ask-app-server 0.4.30 → 0.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5c3830a63e828e66d8b16a739855dd6fd352c4458a146a75635b5c8f51d352bc
-  data.tar.gz: 6bc00c0183a0498b1340759b1ca4c1a057d2f8966a080a70371b4bb534e59b3f
+  metadata.gz: '09c21d6313a0af92e78bed933837e2c292ad657deb958edc8e463e4cca52a4a1'
+  data.tar.gz: d6151661ac80585af0d25bed6363251b3a0a4db877308c50bd47d8260f628a2d
 SHA512:
-  metadata.gz: 35613de895a6499df77dedc58b9819e4524cab9d5164f93dd3a8bb8cfd90e2a53c8d54576718391e2d396c768be13db8e4d1fe06d766e86c7e795be3c388e2ec
-  data.tar.gz: b534bb82110ff140eeddefa7c4256f12084a7d3ddcbd759e692656f4e166af497730a53cdf98d840e5bc7fb55850d731905381228a66ddbe8f2b2f99a27307f3
+  metadata.gz: 674090973396a7cde266772e797f416a9d6533c99ecbbcb3690b209e9eecf38e141cb85ac65997a910c3ada517eab0319fd46f554dbf33515d76e7564b163c01
+  data.tar.gz: d8684d423ff60cf2e305d6f3b5ab38d3bec72dd8355943bbf53ee864ca7657a0c50915404d83ae848c593c01f3a71074e306b06325c47c486239c70ab9b77f0c

data/CHANGELOG.md

@@ -2,6 +2,68 @@
 
 ## [Unreleased]
 
+## [0.5.0] - 2026-09-23
+
+### Added
+
+- `session/resume` accepts optional workspace context — the same nested
+  shape `session/create` takes (`workspace.workspacePath`, or a top-level
+  `workspacePath`). It is passed to the manager for verification only; the
+  resume result shape is unchanged.
+
+### Changed
+
+- `Ask::AppServer::PermissionHandler` now delegates decisions to the shared
+  `ask-permissions` policy (`PermissionRules` + `ApprovalQueue` +
+  `ApprovalPolicy`). Blocked tools are encoded as `ask` rules, approvals
+  flow through the shared queue (protocol request ids are the queue action
+  ids), and timeout/cancel fail closed via queue reject. The blocking
+  protocol API (`before_tool_call`, `handle_response`, `cancel_all!`,
+  `pending_count`/`pending?`, `on_request`, synchronous condition wait)
+  is unchanged.
+- `EmittingApprovalQueue` forwards approval scope and rejection feedback to
+  the resolved action. App-server `approval.updated` events now include
+  non-default `scope` and rejection `feedback` fields when present.
+- App-server approval interactions advertise supported scopes (`once` and
+  `session`, plus `project` when workspace context is available), accept
+  `scope`/rejection `feedback` through JSON-RPC,
+  default omitted scope to `once`, and reject unsupported scopes as invalid
+  requests rather than silently downgrading them. With workspace context,
+  sessions also offer `project` scope, persisted in the configured state
+  provider under a hashed canonical workspace identity.
+
+### Fixed
+
+- **`session/resume` fails closed on project scope.** A durable resume used
+  to reattach the stored project grants while rebuilding the agent with no
+  workspace (`agent_dir`/tools `default_workdir` nil) — restoring an old
+  project's approvals for tools running from the host's cwd. Grants are now
+  attached (and `project` advertised as an approval scope, and tools pinned
+  to the workspace) only when the caller supplies a workspace path that
+  canonicalizes to the session's stored identity; absent or mismatched
+  context resumes with `once`/`session` scopes only and no pinned workdir.
+  The stored `workspaceId` remains a SHA-256 of the canonical path — raw
+  absolute paths are never written to persisted metadata — and is preserved
+  across resumes so a later verified resume can still restore project scope.
+  In-process resume (the live adapter) is unchanged.
+- **Project permission grants no longer lose updates across processes.**
+  `grant`/`revoke` read-modify-write cycles were serialized only by a
+  local `Mutex`, so two app-server processes sharing one SQLite/Postgres/
+  Redis/MySQL backend could interleave and silently drop each other's
+  writes (e.g. a revoke that never persists). Mutations now hold the
+  `Ask::State::Adapter` contract's distributed lock
+  (`acquire_lock`/`release_lock` — token-safe on every shipped backend)
+  across the whole read-modify-write, retrying briefly under contention and
+  failing closed (raising) instead of writing outside the lock if it cannot
+  be acquired. Adapters without lock support keep working through the
+  documented single-process fallback (local mutex only); reads stay
+  lock-free and available while a mutation waits.
+## [0.4.30] - 2026-09-23
+
+### Changed
+
+- Migrated `ApprovalQueue` to `ask-permissions`.
+
 ### Fixed
 
 - **Durable session listings survive restart.** When `state_adapter:` is

data/README.md

@@ -78,7 +78,7 @@ From another process, send JSON-RPC requests:
 | `initialize` | Handshake; negotiates `protocolVersion` and capabilities |
 | `session/create` | Create a new agent session |
 | `session/list` | List active sessions |
-| `session/resume` | Resume an existing session |
+| `session/resume` | Resume an existing session (optional workspace context, see below) |
 | `session/subscribe` | Subscribe to the event stream (with replay snapshot) |
 | `session/send` | Prompt an idle session or inject mid-run (`steered`/`queued`/`stale`) |
 | `session/events` | Poll for events after a sequence number |
@@ -111,6 +111,14 @@ Every event is a canonical `{type, seq, payload}` envelope, delivered as a
 The full vocabulary, payload shapes, method specs, and versioning live in
 the ask-session-protocol gem (JSON Schema artifact included).
 
+`session/resume` takes an optional workspace context — the same nested
+`workspace.workspacePath` shape as `session/create`. It is verified against
+the session's stored identity (a SHA-256 of the canonical path; raw paths
+are never persisted): project-scoped approvals come back and tools are
+pinned to the workspace only when the supplied path canonicalizes to that
+identity. Absent or mismatched context fails closed — the session resumes
+with `once`/`session` approval scopes only and no pinned workdir.
+
 The event log itself is event-sourced in [ask-session](https://github.com/ask-rb/ask-session)'s
 `Host`: replay (`session/events`, subscribe snapshots, cursor push) reads
 the durable log rather than an in-memory buffer, and protocol translation

data/lib/ask/app_server/agent_adapter.rb

@@ -28,6 +28,10 @@ module Ask
       # keeps Host seq and wire seq contiguous from 1.
       HOST_OWNED_EVENT_TYPES = %w[session.created session.ended].freeze
 
+      # Approval scopes available without workspace context. A project scope
+      # is added only when the host supplies a workspace grant store.
+      BASE_APPROVAL_SCOPES = %i[once session].freeze
+
       # The underlying ask-agent session.
       attr_reader :session
 
@@ -64,7 +68,7 @@ module Ask
       #   Ask::Agent::Session.new (hooks, plan_mode, todos, ...)
       def initialize(model:, tools: nil, system_prompt: nil, agent_dir: nil,
                      approval: :off, require_approval: nil, host: nil,
-                     state_adapter: nil, created_at: nil, **session_opts)
+                     state_adapter: nil, created_at: nil, project_grants: nil, **session_opts)
         @model = model
         @system_prompt = system_prompt
         @tools = resolve_tools(tools)
@@ -72,6 +76,7 @@ module Ask
         @approval = approval
         @require_approval = require_approval
         @agent_dir = agent_dir
+        @project_grants = project_grants
         @host = host || build_durable_host(state_adapter)
         @durable_record = false
         # The session's workspace is the tools' home: bash commands
@@ -191,6 +196,12 @@ module Ask
         !@running
       end
 
+      def allowed_approval_scopes
+        scopes = BASE_APPROVAL_SCOPES.dup
+        scopes << :project if @project_grants
+        scopes.map(&:to_s)
+      end
+
       # ── Interactions (approvals) ───────────────────────────────────────
 
       # Pending approval interactions, as canonical Interaction objects.
@@ -203,6 +214,7 @@ module Ask
           payload["args"] = action.args if action.args
           payload["message"] = action.message if action.message
           payload["autoApprovable"] = action.auto_approvable unless action.auto_approvable.nil?
+          payload["allowedScopes"] = allowed_approval_scopes
           Ask::SessionProtocol::Interactions.interaction(
             id: "act_#{action.id}", kind: "approval", status: "pending", payload: payload
           )
@@ -210,33 +222,41 @@ module Ask
       end
 
       # Approve a pending approval interaction by canonical id ("act_N").
+      # @param scope [Symbol, String] :once (default), :session, or :project
+      #   when a workspace-scoped grant store is available.
       # @return [Boolean] whether an action was approved
-      def approve_interaction(interaction_id)
-        apply_interaction(interaction_id) { |queue, id| queue.approve(id) }
+      def approve_interaction(interaction_id, scope: :once)
+        normalized = normalize_approval_scope!(scope)
+        apply_interaction(interaction_id) { |queue, id| queue.approve(id, scope: normalized) }
       end
 
       # Reject a pending approval interaction by canonical id ("act_N").
+      # @param feedback [String, nil] client-supplied denial reason,
+      #   retained on the action and surfaced in approval.updated.
       # @return [Boolean] whether an action was rejected
-      def reject_interaction(interaction_id)
-        apply_interaction(interaction_id) { |queue, id| queue.reject(id) }
+      def reject_interaction(interaction_id, feedback: nil)
+        apply_interaction(interaction_id) { |queue, id| queue.reject(id, feedback: feedback) }
       end
 
       # Approve every pending approval interaction.
+      # @param scope [Symbol, String] :once (default) or :session
       # @return [Integer] number approved
-      def approve_all_interactions
+      def approve_all_interactions(scope: :once)
+        normalized = normalize_approval_scope!(scope)
         queue = @session&.approval_queue
         return 0 unless queue
 
-        queue.approve_all.size
+        queue.approve_all(scope: normalized).size
       end
 
       # Reject every pending approval interaction.
+      # @param feedback [String, nil] denial reason applied to each
       # @return [Integer] number rejected
-      def reject_all_interactions
+      def reject_all_interactions(feedback: nil)
         queue = @session&.approval_queue
         return 0 unless queue
 
-        queue.reject_all.size
+        queue.reject_all(feedback: feedback).size
       end
 
       # ── Plan mode ───────────────────────────────────────────────────────
@@ -463,12 +483,14 @@ module Ask
         return nil if @approval == :off
 
         queue = EmittingApprovalQueue.new(
-          on_submit: ->(action) { @translator.approval_required(action) },
+          on_submit: ->(action) { @translator.approval_required(action, allowed_scopes: allowed_approval_scopes) },
           on_status: ->(action) { @translator.approval_updated(action) }
         )
-        return { queue: queue } if @approval == :auto
+        opts = { queue: queue }
+        opts[:project_grants] = @project_grants if @project_grants
+        return opts if @approval == :auto
 
-        { queue: queue, require_approval: @require_approval }
+        opts.merge(require_approval: @require_approval)
       end
 
       def apply_interaction(interaction_id)
@@ -481,6 +503,23 @@ module Ask
         yield(queue, id.to_i).any?
       end
 
+      # Normalize and validate an approval scope. Omitted scope defaults
+      # to :once (backward compatible). Anything outside
+      # Project scope is available only when the host supplied a project
+      # grants collaborator; unsupported scope raises InvalidRequest.
+      def normalize_approval_scope!(scope)
+        normalized = if scope.nil?
+          :once
+        elsif scope.is_a?(String) || scope.is_a?(Symbol)
+          scope.to_sym
+        end
+        unless allowed_approval_scopes.include?(normalized.to_s)
+          raise InvalidRequest,
+                "Unsupported approval scope '#{scope}' (supported: #{allowed_approval_scopes.join(', ')})"
+        end
+        normalized
+      end
+
       def start_run(content)
         @running_mutex.synchronize do
           @abort_requested = false
@@ -624,15 +663,15 @@ module Ask
 
       private
 
-      def apply(action)
-        result = super
-        @on_status&.call(action.with(status: :approved))
+      def apply(action, scope: :once)
+        result = super(action, scope: scope)
+        @on_status&.call(result)
         result
       end
 
-      def reject_action(action)
-        result = super
-        @on_status&.call(action.with(status: :rejected))
+      def reject_action(action, feedback: nil)
+        result = super(action, feedback: feedback)
+        @on_status&.call(result)
         result
       end
     end

data/lib/ask/app_server/event_translator.rb

@@ -96,11 +96,12 @@ module Ask
       # An approval action was queued: emit approval.required.
       #
       # @param action [Ask::Permissions::ApprovalQueue::Action]
-      def approval_required(action)
+      def approval_required(action, allowed_scopes: %w[once session])
         payload = { "toolName" => action.tool_name.to_s }
         payload["args"] = action.args if action.args
         payload["message"] = action.message if action.message
         payload["autoApprovable"] = action.auto_approvable unless action.auto_approvable.nil?
+        payload["allowedScopes"] = allowed_scopes
         emit("approval.required", payload.merge("id" => "act_#{action.id}"))
       end
 
@@ -111,7 +112,12 @@ module Ask
         status = action.status.to_s
         return unless %w[approved rejected].include?(status)
 
-        emit("approval.updated", { "id" => "act_#{action.id}", "status" => status })
+        payload = { "id" => "act_#{action.id}", "status" => status }
+        if status == "approved" && action.resolution_scope && action.resolution_scope != :once
+          payload["scope"] = action.resolution_scope.to_s
+        end
+        payload["feedback"] = action.feedback if status == "rejected" && action.feedback
+        emit("approval.updated", payload)
       end
 
       # A session was created: emit session.created.

data/lib/ask/app_server/permission_handler.rb

@@ -1,13 +1,15 @@
 # frozen_string_literal: true
 
-require "securerandom"
+require "ask/permissions"
 
 module Ask
   module AppServer
     # Protocol-aware permission handler that integrates with ask-agent's
     # before_tool_call hook system.
     #
-    # When a blocked tool is called, this handler:
+    # Decision logic is delegated to the shared ask-permissions policy
+    # (PermissionRules + ApprovalQueue + ApprovalPolicy). This handler
+    # preserves its blocking protocol API on top:
     #   1. Sends an `interaction/requestPermission` protocol message to the client
     #   2. Blocks the tool thread until the client responds (or timeout)
     #   3. Returns { action: :proceed } if approved, { action: :block } if denied
@@ -28,7 +30,7 @@ module Ask
       # Default timeout in seconds.
       DEFAULT_TIMEOUT = 300
 
-      attr_reader :mode
+      attr_reader :mode, :queue, :rules, :policy
 
       # @param mode [Symbol] :on_request (ask for dangerous tools) or :never (allow all)
       # @param blocked_tools [Array<Symbol>] list of tool names that require permission
@@ -37,10 +39,24 @@ module Ask
         @mode = mode
         @blocked_tools = (blocked_tools || DEFAULT_BLOCKED_TOOLS).map(&:to_sym)
         @timeout = timeout
-        @pending = {}
+        @waiters = {}
         @sender = nil
         @mutex = Mutex.new
         @logger = Logger.new($stdout, level: ENV["DEBUG"] ? Logger::DEBUG : Logger::WARN)
+
+        @rules = Ask::Permissions::PermissionRules.new
+        @blocked_tools.each { |tool| @rules.ask(tool.to_s) }
+
+        @queue = Ask::Permissions::ApprovalQueue.new(
+          on_submit: ->(action) { @sender&.call(action.id.to_s, action.tool_name.to_s, action.args) }
+        )
+
+        @policy = Ask::Permissions::ApprovalPolicy.new(
+          queue: @queue,
+          rules: @rules,
+          require_approval: (@mode != :never),
+          tools: @blocked_tools.map(&:to_s)
+        )
       end
 
       # Register a callback for sending the protocol message.
@@ -51,11 +67,27 @@ module Ask
 
       # Hook interface for Ask::Agent::Session's before_tool_call chain.
       # Returns { action: :proceed } or { action: :block, reason: "..." }.
-      def before_tool_call(tool_call, _context = {})
-        return { action: :proceed } unless @blocked_tools.include?(tool_call.name.to_sym)
+      def before_tool_call(tool_call, context = nil)
         return { action: :proceed } if @mode == :never
 
-        request_approval(tool_call)
+        result = @policy.before_tool_call(tool_call, context)
+
+        case result[:action]
+        when :proceed
+          { action: :proceed }
+        when :block
+          { action: :block, reason: result[:reason] || "Permission denied" }
+        when :pending
+          action_id = result[:action_id]
+          return { action: :block, reason: "Permission error: missing action id" } if action_id.nil?
+
+          wait_for_approval(action_id)
+        else
+          { action: :block, reason: "Permission error: unknown policy decision" }
+        end
+      rescue => e
+        @logger.debug("Permission error: #{e.message}")
+        { action: :block, reason: "Permission error: #{e.message}" }
       end
 
       # Called by the server when the client responds to a permission request.
@@ -64,14 +96,27 @@ module Ask
       # @param decision [String] "approve" or "deny"
       # @param reason [String, nil] optional reason from the client
       def handle_response(request_id, decision, reason: nil)
+        action_id = parse_action_id(request_id)
+        return false if action_id.nil?
+
         @mutex.synchronize do
-          entry = @pending[request_id]
-          return false unless entry
+          action = @queue[action_id]
+          entry = @waiters[action_id]
+          return false if action.nil? && entry.nil?
+          return false if !action.nil? && !action.pending? && entry.nil?
+
+          if decision.to_s == "approve"
+            @queue.approve(action_id)
+          else
+            @queue.reject(action_id)
+          end
 
-          entry[:responded] = true
-          entry[:approved] = (decision.to_s == "approve")
-          entry[:reason] = reason
-          entry[:condition].signal
+          if entry
+            entry[:responded] = true
+            entry[:approved] = (decision.to_s == "approve")
+            entry[:reason] = reason
+            entry[:condition].signal
+          end
           true
         end
       end
@@ -79,35 +124,54 @@ module Ask
       # Cancel all pending permission requests (e.g., on session shutdown).
       def cancel_all!
         @mutex.synchronize do
-          @pending.each_value do |entry|
+          @waiters.each_value do |entry|
             entry[:responded] = true
             entry[:approved] = false
             entry[:reason] = "Permission request cancelled"
             entry[:condition].signal
           end
-          @pending.clear
+          @waiters.clear
         end
+        @queue.reject_all
       end
 
       # Number of pending permission requests.
       def pending_count
-        @mutex.synchronize { @pending.size }
+        @queue.pending_actions.size
       end
 
       # Are there any pending permission requests?
       def pending?
-        pending_count > 0
+        @queue.any_pending?
       end
 
       private
 
-      def request_approval(tool_call)
-        request_id = SecureRandom.uuid
+      def parse_action_id(request_id)
+        return request_id if request_id.is_a?(Integer)
+        return nil if request_id.nil?
+
+        str = request_id.to_s
+        return nil unless str.match?(/\A\d+\z/)
+
+        str.to_i
+      end
+
+      def wait_for_approval(action_id)
         condition = ConditionVariable.new
 
         @mutex.synchronize do
-          @pending[request_id] = {
-            tool_call: tool_call,
+          # If the response already landed before we registered, consume it.
+          action = @queue[action_id]
+          if action && action.approved?
+            @waiters.delete(action_id)
+            return { action: :proceed }
+          elsif action && action.rejected?
+            @waiters.delete(action_id)
+            return { action: :block, reason: "Permission denied" }
+          end
+
+          @waiters[action_id] = {
             condition: condition,
             responded: false,
             approved: false,
@@ -116,49 +180,61 @@ module Ask
           }
         end
 
-        @logger.debug("Requesting permission for #{tool_call.name} (#{request_id})")
+        @logger.debug("Requesting permission (#{action_id})")
 
-        # Send the permission request via the registered callback
-        @sender&.call(request_id, tool_call.name.to_s, tool_call.arguments)
-
-        # Block the tool thread until the client responds
-        response_reason = nil
         was_approved = false
+        response_reason = nil
 
         @mutex.synchronize do
           deadline = Time.now + @timeout
 
           loop do
-            entry = @pending[request_id]
-            break unless entry      # cancelled or already processed
-            break if entry[:responded]  # response received
+            entry = @waiters[action_id]
+            break unless entry # cancelled
+
+            # Fast-path: queue already resolved (handles approve-before-wait race).
+            action = @queue[action_id]
+            if action && action.approved?
+              entry[:approved] = true
+              entry[:responded] = true
+            elsif action && action.rejected? && !entry[:responded]
+              entry[:responded] = true
+              entry[:approved] = false
+            end
+
+            break if entry[:responded]
 
             remaining = deadline - Time.now
             if remaining <= 0
-              @pending.delete(request_id)
-              @logger.debug("Permission request #{request_id} timed out")
+              @waiters.delete(action_id)
+              @queue.reject(action_id)
+              @logger.debug("Permission request #{action_id} timed out")
               return { action: :block, reason: "Permission request timed out after #{@timeout}s" }
             end
 
             condition.wait(@mutex, remaining)
           end
 
-          entry = @pending.delete(request_id)
+          entry = @waiters.delete(action_id)
           if entry
             was_approved = entry[:approved]
             response_reason = entry[:reason]
+          else
+            # Cancelled via cancel_all! (entry cleared after signal).
+            return { action: :block, reason: "Permission request cancelled" }
           end
         end
 
         if was_approved
-          @logger.debug("Permission granted for #{request_id}")
+          @logger.debug("Permission granted for #{action_id}")
           { action: :proceed }
         else
-          @logger.debug("Permission denied for #{request_id}: #{response_reason}")
+          @logger.debug("Permission denied for #{action_id}: #{response_reason}")
           { action: :block, reason: response_reason || "Permission denied" }
         end
       rescue => e
-        @pending.delete(request_id) rescue nil
+        @mutex.synchronize { @waiters.delete(action_id) } rescue nil
+        @queue.reject(action_id) rescue nil
         @logger.debug("Permission error: #{e.message}")
         { action: :block, reason: "Permission error: #{e.message}" }
       end

data/lib/ask/app_server/project_permission_grants.rb

@@ -0,0 +1,152 @@
+# frozen_string_literal: true
+
+require "digest"
+
+module Ask
+  module AppServer
+    # Persistent tool grants scoped to one canonical workspace identity.
+    # Storage is owned by the host and supplied through ask-state-providers.
+    #
+    # grant/revoke are read-modify-write cycles. A local Mutex only
+    # serializes callers inside one process; two app-server processes
+    # sharing a SQLite/Postgres/Redis/MySQL backend interleave their
+    # get→set cycles and lose each other's updates (a revoked grant
+    # silently surviving, or a grant never persisting). The
+    # Ask::State::Adapter contract's distributed lock
+    # (`acquire_lock`/`release_lock` — token-safe on every shipped
+    # backend) is therefore held across each mutation whenever the
+    # supplied adapter implements it.
+    #
+    # Adapters without lock support keep working: mutations fall back
+    # to the local Mutex alone, which is single-process safe only —
+    # cross-process deployments must use a contract-conforming state
+    # adapter. If the lock cannot be acquired within the timeout the
+    # mutation fails closed (raises) rather than writing outside the
+    # lock.
+    class ProjectPermissionGrants
+      SNAPSHOT_VERSION = 1
+
+      # How long one mutation may hold the state-provider lock. The
+      # critical section is a get plus a set — milliseconds; the TTL is
+      # only a stale-lock backstop.
+      LOCK_TTL = 10
+
+      # How long a contended mutation waits for the provider lock before
+      # failing closed.
+      LOCK_TIMEOUT = 2.0
+
+      # Pause between acquire attempts while contended.
+      LOCK_RETRY_INTERVAL = 0.005
+
+      attr_reader :project_id
+
+      def initialize(state:, project_id:, lock_timeout: LOCK_TIMEOUT)
+        normalized = project_id.to_s.strip
+        raise ArgumentError, "project_id must not be blank" if normalized.empty?
+        raise ArgumentError, "state must respond to get and set" unless state.respond_to?(:get) && state.respond_to?(:set)
+
+        @state = state
+        @project_id = normalized
+        @key = "ask-app-server:project-permission-grants:#{Digest::SHA256.hexdigest(normalized)}"
+        @lock_key = "#{@key}:lock"
+        @lock_timeout = lock_timeout
+        @mutex = Mutex.new
+        @distributed_lock = state.respond_to?(:acquire_lock) && state.respond_to?(:release_lock)
+      end
+
+      def granted?(tool_name)
+        name = normalize_tool_name(tool_name)
+        read_tools.include?(name)
+      end
+
+      def grant(tool_name)
+        name = normalize_tool_name(tool_name)
+        with_mutation_lock do
+          tools = read_tools
+          next false if tools.include?(name)
+
+          write_tools(tools + [name])
+          true
+        end
+      end
+
+      def revoke(tool_name)
+        name = normalize_tool_name(tool_name)
+        with_mutation_lock do
+          tools = read_tools
+          next false unless tools.include?(name)
+
+          write_tools(tools - [name])
+          true
+        end
+      end
+
+      def snapshot
+        { version: SNAPSHOT_VERSION, granted_tools: read_tools }
+      end
+
+      private
+
+      # Run one read-modify-write mutation under exclusive access. With
+      # a contract-conforming adapter that is the state provider's
+      # distributed lock (shared by every process on the backend);
+      # otherwise the local Mutex (single-process only — see the class
+      # comment). Returns the block's value.
+      def with_mutation_lock
+        return @mutex.synchronize { yield } unless @distributed_lock
+
+        lock = acquire_state_lock!
+        begin
+          yield
+        ensure
+          @state.release_lock(@lock_key, lock)
+        end
+      end
+
+      # Acquire the provider lock, retrying while a peer holds it.
+      # Raises (fail closed) instead of proceeding unlocked when the
+      # contention outlasts the timeout.
+      def acquire_state_lock!
+        deadline = Process.clock_gettime(Process::CLOCK_MONOTONIC) + @lock_timeout
+        loop do
+          lock = @state.acquire_lock(@lock_key, ttl: LOCK_TTL)
+          return lock if lock
+
+          if Process.clock_gettime(Process::CLOCK_MONOTONIC) >= deadline
+            raise Ask::AppServer::Error,
+                  "Timed out acquiring the project permission grant lock after #{@lock_timeout}s"
+          end
+
+          sleep LOCK_RETRY_INTERVAL
+        end
+      end
+
+      def normalize_tool_name(tool_name)
+        name = tool_name.to_s.strip
+        raise ArgumentError, "tool_name must not be blank" if name.empty?
+
+        name
+      end
+
+      # Reads are a single atomic get on every backend — they stay
+      # lock-free (and available even when a mutation is failing closed
+      # on lock contention).
+      def read_tools
+        stored = @state.get(@key)
+        return [] if stored.nil?
+
+        version = stored[:version] || stored["version"] if stored.is_a?(Hash)
+        tools = stored[:granted_tools] || stored["granted_tools"] if stored.is_a?(Hash)
+        unless version == SNAPSHOT_VERSION && tools.is_a?(Array) && tools.all? { |name| name.is_a?(String) && !name.empty? }
+          raise Ask::AppServer::Error, "Stored project permission grants are malformed"
+        end
+
+        tools.uniq
+      end
+
+      def write_tools(tools)
+        @state.set(@key, { version: SNAPSHOT_VERSION, granted_tools: tools.sort })
+      end
+    end
+  end
+end

data/lib/ask/app_server/server.rb

@@ -260,6 +260,15 @@ module Ask
         10_000 + @outgoing_id
       end
 
+      # Optional workspace context on session/resume: the nested shape
+      # session/create accepts, plus a top-level workspacePath. Absent
+      # (nil) means no proof — the manager fails closed.
+      def resume_workspace_path(params)
+        workspace = params["workspace"] || params[:workspace]
+        path = workspace.is_a?(Hash) ? (workspace["workspacePath"] || workspace[:workspacePath]) : nil
+        path || params["workspacePath"] || params[:workspacePath]
+      end
+
       def reader_loop(connection)
         while @running
           line = connection.read_line
@@ -360,11 +369,22 @@ module Ask
         # otherwise a durable restart resume: rebuild a fresh agent
         # session from the Host (restored from its snapshot when one
         # exists) and attach it to the live registry.
+        #
+        # Optional workspace context: the same nested shape
+        # session/create accepts (`workspace.workspacePath`, or a
+        # top-level `workspacePath`). It is passed through for
+        # verification only — resume fails closed (no project approval
+        # scope, tools unpinned from any workspace) when it is absent
+        # or does not canonicalize to the session's stored (hashed)
+        # workspace identity. See SessionManager#resume_session.
         handler("session/resume") do |params, _id|
           session_id = params["sessionId"] || params[:sessionId]
           raise InvalidRequest, "sessionId is required" unless session_id
 
-          adapter = @session_manager.resume_session(session_id)
+          adapter = @session_manager.resume_session(
+            session_id,
+            workspace_path: resume_workspace_path(params)
+          )
 
           {
             sessionId: session_id,
@@ -488,9 +508,10 @@ module Ask
         handler("interaction/approve") do |params, _id|
           session_id = params["sessionId"] || params[:sessionId]
           interaction_id = params["interactionId"] || params[:interactionId]
+          scope = params["scope"] || params[:scope] || "once"
           raise InvalidRequest, "sessionId and interactionId are required" unless session_id && interaction_id
 
-          approved = @session_manager.approve_interaction(session_id, interaction_id)
+          approved = @session_manager.approve_interaction(session_id, interaction_id, scope: scope)
           raise Ask::AppServer::InteractionNotFound, "Interaction #{interaction_id} not found" unless approved
 
           { approved: true, interactionId: interaction_id }
@@ -500,9 +521,10 @@ module Ask
         handler("interaction/reject") do |params, _id|
           session_id = params["sessionId"] || params[:sessionId]
           interaction_id = params["interactionId"] || params[:interactionId]
+          feedback = params["feedback"] || params[:feedback]
           raise InvalidRequest, "sessionId and interactionId are required" unless session_id && interaction_id
 
-          rejected = @session_manager.reject_interaction(session_id, interaction_id)
+          rejected = @session_manager.reject_interaction(session_id, interaction_id, feedback: feedback)
           raise Ask::AppServer::InteractionNotFound, "Interaction #{interaction_id} not found" unless rejected
 
           { rejected: true, interactionId: interaction_id }
@@ -511,17 +533,19 @@ module Ask
         # Interaction: approve all pending
         handler("interaction/approve-all") do |params, _id|
           session_id = params["sessionId"] || params[:sessionId]
+          scope = params["scope"] || params[:scope] || "once"
           raise InvalidRequest, "sessionId is required" unless session_id
 
-          { approved: @session_manager.approve_all_interactions(session_id) }
+          { approved: @session_manager.approve_all_interactions(session_id, scope: scope) }
         end
 
         # Interaction: reject all pending
         handler("interaction/reject-all") do |params, _id|
           session_id = params["sessionId"] || params[:sessionId]
+          feedback = params["feedback"] || params[:feedback]
           raise InvalidRequest, "sessionId is required" unless session_id
 
-          { rejected: @session_manager.reject_all_interactions(session_id) }
+          { rejected: @session_manager.reject_all_interactions(session_id, feedback: feedback) }
         end
 
         # Interaction: respond to a user_input interaction (elicitation).

data/lib/ask/app_server/session_manager.rb

@@ -33,8 +33,12 @@ module Ask
       attr_reader :permission_timeout
 
       def initialize(store: nil, host: nil, state_adapter: nil, permission_mode: :on_request, blocked_tools: nil, permission_timeout: 300)
+        @state_adapter = state_adapter
+        @project_grant_state = state_adapter || Ask::State::Memory.new
         @store = store || SessionStore.new(state: state_adapter)
         @host = host || build_host(state_adapter)
+        @project_grant_stores = {}
+        @project_grant_mutex = Mutex.new
         @permission_mode = permission_mode
         @blocked_tools = (blocked_tools || DEFAULT_REQUIRE_APPROVAL).map(&:to_s)
         @permission_timeout = permission_timeout
@@ -69,6 +73,7 @@ module Ask
       #   falls back to the manager's permission_mode
       def create_session(workspace_path: nil, mode: nil, model: nil, tools: nil, system_prompt: nil)
         approval_opts, plan_mode = resolve_approval(mode)
+        workspace_id = workspace_identity(workspace_path)
 
         # A provider-qualified model must stay resolvable: the agent's
         # model catalog looks up bare ids, so the prefixed model is
@@ -86,12 +91,13 @@ module Ask
           agent_dir: workspace_path,
           approval: approval_opts[:mode],
           require_approval: approval_opts[:require_approval],
+          project_grants: project_grants_for(workspace_id),
           plan_mode: plan_mode,
           host: @host
         )
 
         session_id = adapter.start_session
-        @store.add(session_id, adapter)
+        @store.add(session_id, adapter, workspace_id: workspace_id)
 
         # Attach observers after registration so they see a settled store
         # (e.g. the pane reporter's session-count metadata), then replay
@@ -115,11 +121,25 @@ module Ask
       # restarts: the rebuilt adapter uses this manager's configured
       # defaults.
       #
+      # Workspace context fails closed. The stored +workspaceId+ is a
+      # hash of the canonical workspace path, never the path itself, so
+      # the caller must prove the context by supplying +workspace_path+:
+      # project grants are attached (and `project` advertised as an
+      # approval scope, and tools pinned to the workspace via
+      # default_workdir) only when the supplied path canonicalizes to
+      # that stored identity. Absent or mismatched context resumes the
+      # session with no project scope — grants never reach tools that
+      # would run from an unverified working directory. The stored
+      # identity itself is preserved either way (still a hash), so a
+      # later verified resume can restore it.
+      #
+      # @param session_id [String]
+      # @param workspace_path [String, nil] the caller's workspace context
       # @return [AgentAdapter]
       # @raise [SessionNotFound] when neither the live registry nor the
       #   durable Host knows the session, or its durable record is
       #   terminal (closed/aborted)
-      def resume_session(session_id)
+      def resume_session(session_id, workspace_path: nil)
         adapter = @store.get(session_id)
         return adapter if adapter
 
@@ -129,25 +149,56 @@ module Ask
           raise Ask::AppServer::SessionNotFound, "Session #{session_id} is not active"
         end
 
+        stored_metadata = @store.metadata(session_id) || {}
+        workspace_id = stored_metadata[:workspaceId] || stored_metadata["workspaceId"]
+        workspace_path = verified_resume_workspace(workspace_id, workspace_path)
+        project_grants = project_grants_for(workspace_id) if workspace_path
         approval_opts, plan_mode = resolve_approval(nil)
         adapter = AgentAdapter.new(
           model: resolve_agent_model(nil),
           tools: DEFAULT_TOOLS,
-          system_prompt: build_default_system_prompt(nil),
+          system_prompt: build_default_system_prompt(workspace_path),
+          agent_dir: workspace_path,
           approval: approval_opts[:mode],
           require_approval: approval_opts[:require_approval],
+          project_grants: project_grants,
           plan_mode: plan_mode,
           host: @host,
           created_at: record.created_at
         )
         adapter.resume_from_host(session_id)
-        @store.add(session_id, adapter)
+        @store.add(session_id, adapter, workspace_id: workspace_id)
 
         adapter.on_event { |event| notify_session_event(adapter.session_id, event) }
         @logger.info("Resumed session #{session_id} from the durable host")
         adapter
       end
 
+      def project_grants_for(workspace_id)
+        return nil unless workspace_id
+
+        @project_grant_mutex.synchronize do
+          @project_grant_stores[workspace_id] ||= ProjectPermissionGrants.new(
+            state: @project_grant_state,
+            project_id: workspace_id
+          )
+        end
+      end
+
+      def workspace_identity(path)
+        canonical = canonical_workspace_path(path)
+        canonical && "workspace:#{Digest::SHA256.hexdigest(canonical)}"
+      end
+
+      def canonical_workspace_path(path)
+        return nil if path.nil? || path.to_s.strip.empty?
+
+        expanded = File.expand_path(path.to_s)
+        File.realpath(expanded)
+      rescue SystemCallError
+        expanded
+      end
+
       # Remove a session.
       def destroy_session(session_id)
         adapter = @store.get(session_id)
@@ -202,39 +253,43 @@ module Ask
       end
 
       # Approve a pending approval interaction by canonical id.
+      # @param scope [Symbol, String] :once (default) or :session
       # @return [Boolean]
-      def approve_interaction(session_id, interaction_id)
+      def approve_interaction(session_id, interaction_id, scope: :once)
         adapter = @store.get(session_id)
         raise Ask::AppServer::SessionNotFound, "Session #{session_id} not found" unless adapter
 
-        adapter.approve_interaction(interaction_id)
+        adapter.approve_interaction(interaction_id, scope: scope)
       end
 
       # Reject a pending approval interaction by canonical id.
+      # @param feedback [String, nil] denial reason forwarded to the queue
       # @return [Boolean]
-      def reject_interaction(session_id, interaction_id)
+      def reject_interaction(session_id, interaction_id, feedback: nil)
         adapter = @store.get(session_id)
         raise Ask::AppServer::SessionNotFound, "Session #{session_id} not found" unless adapter
 
-        adapter.reject_interaction(interaction_id)
+        adapter.reject_interaction(interaction_id, feedback: feedback)
       end
 
       # Approve every pending approval interaction.
+      # @param scope [Symbol, String] :once (default) or :session
       # @return [Integer] number approved
-      def approve_all_interactions(session_id)
+      def approve_all_interactions(session_id, scope: :once)
         adapter = @store.get(session_id)
         raise Ask::AppServer::SessionNotFound, "Session #{session_id} not found" unless adapter
 
-        adapter.approve_all_interactions
+        adapter.approve_all_interactions(scope: scope)
       end
 
       # Reject every pending approval interaction.
+      # @param feedback [String, nil] denial reason forwarded to the queue
       # @return [Integer] number rejected
-      def reject_all_interactions(session_id)
+      def reject_all_interactions(session_id, feedback: nil)
         adapter = @store.get(session_id)
         raise Ask::AppServer::SessionNotFound, "Session #{session_id} not found" unless adapter
 
-        adapter.reject_all_interactions
+        adapter.reject_all_interactions(feedback: feedback)
       end
 
       # ── Plan mode ───────────────────────────────────────────────────────
@@ -340,6 +395,20 @@ module Ask
         nil
       end
 
+      # Fail-closed workspace verification for durable resume: the
+      # canonical path when the caller's +path+ hashes to the stored
+      # +workspaceId+, nil otherwise (no path supplied, or a path for a
+      # different project). Never falls back to a stored raw path —
+      # there is none: only the hash is persisted.
+      def verified_resume_workspace(workspace_id, path)
+        return nil if workspace_id.nil? || path.nil?
+
+        canonical = canonical_workspace_path(path)
+        return nil unless canonical && workspace_identity(canonical) == workspace_id
+
+        canonical
+      end
+
       # Resolve the configured model for a new agent session: parse an
       # optional provider prefix and register it in the catalog so the
       # bare id stays resolvable (see create_session).

data/lib/ask/app_server/session_store.rb

@@ -30,13 +30,14 @@ module Ask
       end
 
       # Register a new session.
-      def add(session_id, adapter)
+      def add(session_id, adapter, workspace_id: nil)
         model = adapter.respond_to?(:instance_variable_get) ? adapter.instance_variable_get(:@model) : nil
         metadata = {
           sessionId: session_id,
           model: model,
           createdAt: adapter.respond_to?(:created_at) ? adapter.created_at.iso8601 : Time.now.iso8601
         }
+        metadata[:workspaceId] = workspace_id if workspace_id
 
         @mutex.synchronize do
           existing = @state.get("#{SESSION_PREFIX}#{session_id}")
@@ -50,6 +51,12 @@ module Ask
         end
       end
 
+      # Session metadata persisted independently of the live adapter.
+      def metadata(session_id)
+        value = @state.get("#{SESSION_PREFIX}#{session_id}")
+        value&.transform_keys(&:to_sym)
+      end
+
       # Remove a session.
       def remove(session_id)
         @mutex.synchronize do

data/lib/ask/app_server/version.rb

@@ -2,6 +2,6 @@
 
 module Ask
   module AppServer
-    VERSION = "0.4.30"
+    VERSION = "0.5.0"
   end
 end

data/lib/ask-app-server.rb

@@ -14,6 +14,7 @@ require_relative "ask/app_server/connection"
 require_relative "ask/app_server/agent_adapter"
 require_relative "ask/app_server/permission_handler"
 require_relative "ask/app_server/session_store"
+require_relative "ask/app_server/project_permission_grants"
 require_relative "ask/app_server/session_manager"
 require_relative "ask/app_server/server"
 require_relative "ask/app_server/socket_server"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ask-app-server
 version: !ruby/object:Gem::Version
-  version: 0.4.30
+  version: 0.5.0
 platform: ruby
 authors:
 - Kaka Ruto
@@ -113,14 +113,14 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.1.0
+        version: 0.2.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.1.0
+        version: 0.2.0
 - !ruby/object:Gem::Dependency
   name: minitest
   requirement: !ruby/object:Gem::Requirement
@@ -214,6 +214,7 @@ files:
 - lib/ask/app_server/event_translator.rb
 - lib/ask/app_server/herdr_reporter.rb
 - lib/ask/app_server/permission_handler.rb
+- lib/ask/app_server/project_permission_grants.rb
 - lib/ask/app_server/server.rb
 - lib/ask/app_server/session_manager.rb
 - lib/ask/app_server/session_store.rb