@open-everywhere/core 0.1.0

package/dist/agent/tools/request_access.js

@@ -0,0 +1,408 @@
+// request_access PROPOSES widening access. It maps the ask into a STRUCTURED delta from the closed vocabulary, validates it against the loaded config, freezes it into an `access.request` pending row, and posts a card. A member's tap opens the bot-PR; the admin's merge is the only grant, and anything the vocabulary cannot express is refused outright, so this tool can never smuggle config authorship into the flow.
+// Two-step by design: the agent only ever OFFERS the button and a human SENDS the request, so an injected session can waste at most a card in its own thread — it cannot spam the admin channel or shape the diff. Fail-closed: no configured admin channel or config repo is a polite refusal, never a silent no-op.
+import { randomUUID } from "node:crypto";
+import { defineDynamic, defineTool } from "eve/tools";
+import { z } from "zod";
+import { actingPrincipalId, bindFrom, currentTurnId } from "../identity/binding.js";
+import { domainKeyOf, resolvePartition } from "../memory/partition.js";
+import { proposalScopeKey } from "../channels/propose-scope.js";
+// OPE-2022 — the turn-scoped observation that a propose REALLY RAN, stamped at each of this tool's
+// three success returns. It is what lets `channels/request-claim-guard.ts` tell an honest "I've
+// submitted the request" from the fabricated one leg 016 measured, without the reply door spending a
+// store read per post. The ledger's own header says which registry row each arm pairs with.
+import { ACCESS_REQUEST_KIND, noteAccessRequestProposed } from "../channels/access-request-ledger.js";
+import { buildResolveRequest, resolveAccessFor, unattendedOf } from "../access/request.js";
+import { resolveAccess } from "../access/resolver.js";
+import { getConfig } from "../access/config.js";
+import { planAccessDelta, grantSentence, HTTP_METHODS, sameScope } from "../access/delta.js";
+import { roleForBinding } from "../access/roles.js";
+import { tryPrincipalKey } from "../identity/principal-key.js";
+import { isLinkSetMember } from "../identity/groups.js";
+import { resolveDomainForChannel } from "../memory/domain.js";
+import { resolveSkillDomain } from "../skills/domain-skills.js";
+import { resolveMessagePermalink } from "../channels/surface-message-ops.js";
+// Static, not `await import()` — bundler rule 1 (see forget.ts's identical import).
+import { requestApproval, autoApprovedNote } from "../approvals/flow.js";
+import { checkApprovalVenue, describeVenueRefusal, cardPostedPrefix, cardPostedTail } from "../approvals/card-venue.js";
+import { approvalPostDeps } from "./set_spend_limit.js";
+import { preRegisterDynamicEntry } from "../access/window-gated.js";
+import { requireSessionContinuation } from "../spend/checkpoint.js";
+import { domainExposureLines, joinWords, normalizeHost } from "../approvals/domain-exposure.js";
+import { surfaceDisplayName } from "../instructions/seat-prompt.js";
+/**
+ * What this ask would ADD, in the two shapes the exposure renderer needs (OPE-235). Read off the
+ * FROZEN delta only, so the card, the PR body and the exposure lines all describe one addition.
+ *
+ * A `grant-connector` ask adds a connector the target does not hold, so its reach tag is exactly
+ * what a container's connector list carries. A `widen-connection` ask adds METHODS and PATH
+ * PREFIXES to a connection that is already effective here — its hosts are therefore already
+ * reachable, and the uniqueness sentence honestly reports that other rooms hold them too. Path
+ * granularity is below what the per-container reach sets can see, so nothing here claims it.
+ */
+export function wideningSubject(delta) {
+    if (delta.kind === "grant-connector") {
+        const name = surfaceDisplayName(delta.connector);
+        return { label: `the ${name} connector`, reachTags: [`connector:${delta.connector}`], opaqueSources: [name] };
+    }
+    // NORMALISED, because the resolver compares host patterns normalised (its own `normHost`) and the
+    // container reach tags are built the same way. A raw `API.Example.COM` would match no container,
+    // read as "no room can reach it", and print a widening claim that is simply false.
+    const hosts = delta.baseConnection.allowedWebsites.map(normalizeHost);
+    return {
+        label: hosts.length > 0 ? joinWords(hosts) : "this connection",
+        reachTags: hosts.map((h) => `host:${h}`),
+        opaqueSources: hosts,
+    };
+}
+/** The ask's target, validated. An unknown string REFUSES rather than defaulting: silently
+ *  reading "personal" as "channel" would widen the wrong universe. */
+export function requestTargetOf(input) {
+    const raw = (input.target ?? "channel").trim();
+    if (raw === "channel" || raw === "personal" || raw === "group")
+        return raw;
+    throw new Error(`unknown request target "${raw}" — the targets are channel (this room), personal (your own DM) and group (a declared person-group).`);
+}
+/**
+ * The scope a target addresses, DERIVED — the propose-time half of the target-scope invariant.
+ * Two of the three come entirely from the verified binding; the group NAME is the one address that comes from the ask, and it is the one gated on org-admin standing below.
+ */
+export function requestingScopeFor(target, binding, surfaceKey, input, domains = []) {
+    switch (target) {
+        case "channel": {
+            const domain = resolveDomainForChannel(surfaceKey, domains).domain;
+            return domain ? { level: "domain", domain: domain.name } : { level: "surface", surface: surfaceKey };
+        }
+        case "personal":
+            // Composed from the binding's platform and the ACTING principal — never from model input, and never from `binding.principalId`, which a triggered fire answers with its attested creator.
+            // `tryPrincipalKey ?? ""` rather than the throwing composer: an unnameable workspace produces the SAME unbindable-key outcome an absent acting principal does, and planRequestAccess refuses it by name, so the failure stays a sentence the requester reads.
+            return { level: "principal", principal: tryPrincipalKey(binding.platform, binding.workspace, actingPrincipalId(binding) ?? "") ?? "" };
+        case "group":
+            return { level: "group", group: (input.group ?? "").trim() };
+    }
+}
+/**
+ * The effective access of a person-group — what a group grant is planned against, and NOT the caller's own. If the answer came from the caller's own DM resolution, an org admin's personal connectors would read as the group's: refusing a request the group genuinely needs, and freezing a base connection the group cannot see.
+ * The binding set is narrowed to the group's OWN bindings and resolved through the real resolver, so there is no second implementation of narrowest-wins. `mode: "dm"` is the only universe a group binding resolves in, and the synthetic principal id is a resolver precondition that can match nothing.
+ */
+export function groupEffectiveAccess(group, platform, workspace, bundles, bindings) {
+    const groupBindings = bindings.filter((b) => b.scope.level === "group" && b.scope.group === group);
+    return resolveAccess({ mode: "dm", platform, workspace, channel: "-", principalId: "-", groups: [group] }, bundles, groupBindings, getConfig().pluginRegistry, getConfig().loadConnectorCredentials?.() ?? []);
+}
+/** The frozen universe note (see {@link RequestAccessArgs.universe}). Code-rendered from the
+ *  derived scope plus the loaded registry — the two facts a merging admin cannot get from the
+ *  grant sentence alone: WHOSE DM, or how many DMs and whether that number can grow by itself. */
+function universeNote(scope, groups) {
+    if (scope.level === "domain") {
+        return `Domain grant for "${scope.domain}" — applies to every current and future room admitted by that domain's reach rules, across every platform and workspace it spans.`;
+    }
+    if (scope.level === "principal")
+        return `Personal DM grant for \`${scope.principal}\` — resolves in that person's DM and nowhere else.`;
+    if (scope.level !== "group")
+        return undefined;
+    const g = groups.find((x) => x.name === scope.group);
+    const sets = g?.members.filter(isLinkSetMember).length ?? 0;
+    return (`Group grant for "${scope.group}" — ${g?.members.length ?? 0} member(s), link-set members: ${sets > 0 ? `yes (${sets})` : "no"}. ` +
+        `It resolves in each member's own DM, never in a channel` +
+        // Link-set expansion is LIVE and CONFIRMED-ONLY: a `{ linkSet }` member reaches every confirmed account of that set in the person's own DM.
+        // A directory suggestion grants nothing, and a suspended or revoked link-set stops granting eagerly.
+        (sets > 0
+            ? `. NOTE: the ${sets} link-set member(s) resolve to each person's CONFIRMED accounts only — a directory suggestion or a suspended/revoked link-set grants nothing.`
+            : "."));
+}
+/**
+ * Pure input → frozen-args mapping: the channel-mode, internal-trust and ACTING-sender refusals, then planAccessDelta against the requesting scope's resolved access.
+ * The SCOPE inside the delta comes from the verified binding and resolve request, never from model input — the propose-time half of the single-scope invariant. Throws, and never creates a pending, on anything invalid or out of vocabulary.
+ */
+export function planRequestAccess(binding, planCtx, input, extras) {
+    // No card-path refusal here: WHERE the card goes is resolved in execute() by the venue walk, and what stays is everything decidable from the inputs alone, which is the whole of this tool's authorization posture.
+    const target = requestTargetOf(input);
+    if (target === "channel" && binding.mode !== "channel") {
+        throw new Error("access requests come from the channel that needs the access (grants bind to a channel scope) — ask again from that channel, not a DM. " +
+            "To widen your OWN personal (DM) access instead, ask me here with target=personal.");
+    }
+    if (target === "personal" && binding.mode !== "dm") {
+        // The personal universe IS the DM (resolver.ts's two-universes rule), and a personal grant
+        // concerns exactly one person — so it is asked for where it lands, not in front of a room.
+        throw new Error("a personal (DM) access request has to come from our DM — that's the universe it would land in. Send me a direct message and ask there.");
+    }
+    if (target === "group" && binding.mode !== "channel" && binding.mode !== "dm") {
+        throw new Error(`group access requests come from a channel or a DM (this surface is "${binding.mode}").`);
+    }
+    if (binding.trust === "external") {
+        // Config-repo grants never bind to guest-reachable scopes (repo-visibility
+        // doctrine) — an externally-shared channel can't request its own widening.
+        throw new Error("this channel is externally shared — access can't be widened from an external surface; an internal admin can PR a grant by hand.");
+    }
+    // principal-gate: presence — the header's own design is TWO-STEP because the agent must never be
+    // the one asking: "the agent only ever OFFERS the button; a human in the channel SENDS the
+    // request". A fire proposing an access widening is that invariant inverted, so the acting-sender
+    // question is the propose-time half of it.
+    //
+    // 🔴 THE ACTING principal, never the bound one (OPE-273). `binding.principalId` was answered by a
+    // triggered fire's ATTESTED creator, so the refusal was unreachable on a fire — and the outcome
+    // this one prevents is the worst of the seven: a merged bot-PR widening the channel's standing
+    // grants, with a real person named as the requester in a diff that outlives every session.
+    const requestedBy = actingPrincipalId(binding);
+    if (!requestedBy) {
+        throw new Error("request_access needs a verified sender on this turn — a triggered routine fire has no acting sender (only the creator it is attributed to), and a fire may not ask for its own channel to be widened in that person's name. Ask someone in this channel to request it.");
+    }
+    // SCOPE AGREEMENT: recompute the target from the server-derived asking key and canonical domain
+    // roster. The model cannot name a domain, and a stale/mismatched planner cannot freeze one.
+    const expectedScope = requestingScopeFor(target, binding, extras.scopeKey, input, extras.domains ?? []);
+    const expectedLevel = target === "channel" ? expectedScope.level : target === "personal" ? "principal" : "group";
+    const scopeAgrees = target === "channel" ? sameScope(planCtx.scope, expectedScope) : planCtx.scope.level === expectedLevel;
+    if (!scopeAgrees) {
+        throw new Error(`request_access wiring bug: target "${target}" addresses ${expectedScope.level}:${expectedScope.level === "surface" ? expectedScope.surface : expectedScope.level === "domain" ? expectedScope.domain : expectedScope.level === "principal" ? expectedScope.principal : expectedScope.group} ` +
+            `but was handed ${planCtx.scope.level}:${planCtx.scope.level === "surface" ? planCtx.scope.surface : planCtx.scope.level === "domain" ? planCtx.scope.domain : planCtx.scope.level === "principal" ? planCtx.scope.principal : planCtx.scope.group}.`);
+    }
+    // ② SELF-ONLY, for a personal grant. The expected key is composed HERE from the verified
+    // binding's platform and the ACTING principal, so this comparison is what makes "a personal
+    // grant for someone else" unreachable rather than merely discouraged — a scope naming any other
+    // key refuses, whatever produced it.
+    if (planCtx.scope.level === "principal") {
+        // `?? ""` can never equal a well-formed `scope.principal`, so an unnameable workspace refuses
+        // here too — the self-only comparison stays the fence rather than becoming a throw site.
+        const self = tryPrincipalKey(binding.platform, binding.workspace, requestedBy) ?? "";
+        if (planCtx.scope.principal !== self) {
+            throw new Error(`personal access requests are self-service only: I can only ask for YOUR own DM access (\`${self}\`), never anyone else's (\`${planCtx.scope.principal}\`). ` +
+                `A grant for another person is theirs to request, or an admin PRs it by hand.`);
+        }
+    }
+    // ②b The group the ASK named must be the group the scope addresses (the one address that comes
+    // from the ask at all — a mismatch means the two halves disagree, so neither is trustworthy).
+    if (planCtx.scope.level === "group" && planCtx.scope.group !== (input.group ?? "").trim()) {
+        throw new Error(`request_access wiring bug: the ask names group "${(input.group ?? "").trim()}" but the scope addresses "${planCtx.scope.group}".`);
+    }
+    // ORG-ADMIN STANDING for a group grant: a group is org-global and tied to no channel, so domain-admin standing cannot bound it — the same reason a domain-level spend cap is org-admin-only.
+    // Computed from the VERIFIED binding through the one roster matcher the whole system uses, and `roleForBinding` reads the ACTING principal, so a fire holds none of its creator's standing here either.
+    if (planCtx.scope.level === "group") {
+        const role = roleForBinding(binding, extras.domains ?? []);
+        if (!role.isOrgAdmin) {
+            throw new Error(`granting a person-group is an org-admin action — a group grant lands in EVERY member's DM, so it isn't scoped to any channel you administer.${role.principalId ? ` Your id ("${role.principalId}") isn't on the "org" pseudo-domain's admins list.` : ""} Ask an org admin to request it, or have them PR the binding by hand.`);
+        }
+    }
+    const delta = planAccessDelta({
+        kind: input.kind,
+        connection: input.connection,
+        addMethods: input.add_methods,
+        addPathPrefixes: input.add_path_prefixes,
+        connector: input.connector,
+        credential: input.credential,
+        // The stated why doubles as the broad-group `allowBroad` acknowledgement (delta.ts) — the
+        // planner refuses a broad group grant that has none, so this is load-bearing, not display.
+        reason: input.reason,
+    }, planCtx);
+    const universe = universeNote(delta.scope, planCtx.groups ?? []);
+    return {
+        org: binding.org,
+        scopeKey: extras.scopeKey,
+        requestId: randomUUID(),
+        delta,
+        requestedBy,
+        ...(input.reason?.trim() ? { reason: input.reason.trim() } : {}),
+        channelId: extras.channelId,
+        threadTs: binding.threadTs ?? null,
+        ...(extras.permalink ? { permalink: extras.permalink } : {}),
+        configRepo: extras.configRepo,
+        ...(universe ? { universe } : {}),
+    };
+}
+// Factored and pre-registered at module load under the deterministic slug-keyed step name, per the replay doctrine in access/window-gated.ts.
+const requestAccessEntry = defineTool({
+    description: "PROPOSE widening access — this grants nothing itself. Use when someone asks for access they don't have. Exactly two request shapes exist: kind=widen-connection (add HTTP methods and/or path prefixes to a connection ALREADY available in the target) and kind=grant-connector (enable a connector this deployment already defines but the target doesn't have, naming in `credential` which configured identity it is reached as). Anything else — a new website/host, a new credential or API key, a new repo, a brand-new integration — is NOT requestable this way: refuse and say an admin needs to PR it by hand. `target` picks the universe: \"channel\" (default — the channel's ENTIRE canonical domain when it belongs to one, otherwise this standalone room; must be asked from that channel), \"personal\" (the ASKER's own DM access — only from their DM, and only ever for themselves: never use it to ask on someone else's behalf), or \"group\" (a declared person-group, landing in every member's DM — org admins only, and name the group in `group`). IN A DIRECT MESSAGE A CHANNEL-SCOPE ASK IS NOT ACTIONABLE AT ALL: a channel grant binds to that channel's own scope, so the request is raised IN THE CHANNEL and never from a DM. Asked for one here, do not call this tool, and never say you submitted, raised or filed anything — say that a channel-scope access request has to be asked for in the channel itself, and ask the person to repeat the ask there. From a DM you may still ask for `target=personal` (the asker's own access, and only theirs) and, as an org admin, for `target=group`; only a channel-scope ask has to move to the channel. On success a \"Request access\" card is posted in this thread; any member's tap sends the request as a bot-PR that an admin merges in GitHub — nothing changes until that merge. The posted card IS the reply to the user — do not add any narration, summary, or confirmation text after this call. EXCEPT when this surface can't host a card: it then goes to a card-capable channel in the same domain, the `note` field names it, and you MUST relay that.",
+    inputSchema: z.object({
+        kind: z.enum(["widen-connection", "grant-connector"]).describe("Which of the two request shapes this ask maps to."),
+        target: z
+            .enum(["channel", "personal", "group"])
+            .optional()
+            .describe('Which universe to widen: "channel" (default — the channel\'s entire canonical domain when assigned, otherwise this standalone room; it is raised IN THAT CHANNEL and is refused from a DM), "personal" (the asker\'s own DM access; DM-only and self-only), "group" (a declared person-group, every member\'s DM; org admins only).'),
+        group: z.string().optional().describe("target=group: the declared person-group name to grant (as listed in this deployment's groups)."),
+        connection: z.string().optional().describe("widen-connection: the id of the existing connection to widen (as listed in the target's access)."),
+        add_methods: z.array(z.enum(HTTP_METHODS)).optional().describe("widen-connection: HTTP methods to add."),
+        add_path_prefixes: z.array(z.string()).optional().describe('widen-connection: path prefixes to add (each starts with "/").'),
+        connector: z.string().optional().describe("grant-connector: the connector name to enable for the target."),
+        credential: z
+            .string()
+            .optional()
+            .describe("grant-connector: which configured credential the target reaches the connector as. REQUIRED for grant-connector — every grant names its identity. Name one this deployment already configures; the refusal lists them."),
+        reason: z
+            .string()
+            .optional()
+            .describe("Why this access is needed — shown on the card and in the PR. REQUIRED for a broad domain (workspace or wildcard reach) or broad person-group (many members, or link-set members): it is recorded on the binding as the reviewed `allowBroad` acknowledgement."),
+    }),
+    outputSchema: z.object({
+        requested: z.boolean(),
+        pendingId: z.string(),
+        expiresAt: z.string().optional().describe("Absent when the chain auto-approved: the row is already decided, so nothing expires."),
+        note: z.string(),
+        autoApproved: z.boolean().optional().describe("The approver chain lowered this verb: no card was posted and it has ALREADY run."),
+    }),
+    // NO `approval:` — see the header + forget.ts's resumed-session pin.
+    async execute(input, ctx) {
+        // SOFT session cost checkpoint (OPE-62) — pause consequential work past a configured
+        // per-session threshold until a member confirms; no-op when unconfigured.
+        await requireSessionContinuation(ctx, "request_access");
+        const binding = bindFrom(ctx);
+        const partition = resolvePartition(ctx);
+        const domain = resolveSkillDomain(ctx) ?? null;
+        // FAIL-CLOSED enablement gate, before any planning: a deployment without an
+        // admin channel + config repo has no one to notify and nowhere to PR.
+        const cfg = getConfig();
+        const ar = cfg.loadAccessRequests?.();
+        if (!ar?.adminChannel || !ar?.configRepo) {
+            throw new Error("access requests aren't enabled on this deployment (no admin channel / config repo configured — " +
+                "OE_ACCESS_ADMIN_CHANNEL + OE_ACCESS_CONFIG_REPO). An admin can PR the grant by hand instead.");
+        }
+        const channelId = typeof binding.target?.channelId === "string" ? binding.target.channelId : undefined;
+        if (!channelId) {
+            throw new Error("request_access couldn't resolve this channel's id — try again from a real channel, not a synthetic context.");
+        }
+        // The TARGET scope is DERIVED, never model-provided — the group NAME excepted. The
+        // addressed proposal key is resolved through the canonical domain roster, so a channel
+        // delta targets its domain when assigned and its exact surface otherwise.
+        // The personal key is composed from the binding's platform and the ACTING principal, by the same rule the resolver's DM branch matches with.
+        const req = buildResolveRequest(ctx);
+        const target = requestTargetOf(input);
+        const groups = cfg.loadGroups?.() ?? [];
+        const loadedDomains = cfg.loadDomains();
+        const requestingSurfaceKey = await proposalScopeKey(ctx, partition);
+        const scope = requestingScopeFor(target, binding, requestingSurfaceKey, input, loadedDomains);
+        const planCtx = {
+            scope,
+            // Whose access the "do they already have it?" question is about: the caller's own resolution for a channel or personal target, and the GROUP's own bindings for a group target — see groupEffectiveAccess for why the caller's personal grants must not read as the group's.
+            access: scope.level === "group"
+                ? groupEffectiveAccess(scope.group, req.platform, req.workspace, cfg.loadBundles(), cfg.loadBindings())
+                : resolveAccessFor(ctx),
+            bundles: cfg.loadBundles(),
+            // The closed set of identities a grant-connector ask may name (OPE-591). Absent ⇒
+            // nothing configured ⇒ every grant-connector refuses, which is the fail-closed answer.
+            connectorCredentials: cfg.loadConnectorCredentials?.() ?? [],
+            groups,
+            domains: loadedDomains,
+        };
+        // Best-effort thread permalink for the PR body — fail-soft and display-only. The Slack arm stays gated by name because `chat.getPermalink` is a VENDOR API reached with Slack's own bot token, while the seam turns every other surface's absence into a registration it can supply from ids it already holds.
+        // ⚠️ Discord still gets the fallback today: the anchor asked about is `binding.threadTs`, which its mapper never sets, so the branch is simply not entered there. The bundle's `permalink` is implemented and pinned; what is missing is a per-message anchor on the binding.
+        const permalink = binding.threadTs
+            ? await resolveMessagePermalink(binding.platform, {
+                channelId,
+                messageId: binding.threadTs,
+                workspace: binding.workspace,
+                dm: binding.mode === "dm",
+            })
+            : undefined;
+        // 🔴 THE ROOM THAT ASKED, NOT THE ROOM THAT ARRIVED LAST (OPE-1756). `partition` is the
+        // TURN's, and a turn that merged queued deliveries carries only the LAST delivery's auth.
+        // The governed scope follows the ADDRESSED wake instead, and it is threaded through the
+        // PLANNER so the frozen args and the card's scope cannot disagree. Falls back to
+        // `partition` on every unknown, so a single-wake turn is unchanged.
+        // 🔴 THE MERGE ROAD IS UNREACHABLE ON eve 0.54.3; THIS READ IS STILL LIVE (OPE-2042). eve
+        // batches adjacent queued deliveries only when their full auth contexts match, and OE
+        // stamps a fresh per-delivery `oe_delivery_id` into `auth.attributes`, so two auth-carrying
+        // deliveries on one unified window never compare equal; only the caller-less task
+        // COMPLETION COHORT still folds, and it carries no `auth` at all. But the TURN's ctx names
+        // the wrong room WITHOUT any merge too: a turn woken by an INTERNAL wake — an approval
+        // decision, a completion — answers a conversation whose envelope is in the seat's shared
+        // context, through the reply fence's same-conversation and pending arms (arms 3 and 4 of
+        // `channels/unified-window.ts` `resolveAnswerableReplyTarget`). Measured in production on
+        // 2026-08-15 (`docs/glossary.md`). So this read is LOAD-BEARING, not defensive.
+        const planned = planRequestAccess(binding, planCtx, input, {
+            scopeKey: requestingSurfaceKey,
+            channelId,
+            configRepo: ar.configRepo,
+            permalink,
+            // The admin roster a GROUP request's standing gate reads (roles.ts roleForBinding) —
+            // passed in rather than looked up inside the pure planner, the same way the bundles
+            // and the group registry are.
+            domains: loadedDomains,
+        });
+        // THE EXPOSURE DELTA, BEFORE THE CLICK (OPE-235). Computed here — at propose, on the
+        // validated delta — and frozen into the args, so the member who taps and the admin who
+        // merges read the same reach. `domainExposureLines` never throws: an unreadable domain
+        // renders one line saying so, which is the answer the ticket asks for and is why this is
+        // not wrapped in a try/catch of its own.
+        //
+        // It is also a PURE function of loaded config — the roster plus a per-room access resolve,
+        // with no store read — which is what lets it join the FROZEN args safely: requestApproval
+        // dedups on the exact `argsJson`, and eve can re-execute an uncommitted step body on
+        // crash-recovery redelivery, so a field that varied per delivery would post a second card
+        // disagreeing with the first.
+        //
+        // 🔴 THE ROOM'S MEMORY DOMAIN, NOT `domain` ABOVE. `resolveSkillDomain` answers a
+        // different question — where a SKILL may be authored — and it deliberately refuses an
+        // externally-shared room and falls back to the `org` pseudo-domain for an unassigned one.
+        // Either answer here would be a wrong statement about reach: the refusal renders "this
+        // room is in no memory domain", a positive all-clear, for a room that sits on a real
+        // roster. `resolveDomainForChannel` is the hop the memory resolver itself makes.
+        const memoryDomain = resolveDomainForChannel(domainKeyOf(partition), loadedDomains).domain?.name ?? null;
+        const exposure = await domainExposureLines({
+            org: planned.org,
+            domain: memoryDomain,
+            subject: wideningSubject(planned.delta),
+            landsOnARoom: planned.delta.scope.level === "surface" || planned.delta.scope.level === "domain",
+        });
+        const args = { ...planned, exposure };
+        // Where the card goes: this room when it can host one, otherwise a card-capable channel in the SAME domain.
+        // 🔴 Note what does NOT move: `args.channelId` and `args.threadTs` stay the ASKING conversation, because they are what the PR body cites as where this was asked and where the outcome note goes back. Only the CARD moves.
+        const venueResult = await checkApprovalVenue(binding, partition, () => cfg.loadDomains());
+        if ("refusal" in venueResult) {
+            throw new Error(describeVenueRefusal(venueResult.refusal, binding.platform, "request that access"));
+        }
+        const venue = venueResult.venue;
+        const posted = await requestApproval({
+            org: args.org,
+            kind: "access.request",
+            args,
+            scopeKey: args.scopeKey,
+            domain,
+            requestedBy: args.requestedBy,
+            channelId: venue.channelId,
+            // Thread the card under the asking conversation (see set_spend_limit.ts) — but only
+            // when the card IS in that conversation; a ts from another workspace's channel
+            // anchors nothing.
+            threadTs: venue.sameRoom ? binding.threadTs ?? null : null,
+            // Mint-frozen proposing-surface identity (task #105) — the TTL sweep's feedback
+            // target, and the VENUE's key because that is where the card actually is.
+            postedTo: venue.surfaceKey,
+            chain: { unattended: unattendedOf(ctx) },
+        }, 
+        // The VENUE's own CardPoster — see forget.ts for why the gate and the renderer have to
+        // move together, and why this reads the venue's platform rather than the binding's.
+        approvalPostDeps(venue.platform, ctx));
+        // Chain-lowered (OPE-296) ⇒ no card, the grant is already in force. See
+        // revoke_connector.ts for why this note stops being internal-only on this branch.
+        if (posted.autoApproved) {
+            // The propose really ran and the chain lowered it, so there is a decided row and no card.
+            // Recorded here rather than in the approvals plane because this is the site that knows
+            // the ask was an ACCESS request; the plane's own row is the durable half.
+            noteAccessRequestProposed(currentTurnId(ctx), ACCESS_REQUEST_KIND, "auto-approved");
+            return {
+                requested: false,
+                autoApproved: true,
+                pendingId: posted.id,
+                note: autoApprovedNote(grantSentence(args.delta), posted.autoApproved),
+            };
+        }
+        // A pending row exists and somebody can go and look at it. `deduped` means the plane handed
+        // back the LIVE card of an identical earlier proposal rather than posting a new one — the
+        // request is just as real, and its `approval.requested` row belongs to that earlier turn,
+        // which is why the two arms are recorded apart rather than flattened into one word.
+        noteAccessRequestProposed(currentTurnId(ctx), ACCESS_REQUEST_KIND, posted.deduped ? "already-pending" : "card-posted");
+        return {
+            requested: true,
+            pendingId: posted.id,
+            expiresAt: posted.expiresAt,
+            // Internal-only bookkeeping WHEN THE CARD IS HERE — the card is then the user-facing
+            // reply. On a REDIRECT it is the only report the asker can get (see forget.ts).
+            note: `${cardPostedPrefix(venue)} — ${grantSentence(args.delta)} (pending ${posted.id}).` + cardPostedTail(venue, "tap it to send the request", posted),
+        };
+    },
+});
+preRegisterDynamicEntry("request_access", "_single", requestAccessEntry);
+// Mounted everywhere; the dynamic wrapper stays only for `preRegisterDynamicEntry`'s replay-immunity.
+// The surface gate is gone, because the card routes to the domain's card-capable channel and the tool therefore works from Teams and Linear.
+export default defineDynamic({
+    events: {
+        "session.started": () => requestAccessEntry,
+    },
+});
+//# sourceMappingURL=request_access.js.map

package/dist/agent/tools/request_access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request_access.js","sourceRoot":"","sources":["../../../agent/tools/request_access.ts"],"names":[],"mappings":"AAAA,gaAAga;AACha,sTAAsT;AAEtT,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,aAAa,EAAuB,MAAM,wBAAwB,CAAC;AACzG,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,mGAAmG;AACnG,gGAAgG;AAChG,qGAAqG;AACrG,4FAA4F;AAC5F,OAAO,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAC;AACtG,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAC3F,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,YAAY,EAAE,SAAS,EAA4D,MAAM,oBAAoB,CAAC;AACvJ,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAc,MAAM,uBAAuB,CAAC;AAEpE,OAAO,EAAE,uBAAuB,EAAe,MAAM,qBAAqB,CAAC;AAC3E,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAC7E,oFAAoF;AACpF,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACxH,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,aAAa,EAAwB,MAAM,iCAAiC,CAAC;AACtH,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AA0BpE;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,KAAkB;IAChD,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACjD,OAAO,EAAE,KAAK,EAAE,OAAO,IAAI,YAAY,EAAE,SAAS,EAAE,CAAC,aAAa,KAAK,CAAC,SAAS,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;IAChH,CAAC;IACD,kGAAkG;IAClG,iGAAiG;IACjG,mFAAmF;IACnF,MAAM,KAAK,GAAG,KAAK,CAAC,cAAc,CAAC,eAAe,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACtE,OAAO;QACL,KAAK,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,iBAAiB;QAC9D,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxC,aAAa,EAAE,KAAK;KACrB,CAAC;AACJ,CAAC;AAmBD;sEACsE;AACtE,MAAM,UAAU,eAAe,CAAC,KAAyC;IACvE,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/C,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,OAAO;QAAE,OAAO,GAAG,CAAC;IAC3E,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,sGAAsG,CAAC,CAAC;AACxJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAqB,EACrB,OAAuB,EACvB,UAAkB,EAClB,KAAwC,EACxC,OAAO,GAAsB,EAAE;IAE/B,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,SAAS,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,uBAAuB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC;YACnE,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;QACvG,CAAC;QACD,KAAK,UAAU;YACb,0LAA0L;YAC1L,8PAA8P;YAC9P,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,EAAE,iBAAiB,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;QACzI,KAAK,OAAO;YACV,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IACjE,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAAa,EACb,QAAgB,EAChB,SAAiB,EACjB,OAA0B,EAC1B,QAA4B;IAE5B,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,KAAK,OAAO,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;IACnG,OAAO,aAAa,CAClB,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,EACpF,OAAO,EACP,aAAa,EACb,SAAS,EAAE,CAAC,cAAc,EAC1B,SAAS,EAAE,CAAC,wBAAwB,EAAE,EAAE,IAAI,EAAE,CAC/C,CAAC;AACJ,CAAC;AAED;;kGAEkG;AAClG,SAAS,YAAY,CAAC,KAAsB,EAAE,MAAwB;IACpE,IAAI,KAAK,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,qBAAqB,KAAK,CAAC,MAAM,mIAAmI,CAAC;IAC9K,CAAC;IACD,IAAI,KAAK,CAAC,KAAK,KAAK,WAAW;QAAE,OAAO,2BAA2B,KAAK,CAAC,SAAS,qDAAqD,CAAC;IACxI,IAAI,KAAK,CAAC,KAAK,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC;IAC9C,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;IAC5D,OAAO,CACL,oBAAoB,KAAK,CAAC,KAAK,OAAO,CAAC,EAAE,OAAO,CAAC,MAAM,IAAI,CAAC,iCAAiC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI;QAClI,yDAAyD;QACzD,4IAA4I;QAC5I,qGAAqG;QACrG,CAAC,IAAI,GAAG,CAAC;YACP,CAAC,CAAC,eAAe,IAAI,+IAA+I;YACpK,CAAC,CAAC,GAAG,CAAC,CACT,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAuB,EACvB,OAAoB,EACpB,KAAyB,EACzB,MAAoH;IAEpH,oNAAoN;IACpN,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CACb,wIAAwI;YACtI,mFAAmF,CACtF,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,UAAU,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QACnD,2FAA2F;QAC3F,2FAA2F;QAC3F,MAAM,IAAI,KAAK,CAAC,wIAAwI,CAAC,CAAC;IAC5J,CAAC;IACD,IAAI,MAAM,KAAK,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,uEAAuE,OAAO,CAAC,IAAI,KAAK,CAAC,CAAC;IAC5G,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;QACjC,2EAA2E;QAC3E,2EAA2E;QAC3E,MAAM,IAAI,KAAK,CAAC,iIAAiI,CAAC,CAAC;IACrJ,CAAC;IACD,iGAAiG;IACjG,2FAA2F;IAC3F,iGAAiG;IACjG,2CAA2C;IAC3C,EAAE;IACF,kGAAkG;IAClG,gGAAgG;IAChG,+FAA+F;IAC/F,2FAA2F;IAC3F,MAAM,WAAW,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,wQAAwQ,CAAC,CAAC;IAC5R,CAAC;IAED,gGAAgG;IAChG,4FAA4F;IAC5F,MAAM,aAAa,GAAG,kBAAkB,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IACxG,MAAM,aAAa,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC;IACjH,MAAM,WAAW,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,aAAa,CAAC;IAC3H,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,sCAAsC,MAAM,eAAe,aAAa,CAAC,KAAK,IAAI,aAAa,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,GAAG;YAC5R,kBAAkB,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CACxP,CAAC;IACJ,CAAC;IAED,yFAAyF;IACzF,4FAA4F;IAC5F,gGAAgG;IAChG,qCAAqC;IACrC,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;QACxC,8FAA8F;QAC9F,yFAAyF;QACzF,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,EAAE,CAAC;QACrF,IAAI,OAAO,CAAC,KAAK,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CACb,4FAA4F,IAAI,+BAA+B,OAAO,CAAC,KAAK,CAAC,SAAS,OAAO;gBAC3J,8EAA8E,CACjF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,+FAA+F;IAC/F,8FAA8F;IAC9F,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,OAAO,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC1F,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,8BAA8B,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;IACtJ,CAAC;IAED,6LAA6L;IAC7L,wMAAwM;IACxM,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACb,+IACE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,cAAc,IAAI,CAAC,WAAW,oDAAoD,CAAC,CAAC,CAAC,EAC1G,uEAAuE,CACxE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,eAAe,CAC3B;QACE,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,UAAU,EAAE,KAAK,CAAC,WAAW;QAC7B,eAAe,EAAE,KAAK,CAAC,iBAAiB;QACxC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,0FAA0F;QAC1F,2FAA2F;QAC3F,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,EACD,OAAO,CACR,CAAC;IAEF,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IACjE,OAAO;QACL,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,SAAS,EAAE,UAAU,EAAE;QACvB,KAAK;QACL,WAAW;QACX,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,IAAI;QAClC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClC,CAAC;AACJ,CAAC;AAED,8IAA8I;AAC9I,MAAM,kBAAkB,GAAG,UAAU,CAAC;IAC9B,WAAW,EACT,giEAAgiE;IACliE,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,kBAAkB,EAAE,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC,mDAAmD,CAAC;QACnH,MAAM,EAAE,CAAC;aACN,IAAI,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;aACtC,QAAQ,EAAE;aACV,QAAQ,CACP,qUAAqU,CACtU;QACH,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,gGAAgG,CAAC;QACvI,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kGAAkG,CAAC;QAC9I,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,YAAqC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;QACjI,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,gEAAgE,CAAC;QAC5H,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+DAA+D,CAAC;QAC1G,UAAU,EAAE,CAAC;aACV,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CACP,uNAAuN,CACxN;QACH,MAAM,EAAE,CAAC;aACN,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CAAC,+PAA+P,CAAC;KAC7Q,CAAC;IACF,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC;QACrB,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;QACtB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;QACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sFAAsF,CAAC;QACjI,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kFAAkF,CAAC;KAClI,CAAC;IACF,qEAAqE;IACrE,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG;QACtB,qFAAqF;QACrF,0EAA0E;QAC1E,MAAM,0BAA0B,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;QACxD,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;QAE/C,4EAA4E;QAC5E,sEAAsE;QACtE,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;QACxB,MAAM,EAAE,GAAG,GAAG,CAAC,kBAAkB,EAAE,EAAE,CAAC;QACtC,IAAI,CAAC,EAAE,EAAE,YAAY,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CACb,iGAAiG;gBAC/F,8FAA8F,CACjG,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,OAAO,OAAO,CAAC,MAAM,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QACvG,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,6GAA6G,CAAC,CAAC;QACjI,CAAC;QAED,mFAAmF;QACnF,uFAAuF;QACvF,0EAA0E;QAC1E,6IAA6I;QAC7I,MAAM,GAAG,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC;QACxC,MAAM,aAAa,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QACxC,MAAM,oBAAoB,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACpE,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,EAAE,OAAO,EAAE,oBAAoB,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;QAC9F,MAAM,OAAO,GAAgB;YAC3B,KAAK;YACL,6QAA6Q;YAC7Q,MAAM,EACJ,KAAK,CAAC,KAAK,KAAK,OAAO;gBACrB,CAAC,CAAC,oBAAoB,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,GAAG,CAAC,YAAY,EAAE,CAAC;gBACvG,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC;YAC3B,OAAO,EAAE,GAAG,CAAC,WAAW,EAAE;YAC1B,kFAAkF;YAClF,uFAAuF;YACvF,oBAAoB,EAAE,GAAG,CAAC,wBAAwB,EAAE,EAAE,IAAI,EAAE;YAC5D,MAAM;YACN,OAAO,EAAE,aAAa;SACvB,CAAC;QAEF,+SAA+S;QAC/S,8QAA8Q;QAC9Q,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ;YAChC,CAAC,CAAC,MAAM,uBAAuB,CAAC,OAAO,CAAC,QAAQ,EAAE;gBAC9C,SAAS;gBACT,SAAS,EAAE,OAAO,CAAC,QAAQ;gBAC3B,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,EAAE,EAAE,OAAO,CAAC,IAAI,KAAK,IAAI;aAC1B,CAAC;YACJ,CAAC,CAAC,SAAS,CAAC;QAEd,wFAAwF;QACxF,0FAA0F;QAC1F,wFAAwF;QACxF,iFAAiF;QACjF,oEAAoE;QACpE,0FAA0F;QAC1F,sFAAsF;QACtF,4FAA4F;QAC5F,kFAAkF;QAClF,2FAA2F;QAC3F,uFAAuF;QACvF,yFAAyF;QACzF,yFAAyF;QACzF,0FAA0F;QAC1F,gFAAgF;QAChF,MAAM,OAAO,GAAG,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE;YACzD,QAAQ,EAAE,oBAAoB;YAC9B,SAAS;YACT,UAAU,EAAE,EAAE,CAAC,UAAU;YACzB,SAAS;YACT,qFAAqF;YACrF,oFAAoF;YACpF,8BAA8B;YAC9B,OAAO,EAAE,aAAa;SACvB,CAAC,CAAC;QAEH,qFAAqF;QACrF,uFAAuF;QACvF,uFAAuF;QACvF,yFAAyF;QACzF,yCAAyC;QACzC,EAAE;QACF,2FAA2F;QAC3F,0FAA0F;QAC1F,qFAAqF;QACrF,0FAA0F;QAC1F,8BAA8B;QAC9B,EAAE;QACF,kFAAkF;QAClF,sFAAsF;QACtF,0FAA0F;QAC1F,uFAAuF;QACvF,qFAAqF;QACrF,iFAAiF;QACjF,MAAM,YAAY,GAAG,uBAAuB,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC,CAAC,MAAM,EAAE,IAAI,IAAI,IAAI,CAAC;QACzG,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC;YACzC,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,MAAM,EAAE,YAAY;YACpB,OAAO,EAAE,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC;YACvC,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,KAAK,QAAQ;SAChG,CAAC,CAAC;QACH,MAAM,IAAI,GAAsB,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,CAAC;QAEzD,4GAA4G;QAC5G,4NAA4N;QAC5N,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;QAC1F,IAAI,SAAS,IAAI,WAAW,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC,CAAC;QACtG,CAAC;QACD,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC;QAEhC,MAAM,MAAM,GAAG,MAAM,eAAe,CAClC;YACE,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,IAAI,EAAE,gBAAgB;YACtB,IAAI;YACJ,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM;YACN,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,oFAAoF;YACpF,+EAA+E;YAC/E,mBAAmB;YACnB,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI;YAC1D,gFAAgF;YAChF,0EAA0E;YAC1E,QAAQ,EAAE,KAAK,CAAC,UAAU;YAC1B,KAAK,EAAE,EAAE,UAAU,EAAE,YAAY,CAAC,GAAG,CAAC,EAAE;SACzC;QACD,uFAAuF;QACvF,oFAAoF;QACpF,gBAAgB,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,CACtC,CAAC;QAEF,wEAAwE;QACxE,kFAAkF;QAClF,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACxB,0FAA0F;YAC1F,uFAAuF;YACvF,0EAA0E;YAC1E,yBAAyB,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,mBAAmB,EAAE,eAAe,CAAC,CAAC;YACpF,OAAO;gBACL,SAAS,EAAE,KAAK;gBAChB,YAAY,EAAE,IAAI;gBAClB,SAAS,EAAE,MAAM,CAAC,EAAE;gBACpB,IAAI,EAAE,gBAAgB,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,YAAY,CAAC;aACvE,CAAC;QACJ,CAAC;QACD,4FAA4F;QAC5F,0FAA0F;QAC1F,0FAA0F;QAC1F,oFAAoF;QACpF,yBAAyB,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,mBAAmB,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;QACvH,OAAO;YACL,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,MAAM,CAAC,EAAE;YACpB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,qFAAqF;YACrF,gFAAgF;YAChF,IAAI,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,MAAM,CAAC,EAAE,IAAI,GAAG,cAAc,CAAC,KAAK,EAAE,4BAA4B,EAAE,MAAM,CAAC;SACxJ,CAAC;IACJ,CAAC;CACR,CAAC,CAAC;AACH,uBAAuB,CAAC,gBAAgB,EAAE,SAAS,EAAE,kBAAkB,CAAC,CAAC;AAEzE,sGAAsG;AACtG,6IAA6I;AAC7I,eAAe,aAAa,CAAC;IAC3B,MAAM,EAAE;QACN,iBAAiB,EAAE,GAAG,EAAE,CAAC,kBAAkB;KAC5C;CACF,CAAC,CAAC"}

package/dist/agent/tools/request_credential_grant.d.ts

@@ -0,0 +1,101 @@
+import { type BindableContext } from "../identity/binding.js";
+/** The vendor tool an ask names for `connector` when the caller named none, or `undefined` when this
+ *  tree has no reviewed default. `undefined` refuses the ask — an invented name would put a string
+ *  the owner cannot judge on their card. */
+export declare function defaultGrantTool(connector: string): string | undefined;
+/**
+ * Which seat may raise an ask: a DELEGATED WORKER, and the domain must declare at least one admissible connector on its own `credentialGrants` field. A conversational seat raises none — it hands the job to a worker (OPE-2023).
+ * 🔴 The GRANT is still the CONVERSATION'S — the scope key is the root seat's session (the room's DOMAIN for a `standing` answer, OPE-1950), never the worker's own one-shot session, which ends before the owner taps anything. So this decides WHO MAY ASK and nothing about which conversation may spend. A task-grain session that is nobody's child mounts nothing, and an unattended fire's delegated child names no verified requester, so its ask is refused before any row is written.
+ */
+export declare function requestCredentialGrantMount(ctx: BindableContext): boolean;
+/** TEST SEAM: reset the once-per-session dedupe (unit tests mint many synthetic sessions). */
+export declare function _resetGrantMountAuditForTest(): void;
+/** TEST SEAM: settles once the row this mount floated has been written (or has failed). */
+export declare function _grantMountAuditSettled(): Promise<void>;
+/**
+ * The seat-shape half of the mount, and the same test the execute path runs. A DELEGATED WORKER, and nothing else.
+ * 🔴 THE CONVERSATIONAL SEAT IS NOT HERE (OPE-2023, Tommy's ruling of 2026-09-20). A seat asks a worker for access to Notion exactly as it asks a worker for any other job: it holds the talking verbs and it delegates. The worker has the full kit and a fresh context to decide how, so the one verb that reaches a person's own account belongs on the same side of the seam as the connector calls it exists to unblock.
+ * 🔴 It asks "is this a delegated worker", not "can it name its seat": `session.parent` reaches TOOL and HOOK contexts but NOT a dynamic-resolver context (eve's `buildResolveContext` builds `session` from the id and the auth bag alone), and the mount IS one — so a predicate demanding a nameable root here would refuse every worker at mount time. The nameable-root question is `grantScopeKey`'s, at execute.
+ */
+export declare function mayRaiseGrantAsk(ctx: BindableContext): boolean;
+/**
+ * The SESSION a grant raised here is scoped to — the root SEAT's, never the worker's. It is what a `once` or `session` grant binds to; a `standing` one binds to `grantDomainScopeKey`'s domain key instead (OPE-1950), and the ask records both because the owner's card decides the mode. `currentSessionId` is this session's own durable id, so inside a one-shot worker it names a run that ends minutes before the owner taps anything, and their approval would mount into nothing.
+ * 🔴 A child never falls back to its own session id, and the test for "child" is the parent bag's PRESENCE rather than what it names: eve has renamed that field before, and presence is the one test that does not move with it. The `""` arm is a fail-closed guard against a shape eve does not currently produce, never a floor that fires.
+ */
+export declare function grantScopeKey(ctx: BindableContext): string;
+/** What the owner's card calls the agent when the deployment configures no `identity.name`. A GENERIC
+ *  NOUN PHRASE, never the shipped brand string: the card's first line is where the owner reads WHO is
+ *  asking, and `DEFAULT_AGENT_FULL_NAME` would put a lowercase product name where a name belongs. */
+export declare const UNNAMED_SEAT_LABEL = "the assistant";
+/** Exported for the test pack ALONE. The mount below is the only production reference — the entry is
+ *  pre-registered at module load, exactly like `dm_person`'s. */
+export declare const requestCredentialGrantEntry: import("eve/tools").ToolDefinition<{
+    connector: string;
+    frozen_args?: Record<string, unknown> | undefined;
+    owner: string;
+    purpose: string;
+    requested_mode: "once" | "session" | "standing";
+    target_label: string;
+    tool?: string | undefined;
+}, {
+    asked: boolean;
+    askId?: string | undefined;
+    owner?: string | undefined;
+    message: string;
+}> & {
+    execute(input: {
+        connector: string;
+        frozen_args?: Record<string, unknown> | undefined;
+        owner: string;
+        purpose: string;
+        requested_mode: "once" | "session" | "standing";
+        target_label: string;
+        tool?: string | undefined;
+    }, ctx: import("eve/tools").ToolContext): Promise<{
+        asked: boolean;
+        message: string;
+        askId?: undefined;
+        owner?: undefined;
+    } | {
+        askId: string;
+        asked: boolean;
+        message: string;
+        owner: string;
+    }>;
+};
+declare const _default: import("eve/tools").DynamicSentinel<(import("eve/tools").ToolDefinition<{
+    connector: string;
+    frozen_args?: Record<string, unknown> | undefined;
+    owner: string;
+    purpose: string;
+    requested_mode: "once" | "session" | "standing";
+    target_label: string;
+    tool?: string | undefined;
+}, {
+    asked: boolean;
+    askId?: string | undefined;
+    owner?: string | undefined;
+    message: string;
+}> & {
+    execute(input: {
+        connector: string;
+        frozen_args?: Record<string, unknown> | undefined;
+        owner: string;
+        purpose: string;
+        requested_mode: "once" | "session" | "standing";
+        target_label: string;
+        tool?: string | undefined;
+    }, ctx: import("eve/tools").ToolContext): Promise<{
+        asked: boolean;
+        message: string;
+        askId?: undefined;
+        owner?: undefined;
+    } | {
+        askId: string;
+        asked: boolean;
+        message: string;
+        owner: string;
+    }>;
+}) | null>;
+export default _default;
+//# sourceMappingURL=request_credential_grant.d.ts.map

package/dist/agent/tools/request_credential_grant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request_credential_grant.d.ts","sourceRoot":"","sources":["../../../agent/tools/request_credential_grant.ts"],"names":[],"mappings":"AAqBA,OAAO,EAA+H,KAAK,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAwC3L;;4CAE4C;AAC5C,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEtE;AAwBD;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CA0BzE;AAeD,8FAA8F;AAC9F,wBAAgB,4BAA4B,IAAI,IAAI,CAEnD;AAMD,2FAA2F;AAC3F,wBAAgB,uBAAuB,IAAI,OAAO,CAAC,IAAI,CAAC,CAEvD;AAyDD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAE9D;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,eAAe,GAAG,MAAM,CAK1D;AAED;;qGAEqG;AACrG,eAAO,MAAM,kBAAkB,kBAAkB,CAAC;AAElD;iEACiE;AACjE,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiQtC,CAAC"}