fix(permission): forget cached denies on a new user turn (#1090)

* fix(permission): forget cached denies on a new user turn

Same-turn reactor retries still short-circuit. A later message must
re-ask the same URL instead of canned-replying Tool call rejected.

* fix(permission): clear denials only on operator inbound

Mailbox, fleet-dry, and background-shell wakes are also
message.received and must not forget a deny the operator just made.

* style(permission): oxfmt CL-8002 tests

Author: TheGreatAxios

src/agent/director.ts

@@ -22,6 +22,7 @@ import {
   type CompactionGovernor,
 } from "./compaction.js";
 import { onTurnBoundary } from "./reactor-events.js";
+import { isOperatorOriginated } from "./message-provenance.js";
 import { type } from "arktype";
 import {
   applyManageTasks,
@@ -559,6 +560,9 @@ class ChatDirectorImpl extends DefaultDirector {
   private currentSourceId: string | undefined;
   /** CL-7918 live replacement for the former getLiveFleetCount closure. */
   private allowIdleWithFleet: boolean;
+  // Forget cached permission denies on the next inbound user message. Session
+  // wiring points this at PermissionGate.clearDenials; unset in unit tests.
+  private clearDenials: (() => void) | undefined;
   // Consecutive assistant turns that contain tool calls and no text. Reset on
   // any turn with text and on every fresh user message — a weak model that
   // spins in place on one thread of tool calls still converges to the
@@ -749,6 +753,10 @@ class ChatDirectorImpl extends DefaultDirector {
     this.allowIdleWithFleet = value;
   }
 
+  setClearDenials(clear: (() => void) | undefined): void {
+    this.clearDenials = clear;
+  }
+
   updateToolDefinitions(toolDefinitions: ToolDefinition[]): void {
     const before = toolSetDigest(this._toolDefinitions);
     const after = toolSetDigest(toolDefinitions);
@@ -1012,6 +1020,15 @@ class ChatDirectorImpl extends DefaultDirector {
       this.toolOnlyStreak = 0;
       this.toolOnlyNudgeFired = false;
       this.pendingToolOnlyNudge = false;
+      // Occupancy mailbox / fleet-dry / bg-shell inbounds are also
+      // message.received; only a human prompt may forget cached denies.
+      const inboundFlags =
+        "flags" in event.message && Array.isArray(event.message.flags)
+          ? event.message.flags.filter(
+              (flag): flag is string => typeof flag === "string",
+            )
+          : undefined;
+      if (isOperatorOriginated(inboundFlags)) this.clearDenials?.();
     }
     if (onTurnBoundary(event)) this.inferenceRecoveries = 0;
 
@@ -1357,6 +1374,7 @@ export interface ChatDirector extends ReactorDirector {
   updateToolDefinitions(toolDefinitions: ToolDefinition[]): void;
   setWorkflowCoordinator(coordinator: WorkflowCoordinator | undefined): void;
   setAllowIdleWithFleet(value: boolean): void;
+  setClearDenials(clear: (() => void) | undefined): void;
   getTasks(): Task[];
   restoreTasks(tasks: Task[]): void;
   getContextEstimate(): { tokens: number; isEstimate: boolean };

src/director.test.ts

@@ -712,6 +712,77 @@ describe("open-task termination guard", () => {
     ).toBe(true);
     expect(actions.some((a) => a.type === "infer")).toBe(false);
   });
+
+  test("a new user turn after a canned decline infers instead of canned-replying", async () => {
+    const director = createChatDirector("base", [], {});
+    let cleared = 0;
+    director.setClearDenials(() => {
+      cleared++;
+    });
+    const declinedTurn = actionsArray(
+      await director.decide(
+        makeToolErrorEvent("c", declined),
+        mockState,
+        mockCapabilities,
+      ),
+    );
+    expect(
+      declinedTurn.some(
+        (a) =>
+          a.type === "reply" &&
+          "content" in a &&
+          a.content === "Tool call rejected by operator.",
+      ),
+    ).toBe(true);
+    expect(cleared).toBe(0);
+
+    const next = actionsArray(
+      await director.decide(
+        {
+          type: "message.received",
+          message: {
+            role: "user",
+            content: "just talk",
+            flags: ["operator-originated"],
+          },
+        } as unknown as ReactorInboundEvent,
+        mockState,
+        mockCapabilities,
+      ),
+    );
+    expect(
+      next.some(
+        (a) =>
+          a.type === "reply" &&
+          "content" in a &&
+          a.content === "Tool call rejected by operator.",
+      ),
+    ).toBe(false);
+    expect(next.some((a) => a.type === "infer")).toBe(true);
+    expect(cleared).toBe(1);
+  });
+
+  test("mailbox inbound does not clear cached denies", async () => {
+    const director = createChatDirector("base", [], {});
+    let cleared = 0;
+    director.setClearDenials(() => {
+      cleared++;
+    });
+    await director.decide(
+      makeToolErrorEvent("c", declined),
+      mockState,
+      mockCapabilities,
+    );
+    await director.decide(
+      {
+        type: "message.received",
+        message: { role: "user", content: "worker report" },
+      } as unknown as ReactorInboundEvent,
+      mockState,
+      mockCapabilities,
+    );
+    expect(cleared).toBe(0);
+  });
 });
 
 describe("chatDirector compaction", () => {

src/exec/runner.ts

@@ -856,6 +856,7 @@ export async function runExec(config: Config): Promise<ExecResult> {
       computeAdvertised,
       inactivityTimeoutMs: config.inactivityTimeoutMs ?? 750_000,
       totalTimeoutMs: config.totalTimeoutMs,
+      clearDenials: () => permissionGate.clearDenials(),
       getProvider: () => config,
       getWorkdir: () => workdir,
       getSessionId: () => sessionId,

src/permission/gate.ts

@@ -436,6 +436,9 @@ export interface PermissionGate {
   getApprovals: () => readonly Approval[];
   // Forget every remembered approval so a fresh session re-prompts from scratch.
   reset: () => void;
+  // Drop cached operator/headless denies so the next user turn re-asks. Same-turn
+  // retries still short-circuit until this runs.
+  clearDenials: () => void;
   // The approvals granted only for this session (not persisted to any store).
   getSessionApprovals: () => readonly Approval[];
   // Drop one approval from the gate's live list and from the session set so the
@@ -633,9 +636,10 @@ export function createPermissionGate(
 
   // Same-turn denial memory: stable fingerprints of headless and
   // operator-declined denies so a retry with a fresh tool_call.id returns the
-  // identical cached reason instead of re-evaluating. Cleared by reset() and
-  // by every state change that can flip a deny to an allow (new grants,
-  // re-seeded approvals, auto/skip toggles, provider-identity switches).
+  // identical cached reason instead of re-evaluating. Cleared on inbound user
+  // turns (clearDenials), by reset(), and by every state change that can flip a
+  // deny to an allow (new grants, re-seeded approvals, auto/skip toggles,
+  // provider-identity switches). Timeouts and aborts are never recorded.
   const denialMemory = new DenialMemory();
 
   // Non-blocking policy decision for one tool call: everything the gate owns —
@@ -1158,6 +1162,7 @@ export function createPermissionGate(
     isReactorGated: () => reactorGated,
     getApprovals: () => approvals,
     reset,
+    clearDenials: () => denialMemory.clear(),
     getSessionApprovals,
     removeSessionApproval,
     setSeededApprovals,

src/permission/permission.test.ts

@@ -2375,6 +2375,46 @@ describe("createPermissionGate", () => {
     expect(asked).toBe(1);
   });
 
+  // A denied URL is remembered only for same-turn retries. An inbound user
+  // turn (clearDenials) must forget it so the same URL can be re-asked.
+  test("clearDenials drops cached denies so a later turn re-asks the same URL", async () => {
+    let asked = 0;
+    const gate = createPermissionGate({
+      approvals: [],
+      interactive: true,
+      skipPermissions: false,
+      reactorGated: false,
+      requestApproval: async () => {
+        asked++;
+        return { allow: false };
+      },
+    });
+    const args = { url: "https://example.com/docs", format: "markdown" };
+    const first = await gate.evaluate({
+      id: "call_0",
+      name: "web_fetch",
+      arguments: args,
+    });
+    if (first.allowed) throw new Error("expected the first call declined");
+    expect(asked).toBe(1);
+    const sameTurn = await gate.evaluate({
+      id: "call_1",
+      name: "web_fetch",
+      arguments: args,
+    });
+    if (sameTurn.allowed)
+      throw new Error("expected the same-turn retry denied");
+    expect(asked).toBe(1);
+    gate.clearDenials();
+    const later = await gate.evaluate({
+      id: "call_2",
+      name: "web_fetch",
+      arguments: args,
+    });
+    if (later.allowed) throw new Error("expected the later-turn call declined");
+    expect(asked).toBe(2);
+  });
+
   // CL-8002: a reactor-path timeout is not an operator decision, so
   // resolveSuspended must not cache it — the retry re-asks the operator.
   test("reactor-path timeout is not cached: retry re-asks", async () => {

src/permission/reactor-authorize.ts

@@ -107,6 +107,7 @@ export function workerPermissionGate(gate: PermissionGate): PermissionGate {
     isReactorGated: () => true,
     getApprovals: () => gate.getApprovals(),
     reset: () => gate.reset(),
+    clearDenials: () => gate.clearDenials(),
     getSessionApprovals: () => gate.getSessionApprovals(),
     removeSessionApproval: (target) => gate.removeSessionApproval(target),
     setSeededApprovals: (seeded) => gate.setSeededApprovals(seeded),

src/session/assemble-runtime.ts

@@ -477,6 +477,11 @@ export interface ChatAgentWiring {
    * the TUI seeds it (fleet lanes may appear mid-session).
    */
   allowIdleWithFleet?: boolean;
+  /**
+   * Bound to PermissionGate.clearDenials so a later user turn re-asks a URL
+   * that was declined this turn. Same-turn reactor retries still short-circuit.
+   */
+  clearDenials?: () => void;
   getProvider: () => { providerName: string; model: string };
   /** Pre-created holder so the workflow controller can close over it first. */
   directorHolder?: { instance?: ChatDirector };
@@ -535,6 +540,8 @@ export function assembleChatAgent(wiring: ChatAgentWiring): AssembledChatAgent {
           allowIdleWithFleet: wiring.allowIdleWithFleet,
         },
       );
+      if (wiring.clearDenials !== undefined)
+        d.setClearDenials(wiring.clearDenials);
       directorHolder.instance = d;
       return d;
     },

src/tui/runner/session.ts

@@ -631,6 +631,7 @@ export async function assembleTUISession(
     // instead of a host closure; no getLiveFleetCount: the publisher drives
     // the allowance through setAllowIdleWithFleet.)
     allowIdleWithFleet: true,
+    clearDenials: () => permissionGate.clearDenials(),
     getProvider: () => state.config,
     directorHolder,
     getWorkdir: () => state.workdir,

tests/integration/harness.ts

@@ -32,6 +32,7 @@ import { type } from "arktype";
 
 import { createAgentWithLiveToolDispatch } from "../../src/agent/live-tool-dispatch.js";
 import { createChatDirector } from "../../src/agent/director.js";
+import { OPERATOR_ORIGINATED_FLAG } from "../../src/agent/message-provenance.js";
 import {
   readSourceCredentialMaterial,
   registerSourceCredential,
@@ -129,10 +130,17 @@ export async function openIntegrationSession(
   const chatDirectorDef = defineDirector({
     id: `${ID_PREFIX}/chat`,
     configSchema: type({}),
-    factory: (_config, _env, agentCtx) =>
-      createChatDirector(agentCtx.systemPrompt, [...agentCtx.toolDefinitions], {
-        inactivityTimeoutMs: 750_000,
-      }),
+    factory: (_config, _env, agentCtx) => {
+      const d = createChatDirector(
+        agentCtx.systemPrompt,
+        [...agentCtx.toolDefinitions],
+        {
+          inactivityTimeoutMs: 750_000,
+        },
+      );
+      d.setClearDenials(() => opts.permissionGate.clearDenials());
+      return d;
+    },
   });
 
   const toolsFactory = defineTool({
@@ -297,10 +305,24 @@ export async function runUntilDone(
 
   const collectTask = collect;
   const sendResult = await Promise.all([
-    session.agent.send(message).then((result) => {
-      turnComplete = true;
-      return result;
-    }),
+    session.agent
+      .send({
+        ref: { uid: 1, mailbox: "INBOX" },
+        headers: {
+          from: "user@local",
+          to: ["agent@local"],
+          date: new Date().toISOString(),
+          messageId: `<${crypto.randomUUID()}@local>`,
+          interchangeType: "conversation.message",
+        },
+        flags: [OPERATOR_ORIGINATED_FLAG],
+        content: message,
+        signatureStatus: "missing",
+      })
+      .then((result) => {
+        turnComplete = true;
+        return result;
+      }),
     session.harness.run({ wallClockBudgetMs: Infinity }),
     collectTask,
   ]).then(([result]) => result);

tests/integration/reactor-permission-multi-turn.test.ts

@@ -173,4 +173,74 @@ describe("integration — reactor permission + multi-turn", () => {
       }
     },
   );
+
+  test.serial(
+    "denied run_shell does not canned-reply a later prose turn and re-asks the same command",
+    async () => {
+      let asked = 0;
+      const session = await openIntegrationSession({
+        permissionGate: createPermissionGate({
+          approvals: [],
+          interactive: true,
+          skipPermissions: false,
+          reactorGated: false,
+          requestApproval: async () => {
+            asked++;
+            return { allow: false };
+          },
+        }),
+      });
+
+      try {
+        session.harness.scenario.replyOnce("anthropic", {
+          toolCalls: [
+            {
+              name: "run_shell",
+              args: { command: "curl https://example.com/docs" },
+            },
+          ],
+        });
+
+        const denied = await runUntilDone(
+          session,
+          "Fetch https://example.com/docs.",
+        );
+        expect(asked).toBeGreaterThan(0);
+        const askedAfterDeny = asked;
+        expect(denied.events.some((e) => e.type === "reactor.error")).toBe(
+          false,
+        );
+
+        session.harness.scenario.replyOnce("anthropic", {
+          text: "I'll continue without fetching.",
+        });
+        const prose = await runUntilDone(
+          session,
+          "Do not fetch anything. Confirm in prose.",
+        );
+        expect(prose.reply).toContain("I'll continue without fetching.");
+        expect(prose.reply).not.toContain("Tool call rejected by operator.");
+        expect(asked).toBe(askedAfterDeny);
+
+        session.harness.scenario.replyOnce("anthropic", {
+          toolCalls: [
+            {
+              name: "run_shell",
+              args: { command: "curl https://example.com/docs" },
+            },
+          ],
+        });
+        const retried = await runUntilDone(
+          session,
+          "Try fetching https://example.com/docs again.",
+        );
+        expect(asked).toBe(askedAfterDeny + 1);
+        expect(retried.events.some((e) => e.type === "reactor.error")).toBe(
+          false,
+        );
+      } finally {
+        await closeIntegrationSession(session);
+      }
+    },
+  );
 });