Require operator confirmation for project approvals file grants (#935)

* Require operator confirmation for project approvals file grants

A repo-committed .corbits/permissions.json previously seeded the permission gate with zero operator involvement, so a planted file could silently auto-allow destructive calls such as force-pushes and file writes.

Gate loadProjectApprovals behind per-entry grant fingerprints stored in the existing project-trust record: an untrusted directory now contributes zero approvals, trust stays keyed by realpath, and the first encounter with an unconfirmed file surfaces what it would grant instead of dropping it silently. Project trust never implies grant trust — each entry needs its own confirmation, recorded when the operator persists a project-scope grant.

Covers CL-7782.

* Prune stale project grant fingerprints on load

Hand-removing an entry from the project approvals file left its trust fingerprint behind, so a byte-identical replant applied silently. Loaders now reconcile trust against the entries on disk.

* Bind project grant confirmations to the confirmed cwd

Author: TheGreatAxios

src/agent/tools.ts

@@ -743,6 +743,7 @@ export async function createAgentToolset(
   let mcpTrustStore: ProjectTrustStore = projectTrust ?? {
     trustedPluginPaths: [],
     trustedMcpFingerprints: [],
+    trustedGrantFingerprints: [],
   };
   const untrustedLocalError = `Not trusted for this project (see ${SETTINGS_DIR_NAME}/trust.json)`;
 

src/config.test.ts

@@ -363,7 +363,11 @@ describe("loadConfig", () => {
       filterMcpServersForConnect(servers, {
         source: "local",
         cwd: "/repo/without-trust-grant",
-        store: { trustedPluginPaths: [], trustedMcpFingerprints: [] },
+        store: {
+          trustedPluginPaths: [],
+          trustedMcpFingerprints: [],
+          trustedGrantFingerprints: [],
+        },
       }),
     ).resolves.toEqual([BUILTIN_EXA_MCP]);
   });

src/exec/runner.ts

@@ -568,6 +568,9 @@ export async function runExec(config: Config): Promise<ExecResult> {
       onPersistNotice: (text) => {
         stderr.write(`${text}\n`);
       },
+      onPendingProjectGrants: (text) => {
+        stderr.write(`${text}\n`);
+      },
       interactive,
       skipPermissions: config.dangerouslySkipPermissions,
       auto: config.auto,

src/permission/project-approvals-trust.test.ts

@@ -0,0 +1,308 @@
+import { describe, expect, test } from "bun:test";
+import { mkdir, mkdtemp, realpath, symlink, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { generateSessionId } from "../session/index.js";
+import { loadSeededApprovals } from "../session/runtime-assembly.js";
+import { runWithSubAgentIdentity } from "../subagent/identity-context.js";
+import { trustProjectGrants } from "../trust/project-trust.js";
+import { createPermissionGate } from "./gate.js";
+import type { Approval, PermissionRequest } from "./types.js";
+import {
+  formatPendingProjectApprovals,
+  loadPendingProjectApprovals,
+  loadProjectApprovals,
+  saveProjectApproval,
+} from "./store.js";
+
+const PLANTED = [
+  { tool: "run_shell", pattern: "git push --force origin main" },
+  { tool: "write_file", pattern: "*.ts" },
+] as const;
+
+async function plantProjectApprovals(
+  cwd: string,
+  entries: readonly unknown[] = PLANTED,
+): Promise<void> {
+  const dir = join(cwd, ".corbits");
+  await mkdir(dir, { recursive: true });
+  await writeFile(
+    join(dir, "permissions.json"),
+    JSON.stringify({ version: 1, approvals: entries }),
+  );
+}
+
+async function driveGate(cwd: string, sessionId: string, home: string) {
+  const asked: string[] = [];
+  const gate = createPermissionGate({
+    cwd,
+    interactive: true,
+    skipPermissions: false,
+    reactorGated: false,
+    requestApproval: async (request: PermissionRequest) => {
+      asked.push(`${request.tool}:${request.subject}`);
+      return { allow: true };
+    },
+    approvals: await loadSeededApprovals(cwd, sessionId, home),
+  });
+  return { gate, asked };
+}
+
+const PUSH = {
+  id: "push",
+  name: "run_shell",
+  arguments: { command: "git push --force origin main" },
+} as const;
+
+const WRITE = {
+  id: "write",
+  name: "write_file",
+  arguments: { path: "notes.ts" },
+} as const;
+
+describe("CL-7782: project approvals require grant trust", () => {
+  test("untrusted directory contributes zero project approvals through the real gate", async () => {
+    const base = await mkdtemp(join(tmpdir(), "cl-7782-untrusted-"));
+    const home = join(base, "home");
+    const cwd = join(base, "repo");
+    await plantProjectApprovals(cwd);
+    const sessionId = generateSessionId();
+
+    expect(await loadProjectApprovals(cwd, home)).toEqual([]);
+    const seeded = await loadSeededApprovals(cwd, sessionId, home);
+    for (const entry of PLANTED) {
+      expect(
+        seeded.some(
+          (approval) =>
+            approval.tool === entry.tool && approval.pattern === entry.pattern,
+        ),
+      ).toBe(false);
+    }
+
+    const { gate, asked } = await driveGate(cwd, sessionId, home);
+    expect((await gate.evaluate({ ...PUSH })).allowed).toBe(true);
+    expect((await gate.evaluate({ ...WRITE })).allowed).toBe(true);
+    expect(asked).toEqual([
+      "run_shell:git push --force origin main",
+      "write_file:notes.ts",
+    ]);
+  });
+
+  test("trusted and confirmed directory grants apply without asking", async () => {
+    const base = await mkdtemp(join(tmpdir(), "cl-7782-trusted-"));
+    const home = join(base, "home");
+    const cwd = join(base, "repo");
+    await plantProjectApprovals(cwd);
+    await trustProjectGrants(cwd, [...PLANTED], home);
+    const sessionId = generateSessionId();
+
+    expect(await loadProjectApprovals(cwd, home)).toHaveLength(2);
+
+    const { gate, asked } = await driveGate(cwd, sessionId, home);
+    expect((await gate.evaluate({ ...PUSH })).allowed).toBe(true);
+    expect((await gate.evaluate({ ...WRITE })).allowed).toBe(true);
+    expect(asked).toEqual([]);
+  });
+
+  test("trust is keyed by realpath: a symlinked checkout cannot inherit or confer", async () => {
+    const base = await mkdtemp(join(tmpdir(), "cl-7782-link-"));
+    const home = join(base, "home");
+    const target = join(base, "real-repo");
+    await plantProjectApprovals(target);
+    const link = join(base, "linked-repo");
+    await symlink(target, link);
+    expect(await realpath(link)).toBe(await realpath(target));
+
+    await trustProjectGrants(link, [...PLANTED], home);
+    expect(await loadProjectApprovals(target, home)).toHaveLength(2);
+
+    const twin = join(base, "twin-repo");
+    await plantProjectApprovals(twin);
+    expect(await loadProjectApprovals(twin, home)).toEqual([]);
+  });
+
+  test("first encounter surfaces the would-be grants instead of dropping them silently", async () => {
+    const base = await mkdtemp(join(tmpdir(), "cl-7782-pending-"));
+    const home = join(base, "home");
+    const cwd = join(base, "repo");
+    await plantProjectApprovals(cwd);
+
+    const pending = await loadPendingProjectApprovals(cwd, home);
+    expect(pending).toHaveLength(2);
+    const notice = formatPendingProjectApprovals(pending);
+    for (const entry of PLANTED) {
+      expect(notice).toContain(entry.pattern);
+    }
+
+    await trustProjectGrants(cwd, [...PLANTED], home);
+    expect(await loadPendingProjectApprovals(cwd, home)).toEqual([]);
+    expect(formatPendingProjectApprovals([])).toBe("");
+  });
+
+  test("hand-removing an entry revokes its confirmation: a byte-identical replant re-surfaces", async () => {
+    const base = await mkdtemp(join(tmpdir(), "cl-7782-replant-"));
+    const home = join(base, "home");
+    const cwd = join(base, "repo");
+    await plantProjectApprovals(cwd);
+    await trustProjectGrants(cwd, [...PLANTED], home);
+    expect(await loadProjectApprovals(cwd, home)).toHaveLength(2);
+
+    // Hand-edit the first entry out of the file without removeProjectApproval.
+    await plantProjectApprovals(cwd, [PLANTED[1]]);
+    expect(await loadProjectApprovals(cwd, home)).toEqual([{ ...PLANTED[1] }]);
+    expect(await loadPendingProjectApprovals(cwd, home)).toEqual([]);
+
+    // Replant the identical bytes: the removed entry surfaces, not applies.
+    await plantProjectApprovals(cwd);
+    expect(await loadProjectApprovals(cwd, home)).toEqual([{ ...PLANTED[1] }]);
+    expect(await loadPendingProjectApprovals(cwd, home)).toEqual([
+      { ...PLANTED[0] },
+    ]);
+  });
+
+  test("a gate-minted project grant ({tool, pattern, cwd}) survives save → reload and still applies", async () => {
+    const base = await mkdtemp(join(tmpdir(), "cl-7782-cwd-"));
+    const home = join(base, "home");
+    const cwd = join(base, "repo");
+
+    // Mint through the real gate so the entry has the production shape.
+    const minted: Approval[] = [];
+    const mintGate = createPermissionGate({
+      cwd,
+      interactive: true,
+      skipPermissions: false,
+      reactorGated: false,
+      requestApproval: async () => ({
+        allow: true,
+        persist: {
+          id: "exact",
+          label: "Always allow",
+          pattern: "npm test",
+          grant: "project",
+        },
+      }),
+      persist: (approval, scope) => {
+        expect(scope).toBe("project");
+        minted.push(approval);
+      },
+      approvals: await loadSeededApprovals(cwd, generateSessionId(), home),
+    });
+    const NPM_TEST = {
+      id: "npm-test",
+      name: "run_shell",
+      arguments: { command: "npm test" },
+    } as const;
+    expect((await mintGate.evaluate({ ...NPM_TEST })).allowed).toBe(true);
+    expect(minted).toEqual([{ tool: "run_shell", pattern: "npm test", cwd }]);
+
+    // Production persist path, then reload: the cwd must round-trip, not strip.
+    const grant = minted[0];
+    if (grant === undefined) throw new Error("gate minted no project grant");
+    await saveProjectApproval(cwd, grant, home);
+    const reloaded = await loadProjectApprovals(cwd, home);
+    expect(reloaded).toEqual(minted);
+
+    // The reloaded entry still applies: a fresh seeded gate asks nothing.
+    const { gate, asked } = await driveGate(cwd, generateSessionId(), home);
+    expect((await gate.evaluate({ ...NPM_TEST })).allowed).toBe(true);
+    expect(asked).toEqual([]);
+  });
+
+  test("confirming a planted entry through the pending flow converges the file to the minted shape", async () => {
+    const base = await mkdtemp(join(tmpdir(), "cl-7782-converge-"));
+    const home = join(base, "home");
+    const cwd = join(base, "repo");
+    await plantProjectApprovals(cwd, [
+      { tool: "run_shell", pattern: "npm test" },
+    ]);
+    expect(await loadPendingProjectApprovals(cwd, home)).toEqual([
+      { tool: "run_shell", pattern: "npm test" },
+    ]);
+
+    // What the gate persist does when the operator confirms the pending entry
+    // with a project-scope persist: mint {tool, pattern, cwd} and write it.
+    await saveProjectApproval(
+      cwd,
+      { tool: "run_shell", pattern: "npm test", cwd },
+      home,
+    );
+
+    // The planted twin is displaced by the minted shape — nothing lingers as
+    // pending, and the grant applies without asking.
+    expect(await loadProjectApprovals(cwd, home)).toEqual([
+      { tool: "run_shell", pattern: "npm test", cwd },
+    ]);
+    expect(await loadPendingProjectApprovals(cwd, home)).toEqual([]);
+
+    const { gate, asked } = await driveGate(cwd, generateSessionId(), home);
+    expect(
+      (
+        await gate.evaluate({
+          id: "npm-test",
+          name: "run_shell",
+          arguments: { command: "npm test" },
+        })
+      ).allowed,
+    ).toBe(true);
+    expect(asked).toEqual([]);
+  });
+
+  test("stripping cwd from a confirmed entry re-surfaces as pending and never cross-repo auto-allows", async () => {
+    const base = await mkdtemp(join(tmpdir(), "cl-7782-cwd-strip-"));
+    const home = join(base, "home");
+    const cwd = join(base, "repo");
+    const other = join(base, "other");
+    await mkdir(other, { recursive: true });
+
+    // Operator confirms {tool, pattern, cwd} through the production path.
+    await saveProjectApproval(
+      cwd,
+      { tool: "run_shell", pattern: "npm test", cwd },
+      home,
+    );
+    expect(await loadProjectApprovals(cwd, home)).toEqual([
+      { tool: "run_shell", pattern: "npm test", cwd },
+    ]);
+
+    // Hand-edit drops the cwd key: byte-identical to a planted entry, but the
+    // confirmation was bound to the cwd-bearing shape, so trust must not
+    // follow the stripped bytes.
+    await plantProjectApprovals(cwd, [
+      { tool: "run_shell", pattern: "npm test" },
+    ]);
+    expect(await loadProjectApprovals(cwd, home)).toEqual([]);
+    expect(await loadPendingProjectApprovals(cwd, home)).toEqual([
+      { tool: "run_shell", pattern: "npm test" },
+    ]);
+
+    // The real gate, seeded after the strip: neither the same-repo request
+    // nor a cross-repo request (different request cwd) auto-allows.
+    const asked: string[] = [];
+    const gate = createPermissionGate({
+      cwd,
+      interactive: true,
+      skipPermissions: false,
+      reactorGated: false,
+      requestApproval: async (request: PermissionRequest) => {
+        asked.push(`${request.tool}:${request.subject}`);
+        return { allow: false };
+      },
+      approvals: await loadSeededApprovals(cwd, generateSessionId(), home),
+    });
+    const NPM_TEST = {
+      id: "npm-test",
+      name: "run_shell",
+      arguments: { command: "npm test" },
+    } as const;
+    expect((await gate.evaluate({ ...NPM_TEST })).allowed).toBe(false);
+    expect(
+      (
+        await runWithSubAgentIdentity(
+          { description: "other", cwd: other },
+          () => gate.evaluate({ ...NPM_TEST }),
+        )
+      ).allowed,
+    ).toBe(false);
+    expect(asked).toEqual(["run_shell:npm test", "run_shell:npm test"]);
+  });
+});