirmation and silently
+ * widen a repo-confined grant to cross-repo. A cwd-less planted entry still
+ * fingerprints the same way at trust and load time, so confirming it through
+ * the pending flow matches the minted shape (saveProjectApproval converges
+ * the file to that shape on write).
  */
 export function projectGrantFingerprint(approval: {
   tool: string;
   pattern: string;
   providerModel?: string;
+  cwd?: string;
 }): string {
   const payload = JSON.stringify({
     tool: approval.tool,
     pattern: approval.pattern,
     providerModel: approval.providerModel ?? "",
+    cwd: approval.cwd ?? "",
   });
   return createHash("sha256").update(payload).digest("hex");
 }
 
 export function isProjectGrantTrusted(
   store: ProjectTrustStore,
-  approval: { tool: string; pattern: string; providerModel?: string },
+  approval: {
+    tool: string;
+    pattern: string;
+    providerModel?: string;
+    cwd?: string;
+  },
 ): boolean {
   return store.trustedGrantFingerprints.includes(
     projectGrantFingerprint(approval),
@@ -362,7 +375,12 @@ export function isProjectGrantTrusted(
  */
 export async function trustProjectGrants(
   cwd: string,
-  approvals: { tool: string; pattern: string; providerModel?: string }[],
+  approvals: {
+    tool: string;
+    pattern: string;
+    providerModel?: string;
+    cwd?: string;
+  }[],
   home: string = homedir(),
 ): Promise<ProjectTrustStore> {
   const fps = approvals.map(projectGrantFingerprint);
@@ -385,7 +403,12 @@ export async function trustProjectGrants(
 /** Drop confirmations for removed entries so a replanted file re-surfaces. */
 export async function untrustProjectGrants(
   cwd: string,
-  approvals: { tool: string; pattern: string; providerModel?: string }[],
+  approvals: {
+    tool: string;
+    pattern: string;
+    providerModel?: string;
+    cwd?: string;
+  }[],
   home: string = homedir(),
 ): Promise<ProjectTrustStore> {
   const fps = new Set(approvals.map(projectGrantFingerprint));
@@ -411,7 +434,12 @@ export async function untrustProjectGrants(
  */
 export async function reconcileProjectGrants(
   cwd: string,
-  onDisk: { tool: string; pattern: string; providerModel?: string }[],
+  onDisk: {
+    tool: string;
+    pattern: string;
+    providerModel?: string;
+    cwd?: string;
+  }[],
   home: string = homedir(),
 ): Promise<ProjectTrustStore> {
   const live = new Set(onDisk.map(projectGrantFingerprint));