Hold the TUI busy across the approval overlay

Author: TheGreatAxios

CHANGELOG.md

@@ -37,6 +37,8 @@ parallel copies under `docs/` or `scripts/notes/`. At cut time: rename
 - Spawned workers enforce the parent permission gate. Unresolved worker
   approvals deny with a reason that names the permission subject so the parent
   can grant and retry, without hanging on operator approval.
+- Operator approval resume late-binds to the live agent and keeps the TUI
+  busy across the overlay so a reload cannot drop the parked tool call.
 
 ### Changed
 

docs/ARCHITECTURE.md

@@ -382,7 +382,7 @@ tool call
 - **command** — Splits chained commands for security classification and derives command-shape approval scopes. Multi-segment chains only offer an exact-command persist pattern (a prefix like `npm *` must not cover `npm i && rm -rf /` later).
 - **auto-shell-policy** — Constrains `run_shell` even when auto mode would otherwise rubber-stamp it. Before matching, `expandShellSubjects` peels `bash`/`sh`/`zsh -c`, `xargs` utility tails, and transparent prefixes (`env`, `nice`, `timeout`, …) so rules see the real payload; an unparseable wrapper (variable expansion or command substitution) sets an opaque flag that forces `ask`. Effects: `deny` blocks outright (file mutations through ad-hoc tooling — output redirection, `tee`, `sed -i`/`perl -i`, interpreter inline programs or heredocs — which must instead go through `write_file`/`edit_file`); `ask` declines to auto-allow and falls through to the operator prompt (recursive `rm`, dependency installs and remote runners: npm/yarn/pnpm/bun, pip, cargo, go, brew, npx/bunx, …, force or uncontained `git worktree` ops, shell that references a sensitive path such as `.env` or a private key, and opaque wrappers). Contained non-force `git worktree add`/`remove`/`prune` and read-only `list` auto-allow (sibling destinations like `../corbits-dispatch-wts/…` included; absolute outside, `~`, globs, and credential basenames still ask). Deny beats ask when multiple subjects match. Quoted spans are stripped before pattern matching so a quoted `>` or install word in an argument is not flagged, and program names are matched only in command position. Adding a table category is a one-line rule append in `AUTO_SHELL_RULES`.
 - **gate** — Evaluates a call: `skipPermissions` allows everything; `allow`-tier passes; for `ask`-tier, checks persisted approvals, otherwise requests operator approval. Shell security classifies each chain segment (`||` / `&&` / `|` / `;` / newlines), but the operator is prompted once for the full command block — any unapproved segment fails the whole block, and execution always runs the unsplit original. Safe pipeline tails and pure shell no-ops (`true` / `false` / `:` and bare control-flow keywords stranded by chain-splitting) skip without a prompt. In a non-interactive run an unresolved `ask` becomes a denial. In auto mode: non-shell built-ins in `AUTO_ALLOWED_TOOLS` (writes/edits/deletes, `manage_tasks`, `spawn_agent`, `wait_agents`, …) auto-allow when not path-restricted; for `run_shell` the gate consults the auto-shell policy — a `deny` rule fails the call, an `ask` rule skips the auto-allow shortcut and proceeds to the normal approval flow, and anything unmatched is auto-allowed. Paths outside the workspace and writes under the session state root (`~/.corbits/projects/...` and legacy `.agent-state`) still ask under auto mode. Under `--dangerously-skip-permissions` (forces this process) or `/yolo` (persists as the user-global default via `setSkipPermissions`), the gate auto-allows those same cases, and pre-gate sandboxes (path-escape, shell session cwd retention, `list_dir` / `delete_file` workspace bounds) honor `getSkipPermissions()` live so outside-workspace access is not hard-denied after the gate already allowed it — without rebuilding the plugin stack. Secret-guard path denies and authorization hard blocks still apply. Mutating MCP and unknown built-ins are not blanket-allowed outside skip. Newly granted scopes are appended in memory and persisted.
-  - **Reactor-gated sessions (main session; `reactorGated: true`).** The gate's decision logic lives in one `decide()` used by both consumers: `evaluate()` (the middleware path below, still used by sub-agents) and `authorizeCall()`, which expresses the decision as the vendored reactor's before-tool authz effect (`src/permission/reactor-authorize.ts` bridges it into `env.authorize`). An `ask` there suspends the call as a reactor `PendingOperation` keyed by a correlationId (persisted through the context store's existing `pendingOperations`); `send()` settles as `suspended` and `src/session/approval-resume.ts` rebuilds the operator request from the approval snapshot, resolves it through the same `requestApproval` seam the TUI overlay uses, and delivers the decision to the reactor on the correlationId signal channel — an approved decision grants a one-shot bypass and the exact parked call re-dispatches; a rejected one answers it with an error result. Under reactor gating the middleware/MCP `gateToolCall` is an execution backstop, not a second copy of `env.authorize`: it consumes the `authorizeCall` verdict only when id, name, and arguments match, and does not re-decide. Deny still blocks and does not call `next`; an `ask` or `allow` skips the middleware prompt so an approved re-dispatch never re-asks. A reused `codex-proxy` id cannot apply an outer `shell` allow to an inner `run_shell` deny. Inner posix runs whose outer tool is not `run_shell` (Codex `apply_patch` proxy) never pass `env.authorize`, so `gateToolCall` decides on that cache miss and still blocks a deny. The headless denial and the stricter chained-command hard-deny are preserved as deny effects (upstream `block`s) decided inside the same `decide()`.
+  - **Reactor-gated sessions (main session; `reactorGated: true`).** The gate's decision logic lives in one `decide()` used by both consumers: `evaluate()` (the middleware path below, still used by sub-agents) and `authorizeCall()`, which expresses the decision as the vendored reactor's before-tool authz effect (`src/permission/reactor-authorize.ts` bridges it into `env.authorize`). An `ask` there suspends the call as a reactor `PendingOperation` keyed by a correlationId (persisted through the context store's existing `pendingOperations`); `send()` settles as `suspended` and `src/session/approval-resume.ts` rebuilds the operator request from the approval snapshot, resolves it through the same `requestApproval` seam the TUI overlay uses, and delivers the decision to the reactor on the correlationId signal channel — an approved decision grants a one-shot bypass and the exact parked call re-dispatches; a rejected one answers it with an error result. The TUI stays busy across the overlay and late-binds deliver through the live agent / session queue. Under reactor gating the middleware/MCP `gateToolCall` is an execution backstop, not a second copy of `env.authorize`: it consumes the `authorizeCall` verdict only when id, name, and arguments match, and does not re-decide. Deny still blocks and does not call `next`; an `ask` or `allow` skips the middleware prompt so an approved re-dispatch never re-asks. A reused `codex-proxy` id cannot apply an outer `shell` allow to an inner `run_shell` deny. Inner posix runs whose outer tool is not `run_shell` (Codex `apply_patch` proxy) never pass `env.authorize`, so `gateToolCall` decides on that cache miss and still blocks a deny. The headless denial and the stricter chained-command hard-deny are preserved as deny effects (upstream `block`s) decided inside the same `decide()`.
   - **Worker reactor ownership.** `workerPermissionGate` is a reactor-gated view over the parent's live permission gate: grants and policy are shared, not copied or toggled. Worker posix plugins and inherited MCP tools are bound to that view at worker start, so they take the reactor-gated `gateToolCall` path because the view reports `isReactorGated()` — they do not close over the parent's middleware-gated `isReactorGated()`. Deny still blocks; ask/allow skip the middleware prompt. `authorizeCall` on the view never emits `ask` — unresolved approvals become denials that name the permission subject, without invoking an approval callback or suspending, even with an interactive parent; the parent can obtain a grant and retry. Worker control-plane tools (`submit_result`, `ask_director`, and nested fleet verbs other than `spawn_agent`) allow without a parent grant. Authorization and tool execution run under the same async-local worker identity and cwd. Fleet authority remains an independent restriction, not an alternative permission grant.
 
 - **matcher** — Approval pattern matching via `@intx/authz` `matchPattern` (`*` wildcards). Exact-command grants store a backslash before each metacharacter; those patterns match by equality after unescape (the package has no escape syntax).

src/tui/runner/exit.ts

@@ -30,6 +30,7 @@ import {
   hostOf,
   liveAgent,
   recordRunError,
+  runWhileAgentBusy,
   type RunnerServices,
   type RunnerState,
   type SnapshotExtra,
@@ -339,15 +340,11 @@ export async function createRunLifecycle(
         services.emitter.emit("session.title", truncateSessionLabel(state.runTaskTitle));
         void persistRunSnapshot("running");
       }
-      state.inFlight++;
-      try {
+      return await runWhileAgentBusy(state, async () => {
         await refreshCodexBeforeSend();
         await refreshXaiBeforeSend();
         return await liveAgent(state).send(content, opts);
-      } finally {
-        state.inFlight--;
-        reloadIfIdle();
-      }
+      });
     },
     stream: () => liveAgent(state).stream(),
     deliver: (message) => {

src/tui/runner/state.ts

@@ -254,6 +254,19 @@ export function liveAgent(state: RunnerState): Agent {
   return agent;
 }
 
+export async function runWhileAgentBusy<T>(
+  state: Pick<RunnerState, "inFlight" | "reloadIfIdle">,
+  op: () => Promise<T>,
+): Promise<T> {
+  state.inFlight++;
+  try {
+    return await op();
+  } finally {
+    state.inFlight--;
+    state.reloadIfIdle?.();
+  }
+}
+
 export function hostOf(state: RunnerState): RunnerHost {
   const host = state.host;
   if (host === undefined) {

src/tui/runner/submit.ts

@@ -38,7 +38,7 @@ import { tuiSendFailureMessage } from "./send-failure-message.js";
 import type { ProviderFailureAttempt } from "../provider/failure-attempt.js";
 import type { Agent } from "@intx/agent";
 import { ASK_DIRECTOR_WAKE_PREFIX } from "../../subagent/fleet-report.js";
-import { hostOf, type RunnerServices, type RunnerState } from "./state.js";
+import { hostOf, runWhileAgentBusy, type RunnerServices, type RunnerState } from "./state.js";
 import { LOG_NAMESPACE_ROOT } from "../../branding.js";
 
 const tuiLogger = getLogger([LOG_NAMESPACE_ROOT, "tui"]);
@@ -259,12 +259,14 @@ export function createSubmitPath(
     const attempt = live.attemptIdentity();
     const providerFailure = services.providerFailureAttempts.begin(attempt);
     try {
-      const result = await live.agentProxy.send(message);
-      // An ask-tier call parked on the reactor's approval gate settles the
-      // send early; resolve the operator surface here and deliver the
-      // decision on the correlationId signal channel so the parked run
-      // resumes.
-      await services.approvalResume.handle(result);
+      await runWhileAgentBusy(state, async () => {
+        const result = await live.agentProxy.send(message);
+        // An ask-tier call parked on the reactor's approval gate settles the
+        // send early; resolve the operator surface here and deliver the
+        // decision on the correlationId signal channel so the parked run
+        // resumes.
+        await services.approvalResume.handle(result);
+      });
       return true;
     } catch (error) {
       handleSendFailure(error, attempt, providerFailure);

tests/unit/tui/approval-reload-during-suspend.test.ts

@@ -0,0 +1,65 @@
+import { describe, expect, test } from "bun:test";
+
+import { runWhileAgentBusy, type RunnerState } from "../../../src/tui/runner/state.js";
+
+function stubBusyState() {
+  const rebuilds: number[] = [];
+  const state: Pick<RunnerState, "inFlight" | "reloadIfIdle"> & { pendingReload: boolean } = {
+    inFlight: 0,
+    pendingReload: false,
+    reloadIfIdle: () => {
+      if (!state.pendingReload || state.inFlight > 0) return;
+      state.pendingReload = false;
+      rebuilds.push(state.inFlight);
+    },
+  };
+  return { state, rebuilds };
+}
+
+describe("runWhileAgentBusy vs pendingReload", () => {
+  test("nested spans hold reloadIfIdle until the outer span finishes", async () => {
+    const { state, rebuilds } = stubBusyState();
+
+    const result = await runWhileAgentBusy(state, async () => {
+      return await runWhileAgentBusy(state, async () => {
+        state.pendingReload = true;
+        state.reloadIfIdle?.();
+        return "suspended";
+      });
+    });
+
+    expect(result).toBe("suspended");
+    expect(rebuilds).toEqual([0]);
+  });
+
+  test("pendingReload during a deferred overlay-shaped outer op rebuilds only after resolve", async () => {
+    const { state, rebuilds } = stubBusyState();
+    let release: (() => void) | undefined;
+    const deferred = new Promise<void>((resolve) => {
+      release = resolve;
+    });
+
+    const running = runWhileAgentBusy(state, async () => {
+      state.pendingReload = true;
+      state.reloadIfIdle?.();
+      await deferred;
+      return "ok";
+    });
+
+    expect(rebuilds).toEqual([]);
+    expect(state.inFlight).toBe(1);
+    release?.();
+    expect(await running).toBe("ok");
+    expect(rebuilds).toEqual([0]);
+    expect(state.inFlight).toBe(0);
+  });
+
+  test("reloadIfIdle is a no-op when inFlight is already greater than zero", () => {
+    const { state, rebuilds } = stubBusyState();
+    state.inFlight = 2;
+    state.pendingReload = true;
+    state.reloadIfIdle?.();
+    expect(rebuilds).toEqual([]);
+    expect(state.pendingReload).toBe(true);
+  });
+});