@deftai/directive-runtime 0.129.5 → 0.129.7

package/vendor/directive-core/dist/hooks/dispatcher.js

@@ -1,7 +1,7 @@
 import { execFileSync } from "node:child_process";
-import { existsSync, readdirSync, realpathSync } from "node:fs";
-import { basename, isAbsolute, join, relative, resolve, sep } from "node:path";
-import { appendAuthzAudit, classifyHookAuthzOps, evaluateAuthzMutation, evidenceSatisfiesImplementationApproval, listActiveHumanGrants, loadAuthzStateResult, markGrantUsed, shouldConsumeSingleUseGrant, utcIso, } from "../authz/index.js";
+import { existsSync, lstatSync, readdirSync, readlinkSync, realpathSync } from "node:fs";
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { appendAuthzAudit, classifyHookAuthzOps, evaluateAuthzMutation, evidenceSatisfiesImplementationApproval, hasKillSwitchShellWrite, isKillSwitchPlantPath, listActiveHumanGrants, loadAuthzStateResult, markGrantUsed, shouldConsumeSingleUseGrant, utcIso, } from "../authz/index.js";
 import { shellCommandHasPayloadRootProtectedDestAfterRealpath } from "../authz/protected-dest-realpath.js";
 import { prepareGithubOnlyDest } from "../design-critique/run-posture.js";
 import { runningInsideDeftRepo } from "../doctor/paths.js";
@@ -29,6 +29,7 @@ import { inspectSessionRitual, verifySessionRitual, WRITE_GATED_REQUIRED_STEPS,
 import { countModelFlagsInLauncherArgv, evaluateSpawnRoutingHonor, extractModelFromLauncherArgv, extractRequestedModelFromPayload, extractStructuralWorkerRole, } from "../swarm/routing-honor.js";
 import { formatLauncherCorrectLifecycleRecovery, UNRESOLVED_HOST_OWNER, uninspectableLifecycleDenyMessage, } from "./classify/host-session-identity.js";
 import { applyPatchHarvestedInputUnclassified, fieldString, firstString, hintUninspectableLifecycleCommand, hookApplyPatchBodyPaths, hookApplyPatchBodyText, hookMcpArgsText, hookMutationTargetPaths, hookShellCommand, hookToolName, hookWriteTargetPath, hostIdentityFallsBackToExplicitOwner, inspectExactLifecycleCommand, inspectHintedLifecycleSessionId, landProcessOnlyFlagOnToolInput, missingToolNameMessage, normalizeMutationTargetPaths, record, resolveHookHostIdentity, rewriteExactLifecycleCommand, toolInputRecord, } from "./classify/index.js";
+import { GROK_SPAWN_WRITING_SKIP_CLASS_FIELD, PROCESS_ONLY_FLAG_KEYS } from "./classify/payload.js";
 import { defaultCursorPlanChoiceDeps, isCursorPlanChoiceManagedPath, storeDenyMessage, } from "./cursor-plan-choice/index.js";
 import { classifyGitDestructive, classifyProductDestForms, payloadWithInjectedWriteTarget, } from "./dest-form.js";
 import { decidePlanChoiceWithHatch, decideQuestionHatchGate, decideQuestionHatchPauseGate, decideSpendRecommendGate, } from "./dispatcher-plan-choice.js";
@@ -38,7 +39,7 @@ import { isLexicalOutsideProjectRoot, isOutsideProjectRootWrite } from "./outsid
 import { restampOwnerLivenessOnHookEvent, } from "./owner-liveness.js";
 import { appliesGrokSpawnDestContract, isAssistPosture, isEphemeralSpawn, isExploreSpawn, isProcessOnlyCriticSpawn, isReadOnlyHookContext, processOnlyCriticRequiresDest, SPAWN_CLASS_RECOVERY, SPAWN_READ_ONLY_RECOVERY, } from "./readonly.js";
 import { inspectActiveScope, POSITIVE_GOVERNING_ALLOW_REQUIRED, } from "./scope.js";
-import { classifyShellWriteTargets, isInRepoShellWritePath } from "./shell-write-targets.js";
+import { classifyShellWriteTargets, isInRepoShellWritePath, isKillSwitchShellWriteBasename, } from "./shell-write-targets.js";
 import { effectiveHookArgumentView, effectiveHookToolName, expectsLocalMutationDest, isApplyPatchTool, isDirectWriteTool, isKillTool, isMcpProxyWrapper, isMcpTool, isMcpWriteShaped, isShellTool, isSpawnTool, } from "./tools.js";
 // Pure parse/classify helpers are defined in ./classify/ and re-exported from
 // ./index.ts (#2950). Dispatcher is orchestration: classify → policy → decision.
@@ -100,7 +101,117 @@ function isLauncherFamilySpawnNotReady(input, toolName) {
     });
     return launcher.kind === "launcher" || launcher.kind === "compound";
 }
+function recordPayload4781(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : null;
+}
+function fieldString4781(input, key) {
+    const value = input[key];
+    if (typeof value === "string" && value.trim().length > 0)
+        return value.trim();
+    return null;
+}
+function toolInput4781(payload) {
+    return (recordPayload4781(payload.tool_input) ??
+        recordPayload4781(payload.toolInput) ??
+        recordPayload4781(payload.input) ??
+        recordPayload4781(payload.arguments) ??
+        payload);
+}
+function fieldTruthy4781(input, key) {
+    const value = input[key];
+    if (value === true)
+        return true;
+    if (typeof value === "number")
+        return value === 1;
+    if (typeof value === "string") {
+        const t = value.trim().toLowerCase();
+        return t === "1" || t === "true" || t === "yes" || t === "on";
+    }
+    return false;
+}
+/** Prefer-A #4781: process_only/plan marker present before implement-conflict gate. */
+function hasProcessOnlySkipMarker4781(payload) {
+    const input = recordPayload4781(payload);
+    if (input === null)
+        return false;
+    const toolInput = toolInput4781(input);
+    const subagentType = fieldString4781(toolInput, "subagent_type") ??
+        fieldString4781(toolInput, "subagentType") ??
+        fieldString4781(input, "subagent_type") ??
+        fieldString4781(input, "subagentType");
+    if (subagentType?.toLowerCase() === "plan")
+        return true;
+    if (GROK_SPAWN_WRITING_SKIP_CLASS_FIELD !== "process_only")
+        return false;
+    return PROCESS_ONLY_FLAG_KEYS.some((key) => fieldTruthy4781(toolInput, key) || fieldTruthy4781(input, key));
+}
+/** Prefer-A #4781: name suppressing implement field when present. */
+function namedImplementConflictSuppressor4781(payload) {
+    const input = recordPayload4781(payload);
+    if (input === null)
+        return null;
+    const toolInput = toolInput4781(input);
+    const driveTo = fieldString4781(toolInput, "drive_to") ??
+        fieldString4781(toolInput, "driveTo") ??
+        fieldString4781(toolInput, "drive-to") ??
+        fieldString4781(input, "drive_to") ??
+        fieldString4781(input, "driveTo") ??
+        fieldString4781(input, "drive-to");
+    if (driveTo !== null) {
+        const normalized = driveTo.toLowerCase().replace(/[_\s]/g, "-");
+        if (normalized === "merge-ready" ||
+            normalized === "merge" ||
+            normalized.startsWith("merge-") ||
+            normalized.includes("implement")) {
+            return "drive_to";
+        }
+    }
+    const workerRole = fieldString4781(toolInput, "worker_role") ??
+        fieldString4781(toolInput, "workerRole") ??
+        fieldString4781(input, "worker_role") ??
+        fieldString4781(input, "workerRole");
+    if (workerRole !== null) {
+        const role = workerRole.toLowerCase().replace(/[_\s]/g, "-");
+        if (role === "leaf-implementation" ||
+            role === "implementation" ||
+            role === "implement" ||
+            role.includes("implement")) {
+            return "worker_role";
+        }
+    }
+    const dispatchKind = fieldString4781(toolInput, "dispatch_kind") ??
+        fieldString4781(toolInput, "dispatchKind") ??
+        fieldString4781(input, "dispatch_kind") ??
+        fieldString4781(input, "dispatchKind");
+    if (dispatchKind !== null) {
+        const kind = dispatchKind.toLowerCase().replace(/[_\s]/g, "-");
+        if (kind === "swarm-cohort" || kind === "swarm-leaf" || kind.includes("implement")) {
+            return "dispatch_kind";
+        }
+    }
+    return null;
+}
+function processOnlyImplementConflictSuppressor4781(payload) {
+    if (!hasProcessOnlySkipMarker4781(payload))
+        return null;
+    return namedImplementConflictSuppressor4781(payload);
+}
+/** Prefer-A #4781: name implement-conflict suppressor when process_only is present but blocked. */
+function overlayProcessOnlyImplementConflictSuppressor(input, decision) {
+    if (decision.verdict !== "deny")
+        return decision;
+    const field = processOnlyImplementConflictSuppressor4781(input.payload);
+    if (field === null)
+        return decision;
+    const note = `process_only was suppressed by ${field} (implement conflict wins; not bare #2885).`;
+    if (decision.message.includes(note))
+        return decision;
+    return { ...decision, message: `${note} ${decision.message}` };
+}
 function overlayGrokCriticSpawnNotReadyRecovery(input, toolName, decision) {
+    decision = overlayProcessOnlyImplementConflictSuppressor(input, decision);
     if (decision.verdict !== "deny" || decision.code !== "spawn-not-ready")
         return decision;
     if (!appliesGrokSpawnDestContract({
@@ -827,6 +938,65 @@ function recordAuthzAudit(projectRoot, decision, state, seams) {
         // Audit write must not crash the host tool gate.
     }
 }
+/**
+ * Resolve as far as the filesystem allows: realpath existing prefixes even when
+ * the leaf is missing (dangling multi-hop symlink parents).
+ */
+function realpathExistingParents(absPath) {
+    try {
+        return realpathSync(absPath);
+    }
+    catch {
+        const parent = dirname(absPath);
+        if (parent === absPath)
+            return absPath;
+        return join(realpathExistingParents(parent), basename(absPath));
+    }
+}
+/**
+ * True when a kill-switch plant path realpath-resolves under `.deft/authz/` or
+ * `.deft/approved-scope/` (symlink alias). Does not treat the flag basename
+ * itself as an inventoried-store hit (#6136 Greptile).
+ * Dangling symlinks: resolve link text, then realpath existing parent dirs so a
+ * directory alias into the store is not missed (#6158 Greptile P1).
+ */
+function killSwitchPlantResolvesToInventoriedAuthzStore(projectRoot, relOrAbsPath) {
+    const root = resolve(projectRoot);
+    const target = isAbsolute(relOrAbsPath)
+        ? resolve(relOrAbsPath)
+        : resolve(root, relOrAbsPath.replace(/\\/g, "/"));
+    let resolved;
+    try {
+        resolved = realpathSync(target);
+    }
+    catch {
+        try {
+            const st = lstatSync(target);
+            if (!st.isSymbolicLink())
+                return false;
+            const link = readlinkSync(target);
+            const candidate = isAbsolute(link) ? resolve(link) : resolve(dirname(target), link);
+            resolved = realpathExistingParents(candidate);
+        }
+        catch {
+            return false;
+        }
+    }
+    let rootReal;
+    try {
+        rootReal = realpathSync(root);
+    }
+    catch {
+        return false;
+    }
+    const rel = relative(rootReal, resolved).split(sep).join("/").replace(/\\/g, "/").toLowerCase();
+    if (rel.length === 0 || rel.startsWith(".."))
+        return false;
+    return (rel === ".deft/authz" ||
+        rel.startsWith(".deft/authz/") ||
+        rel === ".deft/approved-scope" ||
+        rel.startsWith(".deft/approved-scope/"));
+}
 /**
  * UAT lease + human-origin grant gate (#2944). Returns deny decision or null when allowed.
  * Composes before runtimeAuthority path/scope checks for direct writes and shell/MCP.
@@ -853,6 +1023,7 @@ function authzForMutation(input, toolName, seams, options) {
         shellCommand,
         isDirectWrite: options.isDirectWrite,
         mcpArgsText: options.isDirectWrite ? null : hookMcpArgsText(input.payload),
+        writePath: options.isDirectWrite ? options.relPath : null,
     });
     // #4188: realpath recovered dest-of-write against payload root. Lexical
     // classify stays I/O-free; a non-shell symlink dest is grant-immune unknown.
@@ -881,9 +1052,24 @@ function authzForMutation(input, toolName, seams, options) {
         branch = null;
     }
     const repo = (process.env.DEFT_AUTHZ_REPO ?? process.env.GITHUB_REPOSITORY ?? "").trim() || null;
+    // #6136: kill-switch / permanent opt-out plant is always-on grant-gated (not UAT-only).
+    const killSwitchPlant = (shellCommand !== null && hasKillSwitchShellWrite(shellCommand)) ||
+        (options.isDirectWrite && options.relPath !== null && isKillSwitchPlantPath(options.relPath));
+    // Symlink plant of a kill-switch basename into `.deft/authz/` / approved-scope
+    // must not ride a settings grant (settings op skips isProtectedStoreEditDest).
+    // Plain flag basenames are themselves "protected" in relIsProtectedDirectiveDest;
+    // only deny when realpath lands under the inventoried store dirs (#6136 Greptile).
+    if (killSwitchPlant &&
+        options.isDirectWrite &&
+        options.relPath !== null &&
+        killSwitchPlantResolvesToInventoriedAuthzStore(projectRoot, options.relPath)) {
+        return deny(input, "authz-uat-deny", toolName, "Directive denied kill-switch plant: path resolves into the inventoried authz " +
+            "store (`.deft/authz/` or `.deft/approved-scope/`). A settings grant does not " +
+            "authorize rewriting approval state through a flag symlink (#6136).", options.scopePath);
+    }
     // Evaluate each op; first deny wins (compound shell must not short-circuit).
     for (const op of ops) {
-        const decision = evaluateAuthzMutation({
+        let decision = evaluateAuthzMutation({
             state,
             grants,
             op,
@@ -892,6 +1078,48 @@ function authzForMutation(input, toolName, seams, options) {
             repo,
             worktree: projectRoot,
         });
+        // Outside UAT, settings (and kill-switch Write classified as settings) would
+        // authz-inactive allow. Re-evaluate under a synthetic human-origin UAT so the
+        // existing grant gate applies without widening evaluate.ts (#6136).
+        if (killSwitchPlant &&
+            decision.allowed &&
+            decision.code === "authz-inactive" &&
+            (op === "settings" || op === "edit")) {
+            decision = evaluateAuthzMutation({
+                state: {
+                    ...state,
+                    uat: {
+                        active: true,
+                        campaignId: "always-on-kill-switch-plant",
+                        startedAt: "1970-01-01T00:00:00.000Z",
+                        startedBy: {
+                            kind: "operator-cli",
+                            actor: "directive-always-on-kill-switch",
+                            mintedAt: "1970-01-01T00:00:00.000Z",
+                            mintedVia: "cli",
+                            eventRef: null,
+                        },
+                        suspendedAt: null,
+                        note: "synthetic lease for always-on kill-switch plant grant gate (#6136)",
+                    },
+                },
+                grants,
+                op: "settings",
+                path: options.relPath,
+                branch,
+                repo,
+                worktree: projectRoot,
+            });
+            if (!decision.allowed) {
+                decision = {
+                    ...decision,
+                    reason: "Directive denied kill-switch / permanent opt-out plant without a human-origin " +
+                        "settings grant (#6136). Agents must not self-serve `.deft-directive-disable` or " +
+                        "`.no-deft-directive`. Human action required: plant outside an agent session, or " +
+                        "run `deft authz:grant` covering settings for this cohort.",
+                };
+            }
+        }
         recordAuthzAudit(projectRoot, decision, state, seams);
         if (!decision.allowed) {
             return deny(input, authzCodeToHook(decision.code), toolName, decision.reason, options.scopePath);
@@ -1083,6 +1311,8 @@ function inspectMutationGates(input, toolName, seams, options) {
                 scopePath: null,
                 runGit: dispatchGit,
                 projectRoot,
+                deferGrantConsume: options.deferGrantConsume === true,
+                pendingConsumeOut: options.pendingConsumeOut,
             });
             if (authzDeny !== null)
                 return authzDeny;
@@ -1194,6 +1424,8 @@ function inspectMutationGates(input, toolName, seams, options) {
                 scopePath: null,
                 runGit: dispatchGit,
                 projectRoot,
+                deferGrantConsume: options.deferGrantConsume === true,
+                pendingConsumeOut: options.pendingConsumeOut,
             });
             if (authzDeny !== null)
                 return authzDeny;
@@ -1453,10 +1685,11 @@ function inspectMutationGates(input, toolName, seams, options) {
                         "`worker_role`/`subagent_type` ∈ {ephemeral, docs, assist} (hosts that support them), " +
                         "or set session assist (`DEFT_SESSION_POSTURE=assist` or `DEFT_HOOK_ASSIST=1`), " +
                         "or run local-dev Shell (`docker compose` / `pnpm dev`) in the parent without a " +
-                        "lifecycle story. (4) Process-only critic — spawn with structural `subagent_type` " +
-                        "plan or `process_only` (Grok PreToolUse stdin). Dest-path is not that class. " +
-                        "Free-text markers such as `[worker_role: ephemeral]` or naming critic in the prompt " +
-                        "are NOT sufficient. Do not invent a fake scope only to satisfy this gate.";
+                        "lifecycle story. (4) Process-only critic / review-monitor / validation seat — spawn with " +
+                        "structural `subagent_type` plan or `process_only` (Grok PreToolUse stdin) plus dest cwd " +
+                        "for watch/report seats. Dest-path is not that class. Free-text markers such as " +
+                        "`[worker_role: ephemeral]` or naming critic in the prompt are NOT sufficient. Do not " +
+                        "invent a fake scope only to satisfy this gate.";
             }
             else if (options.proposedLifecycleExempt &&
                 relTarget !== null &&
@@ -1539,7 +1772,7 @@ function inspectMutationGates(input, toolName, seams, options) {
     };
     if (!isSpawnTool(toolName)) {
         // Wave 1 authz (UAT lease + human-origin grant) before runtimeAuthority (#2944 / #2948 L1–L2).
-        const pendingGrantConsume = [];
+        const pendingGrantConsume = options.pendingConsumeOut ?? [];
         const authzDeny = authzForMutationTargets(input, toolName, seams, {
             isDirectWrite: true,
             scopePath: scope.path,
@@ -1556,7 +1789,12 @@ function inspectMutationGates(input, toolName, seams, options) {
         const runtimeDeny = runtimeAuthorityForDirectWrite(input, toolName, seams, scope.path, effectiveRoot);
         if (runtimeDeny !== null)
             return runtimeDeny;
-        consumePendingSingleUseGrants(projectRoot, pendingGrantConsume);
+        // Shell write-reissue may defer spend so decideShellOrMcpRuntimeAuthority can
+        // reuse the same single-use grant (#6136 Greptile P1). When pendingConsumeOut
+        // is the same bag, authz already recorded refs — do not push twice.
+        if (options.deferGrantConsume !== true) {
+            consumePendingSingleUseGrants(projectRoot, pendingGrantConsume);
+        }
         // Intentional product-write allow: Prefer-A durable marker (#5176 / #4544).
         const occupancyDeny = recheckOccupancyBeforeWriteAllow(true);
         if (occupancyDeny !== null)
@@ -1812,29 +2050,37 @@ function decideGitDestructive(input, toolName) {
 /**
  * Authorize recognized in-repo Shell file-write dests through inspectMutationGates (#3983 / #3987).
  * Deny is returned; allow falls through so dest-forms and push/merge still run.
+ * Kill-switch basenames are checked before the in-repo skip so out-of-tree plants
+ * cannot fail-open (#6136 Prefer-A Bound limb 2).
  */
-function decideShellWriteReissue(input, toolName, seams, observation) {
+function decideShellWriteReissue(input, toolName, seams, observation, pendingConsumeOut) {
     const command = hookShellCommand(input.payload);
     if (command === null)
         return null;
     const projectRoot = resolve(input.projectRoot);
     for (const dest of classifyShellWriteTargets(command)) {
+        const killSwitchDest = isKillSwitchShellWriteBasename(dest.path);
         if (dest.unprovable === true) {
-            if (!isInRepoShellWritePath(projectRoot, dest.path))
+            if (!killSwitchDest && !isInRepoShellWritePath(projectRoot, dest.path))
                 continue;
             return deny(input, "scope-not-ready", toolName, "Directive denied " +
                 toolName +
                 ": Shell write dest is not reconstructable (compound command). Use one simple command or Edit/Write.");
         }
-        if (!isInRepoShellWritePath(projectRoot, dest.path))
+        // #6136: protected basename before isInRepoShellWritePath skip.
+        if (!killSwitchDest && !isInRepoShellWritePath(projectRoot, dest.path))
             continue;
         const destInput = {
             ...input,
             payload: payloadWithInjectedWriteTarget(input.payload, dest.path),
         };
+        // Defer single-use spend into pendingConsumeOut; caller spends after the whole
+        // shell call allows so ordinary edit grants are not reusable (#6136 Greptile).
         const destDecision = inspectMutationGates(destInput, toolName, seams, {
             proposedLifecycleExempt: true,
             observation,
+            deferGrantConsume: true,
+            pendingConsumeOut,
         });
         if (destDecision.verdict === "deny")
             return destDecision;
@@ -2287,12 +2533,15 @@ function tryPublishApplyingHostFromSessionStart(input, projectRoot) {
         const transport = identity.provider === "grok" && environ.GROK_HOOK_EVENT?.trim()
             ? "grok-hook-event"
             : "native";
+        // SessionStart soft claim may take over a no-lease different-provider record
+        // (#6143 P1/P4); RO CLI path must omit allowForeignTakeover.
         // Native Cursor SessionStart must stay cursor even when GROK_SESSION_ID lingers.
         if (input.host === "cursor" && transport === "native") {
             publishApplyingHost(projectRoot, {
                 provider: "cursor",
                 rawSessionId: identity.rawSessionId,
                 transport: "native",
+                allowForeignTakeover: true,
             });
             return;
         }
@@ -2300,6 +2549,7 @@ function tryPublishApplyingHostFromSessionStart(input, projectRoot) {
             provider: identity.provider,
             rawSessionId: identity.rawSessionId,
             transport,
+            allowForeignTakeover: true,
         });
     }
     catch {
@@ -2386,6 +2636,8 @@ function attachLifecycleIdentityRewrite(input, toolName, decision, seams) {
                         : "native";
                     // Prefer deposit identity when it matches the named canonical owner.
                     const identity = resolveHookHostIdentity(input.host, input.payload, environ);
+                    // #6143 P4: RO SessionStart must not displace a different-provider fresh
+                    // record (omit allowForeignTakeover; publish defers foreign-fresh-claim).
                     if (identity.status === "ok" &&
                         identity.sessionId === lifecycle.sessionId &&
                         // Leftover GROK_SESSION_ID alone must not publish Cursor as Claude/grok.
@@ -2447,7 +2699,17 @@ function attachLifecycleIdentityRewrite(input, toolName, decision, seams) {
         return denyIdentity("occupancy-identity-conflict", applyingAdmission.message);
     }
     let liveOwnerBypass = false;
-    if (applyingAdmission.kind === "foreign-owner") {
+    if (applyingAdmission.kind === "live-owner-cleanup") {
+        // Deposit equals live lease holder (#6101 Prefer-A): effectiveOwner is the
+        // live deposit identity; bare stays on the rewrite path (not soft-pass).
+        liveOwnerBypass = true;
+    }
+    else if (applyingAdmission.kind === "advisory-takeover") {
+        // #6143 P1: no-lease fresh applying-host is advisory; caller keeps identity
+        // and may republish after lifecycle succeeds.
+        liveOwnerBypass = true;
+    }
+    else if (applyingAdmission.kind === "foreign-owner") {
         const live = liveOccupant(resolve(input.projectRoot));
         if (live !== null && live.sessionId === identity.sessionId) {
             // Applying-host was replaced by another SessionStart; keep live lease owner
@@ -2568,6 +2830,14 @@ function prepareProcessOnlyDestPath(destPath, projectRoot, seams, payload) {
             destPath,
             againstImplementationSha: against,
         });
+        // Strict false only: legacy success mocks may omit `ok` and still carry `record` (#6100).
+        if (prepared.ok === false) {
+            return {
+                ok: false,
+                message: `Directive denied process-only critic spawn: dest prepare failed: ${prepared.code}: ${prepared.message}. ` +
+                    "Parent must fetch origin and create or verify the dest at origin/<default> before spawn.",
+            };
+        }
         return { ok: true, record: prepared.record };
     }
     catch (cause) {
@@ -3008,11 +3278,15 @@ function routeHookDecision(input, seams, observation) {
         if (prospective !== null) {
             return remapProxyShellUpdatedInput(input.payload, toolName, shellProxyUnwrap, attachLifecycleIdentityRewrite(shellInput, shellToolName, prospective, seams));
         }
-        const writeReissue = decideShellWriteReissue(shellInput, shellToolName, seams, observation);
+        const pendingShellGrantConsume = [];
+        const writeReissue = decideShellWriteReissue(shellInput, shellToolName, seams, observation, pendingShellGrantConsume);
         if (writeReissue !== null) {
             return remapProxyShellUpdatedInput(input.payload, toolName, shellProxyUnwrap, attachLifecycleIdentityRewrite(shellInput, shellToolName, writeReissue, seams));
         }
         const decision = decideShellDestFormsThenRuntimeAuthority(shellInput, shellToolName, seams, observation);
+        if (decision.verdict === "allow") {
+            consumePendingSingleUseGrants(resolve(shellInput.projectRoot), pendingShellGrantConsume);
+        }
         return remapProxyShellUpdatedInput(input.payload, toolName, shellProxyUnwrap, attachLifecycleIdentityRewrite(shellInput, shellToolName, decision, seams));
     }
     // Host kill deny-class / attestation gate (#5281 Prefer-A Bound).