@cruxy/cli 0.8.0 → 0.9.0

package/dist/checkpoint/types.d.ts

@@ -0,0 +1,117 @@
+/**
+ * Working-tree checkpoints (C.32): a complete snapshot of everything the agent
+ * could touch, captured before a run's first mutation, so `cruxy rollback` can
+ * undo the entire run — creates, edits, deletes — in one gated operation.
+ *
+ * Two layers, deliberately separated:
+ *   • {@link CheckpointStore} — the *content substrate* (where file bytes
+ *     live), swappable like VectorStore: git-object-backed in a repo, a
+ *     content-addressed shadow copy otherwise.
+ *   • The manifest — uniform JSON under `.cruxy/checkpoints/`, owned by the
+ *     service regardless of substrate, so list/prune/rollback never care which
+ *     store wrote a checkpoint.
+ *
+ * Explicit boundary: checkpoints cover WORKING-TREE file state only. They can
+ * never undo git commits, pushes, or PRs made during a run (C.15) — that is
+ * stated in the rollback preview, not silently implied.
+ */
+/** A file selected for capture: project-relative POSIX path + where it is on disk. */
+export interface CaptureFile {
+    path: string;
+    absPath: string;
+}
+/** Which content substrate a checkpoint was written with. */
+export type CheckpointStoreKind = "git" | "shadow";
+/**
+ * One captured file in a checkpoint manifest. `oid` is the content address in
+ * the store that wrote it: a git blob sha-1 for the git store, a sha-256 for
+ * the shadow store. `mode` preserves the executable bit across restore.
+ */
+export interface FileEntry {
+    path: string;
+    mode: "100644" | "100755";
+    oid: string;
+}
+/** A persisted checkpoint: identity, provenance, and the full pre-run manifest. */
+export interface Checkpoint {
+    /** Stable id, e.g. `ck-20260703T141530-a4f2`. */
+    id: string;
+    /** ISO-8601 creation time. */
+    createdAt: string;
+    /** One line describing the run this checkpoint protects. */
+    runSummary: string;
+    store: CheckpointStoreKind;
+    /** Every file that existed (and was capturable) before the run's first mutation. */
+    files: FileEntry[];
+    /**
+     * Project-relative paths the tracked run mutated through file tools, recorded
+     * as the run proceeds. At rollback time, a difference on a path NOT in this
+     * list is an *external* change — surfaced loudly in the preview.
+     */
+    touchedPaths: string[];
+    /**
+     * True when the run executed approved shell commands: a shell command can
+     * touch any path, so per-file attribution becomes impossible and the preview
+     * says so instead of guessing.
+     */
+    hasShellMutations: boolean;
+}
+/**
+ * The content substrate seam. Implementations persist and retrieve file
+ * *contents* only — manifests are the service's job.
+ *
+ * THE invariant (git store): snapshot/read must never disturb user-visible git
+ * state — HEAD, the index, the stash, or any ref. The git store self-checks
+ * this at runtime and fails loudly on drift.
+ */
+export interface CheckpointStore {
+    readonly kind: CheckpointStoreKind;
+    /** Persist the current contents of `files`; returns the manifest entries. */
+    snapshot(files: CaptureFile[]): Promise<FileEntry[]>;
+    /** The content address `snapshot` would give this buffer (for diffing). */
+    hashContent(content: Buffer): string;
+    /** Read one captured file's bytes back. Throws CRUXY_E_CHECKPOINT_FAILED if gone. */
+    readContent(entry: FileEntry): Promise<Buffer>;
+    /**
+     * Best-effort GC after prune: drop stored content whose oid is no longer
+     * referenced by any surviving manifest. The git store is a no-op (dangling
+     * objects belong to git's own gc); the shadow store sweeps its object pool.
+     */
+    collect(referenced: ReadonlySet<string>): Promise<void>;
+}
+/** What rollback will do to one path. */
+export type RollbackAction = 
+/** The run deleted it — recreate from the checkpoint. */
+"recreate"
+/** The run edited it — revert content (and mode) to the checkpoint. */
+ | "revert"
+/** The run created it — delete it. */
+ | "delete";
+export interface RollbackEntry {
+    path: string;
+    action: RollbackAction;
+    /**
+     * True when this path changed since the checkpoint but the tracked run never
+     * touched it — concurrent user (or other-tool) work that rollback would
+     * clobber. Always surfaced in the preview; never overwritten silently.
+     */
+    external: boolean;
+    /** Checkpoint-side content to restore (recreate/revert; absent for delete). */
+    entry?: FileEntry;
+}
+/** The computed diff between the current working tree and a checkpoint. */
+export interface RollbackPlan {
+    checkpoint: Checkpoint;
+    /** Sorted by path; empty means the tree already matches the checkpoint. */
+    entries: RollbackEntry[];
+    /** The `external: true` paths, for the preview's warning block. */
+    externalPaths: string[];
+    /** Mirrors {@link Checkpoint.hasShellMutations}: attribution is unknowable. */
+    attributionUnknown: boolean;
+}
+/** Counts of what a successful rollback actually did. */
+export interface RollbackApplied {
+    recreated: number;
+    reverted: number;
+    deleted: number;
+}

package/dist/checkpoint/types.js

@@ -0,0 +1,18 @@
+/**
+ * Working-tree checkpoints (C.32): a complete snapshot of everything the agent
+ * could touch, captured before a run's first mutation, so `cruxy rollback` can
+ * undo the entire run — creates, edits, deletes — in one gated operation.
+ *
+ * Two layers, deliberately separated:
+ *   • {@link CheckpointStore} — the *content substrate* (where file bytes
+ *     live), swappable like VectorStore: git-object-backed in a repo, a
+ *     content-addressed shadow copy otherwise.
+ *   • The manifest — uniform JSON under `.cruxy/checkpoints/`, owned by the
+ *     service regardless of substrate, so list/prune/rollback never care which
+ *     store wrote a checkpoint.
+ *
+ * Explicit boundary: checkpoints cover WORKING-TREE file state only. They can
+ * never undo git commits, pushes, or PRs made during a run (C.15) — that is
+ * stated in the rollback preview, not silently implied.
+ */
+export {};

package/dist/cli/commands/checkpoint.d.ts

@@ -0,0 +1,7 @@
+import { Command } from "commander";
+/**
+ * `cruxy checkpoint` (C.32) — inspect the working-tree snapshots that back
+ * `cruxy rollback`. Creation is automatic (before a run's first mutation);
+ * this command only lists.
+ */
+export declare function checkpointCommand(): Command;

package/dist/cli/commands/checkpoint.js

@@ -0,0 +1,31 @@
+import { Command } from "commander";
+import pc from "picocolors";
+import { loadConfig } from "../../config/index.js";
+import { CheckpointService } from "../../checkpoint/index.js";
+import { logger } from "../../utils/logger.js";
+/**
+ * `cruxy checkpoint` (C.32) — inspect the working-tree snapshots that back
+ * `cruxy rollback`. Creation is automatic (before a run's first mutation);
+ * this command only lists.
+ */
+export function checkpointCommand() {
+    const cmd = new Command("checkpoint").description("working-tree checkpoints — the undo units behind `cruxy rollback`");
+    cmd
+        .command("list")
+        .description("list saved checkpoints, newest first")
+        .action(async () => {
+        const { config } = loadConfig();
+        const service = new CheckpointService({ root: process.cwd(), config });
+        const checkpoints = await service.list();
+        if (checkpoints.length === 0) {
+            logger.print(pc.dim("no checkpoints yet — one is created automatically before an agent run's first file change"));
+            return;
+        }
+        for (const c of checkpoints) {
+            const files = `${c.files.length} file${c.files.length === 1 ? "" : "s"}`;
+            logger.print(`${pc.cyan(c.id)}  ${pc.dim(c.createdAt)}  ${pc.dim(`[${c.store}]`)}  ${files}  ${c.runSummary}`);
+        }
+        logger.print(pc.dim(`\nrestore one with \`cruxy rollback <id>\` (or \`cruxy rollback\` for the newest)`));
+    });
+    return cmd;
+}

package/dist/cli/commands/rollback.d.ts

@@ -0,0 +1,10 @@
+import { Command } from "commander";
+/**
+ * `cruxy rollback [id]` (C.32) — restore the working tree to a checkpoint,
+ * undoing everything an agent run changed (creates, edits, deletes) in one
+ * operation. Destructive by definition, so it is preview-first and gated
+ * through U.3 at the destructive tier, ungrantable; non-TTY is refused with a
+ * coded error before anything is computed. Out of scope, stated in the
+ * preview: commits, pushes, and PRs made during the run are not undone.
+ */
+export declare function rollbackCommand(): Command;

package/dist/cli/commands/rollback.js

@@ -0,0 +1,51 @@
+import { Command } from "commander";
+import pc from "picocolors";
+import { loadConfig } from "../../config/index.js";
+import { CheckpointService } from "../../checkpoint/index.js";
+import { ApprovalService, defaultPromptIO } from "../../approval/index.js";
+import { rollbackApprovalRequired, shouldUseColor, } from "../../errors/index.js";
+import { logger } from "../../utils/logger.js";
+/**
+ * `cruxy rollback [id]` (C.32) — restore the working tree to a checkpoint,
+ * undoing everything an agent run changed (creates, edits, deletes) in one
+ * operation. Destructive by definition, so it is preview-first and gated
+ * through U.3 at the destructive tier, ungrantable; non-TTY is refused with a
+ * coded error before anything is computed. Out of scope, stated in the
+ * preview: commits, pushes, and PRs made during the run are not undone.
+ */
+export function rollbackCommand() {
+    return new Command("rollback")
+        .description("restore the working tree to a checkpoint, undoing an agent run's file changes")
+        .argument("[id]", "checkpoint id (defaults to the most recent)")
+        .action(async (id) => {
+        const interactive = Boolean(process.stdin.isTTY);
+        // Refuse before touching anything: rollback is a deliberate, interactive
+        // act. There is no flag to bypass this, by design.
+        if (!interactive)
+            throw rollbackApprovalRequired();
+        const { config } = loadConfig();
+        const root = process.cwd();
+        const service = new CheckpointService({ root, config });
+        const approval = new ApprovalService({
+            cwd: root,
+            interactive,
+            io: defaultPromptIO(shouldUseColor()),
+        });
+        const result = await service.rollback(id, {
+            requestApproval: (action) => approval.requestApproval(action),
+            interactive,
+        });
+        if (result.kind === "noop") {
+            logger.print(pc.dim(`working tree already matches checkpoint ${result.checkpoint.id} — nothing to roll back`));
+            return;
+        }
+        if (result.kind === "rejected") {
+            logger.print(pc.dim("rollback declined — nothing was changed"));
+            return;
+        }
+        const { recreated, reverted, deleted } = result.applied;
+        logger.print(`${pc.green("✓")} restored checkpoint ${pc.cyan(result.checkpoint.id)} — ` +
+            `${reverted} reverted, ${recreated} recreated, ${deleted} deleted`);
+        logger.print(pc.dim("note: commits, pushes, and PRs made during the run are not undone"));
+    });
+}

package/dist/cli/commands/run.js

@@ -4,6 +4,7 @@ import { logger } from "../../utils/logger.js";
 import { loadConfig, resolveApiKey } from "../../config/index.js";
 import { authMissingKey, usageError } from "../../errors/index.js";
 import { createRenderer } from "../../render/index.js";
+import { CheckpointService } from "../../checkpoint/index.js";
 import { runInteractive } from "../repl.js";
 import { buildAgentSession } from "../session-factory.js";
 import { apiKeyEnvVar, maybeRunOnboarding } from "../onboard.js";
@@ -53,11 +54,18 @@ export function runCommand() {
         // One renderer for the whole run (U.2): the streaming path and the
         // approval prompt's status-suspend hook must share the same live region.
         const renderer = createRenderer();
-        const session = buildAgentSession(config, apiKey, process.cwd(), Boolean(process.stdin.isTTY), planMode, renderer);
+        // Checkpoint-before-first-mutation (C.32): the service is latched per run
+        // and fires from the approval seam inside the session, so one instance
+        // covers the one-shot path, every REPL turn, and plan-mode execution.
+        const checkpoints = config.checkpoint.enabled
+            ? new CheckpointService({ root: process.cwd(), config })
+            : undefined;
+        const session = buildAgentSession(config, apiKey, process.cwd(), Boolean(process.stdin.isTTY), planMode, renderer, checkpoints);
         if (interactive) {
-            await runInteractive(session, undefined, renderer);
+            await runInteractive(session, undefined, renderer, checkpoints);
             return;
         }
+        checkpoints?.beginRun(prompt);
         // One-shot: a single turn, then exit. Preserves scripting/pipe use.
         // Assistant text streams to stdout delta by delta (same as the REPL);
         // piped output degrades to the plain renderer (no ANSI, chrome on stderr).

package/dist/cli/program.js

@@ -10,6 +10,8 @@ import { skillsCommand } from "./commands/skills.js";
 import { prCommand } from "./commands/pr.js";
 import { loginCommand } from "./commands/login.js";
 import { initCommand } from "./commands/init.js";
+import { checkpointCommand } from "./commands/checkpoint.js";
+import { rollbackCommand } from "./commands/rollback.js";
 import { loadConfig } from "../config/index.js";
 import { maybeRunOnboarding } from "./onboard.js";
 export function buildProgram() {
@@ -36,6 +38,8 @@ export function buildProgram() {
     program.addCommand(prCommand());
     program.addCommand(loginCommand());
     program.addCommand(initCommand());
+    program.addCommand(checkpointCommand());
+    program.addCommand(rollbackCommand());
     // Default action: bare `cruxy` -> entrypoint. An unrecognized first operand
     // means an unknown command (Commander runs the default action with it as an
     // operand rather than erroring), so reject it as a usage error.

package/dist/cli/repl.d.ts

@@ -1,5 +1,6 @@
 import type { Readable, Writable } from "node:stream";
 import type { Session } from "../agent/index.js";
+import type { CheckpointService } from "../checkpoint/index.js";
 import { type StreamRenderer } from "../render/index.js";
 /** The stdin/stdout pair the REPL reads from and prompts on. Injectable for tests. */
 export interface ReplIO {
@@ -17,4 +18,4 @@ export interface ReplIO {
  * live region, anything else the plain append-only renderer); `cruxy run`
  * passes its own so the approval prompt's status-suspend hook shares it.
  */
-export declare function runInteractive(session: Session, io?: ReplIO, renderer?: StreamRenderer): Promise<void>;
+export declare function runInteractive(session: Session, io?: ReplIO, renderer?: StreamRenderer, checkpoints?: CheckpointService): Promise<void>;

package/dist/cli/repl.js

@@ -74,16 +74,16 @@ function printReplError(err) {
  * live region, anything else the plain append-only renderer); `cruxy run`
  * passes its own so the approval prompt's status-suspend hook shares it.
  */
-export async function runInteractive(session, io = defaultIO(), renderer = createRenderer(io.output, process.stderr)) {
+export async function runInteractive(session, io = defaultIO(), renderer = createRenderer(io.output, process.stderr), checkpoints) {
     logger.print(pc.dim("interactive session — /help for commands, /exit or Ctrl+D to quit"));
     try {
-        await replLoop(session, io, renderer);
+        await replLoop(session, io, renderer, checkpoints);
     }
     finally {
         renderer.close();
     }
 }
-async function replLoop(session, io, renderer) {
+async function replLoop(session, io, renderer, checkpoints) {
     for (;;) {
         const line = await readLine(io, PROMPT);
         // EOF / Ctrl+D.
@@ -138,6 +138,9 @@ async function replLoop(session, io, renderer) {
         // line. Errors (provider/API failures) log and return to the prompt rather
         // than killing the REPL.
         try {
+            // Each REPL turn is its own undo unit (C.32): a fresh checkpoint latch,
+            // so `cruxy rollback` reverts exactly one turn's mutations.
+            checkpoints?.beginRun(trimmed);
             await session.send(line, renderer);
         }
         catch (err) {

package/dist/cli/session-factory.d.ts

@@ -1,6 +1,19 @@
 import type { CruxyConfig } from "../config/index.js";
+import type { ApprovalDecision } from "../approval/index.js";
+import type { CheckpointService } from "../checkpoint/index.js";
 import type { StreamRenderer } from "../render/index.js";
+import { type ApproveAction } from "../tools/index.js";
 import { Session } from "../agent/index.js";
+/**
+ * Wrap the approval gate with the C.32 auto-checkpoint hook. Ordering is the
+ * whole point: a tool mutates only *after* `requestApproval` resolves, so
+ * snapshotting after an `allow` decision but before returning it means the
+ * checkpoint always lands before the run's first mutation — and a denied
+ * action never creates one. The same seam records which paths the run touched
+ * (file actions) or that attribution is lost (shell), for rollback's
+ * external-change detection.
+ */
+export declare function withCheckpointGate(requestApproval: (action: ApproveAction) => Promise<ApprovalDecision>, checkpoints: CheckpointService | undefined, cwd: string): (action: ApproveAction) => Promise<ApprovalDecision>;
 /**
  * Build a ready-to-run agent {@link Session} from a resolved key — the wiring
  * shared by `cruxy run` and the onboarding first-win task (so they can't drift).
@@ -10,4 +23,4 @@ import { Session } from "../agent/index.js";
  * over the shared U.3 allowlist and a `planRunner` so `session.send` proposes →
  * approves → executes. Plan mode is fully opt-in; the default path is unchanged.
  */
-export declare function buildAgentSession(config: CruxyConfig, apiKey: string, cwd: string, ttyInteractive: boolean, planMode?: boolean, renderer?: StreamRenderer): Session;
+export declare function buildAgentSession(config: CruxyConfig, apiKey: string, cwd: string, ttyInteractive: boolean, planMode?: boolean, renderer?: StreamRenderer, checkpoints?: CheckpointService): Session;

package/dist/cli/session-factory.js

@@ -2,16 +2,19 @@ import { createProvider } from "@cruxy/sdk";
 import { loadProjectInstructions } from "../config/index.js";
 import { logger } from "../utils/logger.js";
 import { getGitInfo } from "../utils/git.js";
-import { ApprovalService, InteractivePolicy, SessionAllowlist, defaultPromptIO, } from "../approval/index.js";
+import { ApprovalService, InteractivePolicy, SessionAllowlist, classify, defaultPromptIO, } from "../approval/index.js";
 import { shouldUseColor } from "../errors/index.js";
 import { buildDefaultRegistry } from "../tools/index.js";
 import { Session } from "../agent/index.js";
 import { PlanExecutionPolicy, runPlanSession } from "../plan/index.js";
+import { SubagentOrchestrator, makeSpawnSubagentTool, } from "../subagent/index.js";
 /**
- * Wrap a PromptIO so the renderer's transient status line is erased before any
- * prompt text lands (U.2): the approval prompt writes to stderr while the
- * spinner owns the last stdout row of the same terminal — clearing first keeps
- * the prompt from tearing through the live region.
+ * Wrap a PromptIO so the live region yields before any prompt text lands
+ * (U.2/U.4): the prompt writes to stderr while the status line owns the last
+ * stdout row of the same terminal. Entering the `awaiting-approval` phase
+ * hides the live line (the prompt IS the visible state) while keeping the
+ * step-progress register intact, so the line comes back with full context on
+ * the next transition after the user decides.
  */
 function suspendStatusOnPrompt(io, renderer) {
     if (!renderer)
@@ -19,11 +22,58 @@ function suspendStatusOnPrompt(io, renderer) {
     return {
         ...io,
         write: (text) => {
-            renderer.status(null);
+            renderer.setPhase({ kind: "awaiting-approval" });
             io.write(text);
         },
     };
 }
+/**
+ * Restore the live line once an approval request fully settles (U.4). The
+ * settle point must be the service call, not the prompt's key read: the
+ * prompt writes a trailing newline AFTER the read, which re-enters
+ * `awaiting-approval` — resolving here is the first moment no more prompt
+ * bytes can follow. Fires on every decision (prompted or not); the renderer
+ * treats it as a no-op unless a prompt actually displaced the line.
+ */
+function resumeLineAfterApproval(requestApproval, renderer) {
+    if (!renderer)
+        return requestApproval;
+    return async (action) => {
+        try {
+            return await requestApproval(action);
+        }
+        finally {
+            renderer.promptResolved();
+        }
+    };
+}
+/**
+ * Wrap the approval gate with the C.32 auto-checkpoint hook. Ordering is the
+ * whole point: a tool mutates only *after* `requestApproval` resolves, so
+ * snapshotting after an `allow` decision but before returning it means the
+ * checkpoint always lands before the run's first mutation — and a denied
+ * action never creates one. The same seam records which paths the run touched
+ * (file actions) or that attribution is lost (shell), for rollback's
+ * external-change detection.
+ */
+export function withCheckpointGate(requestApproval, checkpoints, cwd) {
+    if (!checkpoints)
+        return requestApproval;
+    return async (action) => {
+        const decision = await requestApproval(action);
+        if (!decision.allow)
+            return decision;
+        const request = classify(action, cwd);
+        if (request.tier === "read")
+            return decision;
+        await checkpoints.ensureCheckpoint();
+        if (action.kind === "shell")
+            await checkpoints.recordShellMutation();
+        else
+            await checkpoints.recordTouched([...request.targets]);
+        return decision;
+    };
+}
 /**
  * Build a ready-to-run agent {@link Session} from a resolved key — the wiring
  * shared by `cruxy run` and the onboarding first-win task (so they can't drift).
@@ -33,7 +83,7 @@ function suspendStatusOnPrompt(io, renderer) {
  * over the shared U.3 allowlist and a `planRunner` so `session.send` proposes →
  * approves → executes. Plan mode is fully opt-in; the default path is unchanged.
  */
-export function buildAgentSession(config, apiKey, cwd, ttyInteractive, planMode = false, renderer) {
+export function buildAgentSession(config, apiKey, cwd, ttyInteractive, planMode = false, renderer, checkpoints) {
     const provider = createProvider({
         provider: config.model.provider,
         apiKey,
@@ -45,10 +95,35 @@ export function buildAgentSession(config, apiKey, cwd, ttyInteractive, planMode
     const execRegistry = buildDefaultRegistry();
     const git = getGitInfo(cwd);
     const projectInstructions = loadProjectInstructions(cwd);
+    // One io shared by every prompt in the session (plan approval, the U.3 gate,
+    // and any gate inside a subagent), so they all coordinate with the same live
+    // region. The full wrapper stack around an ApprovalService is factored here
+    // because subagents must get the *identical* stack over a FRESH service: same
+    // prompt + same checkpoint hook, but a new (empty) session allowlist — a
+    // grant in the parent never silently widens a child's authority.
+    const io = suspendStatusOnPrompt(defaultPromptIO(shouldUseColor()), renderer);
+    const gate = (approval) => withCheckpointGate(resumeLineAfterApproval((action) => approval.requestApproval(action), renderer), checkpoints, cwd);
+    // Subagent orchestration (C.14): spawn_subagent goes on the main registry
+    // only when depth allows (maxDepth 0 disables the feature structurally).
+    // Registered before the plan wiring so plan-mode execution steps can
+    // dispatch subagents too; the propose phase filters it out (read-only).
+    const orchestrator = new SubagentOrchestrator({
+        provider,
+        config,
+        parentRegistry: execRegistry,
+        cwd,
+        logger,
+        git,
+        projectInstructions,
+        renderer,
+        makeChildApproval: () => gate(new ApprovalService({ cwd, interactive: ttyInteractive, io })),
+    });
+    if (config.subagent.maxDepth > 0) {
+        execRegistry.register(makeSpawnSubagentTool(orchestrator, 0));
+    }
     if (planMode) {
-        // One io + allowlist shared by the plan-approval prompt and the per-action
+        // One allowlist shared by the plan-approval prompt and the per-action
         // gate, so a grant recorded during execution is honored by U.3's own check.
-        const io = suspendStatusOnPrompt(defaultPromptIO(shouldUseColor()), renderer);
         const allowlist = new SessionAllowlist();
         const planPolicy = new PlanExecutionPolicy(allowlist, new InteractivePolicy(allowlist, io));
         const approval = new ApprovalService({
@@ -57,12 +132,7 @@ export function buildAgentSession(config, apiKey, cwd, ttyInteractive, planMode
             policy: planPolicy,
             io,
         });
-        const ctx = {
-            cwd,
-            config,
-            logger,
-            requestApproval: (action) => approval.requestApproval(action),
-        };
+        const ctx = { cwd, config, logger, requestApproval: gate(approval) };
         const planRunner = ({ messages, projectInstructions, renderer: turnRenderer, }) => runPlanSession({
             provider,
             config,
@@ -90,14 +160,9 @@ export function buildAgentSession(config, apiKey, cwd, ttyInteractive, planMode
     const approval = new ApprovalService({
         cwd,
         interactive: ttyInteractive,
-        io: suspendStatusOnPrompt(defaultPromptIO(shouldUseColor()), renderer),
+        io,
     });
-    const ctx = {
-        cwd,
-        config,
-        logger,
-        requestApproval: (action) => approval.requestApproval(action),
-    };
+    const ctx = { cwd, config, logger, requestApproval: gate(approval) };
     return new Session({
         provider,
         registry: execRegistry,