Close permission.wait on abort and clear active turn

Always end the wait span in finally when requestApproval throws.
Move the process-wide turn id into active-turn so clear() and turn
close both null the nesting slot used by gate and task spans.

Author: TheGreatAxios

src/perf/active-turn.ts

@@ -0,0 +1,19 @@
+/**
+ * Process-wide open-turn id for nesting permission.wait / subagent outside the
+ * reactor observer. Single-primary assumption: one run-sink observer owns the
+ * slot. `clear()` and observer `reset()`/`closeTurn` null it.
+ */
+
+let activeTurnId: string | null = null;
+
+export function getActiveTurnId(): string | null {
+  return activeTurnId;
+}
+
+export function setActiveTurnId(id: string | null): void {
+  activeTurnId = id;
+}
+
+export function clearActiveTurnId(): void {
+  activeTurnId = null;
+}

src/perf/index.ts

@@ -11,6 +11,7 @@
  */
 
 import { isOpaqueId, sanitizeTags, type PerfTags } from "./sanitize.js";
+import { clearActiveTurnId } from "./active-turn.js";
 
 export {
   sanitizeTags,
@@ -244,4 +245,6 @@ export function clear(): void {
   ringWrite = 0;
   ringCount = 0;
   nextId = 0;
+  clearActiveTurnId();
 }
+

src/perf/permission-subagent-spans.test.ts

@@ -6,7 +6,7 @@ import type { ReactorEmittedEvent } from "@intx/inference";
 import { createPermissionGate } from "../permission/gate.js";
 import { createTaskTool } from "../subagent/task-tool.js";
 import { clear, snapshot, type PerfSpan } from "./index.js";
-import { createPerfReactorObserver } from "./reactor-spans.js";
+import { createPerfReactorObserver, currentTurnId } from "./reactor-spans.js";
 
 afterEach(() => {
   clear();
@@ -93,6 +93,36 @@ describe("permission.wait spans", () => {
     expect(waits[0]!.tags).toEqual({ tool_id: "write_file", decision: "allow" });
   });
 
+  test("closes permission.wait when requestApproval throws", async () => {
+    const gate = createPermissionGate({
+      approvals: [],
+      interactive: true,
+      skipPermissions: false,
+      requestApproval: async () => {
+        throw new Error("ui aborted");
+      },
+    });
+
+    await expect(gate.evaluate(shellCall("curl example.com"))).rejects.toThrow(
+      "ui aborted",
+    );
+
+    const waits = byName(completed(snapshot()), "permission.wait");
+    expect(waits).toHaveLength(1);
+    expect(waits[0]!.endNs).toBeDefined();
+    expect(waits[0]!.tags?.tool_id).toBe("run_shell");
+    // No decision tag when approval never returned.
+    expect(waits[0]!.tags?.decision).toBeUndefined();
+  });
+
+  test("clear() nulls process-wide currentTurnId", () => {
+    const obs = createPerfReactorObserver();
+    obs.observe(event("inference.start", { model: "m" }));
+    expect(currentTurnId()).not.toBeNull();
+    clear();
+    expect(currentTurnId()).toBeNull();
+  });
+
   test("does not open a span when a grant auto-approves", async () => {
     let asked = 0;
     const gate = createPermissionGate({

src/perf/reactor-spans.ts

@@ -21,6 +21,10 @@
 
 import type { ReactorEmittedEvent } from "@intx/inference";
 import { end, start } from "./index.js";
+import {
+  getActiveTurnId,
+  setActiveTurnId,
+} from "./active-turn.js";
 
 /** Content-bearing events that end TTFT and open the stream phase. */
 const FIRST_TOKEN_TYPES: ReadonlySet<string> = new Set([
@@ -49,17 +53,10 @@ export type PerfReactorObserver = {
 /**
  * Process-wide open-turn id from the most recently active reactor observer.
  * Permission-wait and subagent spans nest under this when present.
- * Tests that open turns should clear() PerfTrace and reset observers between cases.
+ * Owned by `active-turn.ts`; cleared on observer close/reset and PerfTrace clear().
  */
-let activeTurnId: string | null = null;
-
-/** Current open turn span id (for nesting permission.wait / subagent outside the observer). */
 export function currentTurnId(): string | null {
-  return activeTurnId;
-}
-
-function setActiveTurnId(id: string | null): void {
-  activeTurnId = id;
+  return getActiveTurnId();
 }
 
 type ObserverState = {
@@ -172,7 +169,7 @@ export function createPerfReactorObserver(): PerfReactorObserver {
   function closeTurn(): void {
     closeOpenTools();
     endIfOpen(state.turnId);
-    if (state.turnId !== null && activeTurnId === state.turnId) {
+    if (state.turnId !== null && getActiveTurnId() === state.turnId) {
       setActiveTurnId(null);
     }
     state.turnId = null;

src/permission/gate.ts

@@ -466,11 +466,20 @@ export function createPermissionGate(options: PermissionGateOptions): Permission
           ...(turnId !== null && turnId.length > 0 ? { parentId: turnId } : {}),
           tags: { tool_id: request.tool },
         });
-        const outcome = await requestApproval(requestForOperator);
-        end(waitSpanId, { decision: outcome.allow ? "allow" : "deny" });
-        if (!outcome.allow) {
+        let outcome: ApprovalOutcome | undefined;
+        try {
+          outcome = await requestApproval(requestForOperator);
+        } finally {
+          end(
+            waitSpanId,
+            outcome !== undefined
+              ? { decision: outcome.allow ? "allow" : "deny" }
+              : undefined,
+          );
+        }
+        if (outcome === undefined || !outcome.allow) {
           const suffix =
-            outcome.message !== undefined && outcome.message.length > 0
+            outcome?.message !== undefined && outcome.message.length > 0
               ? ` — ${outcome.message}`
               : "";
           return {
@@ -509,13 +518,26 @@ export function createPermissionGate(options: PermissionGateOptions): Permission
         ...(turnId !== null && turnId.length > 0 ? { parentId: turnId } : {}),
         tags: { tool_id: request.tool },
       });
-      const outcome = await requestApproval(request);
-      end(waitSpanId, { decision: outcome.allow ? "allow" : "deny" });
-      if (!outcome.allow) {
-        const suffix = outcome.message !== undefined && outcome.message.length > 0
-          ? ` — ${outcome.message}`
-          : "";
-        return { allowed: false, reason: `Operator declined: ${request.action} (${request.subject})${suffix}` };
+      let outcome: ApprovalOutcome | undefined;
+      try {
+        outcome = await requestApproval(request);
+      } finally {
+        end(
+          waitSpanId,
+          outcome !== undefined
+            ? { decision: outcome.allow ? "allow" : "deny" }
+            : undefined,
+        );
+      }
+      if (outcome === undefined || !outcome.allow) {
+        const suffix =
+          outcome?.message !== undefined && outcome.message.length > 0
+            ? ` — ${outcome.message}`
+            : "";
+        return {
+          allowed: false,
+          reason: `Operator declined: ${request.action} (${request.subject})${suffix}`,
+        };
       }
       mintGrant(request.tool, outcome);
     }