@iowarp/clio-coder 0.4.9 → 0.5.0

package/src/tools/file-mutation-queue.ts

@@ -1,30 +1,31 @@
 import { randomUUID } from "node:crypto";
-import { lstatSync, readlinkSync, realpathSync } from "node:fs";
-import { lstat, mkdir, open, readlink, realpath, rename, stat, unlink } from "node:fs/promises";
-import { basename, dirname, join, resolve } from "node:path";
+import { lstat, mkdir, open, realpath, rename, stat, unlink } from "node:fs/promises";
+import { basename, dirname, join } from "node:path";
+import { canonicalizeRawPath } from "../core/path-canonical.js";
 
 const fileMutationQueues = new Map<string, Promise<void>>();
 
-function mutationQueueKey(filePath: string, depth = 0): string {
-	const resolved = resolve(filePath);
-	if (depth > 40) throw new Error("Too many symbolic links");
-	try {
-		return realpathSync.native(resolved);
-	} catch {
-		try {
-			if (lstatSync(resolved).isSymbolicLink()) {
-				return mutationQueueKey(resolve(dirname(resolved), readlinkSync(resolved)), depth + 1);
-			}
-		} catch {
-			// Missing paths still share a key through the nearest real ancestor.
-		}
-		const parent = dirname(resolved);
-		return parent === resolved ? resolved : join(mutationQueueKey(parent, depth), basename(resolved));
+/**
+ * Where a mutation of filePath lands: the walk safety admission uses, so the
+ * queue key and the published file are the path admission judged. Throws,
+ * before anything is read or written, when that walk cannot finish.
+ */
+function physicalTarget(filePath: string): string {
+	const target = canonicalizeRawPath(filePath, process.cwd());
+	if (target === null) {
+		throw new Error(`Refusing unresolvable target (a symbolic link loop or more than 40 links): ${filePath}`);
 	}
+	return target;
 }
 
-export async function withFileMutationQueue<T>(filePath: string, fn: () => Promise<T>): Promise<T> {
-	const key = mutationQueueKey(filePath);
+/**
+ * Serializes in-process mutations of one physical file. A caller that walked
+ * filePath in the same synchronous step passes the result as physical, and the
+ * key reuses it: nothing can run between that walk and this one. publish still
+ * walks again, because the queue wait and the tool's own reads come between.
+ */
+export async function withFileMutationQueue<T>(filePath: string, fn: () => Promise<T>, physical?: string): Promise<T> {
+	const key = physical ?? physicalTarget(filePath);
 	const currentQueue = fileMutationQueues.get(key) ?? Promise.resolve();
 
 	let releaseNext!: () => void;
@@ -62,14 +63,12 @@ export interface AtomicPublishOptions {
 	rename?: (tempPath: string, targetPath: string) => Promise<void>;
 }
 
-async function resolvePublishTarget(filePath: string, depth = 0): Promise<string> {
-	if (depth > 40) throw new Error("Too many symbolic links");
-	const absolute = resolve(filePath);
+async function resolvePublishTarget(filePath: string): Promise<string> {
+	// Every link on the way is already followed, so a link here was swapped in
+	// after resolution and is refused as a non-file rather than followed.
+	const absolute = physicalTarget(filePath);
 	try {
 		const info = await lstat(absolute);
-		if (info.isSymbolicLink()) {
-			return resolvePublishTarget(resolve(dirname(absolute), await readlink(absolute)), depth + 1);
-		}
 		if (!info.isFile()) throw new Error(`Refusing non-file target (including directories): ${filePath}`);
 	} catch (error) {
 		if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;

package/src/tools/gateway/clio-context-surface.ts

@@ -24,7 +24,7 @@ export const clioDocsToolSurface = {
 export const clioLibraryToolSurface = {
 	name: ToolNames.ClioLibrary,
 	description:
-		"Read the recipe catalog: installed skills, agents, prompts, and fleets with their owner and invocation, plus installable packages. Body-free rows, bounded pages; activates and installs nothing. Unavailable inside a worker.",
+		"Read the recipe catalog: discovered and installed skills, agents, prompts, and fleets with their owner and invocation, plus installable packages. Body-free rows, bounded pages; activates and installs nothing. Unavailable inside a worker.",
 	parameters: Type.Object({
 		query: Type.Optional(Type.String({ description: "Name, owner, or description terms." })),
 		kind: Type.Optional(

package/src/tools/gateway/index.ts

@@ -142,8 +142,12 @@ function autonomyNote(actionClass: ActionClass): string {
 export function createGatewayTool(deps: GatewayToolDeps): ToolSpec {
 	const { registry } = deps;
 
-	const allowedSet = (options: ToolInvokeOptions | undefined): ReadonlySet<string> | null =>
-		options?.allowedTools ? new Set<string>(options.allowedTools) : null;
+	const allowedSet = (options: ToolInvokeOptions | undefined): ReadonlySet<string> | null => {
+		const run = options?.allowedTools;
+		const turn = options?.turnConstraints?.allowedTools;
+		if (run === undefined && turn === undefined) return null;
+		return new Set((run ?? turn ?? []).filter((name) => turn === undefined || turn.includes(name)));
+	};
 
 	const resolveCapability = async (
 		name: string,
@@ -173,7 +177,7 @@ export function createGatewayTool(deps: GatewayToolDeps): ToolSpec {
 
 	const outsideSurface = (name: string, allowed: ReadonlySet<string>): ToolResult => ({
 		kind: "error",
-		message: `gateway: capability "${name}" is not on this run's admitted tool surface (${[...allowed].sort().join(", ")}); the recipe did not declare it, so the gateway refuses to call it`,
+		message: `gateway: capability "${name}" is not on this run's admitted tool surface (${[...allowed].sort().join(", ")}); the recipe or explicit task scope excludes it`,
 	});
 
 	const runFind = async (args: Record<string, unknown>, options: ToolInvokeOptions | undefined): Promise<ToolResult> => {

package/src/tools/gateway/mcp-capabilities.ts

@@ -83,7 +83,7 @@ export interface McpCapabilitySource {
 	/** One sentence of provenance and authority for describe, or null for a name this source does not own. */
 	authorityNote(name: string): string | null;
 	/** Ids of the servers launched this session and still open. */
-	connectedIds(): string[];
+	connectedIds(options?: { readyOnly?: boolean }): string[];
 	/**
 	 * Close every launched client. Idempotent. A process group that survived
 	 * the client's own SIGKILL is reported here and on stderr, with its pgid,
@@ -440,8 +440,10 @@ export function createMcpCapabilitySource(options: McpCapabilitySourceOptions):
 						: "calls run as reads at every autonomy level"
 			}. Launching the server does not sandbox it.`;
 		},
-		connectedIds() {
-			return [...(states?.values() ?? [])].filter((state) => state.client !== null).map((state) => state.declaration.id);
+		connectedIds(options) {
+			return [...(states?.values() ?? [])]
+				.filter((state) => state.client !== null && (!options?.readyOnly || state.client.state().status === "ready"))
+				.map((state) => state.declaration.id);
 		},
 		teardownReports() {
 			return [...teardowns];

package/src/tools/grep.ts

@@ -95,6 +95,18 @@ interface GrepRenderInput {
 
 const NO_MATCH_OUTPUT = "No matches found";
 
+/**
+ * The string in one of rg's JSON "arbitrary data" objects. rg writes `text`
+ * when the bytes are valid UTF-8 and base64 `bytes` when they are not, so a
+ * match on a Latin-1 line arrives without `text`. It decodes the way the
+ * fallback reads a file: invalid sequences become U+FFFD and the line shows.
+ */
+function rgJsonText(field: unknown): string | undefined {
+	if (!field || typeof field !== "object") return undefined;
+	const { text, bytes } = field as { text?: unknown; bytes?: unknown };
+	if (typeof text === "string") return text;
+	return typeof bytes === "string" ? Buffer.from(bytes, "base64").toString("utf8") : undefined;
+}
 /**
  * Shared shaping for the rg and fallback paths: byte-cap the rendered lines at
  * the reservation cap (never mid-line), recount shown items, offload the full
@@ -219,9 +231,9 @@ async function runRipgrep(input: RgSearchInput): Promise<ToolResult> {
 		const type = (event as { type?: unknown }).type;
 		if (type !== "match" && type !== "context") return;
 		const data = (event as { data?: Record<string, unknown> }).data;
-		const filePath = (data?.path as { text?: unknown } | undefined)?.text;
+		const filePath = rgJsonText(data?.path);
 		const lineNumber = data?.line_number;
-		const lineText = (data?.lines as { text?: unknown } | undefined)?.text;
+		const lineText = rgJsonText(data?.lines);
 		if (typeof filePath !== "string" || typeof lineNumber !== "number" || typeof lineText !== "string") return;
 		if (!input.pathFilter.allows(filePath)) return;
 		const { text, wasTruncated } = truncateLine(sanitizeMatchText(lineText));

package/src/tools/ls.ts

@@ -113,10 +113,7 @@ export const lsTool: ToolSpec = {
 		commitObservationReservation(reservation);
 		try {
 			const policy = options?.allowsObservationPath ? undefined : createSafetyPolicyEngine({ cwd: process.cwd() });
-			const allows =
-				options?.allowsObservationPath ??
-				((entryPath: string) =>
-					policy?.evaluate({ tool: "read", args: { path: entryPath } }).reasonCode !== "path-policy:zeroAccessPaths");
+			const allows = options?.allowsObservationPath ?? ((entryPath: string) => policy?.readablePath(entryPath) !== false);
 			let withheldPaths = 0;
 			let visibleCount = 0;
 			let scanned = 0;

package/src/tools/monitor.ts

@@ -28,7 +28,13 @@ import type { DispatchRunEventRegistry } from "./dispatch.js";
 import { monitorToolSurface } from "./monitor-surface.js";
 import type { ToolInvokeOptions, ToolResult, ToolSpec } from "./registry.js";
 import { truncateUtf8 } from "./truncate-utf8.js";
-import { receiptEvidenceLabels, workerTextLabel, workerTextNonEvidenceNotices } from "./worker-evidence.js";
+import {
+	compactHelperResultLines,
+	receiptEvidenceLabels,
+	receiptHelperResult,
+	workerTextLabel,
+	workerTextNonEvidenceNotices,
+} from "./worker-evidence.js";
 
 /**
  * The monitor tool: read-only visibility into known synchronous and detached
@@ -569,6 +575,10 @@ function failedIntegrityReason(integrity: ReceiptIntegrityResult): string {
 }
 
 function collectRunLine(row: CollectedRunRow): string[] {
+	if (row.evidence.receipt !== null) {
+		const helperLines = compactHelperResultLines(row.evidence.receipt, row.evidence.integrity, COLLECT_TEXT_BYTES);
+		if (helperLines !== null) return helperLines;
+	}
 	const run = row.run;
 	const lines = run
 		? [
@@ -743,7 +753,10 @@ async function runCollect(
 			failedCount: failed.length,
 			runs: collectedRows.map((row) => {
 				const output = row.evidence.output;
+				const helperResult =
+					row.evidence.receipt === null ? null : receiptHelperResult(row.evidence.receipt, row.evidence.integrity);
 				return {
+					...(helperResult !== null ? { helperResult } : {}),
 					runId: row.runId,
 					...(row.assignmentId !== null
 						? {

package/src/tools/observation.ts

@@ -494,9 +494,7 @@ export function createObservationPathFilter(
 	readonly withheldPaths: number;
 } {
 	const policy = allowsPath ? undefined : createSafetyPolicyEngine({ cwd });
-	const allows =
-		allowsPath ??
-		((path: string) => policy?.evaluate({ tool: "read", args: { path } }).reasonCode !== "path-policy:zeroAccessPaths");
+	const allows = allowsPath ?? ((path: string) => policy?.readablePath(path) !== false);
 	const withheld = new Set<string>();
 	return {
 		allows(path) {

package/src/tools/path-utils.ts

@@ -1,7 +1,7 @@
 import { accessSync, constants } from "node:fs";
 import { homedir } from "node:os";
-import { isAbsolute, resolve as resolvePath, sep } from "node:path";
-import { canonicalizeExistingPath } from "../core/path-canonical.js";
+import { isAbsolute, sep } from "node:path";
+import { canonicalizeRawPath } from "../core/path-canonical.js";
 
 /**
  * Render a path with forward slashes for a tool's observation.
@@ -46,34 +46,67 @@ function tryCurlyQuoteVariant(filePath: string): string {
 	return filePath.replace(/'/g, "\u2019");
 }
 
+/**
+ * The spelling changes every path-taking tool applies before it resolves a
+ * path: a leading `@` is dropped and Unicode spaces become plain ones. Safety
+ * admission applies the same changes first, so it judges the path the tool
+ * opens: `@../x` is `../x`, not a directory named `@..`.
+ */
+export function normalizeToolPath(filePath: string): string {
+	return normalizeUnicodeSpaces(normalizeAtPrefix(filePath));
+}
+
 export function expandPath(filePath: string): string {
-	const normalized = normalizeUnicodeSpaces(normalizeAtPrefix(filePath));
+	const normalized = normalizeToolPath(filePath);
 	if (normalized === "~") return homedir();
 	if (normalized.startsWith("~/")) return homedir() + normalized.slice(1);
 	return normalized;
 }
 
+/**
+ * Where the kernel lands a path, resolved by the same walk safety admission
+ * uses, so the file a tool touches is the file admission judged: `link/..`
+ * steps up from the link's target, not from the link's own directory. A path
+ * that cannot be canonicalized comes back joined but not normalized, so the
+ * syscall that follows fails on it the way the kernel would and a mutation
+ * refuses it.
+ */
 export function resolveToCwd(filePath: string, cwd: string = process.cwd()): string {
+	return resolveMutationTarget(filePath, cwd).path;
+}
+
+/**
+ * resolveToCwd, plus the physical target when the walk finished. A mutation
+ * passes physical to withFileMutationQueue in the same synchronous step, so
+ * the queue keys the path this walk found instead of walking it again.
+ */
+export function resolveMutationTarget(
+	filePath: string,
+	cwd: string = process.cwd(),
+): { path: string; physical: string | undefined } {
 	const expanded = expandPath(filePath);
-	const resolved = isAbsolute(expanded) ? resolvePath(expanded) : resolvePath(cwd, expanded);
-	return canonicalizeExistingPath(resolved);
+	const physical = canonicalizeRawPath(expanded, cwd);
+	if (physical !== null) return { path: physical, physical };
+	return { path: isAbsolute(expanded) ? expanded : `${cwd}${sep}${expanded}`, physical: undefined };
+}
+
+/**
+ * The other spellings resolveReadPath tries, in order, when the resolved path
+ * does not exist: the macOS screenshot AM/PM space, NFD, a curly apostrophe,
+ * and NFD with the curly apostrophe. Read admission judges each of them too,
+ * because any of them can name a link the plain spelling does not.
+ */
+export function readPathVariants(resolved: string): string[] {
+	const nfd = tryNfdVariant(resolved);
+	const variants = [tryMacOSScreenshotPath(resolved), nfd, tryCurlyQuoteVariant(resolved), tryCurlyQuoteVariant(nfd)];
+	return [...new Set(variants)].filter((variant) => variant !== resolved);
 }
 
 export function resolveReadPath(filePath: string, cwd: string = process.cwd()): string {
 	const resolved = resolveToCwd(filePath, cwd);
 	if (fileExists(resolved)) return resolved;
-
-	const amPmVariant = tryMacOSScreenshotPath(resolved);
-	if (amPmVariant !== resolved && fileExists(amPmVariant)) return amPmVariant;
-
-	const nfdVariant = tryNfdVariant(resolved);
-	if (nfdVariant !== resolved && fileExists(nfdVariant)) return nfdVariant;
-
-	const curlyVariant = tryCurlyQuoteVariant(resolved);
-	if (curlyVariant !== resolved && fileExists(curlyVariant)) return curlyVariant;
-
-	const nfdCurlyVariant = tryCurlyQuoteVariant(nfdVariant);
-	if (nfdCurlyVariant !== resolved && fileExists(nfdCurlyVariant)) return nfdCurlyVariant;
-
+	for (const variant of readPathVariants(resolved)) {
+		if (fileExists(variant)) return variant;
+	}
 	return resolved;
 }

package/src/tools/process-lease.ts

@@ -0,0 +1,99 @@
+/**
+ * A durable claim's proof of which process owns it, shared by the compete
+ * groups and the task worktrees. The lease names the host, the PID, and a
+ * PID-reuse-resistant birth token, so restart recovery can tell a dead owner
+ * from a live one and from an unrelated process that inherited the PID.
+ */
+
+import { execFileSync } from "node:child_process";
+import { readFileSync } from "node:fs";
+import { hostname } from "node:os";
+
+export interface ProcessLease {
+	host: string;
+	pid: number;
+	birthToken: string | null;
+}
+
+export interface ProcessSnapshot {
+	alive: boolean;
+	birthToken: string | null;
+}
+
+/**
+ * Return a PID-reuse-resistant process identity where the host exposes one.
+ * Linux's kernel start ticks are stable for the lifetime of a process. The
+ * portable fallback uses `ps` start time; if neither is available we retain
+ * liveness but refuse to signal a live PID during restart recovery.
+ */
+export function processSnapshot(pid: number): ProcessSnapshot {
+	if (!Number.isSafeInteger(pid) || pid <= 0) return { alive: false, birthToken: null };
+	try {
+		process.kill(pid, 0);
+	} catch (err) {
+		if ((err as NodeJS.ErrnoException).code !== "EPERM") return { alive: false, birthToken: null };
+	}
+
+	try {
+		const stat = readFileSync(`/proc/${pid}/stat`, "utf8").trim();
+		const close = stat.lastIndexOf(")");
+		if (close > 0) {
+			// Fields after the command name start at kernel field 3. Field 3 is
+			// process state and field 22 (index 19 here) is starttime in ticks.
+			const fields = stat
+				.slice(close + 1)
+				.trim()
+				.split(/\s+/u);
+			if (fields[0] === "Z") return { alive: false, birthToken: fields[19] ?? null };
+			const startTicks = fields[19];
+			if (startTicks !== undefined && /^\d+$/u.test(startTicks)) {
+				return { alive: true, birthToken: `linux:${startTicks}` };
+			}
+		}
+	} catch {
+		// Non-Linux host or procfs unavailable; try the portable fallback.
+	}
+
+	try {
+		const started = execFileSync("ps", ["-o", "lstart=", "-p", String(pid)], {
+			encoding: "utf8",
+			stdio: ["ignore", "pipe", "ignore"],
+			timeout: 2_000,
+		}).trim();
+		if (started.length > 0) return { alive: true, birthToken: `ps:${started}` };
+	} catch {
+		// The PID exists, but it cannot be identified strongly enough to kill.
+	}
+	return { alive: true, birthToken: null };
+}
+
+export function currentProcessLease(): ProcessLease {
+	return {
+		host: hostname(),
+		pid: process.pid,
+		birthToken: processSnapshot(process.pid).birthToken,
+	};
+}
+
+export function validProcessLease(value: unknown): value is ProcessLease {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+	const lease = value as Record<string, unknown>;
+	return (
+		typeof lease.host === "string" &&
+		lease.host.length > 0 &&
+		typeof lease.pid === "number" &&
+		Number.isSafeInteger(lease.pid) &&
+		lease.pid > 0 &&
+		(lease.birthToken === null || typeof lease.birthToken === "string")
+	);
+}
+
+export function ownerIsAlive(owner: ProcessLease): boolean {
+	if (owner.host !== hostname()) return true;
+	const snapshot = processSnapshot(owner.pid);
+	if (!snapshot.alive) return false;
+	// A null identity cannot distinguish PID reuse, so preserving is the only
+	// safe choice. Supported hosts normally provide a token above.
+	if (owner.birthToken === null || snapshot.birthToken === null) return true;
+	return owner.birthToken === snapshot.birthToken;
+}

package/src/tools/read.ts

@@ -352,7 +352,7 @@ function beyondEndOfFile(offset: number, totalLines: number, file: ReadFileIdent
 			`read: offset ${offset} is beyond end of file (${totalLines} lines total). The file ends at line ` +
 			`${totalLines} and has no further content; do not page past it or re-read the tail. A read covering ` +
 			`line ${totalLines} has already returned everything.`,
-		details: { file },
+		details: { file, code: "read_past_eof", totalLines },
 	};
 }
 

package/src/tools/registry.ts

@@ -9,6 +9,7 @@ import {
 	type SkillToolSurfaceViolation,
 } from "../core/skill-activation.js";
 import { type ToolName, ToolNames } from "../core/tool-names.js";
+import { type TurnConstraints, turnAllowsTool } from "../core/turn-constraints.js";
 import { containsInstructionMarkers, INSTRUCTION_SHAPED_WARNING } from "../core/untrusted-content.js";
 import type { MiddlewareContract } from "../domains/middleware/contract.js";
 import type { MiddlewareEffect, MiddlewareHookInput, MiddlewareMetadataValue } from "../domains/middleware/types.js";
@@ -230,6 +231,8 @@ export interface RegistryDeps {
 }
 
 export interface ToolInvokeOptions {
+	/** Host-owned task scope, preserved on nested gateway calls. */
+	turnConstraints?: TurnConstraints;
 	/** Registry-owned filter bound to the active compiled safety policy. */
 	allowsObservationPath?: (path: string) => boolean;
 	/** Trusted submitting host identity for nested dispatch; never model arguments. */
@@ -446,7 +449,19 @@ export interface ToolRegistry {
 
 export type RegistryVerdict =
 	| { kind: "ok"; result: ToolResult; decision: SafetyDecision }
-	| { kind: "blocked"; reason: string; decision: SafetyDecision }
+	| {
+			kind: "blocked";
+			reason: string;
+			decision: SafetyDecision;
+			/**
+			 * The call parked for approval and the park was answered without one:
+			 * denied (by an operator, or by a headless run that has none) or
+			 * cancelled. Set by `parkAnsweredBlockedVerdict` only. Consumers key on
+			 * this instead of the reason text, which the loop guard replaces on a
+			 * repeated denied call.
+			 */
+			deniedPark?: true;
+	  }
 	| { kind: "not_visible"; reason: string };
 
 interface ParkedCall {
@@ -600,6 +615,27 @@ export function createRegistry(deps: RegistryDeps): ToolRegistry {
 		if (decision.kind === "block") {
 			return { kind: "terminal", verdict: { kind: "blocked", reason: decision.rejection.short, decision } };
 		}
+		const outsideTurn = !turnAllowsTool(options?.turnConstraints, call.tool);
+		const outsideRun =
+			options?.allowedTools !== undefined && !turnAllowsTool({ allowedTools: options.allowedTools }, call.tool);
+		const disabledSkills =
+			options?.turnConstraints?.skills === "disabled" && call.tool === ToolNames.Context && call.args?.scope === "skills";
+		if (outsideTurn || outsideRun || disabledSkills) {
+			const reason = disabledSkills
+				? "Skills are disabled for this task."
+				: `${call.tool} is outside this task's admitted tool scope.`;
+			const blocked: SafetyDecision = {
+				kind: "block",
+				classification: decision.classification,
+				rejection: {
+					short: `${call.tool} blocked: turn constraint`,
+					detail: reason,
+					hints: ["Work within the operator's task scope; approval of an individual tool does not widen it."],
+				},
+			};
+			recordRegistryDisposition(call, blocked, "blocked", { reasonCode: "turn_constraint", reasons: [reason] });
+			return { kind: "terminal", verdict: { kind: "blocked", reason, decision: blocked } };
+		}
 		// Stage 1.5, the skill tool surface: a loaded SKILL.md that declares
 		// allowed-tools or disallowed-tools narrows the surface until the
 		// policy's lifetime ends. Interactively that is the session: the
@@ -665,13 +701,15 @@ export function createRegistry(deps: RegistryDeps): ToolRegistry {
 				: call.tool === ToolNames.WebFetch && webFetchIsOutward(call.args)
 					? "outward"
 					: DEFAULT_AUTONOMY_EXPOSURE;
+		const readOutside = decision.policy?.readScope === "outside-workspace";
 		const disposition = mapAutonomy(level, actionClass, {
 			executeRecognized: decision.policy?.execRecognition !== "unrecognized",
+			...(readOutside ? { readOutsideWorkspace: true } : {}),
 			...(planScale ? { dispatchPlanScale: true } : {}),
 			...(exposure === "outward" ? { exposure } : {}),
 		});
 		if (disposition === "deny") {
-			const verdict = autonomyDenyVerdict(decision, level, call.tool, actionClass);
+			const verdict = autonomyDenyVerdict(decision, level, call.tool, actionClass, readOutside);
 			recordRegistryDisposition(call, verdict.decision, "denied", { reasonCode: `autonomy:${level}` });
 			notifyAutonomyDenied(call, verdict.decision, level);
 			return { kind: "terminal", verdict };
@@ -680,7 +718,7 @@ export function createRegistry(deps: RegistryDeps): ToolRegistry {
 			const askDecision =
 				planScale && dispatchPlan !== null
 					? toDispatchPlanAskDecision(decision, level, dispatchPlan)
-					: toAutonomyAskDecision(decision, level, call.tool, actionClass, exposure);
+					: toAutonomyAskDecision(decision, level, call.tool, actionClass, exposure, readOutside);
 			return { kind: "park", decision: askDecision, axis: approvalAxisId(askDecision, level) };
 		}
 		recordRegistryDisposition(call, decision, "allowed");
@@ -851,6 +889,19 @@ export function createRegistry(deps: RegistryDeps): ToolRegistry {
 				return observeBlockedAttempt(admissionCall, outcome.verdict, options) ?? outcome.verdict;
 			}
 			if (outcome.kind === "execute") return runSpec(outcome.spec, admissionCall, outcome.decision, options);
+			// A park settles only through a listener's answer, so with no listener
+			// the promise would never resolve. Refuse the call instead, fail closed.
+			if (permissionListeners.size === 0) {
+				disposeAdmissionArgs(tools.get(admissionCall.tool as ToolName), admissionCall.args ?? {});
+				recordRegistryDisposition(admissionCall, outcome.decision, "denied", {
+					reasonCode: NO_PARK_LISTENER_REASON_CODE,
+				});
+				const loopReason = observeRejectedAttempt(admissionCall, outcome.decision, options);
+				return (
+					guardOverrideForRejectedAttempt(admissionCall, outcome.decision, loopReason) ??
+					parkAnsweredBlockedVerdict(outcome.decision, admissionCall.tool, loopReason ?? NO_PARK_LISTENER_REASON)
+				);
+			}
 			const abortReason = "run aborted before the operator decided";
 			if (options?.signal?.aborted) {
 				disposeAdmissionArgs(tools.get(admissionCall.tool as ToolName), admissionCall.args ?? {});
@@ -1070,6 +1121,10 @@ function applyRegisteredToolClassification(decision: SafetyDecision, spec: ToolS
 /** Final reason code for a before_tool guard block, matching the audit convention (sd-01 §2.5). */
 const GUARD_BLOCK_REASON_CODE = "guard_block";
 
+const NO_PARK_LISTENER_REASON_CODE = "no_park_listener";
+const NO_PARK_LISTENER_REASON =
+	"refused: this call needs operator confirmation and no permission listener is registered to ask for it";
+
 /**
  * Details key under which a tool body hands a refused nested verdict back to
  * the registry. Written by {@link nestedBlockedResult}, read once by `runSpec`,
@@ -1088,6 +1143,7 @@ const NESTED_BLOCKED_DETAIL = "nestedBlockedVerdict";
 interface NestedBlockedMarker {
 	reason: string;
 	decision: SafetyDecision;
+	deniedPark?: true;
 }
 
 /**
@@ -1097,7 +1153,11 @@ interface NestedBlockedMarker {
  * call identically instead of dressing the refusal as a tool error.
  */
 export function nestedBlockedResult(verdict: Extract<RegistryVerdict, { kind: "blocked" }>): ToolResult {
-	const marker: NestedBlockedMarker = { reason: verdict.reason, decision: verdict.decision };
+	const marker: NestedBlockedMarker = {
+		reason: verdict.reason,
+		decision: verdict.decision,
+		...(verdict.deniedPark === true ? { deniedPark: true } : {}),
+	};
 	return { kind: "error", message: verdict.reason, details: { [NESTED_BLOCKED_DETAIL]: marker } };
 }
 
@@ -1105,7 +1165,7 @@ function nestedBlockedVerdict(result: ToolResult): Extract<RegistryVerdict, { ki
 	if (result.kind !== "error") return null;
 	const marker = result.details?.[NESTED_BLOCKED_DETAIL];
 	if (typeof marker !== "object" || marker === null) return null;
-	const { reason, decision } = marker as Partial<NestedBlockedMarker>;
+	const { reason, decision, deniedPark } = marker as Partial<NestedBlockedMarker>;
 	if (
 		typeof reason !== "string" ||
 		typeof decision !== "object" ||
@@ -1115,7 +1175,7 @@ function nestedBlockedVerdict(result: ToolResult): Extract<RegistryVerdict, { ki
 	) {
 		return null;
 	}
-	return { kind: "blocked", reason, decision };
+	return { kind: "blocked", reason, decision, ...(deniedPark === true ? { deniedPark: true } : {}) };
 }
 
 /**
@@ -1220,7 +1280,7 @@ function parkAnsweredBlockedVerdict(
 		},
 		...(decision.policy !== undefined ? { policy: decision.policy } : {}),
 	};
-	return { kind: "blocked", reason, decision: blocked };
+	return { kind: "blocked", reason, decision: blocked, deniedPark: true };
 }
 
 /**
@@ -1264,8 +1324,9 @@ function autonomyDenyVerdict(
 	level: AutonomyLevel,
 	tool: string,
 	actionClass: ActionClass,
+	readOutsideWorkspace = false,
 ): Extract<RegistryVerdict, { kind: "blocked" }> {
-	const rejection = autonomyDenyRejection(level, tool, actionClass);
+	const rejection = autonomyDenyRejection(level, tool, actionClass, readOutsideWorkspace);
 	const blocked: SafetyDecision = {
 		kind: "block",
 		classification: decision.classification,
@@ -1287,11 +1348,12 @@ function toAutonomyAskDecision(
 	tool: string,
 	actionClass: ActionClass,
 	exposure: AutonomyExposure = DEFAULT_AUTONOMY_EXPOSURE,
+	readOutsideWorkspace = false,
 ): SafetyDecision {
 	return {
 		kind: "ask",
 		classification: decision.classification,
-		rejection: autonomyAskRejection(level, tool, actionClass, exposure),
+		rejection: autonomyAskRejection(level, tool, actionClass, exposure, readOutsideWorkspace),
 		...(decision.policy !== undefined ? { policy: decision.policy } : {}),
 	};
 }