@qduc/term2 0.11.1 → 0.13.0

package/dist/services/approval/approval-decision-executor.js

@@ -0,0 +1,210 @@
+import path from 'node:path';
+import { markToolCallAsApprovalRejection } from '../../utils/streaming/extract-command-messages.js';
+import { getCallIdFromObject, getToolInfoFromInterruption } from '../interruption-info.js';
+import { parseToolCallArguments } from '../tool-call-arguments.js';
+import { createInvalidToolCallDiagnostic } from '../logging/logging-contract.js';
+import { getProjectAllowReadStore } from '../../utils/shell/sandbox/denied-read-stores.js';
+import { isDeniedReadApproveAnswer, isDockerHostControlApproveAnswer, isReadFileSessionApproveAnswer, supportsFolderSessionRead, } from '../../contracts/conversation.js';
+import { isDockerHostControlShellApproval } from './shell-sandbox-approval.js';
+import { resolveSessionReadFolder } from './session-read-grant-target.js';
+import { getActiveWorkspaceRoot } from '../workspace/active-workspace-root.js';
+/**
+ * Applies one already-authorized approval decision to the continuation that
+ * owns it. This is deliberately independent of root `ApprovalState`, turn
+ * generations, and continuation planning so a transferred child lease can use
+ * the exact same capability policy without taking over the root interaction.
+ */
+export class ApprovalDecisionExecutor {
+    deps;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    resolve({ pendingApprovalContext, answer, rejectionReason, source = 'user', }) {
+        const { state, interruption } = pendingApprovalContext;
+        const decisionCallId = getCallIdFromObject(interruption);
+        pendingApprovalContext.decisionsByCallId ??= new Map();
+        const { toolName: decisionToolName, rawArguments: decisionRawArguments } = getToolInfoFromInterruption(interruption);
+        const parsedDecisionArgs = parseToolCallArguments(decisionRawArguments, {
+            callId: decisionCallId ?? String(Date.now()),
+            toolName: decisionToolName,
+            sessionId: this.deps.sessionId,
+            traceId: this.deps.logger.getCorrelationId() ?? 'trace-unknown',
+        }).arguments;
+        const deniedReadDecision = isDeniedReadApproveAnswer(answer);
+        const dockerDecision = isDockerHostControlApproveAnswer(answer);
+        const isDockerRequest = isDockerHostControlShellApproval(decisionToolName, parsedDecisionArgs, this.deps.sessionId, this.deps.sessionAccess, this.deps.nestedCompatibility);
+        const allowReadFolderForSession = isReadFileSessionApproveAnswer(answer) && supportsFolderSessionRead(decisionToolName);
+        const editSessionGrant = this.#getEditSessionGrant(answer, decisionToolName, parsedDecisionArgs);
+        if (allowReadFolderForSession) {
+            const folder = resolveSessionReadFolder(decisionToolName, parsedDecisionArgs);
+            if (folder) {
+                if (this.deps.sessionAccess)
+                    this.deps.sessionAccess.allowReadFolder(folder);
+                else
+                    this.deps.nestedCompatibility?.readAccess.allowFolder(this.deps.sessionId, folder);
+            }
+        }
+        if (editSessionGrant) {
+            if (this.deps.sessionAccess) {
+                if (editSessionGrant.kind === 'file')
+                    this.deps.sessionAccess.allowEditFile(editSessionGrant.path);
+                else
+                    this.deps.sessionAccess.allowEditFolder(editSessionGrant.path);
+            }
+        }
+        // Docker host control is a distinct capability. Generic resume answers
+        // remain rejected even if the tool call otherwise looks approvable.
+        const isApproved = isDockerRequest
+            ? dockerDecision
+            : answer === 'y' || deniedReadDecision || allowReadFolderForSession || editSessionGrant !== null;
+        let toolStartedEvent;
+        if (isApproved) {
+            this.#applyDeniedReadDecision(answer, deniedReadDecision, interruption, decisionCallId);
+            this.#applyDockerDecision(answer, dockerDecision, isDockerRequest, parsedDecisionArgs);
+            this.deps.logger.debug('Tool approval granted', {
+                eventType: 'approval.granted',
+                category: 'approval',
+                phase: 'approval',
+                sessionId: this.deps.sessionId,
+                traceId: this.deps.logger.getCorrelationId(),
+                ...(deniedReadDecision ? { deniedReadDecision: answer } : {}),
+            });
+            const { toolName, rawArguments } = getToolInfoFromInterruption(interruption);
+            const parseResult = parseToolCallArguments(rawArguments, {
+                callId: decisionCallId ?? String(Date.now()),
+                toolName,
+                sessionId: this.deps.sessionId,
+                traceId: this.deps.logger.getCorrelationId() ?? 'trace-unknown',
+            });
+            if (parseResult.invalidJsonDiagnostic) {
+                const diagnostic = createInvalidToolCallDiagnostic(parseResult.invalidJsonDiagnostic);
+                this.deps.logger.error('Invalid tool call argument payload', {
+                    ...diagnostic,
+                    sessionId: this.deps.sessionId,
+                    messageId: decisionCallId ?? String(Date.now()),
+                });
+            }
+            const toolCallId = decisionCallId ?? String(Date.now());
+            toolStartedEvent =
+                pendingApprovalContext.owner.kind === 'subagent'
+                    ? {
+                        type: 'subagent_tool_started',
+                        agentId: pendingApprovalContext.owner.agentId,
+                        role: pendingApprovalContext.owner.role,
+                        toolCallId,
+                        toolName,
+                        arguments: parseResult.arguments,
+                    }
+                    : {
+                        type: 'tool_started',
+                        toolCallId,
+                        toolName,
+                        arguments: parseResult.arguments,
+                    };
+            state.approve?.(interruption);
+            if (decisionCallId)
+                pendingApprovalContext.decisionsByCallId.set(decisionCallId, 'approved');
+        }
+        else {
+            const message = rejectionReason
+                ? `Tool execution was not approved. User's reason: ${rejectionReason}`
+                : 'Tool execution was not approved.';
+            // Rejection settles an indirect Docker denial, otherwise the same
+            // command would require the abandoned prompt again forever.
+            if (isDockerRequest && typeof parsedDecisionArgs?.command === 'string') {
+                if (this.deps.sessionAccess)
+                    this.deps.sessionAccess.consumeDockerDenial(parsedDecisionArgs.command);
+                else
+                    this.deps.nestedCompatibility?.docker.consumeDenial(this.deps.sessionId, parsedDecisionArgs.command);
+            }
+            markToolCallAsApprovalRejection(decisionCallId);
+            state.reject?.(interruption, { message });
+            if (decisionCallId)
+                pendingApprovalContext.decisionsByCallId.set(decisionCallId, 'rejected');
+            this.deps.logger.debug('Tool approval rejected', {
+                eventType: 'approval.rejected',
+                category: 'approval',
+                phase: 'approval',
+                sessionId: this.deps.sessionId,
+                traceId: this.deps.logger.getCorrelationId(),
+            });
+        }
+        if (this.deps.hookLifecycle && this.deps.hookEvents) {
+            void this.deps.hookLifecycle.emit(this.deps.hookEvents.create('approval.resolved', {
+                resolution: isApproved ? (source === 'policy' ? 'auto_approved' : 'approved') : 'rejected',
+                source,
+                executionFollowed: isApproved,
+            }, { toolCallId: decisionCallId }));
+        }
+        return { pendingApprovalContext, isApproved, toolStartedEvent };
+    }
+    #getEditSessionGrant(answer, toolName, args) {
+        if (toolName !== 'apply_patch' && toolName !== 'create_file' && toolName !== 'search_replace')
+            return null;
+        const record = args && typeof args === 'object' ? args : null;
+        const operation = Array.isArray(record?.operations) ? record.operations[0] : record;
+        const rawPath = operation && typeof operation === 'object' && typeof operation.path === 'string'
+            ? operation.path
+            : undefined;
+        if (!rawPath)
+            return null;
+        const target = path.resolve(rawPath);
+        if (answer === 'allow-edit-file-session')
+            return { kind: 'file', path: target };
+        if (answer === 'allow-edit-folder-session')
+            return { kind: 'folder', path: path.dirname(target) };
+        return null;
+    }
+    #applyDeniedReadDecision(answer, deniedReadDecision, interruption, decisionCallId) {
+        if (!deniedReadDecision)
+            return;
+        const { rawArguments } = getToolInfoFromInterruption(interruption);
+        const parsedArgs = parseToolCallArguments(rawArguments, {
+            callId: decisionCallId ?? String(Date.now()),
+            toolName: 'shell',
+            sessionId: this.deps.sessionId,
+            traceId: this.deps.logger.getCorrelationId() ?? 'trace-unknown',
+        });
+        const shellCommand = parsedArgs.arguments?.command;
+        if (typeof shellCommand !== 'string')
+            return;
+        const stagedInfo = this.deps.nestedCompatibility?.deniedReads.consumeStaged(shellCommand);
+        if (!stagedInfo)
+            return;
+        if (answer === 'allow-once' || answer === 'allow-remember') {
+            this.deps.nestedCompatibility?.executionOverrides.set(shellCommand, {
+                extraAllowRead: [stagedInfo.suggestedParent],
+            });
+            if (answer === 'allow-remember') {
+                // Key the grant to the root the command actually ran under, so a grant
+                // made in one worktree does not silently authorize another.
+                getProjectAllowReadStore(getActiveWorkspaceRoot()).append(stagedInfo.suggestedParent);
+                this.deps.logger.security('Sandbox allowed-read path remembered for project', {
+                    path: stagedInfo.suggestedParent,
+                    deniedPath: stagedInfo.path,
+                    sensitive: stagedInfo.sensitive,
+                    sessionId: this.deps.sessionId,
+                });
+            }
+        }
+        else if (answer === 'unsandboxed-once') {
+            this.deps.nestedCompatibility?.executionOverrides.set(shellCommand, { forceUnsandboxed: true });
+        }
+    }
+    #applyDockerDecision(answer, dockerDecision, isDockerRequest, parsedDecisionArgs) {
+        if (!dockerDecision || !isDockerRequest || typeof parsedDecisionArgs?.command !== 'string')
+            return;
+        const cwd = typeof parsedDecisionArgs.cwd === 'string' ? parsedDecisionArgs.cwd : getActiveWorkspaceRoot();
+        const scope = answer === 'docker-allow-once' ? 'once' : answer === 'docker-allow-session' ? 'session' : 'project';
+        if (this.deps.sessionAccess)
+            this.deps.sessionAccess.grantDocker(parsedDecisionArgs.command, cwd, scope);
+        else
+            this.deps.nestedCompatibility?.docker.grant({
+                command: parsedDecisionArgs.command,
+                cwd,
+                scope,
+                sessionId: this.deps.sessionId,
+            });
+    }
+}
+//# sourceMappingURL=approval-decision-executor.js.map

package/dist/services/approval/approval-decision-executor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-decision-executor.js","sourceRoot":"","sources":["../../../source/services/approval/approval-decision-executor.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,OAAO,EAAE,+BAA+B,EAAE,MAAM,mDAAmD,CAAC;AACpG,OAAO,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AAC3F,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EAAE,+BAA+B,EAAE,MAAM,gCAAgC,CAAC;AACjF,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,EACL,yBAAyB,EACzB,gCAAgC,EAChC,8BAA8B,EAC9B,yBAAyB,GAC1B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,gCAAgC,EAAE,MAAM,6BAA6B,CAAC;AAC/E,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAM1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AA4B/E;;;;;GAKG;AACH,MAAM,OAAO,wBAAwB;IACN,IAAI;IAAjC,YAA6B,IAAkC;oBAAlC,IAAI;IAAiC,CAAC;IAEnE,OAAO,CAAC,EACN,sBAAsB,EACtB,MAAM,EACN,eAAe,EACf,MAAM,GAAG,MAAM,GACc;QAC7B,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,sBAAsB,CAAC;QACvD,MAAM,cAAc,GAAG,mBAAmB,CAAC,YAAY,CAAC,CAAC;QACzD,sBAAsB,CAAC,iBAAiB,KAAK,IAAI,GAAG,EAAE,CAAC;QAEvD,MAAM,EAAE,QAAQ,EAAE,gBAAgB,EAAE,YAAY,EAAE,oBAAoB,EAAE,GACtE,2BAA2B,CAAC,YAAY,CAAC,CAAC;QAC5C,MAAM,kBAAkB,GAAG,sBAAsB,CAAC,oBAAoB,EAAE;YACtE,MAAM,EAAE,cAAc,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YAC5C,QAAQ,EAAE,gBAAgB;YAC1B,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS;YAC9B,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,IAAI,eAAe;SAChE,CAAC,CAAC,SAAwD,CAAC;QAC5D,MAAM,kBAAkB,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;QAC7D,MAAM,cAAc,GAAG,gCAAgC,CAAC,MAAM,CAAC,CAAC;QAChE,MAAM,eAAe,GAAG,gCAAgC,CACtD,gBAAgB,EAChB,kBAAkB,EAClB,IAAI,CAAC,IAAI,CAAC,SAAS,EACnB,IAAI,CAAC,IAAI,CAAC,aAAa,EACvB,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAC9B,CAAC;QACF,MAAM,yBAAyB,GAC7B,8BAA8B,CAAC,MAAM,CAAC,IAAI,yBAAyB,CAAC,gBAAgB,CAAC,CAAC;QACxF,MAAM,gBAAgB,GAAG,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;QAEjG,IAAI,yBAAyB,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,wBAAwB,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;YAC9E,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa;oBAAE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;;oBACxE,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YAC1F,CAAC;QACH,CAAC;QACD,IAAI,gBAAgB,EAAE,CAAC;YACrB,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;gBAC5B,IAAI,gBAAgB,CAAC,IAAI,KAAK,MAAM;oBAAE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;;oBAC9F,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;YACtE,CAAC;QACH,CAAC;QAED,uEAAuE;QACvE,oEAAoE;QACpE,MAAM,UAAU,GAAG,eAAe;YAChC,CAAC,CAAC,cAAc;YAChB,CAAC,CAAC,MAAM,KAAK,GAAG,IAAI,kBAAkB,IAAI,yBAAyB,IAAI,gBAAgB,KAAK,IAAI,CAAC;QACnG,IAAI,gBAA+C,CAAC;QAEpD,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,CAAC,wBAAwB,CAAC,MAAM,EAAE,kBAAkB,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC;YACxF,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,cAAc,EAAE,eAAe,EAAE,kBAAkB,CAAC,CAAC;YAEvF,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,EAAE;gBAC9C,SAAS,EAAE,kBAAkB;gBAC7B,QAAQ,EAAE,UAAU;gBACpB,KAAK,EAAE,UAAU;gBACjB,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS;gBAC9B,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE;gBAC5C,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9D,CAAC,CAAC;YAEH,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,2BAA2B,CAAC,YAAY,CAAC,CAAC;YAC7E,MAAM,WAAW,GAAG,sBAAsB,CAAC,YAAY,EAAE;gBACvD,MAAM,EAAE,cAAc,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;gBAC5C,QAAQ;gBACR,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS;gBAC9B,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,IAAI,eAAe;aAChE,CAAC,CAAC;YACH,IAAI,WAAW,CAAC,qBAAqB,EAAE,CAAC;gBACtC,MAAM,UAAU,GAAG,+BAA+B,CAAC,WAAW,CAAC,qBAAqB,CAAC,CAAC;gBACtF,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oCAAoC,EAAE;oBAC3D,GAAG,UAAU;oBACb,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS;oBAC9B,SAAS,EAAE,cAAc,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;iBAChD,CAAC,CAAC;YACL,CAAC;YAED,MAAM,UAAU,GAAG,cAAc,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YACxD,gBAAgB;gBACd,sBAAsB,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU;oBAC9C,CAAC,CAAC;wBACE,IAAI,EAAE,uBAAuB;wBAC7B,OAAO,EAAE,sBAAsB,CAAC,KAAK,CAAC,OAAO;wBAC7C,IAAI,EAAE,sBAAsB,CAAC,KAAK,CAAC,IAAI;wBACvC,UAAU;wBACV,QAAQ;wBACR,SAAS,EAAE,WAAW,CAAC,SAAS;qBACjC;oBACH,CAAC,CAAC;wBACE,IAAI,EAAE,cAAc;wBACpB,UAAU;wBACV,QAAQ;wBACR,SAAS,EAAE,WAAW,CAAC,SAAS;qBACjC,CAAC;YAER,KAAK,CAAC,OAAO,EAAE,CAAC,YAAY,CAAC,CAAC;YAC9B,IAAI,cAAc;gBAAE,sBAAsB,CAAC,iBAAiB,CAAC,GAAG,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;QAC/F,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,eAAe;gBAC7B,CAAC,CAAC,mDAAmD,eAAe,EAAE;gBACtE,CAAC,CAAC,kCAAkC,CAAC;YAEvC,kEAAkE;YAClE,4DAA4D;YAC5D,IAAI,eAAe,IAAI,OAAO,kBAAkB,EAAE,OAAO,KAAK,QAAQ,EAAE,CAAC;gBACvE,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa;oBAAE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;;oBAChG,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,kBAAkB,CAAC,OAAO,CAAC,CAAC;YAC5G,CAAC;YAED,+BAA+B,CAAC,cAAc,CAAC,CAAC;YAChD,KAAK,CAAC,MAAM,EAAE,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YAC1C,IAAI,cAAc;gBAAE,sBAAsB,CAAC,iBAAiB,CAAC,GAAG,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;YAE7F,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE;gBAC/C,SAAS,EAAE,mBAAmB;gBAC9B,QAAQ,EAAE,UAAU;gBACpB,KAAK,EAAE,UAAU;gBACjB,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS;gBAC9B,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE;aAC7C,CAAC,CAAC;QACL,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACpD,KAAK,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAC/B,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CACzB,mBAAmB,EACnB;gBACE,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU;gBAC1F,MAAM;gBACN,iBAAiB,EAAE,UAAU;aAC9B,EACD,EAAE,UAAU,EAAE,cAAc,EAAE,CAC/B,CACF,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,gBAAgB,EAAE,CAAC;IAClE,CAAC;IAED,oBAAoB,CAClB,MAAc,EACd,QAA4B,EAC5B,IAAa;QAEb,IAAI,QAAQ,KAAK,aAAa,IAAI,QAAQ,KAAK,aAAa,IAAI,QAAQ,KAAK,gBAAgB;YAAE,OAAO,IAAI,CAAC;QAC3G,MAAM,MAAM,GAAG,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAiD,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5G,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QACpF,MAAM,OAAO,GACX,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,OAAQ,SAAgC,CAAC,IAAI,KAAK,QAAQ;YACtG,CAAC,CAAE,SAA8B,CAAC,IAAI;YACtC,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,MAAM,KAAK,yBAAyB;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAChF,IAAI,MAAM,KAAK,2BAA2B;YAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClG,OAAO,IAAI,CAAC;IACd,CAAC;IAED,wBAAwB,CACtB,MAAc,EACd,kBAA2B,EAC3B,YAAqB,EACrB,cAAkC;QAElC,IAAI,CAAC,kBAAkB;YAAE,OAAO;QAEhC,MAAM,EAAE,YAAY,EAAE,GAAG,2BAA2B,CAAC,YAAY,CAAC,CAAC;QACnE,MAAM,UAAU,GAAG,sBAAsB,CAAC,YAAY,EAAE;YACtD,MAAM,EAAE,cAAc,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YAC5C,QAAQ,EAAE,OAAO;YACjB,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS;YAC9B,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,IAAI,eAAe;SAChE,CAAC,CAAC;QACH,MAAM,YAAY,GAAI,UAAU,CAAC,SAAyC,EAAE,OAAO,CAAC;QACpF,IAAI,OAAO,YAAY,KAAK,QAAQ;YAAE,OAAO;QAE7C,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,WAAW,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QAC1F,IAAI,CAAC,UAAU;YAAE,OAAO;QAExB,IAAI,MAAM,KAAK,YAAY,IAAI,MAAM,KAAK,gBAAgB,EAAE,CAAC;YAC3D,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,kBAAkB,CAAC,GAAG,CAAC,YAAY,EAAE;gBAClE,cAAc,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC;aAC7C,CAAC,CAAC;YACH,IAAI,MAAM,KAAK,gBAAgB,EAAE,CAAC;gBAChC,uEAAuE;gBACvE,4DAA4D;gBAC5D,wBAAwB,CAAC,sBAAsB,EAAE,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;gBACtF,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,kDAAkD,EAAE;oBAC5E,IAAI,EAAE,UAAU,CAAC,eAAe;oBAChC,UAAU,EAAE,UAAU,CAAC,IAAI;oBAC3B,SAAS,EAAE,UAAU,CAAC,SAAS;oBAC/B,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS;iBAC/B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;aAAM,IAAI,MAAM,KAAK,kBAAkB,EAAE,CAAC;YACzC,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,kBAAkB,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;QAClG,CAAC;IACH,CAAC;IAED,oBAAoB,CAClB,MAAc,EACd,cAAuB,EACvB,eAAwB,EACxB,kBAA+D;QAE/D,IAAI,CAAC,cAAc,IAAI,CAAC,eAAe,IAAI,OAAO,kBAAkB,EAAE,OAAO,KAAK,QAAQ;YAAE,OAAO;QAEnG,MAAM,GAAG,GAAG,OAAO,kBAAkB,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,sBAAsB,EAAE,CAAC;QAC3G,MAAM,KAAK,GAAG,MAAM,KAAK,mBAAmB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,KAAK,sBAAsB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QAClH,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa;YAAE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,kBAAkB,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;;YAEvG,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAC,KAAK,CAAC;gBAC1C,OAAO,EAAE,kBAAkB,CAAC,OAAO;gBACnC,GAAG;gBACH,KAAK;gBACL,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS;aAC/B,CAAC,CAAC;IACP,CAAC;CACF"}

package/dist/services/approval/approval-decision-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"approval-decision-policy.d.ts","sourceRoot":"","sources":["../../../source/services/approval/approval-decision-policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAEnF,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,SAAS,GAAG,QAAQ,GAAG,QAAQ,CAAC,CAAC;CAC5E;AAED,qBAAa,4BAA6B,YAAW,sBAAsB;IACnE,MAAM,IAAI,OAAO,CAAC,QAAQ,CAAC,CAEhC;CACF;AAED,qBAAa,+BAAgC,YAAW,sBAAsB;IAChE,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAA9C,YAA6B,iBAAiB,EAAE,yBAAyB,EAAI;IAEvE,MAAM,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,SAAS,GAAG,QAAQ,CAAC,CAKpE;CACF"}
+{"version":3,"file":"approval-decision-policy.d.ts","sourceRoot":"","sources":["../../../source/services/approval/approval-decision-policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAEnF,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,SAAS,GAAG,QAAQ,GAAG,QAAQ,CAAC,CAAC;CAC5E;AAED,qBAAa,4BAA6B,YAAW,sBAAsB;IACnE,MAAM,IAAI,OAAO,CAAC,QAAQ,CAAC,CAEhC;CACF;AAED,qBAAa,+BAAgC,YAAW,sBAAsB;IAChE,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAA9C,YAA6B,iBAAiB,EAAE,yBAAyB,EAAI;IAEvE,MAAM,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,SAAS,GAAG,QAAQ,CAAC,CAIpE;CACF"}

package/dist/services/approval/approval-decision-policy.js

@@ -11,8 +11,6 @@ export class ShellAutoApprovalDecisionPolicy {
     async decide(context) {
         if (context.toolName !== 'shell' && context.toolName !== 'bash')
             return 'prompt';
-        if (!context.llmAdvisory)
-            return 'prompt';
         if (this.shellAutoApproval.shouldAutoApprove(context.llmAdvisory))
             return 'approve';
         return 'prompt';

package/dist/services/approval/approval-decision-policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"approval-decision-policy.js","sourceRoot":"","sources":["../../../source/services/approval/approval-decision-policy.ts"],"names":[],"mappings":"AAcA,MAAM,OAAO,4BAA4B;IACvC,KAAK,CAAC,MAAM;QACV,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF;AAED,MAAM,OAAO,+BAA+B;IACb,iBAAiB;IAA9C,YAA6B,iBAA4C;iCAA5C,iBAAiB;IAA8B,CAAC;IAE7E,KAAK,CAAC,MAAM,CAAC,OAAwB;QACnC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM;YAAE,OAAO,QAAQ,CAAC;QACjF,IAAI,CAAC,OAAO,CAAC,WAAW;YAAE,OAAO,QAAQ,CAAC;QAC1C,IAAI,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,OAAO,CAAC,WAAW,CAAC;YAAE,OAAO,SAAS,CAAC;QACpF,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}
+{"version":3,"file":"approval-decision-policy.js","sourceRoot":"","sources":["../../../source/services/approval/approval-decision-policy.ts"],"names":[],"mappings":"AAcA,MAAM,OAAO,4BAA4B;IACvC,KAAK,CAAC,MAAM;QACV,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF;AAED,MAAM,OAAO,+BAA+B;IACb,iBAAiB;IAA9C,YAA6B,iBAA4C;iCAA5C,iBAAiB;IAA8B,CAAC;IAE7E,KAAK,CAAC,MAAM,CAAC,OAAwB;QACnC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM;YAAE,OAAO,QAAQ,CAAC;QACjF,IAAI,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,OAAO,CAAC,WAAW,CAAC;YAAE,OAAO,SAAS,CAAC;QACpF,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}

package/dist/services/approval/approval-flow-coordinator.d.ts

@@ -4,6 +4,13 @@ import { ApprovalState, type AbortedApprovalContext, type PendingApprovalContext
 import type { ConversationAgentClient } from '../conversation-agent-client.js';
 import { SessionToolTracker } from '../session/session-tool-tracker.js';
 import { GenerationGuard } from '../generation-guard.js';
+import type { ToolOwner } from './tool-owner.js';
+import { ToolOwnershipRegistry } from './tool-ownership-registry.js';
+import type { SessionAccessState } from '../session/session-access-state.js';
+import type { NestedToolCompatibilityState } from '../session/nested-tool-compatibility-state.js';
+import type { HookLifecyclePort } from '../hooks/hook-service.js';
+import type { HookEventFactory } from '../hooks/hook-event-factory.js';
+import { type ApprovalDecisionSource } from './approval-decision-executor.js';
 export interface ApprovalFlowCoordinatorDeps {
     agentClient: ConversationAgentClient;
     approvalState: ApprovalState;
@@ -11,28 +18,39 @@ export interface ApprovalFlowCoordinatorDeps {
     sessionId: string;
     toolTracker: SessionToolTracker;
     generationGuard: GenerationGuard;
+    /** Session-owned registry shared with nested subagent runners. */
+    toolOwnership: ToolOwnershipRegistry;
+    /** Handle-owned root capability; omitted only by nested compatibility fixtures. */
+    sessionAccess?: SessionAccessState;
+    /** Explicit nested/test-only legacy approval state. */
+    nestedCompatibility?: NestedToolCompatibilityState;
+    hookLifecycle?: HookLifecyclePort;
+    hookEvents?: HookEventFactory;
 }
 export interface AbortResolutionPlan {
     abortedContext: AbortedApprovalContext;
-    /** Cleanup that removes the rejection interceptor; always safe to call. */
-    removeInterceptor: () => void;
 }
 export interface ContinuationPlan {
     pendingApprovalContext: PendingApprovalContext;
     toolStartedEvent?: ConversationEvent;
-    /** Cleanup that removes the rejection interceptor; always safe to call. */
-    removeInterceptor: () => void;
 }
 export type ApprovalDecisionInput = {
     kind: 'approval_decision';
     answer: string;
     rejectionReason?: string;
     generation: number;
+    stopAfterApprovalResolution?: boolean;
 };
 export declare class ApprovalFlowCoordinator {
+    #private;
     private readonly deps;
     constructor(deps: ApprovalFlowCoordinatorDeps);
-    buildApprovalDecision(answer: string, rejectionReason?: string): ApprovalDecisionInput;
+    /**
+     * Which agent issued this pending tool call. A subagent claims its own
+     * approvals when it raises them; anything unclaimed is the parent's.
+     */
+    resolveOwner(interruption: unknown): ToolOwner;
+    buildApprovalDecision(answer: string, rejectionReason?: string, stopAfterApprovalResolution?: boolean): ApprovalDecisionInput;
     abort(): {
         aborted: boolean;
         callId?: string;
@@ -55,10 +73,9 @@ export declare class ApprovalFlowCoordinator {
     prepareAbortResolution(abortedContext: AbortedApprovalContext, userText: string): AbortResolutionPlan;
     /**
      * Prepare for a continuation after the user makes an approval decision.
-     * Returns null if there is no pending approval. Caller is responsible for invoking
-     * `removeInterceptor` in a finally block once the continuation stream completes.
+     * Returns null if there is no pending approval.
      */
-    prepareContinuation(answer: string, rejectionReason: string | undefined): ContinuationPlan | null;
+    prepareContinuation(answer: string, rejectionReason: string | undefined, source?: ApprovalDecisionSource): ContinuationPlan | null;
     recordPending(pending: PendingApprovalContext): void;
     clearPending(): void;
     getPending(): PendingApprovalContext | null;

package/dist/services/approval/approval-flow-coordinator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"approval-flow-coordinator.d.ts","sourceRoot":"","sources":["../../../source/services/approval/approval-flow-coordinator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAChF,OAAO,EAAE,aAAa,EAAE,KAAK,sBAAsB,EAAE,KAAK,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAK9G,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC/E,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAsBzD,MAAM,WAAW,2BAA2B;IAC1C,WAAW,EAAE,uBAAuB,CAAC;IACrC,aAAa,EAAE,aAAa,CAAC;IAC7B,MAAM,EAAE,eAAe,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,kBAAkB,CAAC;IAChC,eAAe,EAAE,eAAe,CAAC;CAClC;AAED,MAAM,WAAW,mBAAmB;IAClC,cAAc,EAAE,sBAAsB,CAAC;IACvC,2EAA2E;IAC3E,iBAAiB,EAAE,MAAM,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,gBAAgB;IAC/B,sBAAsB,EAAE,sBAAsB,CAAC;IAC/C,gBAAgB,CAAC,EAAE,iBAAiB,CAAC;IACrC,2EAA2E;IAC3E,iBAAiB,EAAE,MAAM,IAAI,CAAC;CAC/B;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC,IAAI,EAAE,mBAAmB,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,qBAAa,uBAAuB;IACtB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAjC,YAA6B,IAAI,EAAE,2BAA2B,EAAI;IAElE,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,MAAM,GAAG,qBAAqB,CAOrF;IAED,KAAK,IAAI;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAgB7C;IAED,cAAc,IAAI,sBAAsB,GAAG,IAAI,CAE9C;IAED,gBAAgB,IAAI;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,IAAI,EAAE,SAAS,CAAC;QAAC,OAAO,EAAE,sBAAsB,CAAA;KAAE,GAAG;QAAE,IAAI,EAAE,OAAO,CAAA;KAAE,CAU9G;IAED;;;;;OAKG;IACH,sBAAsB,CAAC,cAAc,EAAE,sBAAsB,EAAE,QAAQ,EAAE,MAAM,GAAG,mBAAmB,CAapG;IAED;;;;OAIG;IACH,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,SAAS,GAAG,gBAAgB,GAAG,IAAI,CA4KhG;IAED,aAAa,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI,CAEnD;IAED,YAAY,IAAI,IAAI,CAEnB;IAED,UAAU,IAAI,sBAAsB,GAAG,IAAI,CAE1C;IAED,sBAAsB,IAAI,OAAO,CAEhC;IAED,2BAA2B,CAAC,YAAY,EAAE,OAAO,GAAG,sBAAsB,GAAG,IAAI,CAahF;CACF"}
+{"version":3,"file":"approval-flow-coordinator.d.ts","sourceRoot":"","sources":["../../../source/services/approval/approval-flow-coordinator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAChF,OAAO,EAAE,aAAa,EAAE,KAAK,sBAAsB,EAAE,KAAK,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAG9G,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC/E,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAC7E,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,+CAA+C,CAAC;AAClG,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EAA4B,KAAK,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAExG,MAAM,WAAW,2BAA2B;IAC1C,WAAW,EAAE,uBAAuB,CAAC;IACrC,aAAa,EAAE,aAAa,CAAC;IAC7B,MAAM,EAAE,eAAe,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,kBAAkB,CAAC;IAChC,eAAe,EAAE,eAAe,CAAC;IACjC,kEAAkE;IAClE,aAAa,EAAE,qBAAqB,CAAC;IACrC,mFAAmF;IACnF,aAAa,CAAC,EAAE,kBAAkB,CAAC;IACnC,uDAAuD;IACvD,mBAAmB,CAAC,EAAE,4BAA4B,CAAC;IACnD,aAAa,CAAC,EAAE,iBAAiB,CAAC;IAClC,UAAU,CAAC,EAAE,gBAAgB,CAAC;CAC/B;AAED,MAAM,WAAW,mBAAmB;IAClC,cAAc,EAAE,sBAAsB,CAAC;CACxC;AAED,MAAM,WAAW,gBAAgB;IAC/B,sBAAsB,EAAE,sBAAsB,CAAC;IAC/C,gBAAgB,CAAC,EAAE,iBAAiB,CAAC;CACtC;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC,IAAI,EAAE,mBAAmB,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,2BAA2B,CAAC,EAAE,OAAO,CAAC;CACvC,CAAC;AAEF,qBAAa,uBAAuB;;IAItB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAjC,YAA6B,IAAI,EAAE,2BAA2B,EAU7D;IAED;;;OAGG;IACH,YAAY,CAAC,YAAY,EAAE,OAAO,GAAG,SAAS,CAE7C;IAED,qBAAqB,CACnB,MAAM,EAAE,MAAM,EACd,eAAe,CAAC,EAAE,MAAM,EACxB,2BAA2B,CAAC,EAAE,OAAO,GACpC,qBAAqB,CAQvB;IAED,KAAK,IAAI;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAgB7C;IAED,cAAc,IAAI,sBAAsB,GAAG,IAAI,CAE9C;IAED,gBAAgB,IAAI;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,IAAI,EAAE,SAAS,CAAC;QAAC,OAAO,EAAE,sBAAsB,CAAA;KAAE,GAAG;QAAE,IAAI,EAAE,OAAO,CAAA;KAAE,CAU9G;IAED;;;;;OAKG;IACH,sBAAsB,CAAC,cAAc,EAAE,sBAAsB,EAAE,QAAQ,EAAE,MAAM,GAAG,mBAAmB,CAapG;IAED;;;OAGG;IACH,mBAAmB,CACjB,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,MAAM,GAAG,SAAS,EACnC,MAAM,GAAE,sBAA+B,GACtC,gBAAgB,GAAG,IAAI,CAazB;IAED,aAAa,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI,CAEnD;IAED,YAAY,IAAI,IAAI,CAEnB;IAED,UAAU,IAAI,sBAAsB,GAAG,IAAI,CAE1C;IAED,sBAAsB,IAAI,OAAO,CAEhC;IAED,2BAA2B,CAAC,YAAY,EAAE,OAAO,GAAG,sBAAsB,GAAG,IAAI,CAahF;CACF"}

package/dist/services/approval/approval-flow-coordinator.js

@@ -1,25 +1,36 @@
 import { markToolCallAsApprovalRejection } from '../../utils/streaming/extract-command-messages.js';
-import { getCallIdFromObject, getToolInfoFromInterruption } from '../interruption-info.js';
-import { parseToolCallArguments } from '../tool-call-arguments.js';
-import { createInvalidToolCallDiagnostic } from '../logging/logging-contract.js';
-import { resolveToolOwner } from './tool-owner.js';
-import { deniedReadStore, executionOverrideStore, getProjectAllowReadStore, } from '../../utils/shell/sandbox/denied-read-stores.js';
-import { isDeniedReadApproveAnswer, isDockerHostControlApproveAnswer, isReadFileSessionApproveAnswer, } from '../../contracts/conversation.js';
-import path from 'node:path';
-import { sessionReadAccess } from './session-read-access.js';
-import { consumeDockerHostControlDenial, grantDockerHostControl, requiresDockerHostControlApproval, } from '../../utils/shell/sandbox/docker-host-control-grants.js';
-const noop = () => undefined;
+import { getCallIdFromObject } from '../interruption-info.js';
+import { ApprovalDecisionExecutor } from './approval-decision-executor.js';
 export class ApprovalFlowCoordinator {
     deps;
+    #toolOwnership;
+    #decisionExecutor;
     constructor(deps) {
         this.deps = deps;
+        this.#toolOwnership = deps.toolOwnership;
+        this.#decisionExecutor = new ApprovalDecisionExecutor({
+            logger: deps.logger,
+            sessionId: deps.sessionId,
+            sessionAccess: deps.sessionAccess,
+            nestedCompatibility: deps.nestedCompatibility,
+            hookLifecycle: deps.hookLifecycle,
+            hookEvents: deps.hookEvents,
+        });
+    }
+    /**
+     * Which agent issued this pending tool call. A subagent claims its own
+     * approvals when it raises them; anything unclaimed is the parent's.
+     */
+    resolveOwner(interruption) {
+        return this.#toolOwnership.ownerOf(getCallIdFromObject(interruption));
     }
-    buildApprovalDecision(answer, rejectionReason) {
+    buildApprovalDecision(answer, rejectionReason, stopAfterApprovalResolution) {
         return {
             kind: 'approval_decision',
             answer,
             rejectionReason,
             generation: this.deps.approvalState.getPending()?.token ?? 0,
+            ...(stopAfterApprovalResolution ? { stopAfterApprovalResolution: true } : {}),
         };
     }
     abort() {
@@ -63,173 +74,29 @@ export class ApprovalFlowCoordinator {
         const expectedCallId = getCallIdFromObject(abortedContext.interruption);
         const rejectionMessage = `Tool execution was not approved. User provided new input instead: ${userText}`;
         markToolCallAsApprovalRejection(expectedCallId);
-        abortedContext.state.reject(abortedContext.interruption, { message: rejectionMessage });
+        abortedContext.state.reject?.(abortedContext.interruption, { message: rejectionMessage });
         abortedContext.decisionsByCallId ??= new Map();
         if (expectedCallId) {
             abortedContext.decisionsByCallId.set(expectedCallId, 'rejected');
         }
-        return { abortedContext, removeInterceptor: noop };
+        return { abortedContext };
     }
     /**
      * Prepare for a continuation after the user makes an approval decision.
-     * Returns null if there is no pending approval. Caller is responsible for invoking
-     * `removeInterceptor` in a finally block once the continuation stream completes.
+     * Returns null if there is no pending approval.
      */
-    prepareContinuation(answer, rejectionReason) {
+    prepareContinuation(answer, rejectionReason, source = 'user') {
         const pendingApprovalContext = this.deps.approvalState.getPending();
         if (!pendingApprovalContext) {
             return null;
         }
-        const { state, interruption } = pendingApprovalContext;
-        const decisionCallId = getCallIdFromObject(interruption);
-        pendingApprovalContext.decisionsByCallId ??= new Map();
-        let toolStartedEvent;
-        // Denied-read decision values require approval (SDK resumes) plus an execution override.
-        const deniedReadDecision = isDeniedReadApproveAnswer(answer);
-        const { toolName: decisionToolName, rawArguments: decisionRawArguments } = getToolInfoFromInterruption(interruption);
-        const parsedDecisionArgs = parseToolCallArguments(decisionRawArguments, {
-            callId: decisionCallId ?? String(Date.now()),
-            toolName: decisionToolName,
-            sessionId: this.deps.sessionId,
-            traceId: this.deps.logger.getCorrelationId() ?? 'trace-unknown',
-        }).arguments;
-        const dockerDecision = isDockerHostControlApproveAnswer(answer);
-        const isDockerRequest = decisionToolName === 'shell' &&
-            typeof parsedDecisionArgs?.command === 'string' &&
-            requiresDockerHostControlApproval(parsedDecisionArgs.command);
-        let allowReadFolderForSession = false;
-        if (isReadFileSessionApproveAnswer(answer) && decisionToolName === 'read_file') {
-            const parsedReadArgs = parseToolCallArguments(decisionRawArguments, {
-                callId: decisionCallId ?? String(Date.now()),
-                toolName: decisionToolName,
-                sessionId: this.deps.sessionId,
-                traceId: this.deps.logger.getCorrelationId() ?? 'trace-unknown',
-            });
-            const requestedPath = parsedReadArgs.arguments?.path;
-            if (typeof requestedPath === 'string' && requestedPath.length > 0) {
-                sessionReadAccess.allowFolder(this.deps.sessionId, path.dirname(requestedPath));
-                allowReadFolderForSession = true;
-            }
-        }
-        // Docker host control is a distinct capability: ordinary approval answers
-        // must not resume it, because resumption without a matching grant would
-        // make generic/programmatic continuation a host-access bypass.
-        const isApproved = isDockerRequest
-            ? dockerDecision
-            : answer === 'y' || deniedReadDecision || allowReadFolderForSession;
-        if (isApproved) {
-            // For denied-read decisions, set the execution override before the SDK resumes.
-            if (deniedReadDecision) {
-                const { rawArguments } = getToolInfoFromInterruption(interruption);
-                const parsedArgs = parseToolCallArguments(rawArguments, {
-                    callId: decisionCallId ?? String(Date.now()),
-                    toolName: 'shell',
-                    sessionId: this.deps.sessionId,
-                    traceId: this.deps.logger.getCorrelationId() ?? 'trace-unknown',
-                });
-                const shellCommand = parsedArgs.arguments?.command;
-                if (typeof shellCommand === 'string') {
-                    const stagedInfo = deniedReadStore.consumeStaged(shellCommand);
-                    if (stagedInfo) {
-                        if (answer === 'allow-once' || answer === 'allow-remember') {
-                            executionOverrideStore.set(shellCommand, {
-                                extraAllowRead: [stagedInfo.suggestedParent],
-                            });
-                            if (answer === 'allow-remember') {
-                                getProjectAllowReadStore(process.cwd()).append(stagedInfo.suggestedParent);
-                                this.deps.logger.security('Sandbox allowed-read path remembered for project', {
-                                    path: stagedInfo.suggestedParent,
-                                    deniedPath: stagedInfo.path,
-                                    sensitive: stagedInfo.sensitive,
-                                    sessionId: this.deps.sessionId,
-                                });
-                            }
-                        }
-                        else if (answer === 'unsandboxed-once') {
-                            executionOverrideStore.set(shellCommand, { forceUnsandboxed: true });
-                        }
-                    }
-                }
-            }
-            if (dockerDecision && isDockerRequest && typeof parsedDecisionArgs?.command === 'string') {
-                const cwd = typeof parsedDecisionArgs.cwd === 'string' ? parsedDecisionArgs.cwd : process.cwd();
-                const scope = answer === 'docker-allow-once' ? 'once' : answer === 'docker-allow-session' ? 'session' : 'project';
-                grantDockerHostControl({ command: parsedDecisionArgs.command, cwd, scope, sessionId: this.deps.sessionId });
-                // The pending block is left in place deliberately: for an indirect
-                // invocation it is the only thing that tells `execute` this command
-                // needs host control. `execute` consumes it when it creates the control.
-            }
-            this.deps.logger.debug('Tool approval granted', {
-                eventType: 'approval.granted',
-                category: 'approval',
-                phase: 'approval',
-                sessionId: this.deps.sessionId,
-                traceId: this.deps.logger.getCorrelationId(),
-                ...(deniedReadDecision ? { deniedReadDecision: answer } : {}),
-            });
-            const { toolName, rawArguments } = getToolInfoFromInterruption(interruption);
-            const callId = decisionCallId;
-            const parseResult = parseToolCallArguments(rawArguments, {
-                callId: callId ?? String(Date.now()),
-                toolName,
-                sessionId: this.deps.sessionId,
-                traceId: this.deps.logger.getCorrelationId() ?? 'trace-unknown',
-            });
-            if (parseResult.invalidJsonDiagnostic) {
-                const diagnostic = createInvalidToolCallDiagnostic(parseResult.invalidJsonDiagnostic);
-                this.deps.logger.error('Invalid tool call argument payload', {
-                    ...diagnostic,
-                    sessionId: this.deps.sessionId,
-                    messageId: callId ?? String(Date.now()),
-                });
-            }
-            const toolCallId = callId ?? String(Date.now());
-            toolStartedEvent =
-                pendingApprovalContext.owner.kind === 'subagent'
-                    ? {
-                        type: 'subagent_tool_started',
-                        agentId: pendingApprovalContext.owner.agentId,
-                        role: pendingApprovalContext.owner.role,
-                        toolCallId,
-                        toolName,
-                        arguments: parseResult.arguments,
-                    }
-                    : {
-                        type: 'tool_started',
-                        toolCallId,
-                        toolName,
-                        arguments: parseResult.arguments,
-                    };
-            state.approve(interruption);
-            if (callId) {
-                pendingApprovalContext.decisionsByCallId.set(callId, 'approved');
-            }
-        }
-        else {
-            const expectedCallId = decisionCallId;
-            const rejectionMessage = rejectionReason
-                ? `Tool execution was not approved. User's reason: ${rejectionReason}`
-                : 'Tool execution was not approved.';
-            // A refused Docker request is settled: drop the pending block so the same
-            // command runs sandboxed again instead of stalling on approval forever.
-            if (isDockerRequest && typeof parsedDecisionArgs?.command === 'string') {
-                consumeDockerHostControlDenial(parsedDecisionArgs.command);
-            }
-            markToolCallAsApprovalRejection(expectedCallId);
-            state.reject?.(interruption, { message: rejectionMessage });
-            if (expectedCallId) {
-                pendingApprovalContext.decisionsByCallId.set(expectedCallId, 'rejected');
-            }
-            this.deps.logger.debug('Tool approval rejected', {
-                eventType: 'approval.rejected',
-                category: 'approval',
-                phase: 'approval',
-                sessionId: this.deps.sessionId,
-                traceId: this.deps.logger.getCorrelationId(),
-            });
-        }
-        const removeInterceptor = noop;
-        return { pendingApprovalContext, toolStartedEvent, removeInterceptor };
+        const result = this.#decisionExecutor.resolve({
+            pendingApprovalContext,
+            answer,
+            rejectionReason,
+            source,
+        });
+        return { pendingApprovalContext, toolStartedEvent: result.toolStartedEvent };
     }
     recordPending(pending) {
         this.deps.approvalState.setPending(pending);
@@ -252,7 +119,7 @@ export class ApprovalFlowCoordinator {
             ...pending,
             interruption,
             promptedCallId: getCallIdFromObject(interruption),
-            owner: resolveToolOwner(pending.state, interruption, this.deps.logger),
+            owner: this.resolveOwner(interruption),
         });
         return this.deps.approvalState.getPending();
     }

package/dist/services/approval/approval-flow-coordinator.js.map

@@ -1 +1 @@
-{"version":3,"file":"approval-flow-coordinator.js","sourceRoot":"","sources":["../../../source/services/approval/approval-flow-coordinator.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,+BAA+B,EAAE,MAAM,mDAAmD,CAAC;AACpG,OAAO,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AAC3F,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EAAE,+BAA+B,EAAE,MAAM,gCAAgC,CAAC;AAIjF,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,iDAAiD,CAAC;AACzD,OAAO,EACL,yBAAyB,EACzB,gCAAgC,EAChC,8BAA8B,GAC/B,MAAM,iCAAiC,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EACL,8BAA8B,EAC9B,sBAAsB,EACtB,iCAAiC,GAClC,MAAM,yDAAyD,CAAC;AAEjE,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,SAAS,CAAC;AA+B7B,MAAM,OAAO,uBAAuB;IACL,IAAI;IAAjC,YAA6B,IAAiC;oBAAjC,IAAI;IAAgC,CAAC;IAElE,qBAAqB,CAAC,MAAc,EAAE,eAAwB;QAC5D,OAAO;YACL,IAAI,EAAE,mBAAmB;YACzB,MAAM;YACN,eAAe;YACf,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,EAAE,KAAK,IAAI,CAAC;SAC7D,CAAC;IACJ,CAAC;IAED,KAAK;QACH,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC;QACrD,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/E,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,EAAE,CAAC;YAC3C,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,oBAAoB,CAAC,kCAAkC,EAAE,MAAM,CAAC,CAAC;YACvF,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gEAAgE,EAAE;gBACvF,SAAS,EAAE,kBAAkB;gBAC7B,QAAQ,EAAE,UAAU;gBACpB,KAAK,EAAE,OAAO;gBACd,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS;gBAC9B,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE;aAC7C,CAAC,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QACnC,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED,cAAc;QACZ,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,cAAc,EAAE,CAAC;IAClD,CAAC;IAED,gBAAgB;QACd,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,cAAc,EAAE,CAAC;QACzD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC1B,CAAC;QACD,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC;QACpC,IAAI,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;QAC/C,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC3B,CAAC;IAED;;;;;OAKG;IACH,sBAAsB,CAAC,cAAsC,EAAE,QAAgB;QAC7E,MAAM,cAAc,GAAG,mBAAmB,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;QACxE,MAAM,gBAAgB,GAAG,qEAAqE,QAAQ,EAAE,CAAC;QAEzG,+BAA+B,CAAC,cAAc,CAAC,CAAC;QAEhD,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,YAAmB,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC/F,cAAc,CAAC,iBAAiB,KAAK,IAAI,GAAG,EAAE,CAAC;QAC/C,IAAI,cAAc,EAAE,CAAC;YACnB,cAAc,CAAC,iBAAiB,CAAC,GAAG,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;QACnE,CAAC;QAED,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC;IACrD,CAAC;IAED;;;;OAIG;IACH,mBAAmB,CAAC,MAAc,EAAE,eAAmC;QACrE,MAAM,sBAAsB,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC;QACpE,IAAI,CAAC,sBAAsB,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,sBAAsB,CAAC;QACvD,MAAM,cAAc,GAAG,mBAAmB,CAAC,YAAY,CAAC,CAAC;QACzD,sBAAsB,CAAC,iBAAiB,KAAK,IAAI,GAAG,EAAE,CAAC;QAEvD,IAAI,gBAA+C,CAAC;QAEpD,yFAAyF;QACzF,MAAM,kBAAkB,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;QAC7D,MAAM,EAAE,QAAQ,EAAE,gBAAgB,EAAE,YAAY,EAAE,oBAAoB,EAAE,GACtE,2BAA2B,CAAC,YAAY,CAAC,CAAC;QAC5C,MAAM,kBAAkB,GAAG,sBAAsB,CAAC,oBAAoB,EAAE;YACtE,MAAM,EAAE,cAAc,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YAC5C,QAAQ,EAAE,gBAAgB;YAC1B,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS;YAC9B,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,IAAI,eAAe;SAChE,CAAC,CAAC,SAAwD,CAAC;QAC5D,MAAM,cAAc,GAAG,gCAAgC,CAAC,MAAM,CAAC,CAAC;QAChE,MAAM,eAAe,GACnB,gBAAgB,KAAK,OAAO;YAC5B,OAAO,kBAAkB,EAAE,OAAO,KAAK,QAAQ;YAC/C,iCAAiC,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAChE,IAAI,yBAAyB,GAAG,KAAK,CAAC;QACtC,IAAI,8BAA8B,CAAC,MAAM,CAAC,IAAI,gBAAgB,KAAK,WAAW,EAAE,CAAC;YAC/E,MAAM,cAAc,GAAG,sBAAsB,CAAC,oBAAoB,EAAE;gBAClE,MAAM,EAAE,cAAc,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;gBAC5C,QAAQ,EAAE,gBAAgB;gBAC1B,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS;gBAC9B,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,IAAI,eAAe;aAChE,CAAC,CAAC;YACH,MAAM,aAAa,GAAI,cAAc,CAAC,SAAuC,EAAE,IAAI,CAAC;YACpF,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAClE,iBAAiB,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC;gBAChF,yBAAyB,GAAG,IAAI,CAAC;YACnC,CAAC;QACH,CAAC;QACD,0EAA0E;QAC1E,wEAAwE;QACxE,+DAA+D;QAC/D,MAAM,UAAU,GAAG,eAAe;YAChC,CAAC,CAAC,cAAc;YAChB,CAAC,CAAC,MAAM,KAAK,GAAG,IAAI,kBAAkB,IAAI,yBAAyB,CAAC;QAEtE,IAAI,UAAU,EAAE,CAAC;YACf,gFAAgF;YAChF,IAAI,kBAAkB,EAAE,CAAC;gBACvB,MAAM,EAAE,YAAY,EAAE,GAAG,2BAA2B,CAAC,YAAY,CAAC,CAAC;gBACnE,MAAM,UAAU,GAAG,sBAAsB,CAAC,YAAY,EAAE;oBACtD,MAAM,EAAE,cAAc,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;oBAC5C,QAAQ,EAAE,OAAO;oBACjB,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS;oBAC9B,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,IAAI,eAAe;iBAChE,CAAC,CAAC;gBACH,MAAM,YAAY,GAAI,UAAU,CAAC,SAAyC,EAAE,OAAO,CAAC;gBACpF,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;oBACrC,MAAM,UAAU,GAAG,eAAe,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;oBAC/D,IAAI,UAAU,EAAE,CAAC;wBACf,IAAI,MAAM,KAAK,YAAY,IAAI,MAAM,KAAK,gBAAgB,EAAE,CAAC;4BAC3D,sBAAsB,CAAC,GAAG,CAAC,YAAY,EAAE;gCACvC,cAAc,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC;6BAC7C,CAAC,CAAC;4BACH,IAAI,MAAM,KAAK,gBAAgB,EAAE,CAAC;gCAChC,wBAAwB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;gCAC3E,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,kDAAkD,EAAE;oCAC5E,IAAI,EAAE,UAAU,CAAC,eAAe;oCAChC,UAAU,EAAE,UAAU,CAAC,IAAI;oCAC3B,SAAS,EAAE,UAAU,CAAC,SAAS;oCAC/B,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS;iCAC/B,CAAC,CAAC;4BACL,CAAC;wBACH,CAAC;6BAAM,IAAI,MAAM,KAAK,kBAAkB,EAAE,CAAC;4BACzC,sBAAsB,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;wBACvE,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YACD,IAAI,cAAc,IAAI,eAAe,IAAI,OAAO,kBAAkB,EAAE,OAAO,KAAK,QAAQ,EAAE,CAAC;gBACzF,MAAM,GAAG,GAAG,OAAO,kBAAkB,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;gBAChG,MAAM,KAAK,GACT,MAAM,KAAK,mBAAmB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,KAAK,sBAAsB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;gBACtG,sBAAsB,CAAC,EAAE,OAAO,EAAE,kBAAkB,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;gBAC5G,mEAAmE;gBACnE,oEAAoE;gBACpE,yEAAyE;YAC3E,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,EAAE;gBAC9C,SAAS,EAAE,kBAAkB;gBAC7B,QAAQ,EAAE,UAAU;gBACpB,KAAK,EAAE,UAAU;gBACjB,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS;gBAC9B,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE;gBAC5C,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9D,CAAC,CAAC;YAEH,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,2BAA2B,CAAC,YAAY,CAAC,CAAC;YAC7E,MAAM,MAAM,GAAG,cAAc,CAAC;YAE9B,MAAM,WAAW,GAAG,sBAAsB,CAAC,YAAY,EAAE;gBACvD,MAAM,EAAE,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;gBACpC,QAAQ;gBACR,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS;gBAC9B,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,IAAI,eAAe;aAChE,CAAC,CAAC;YAEH,IAAI,WAAW,CAAC,qBAAqB,EAAE,CAAC;gBACtC,MAAM,UAAU,GAAG,+BAA+B,CAAC,WAAW,CAAC,qBAAqB,CAAC,CAAC;gBACtF,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oCAAoC,EAAE;oBAC3D,GAAG,UAAU;oBACb,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS;oBAC9B,SAAS,EAAE,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;iBACxC,CAAC,CAAC;YACL,CAAC;YAED,MAAM,UAAU,GAAG,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAChD,gBAAgB;gBACd,sBAAsB,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU;oBAC9C,CAAC,CAAC;wBACE,IAAI,EAAE,uBAAuB;wBAC7B,OAAO,EAAE,sBAAsB,CAAC,KAAK,CAAC,OAAO;wBAC7C,IAAI,EAAE,sBAAsB,CAAC,KAAK,CAAC,IAAI;wBACvC,UAAU;wBACV,QAAQ;wBACR,SAAS,EAAE,WAAW,CAAC,SAAS;qBACjC;oBACH,CAAC,CAAC;wBACE,IAAI,EAAE,cAAc;wBACpB,UAAU;wBACV,QAAQ;wBACR,SAAS,EAAE,WAAW,CAAC,SAAS;qBACjC,CAAC;YAER,KAAK,CAAC,OAAO,CAAC,YAAmB,CAAC,CAAC;YACnC,IAAI,MAAM,EAAE,CAAC;gBACX,sBAAsB,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,cAAc,GAAG,cAAc,CAAC;YACtC,MAAM,gBAAgB,GAAG,eAAe;gBACtC,CAAC,CAAC,mDAAmD,eAAe,EAAE;gBACtE,CAAC,CAAC,kCAAkC,CAAC;YAEvC,0EAA0E;YAC1E,wEAAwE;YACxE,IAAI,eAAe,IAAI,OAAO,kBAAkB,EAAE,OAAO,KAAK,QAAQ,EAAE,CAAC;gBACvE,8BAA8B,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;YAC7D,CAAC;YAED,+BAA+B,CAAC,cAAc,CAAC,CAAC;YAEhD,KAAK,CAAC,MAAM,EAAE,CAAC,YAAmB,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC,CAAC;YACnE,IAAI,cAAc,EAAE,CAAC;gBACnB,sBAAsB,CAAC,iBAAiB,CAAC,GAAG,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;YAC3E,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE;gBAC/C,SAAS,EAAE,mBAAmB;gBAC9B,QAAQ,EAAE,UAAU;gBACpB,KAAK,EAAE,UAAU;gBACjB,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS;gBAC9B,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE;aAC7C,CAAC,CAAC;QACL,CAAC;QAED,MAAM,iBAAiB,GAAG,IAAI,CAAC;QAE/B,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,CAAC;IACzE,CAAC;IAED,aAAa,CAAC,OAA+B;QAC3C,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED,YAAY;QACV,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,CAAC;IACzC,CAAC;IAED,UAAU;QACR,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC;IAC9C,CAAC;IAED,sBAAsB;QACpB,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,EAAE,YAAY,CAAC;IAC5D,CAAC;IAED,2BAA2B,CAAC,YAAqB;QAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC;QACrD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC;YACjC,GAAG,OAAO;YACV,YAAY;YACZ,cAAc,EAAE,mBAAmB,CAAC,YAAY,CAAC;YACjD,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;SACvE,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC;IAC9C,CAAC;CACF"}
+{"version":3,"file":"approval-flow-coordinator.js","sourceRoot":"","sources":["../../../source/services/approval/approval-flow-coordinator.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,+BAA+B,EAAE,MAAM,mDAAmD,CAAC;AACpG,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAU9D,OAAO,EAAE,wBAAwB,EAA+B,MAAM,iCAAiC,CAAC;AAoCxG,MAAM,OAAO,uBAAuB;IAIL,IAAI;IAHxB,cAAc,CAAwB;IACtC,iBAAiB,CAA2B;IAErD,YAA6B,IAAiC;oBAAjC,IAAI;QAC/B,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,aAAa,CAAC;QACzC,IAAI,CAAC,iBAAiB,GAAG,IAAI,wBAAwB,CAAC;YACpD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;YAC7C,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,YAAY,CAAC,YAAqB;QAChC,OAAO,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,mBAAmB,CAAC,YAAY,CAAC,CAAC,CAAC;IACxE,CAAC;IAED,qBAAqB,CACnB,MAAc,EACd,eAAwB,EACxB,2BAAqC;QAErC,OAAO;YACL,IAAI,EAAE,mBAAmB;YACzB,MAAM;YACN,eAAe;YACf,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,EAAE,KAAK,IAAI,CAAC;YAC5D,GAAG,CAAC,2BAA2B,CAAC,CAAC,CAAC,EAAE,2BAA2B,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9E,CAAC;IACJ,CAAC;IAED,KAAK;QACH,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC;QACrD,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/E,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,EAAE,CAAC;YAC3C,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,oBAAoB,CAAC,kCAAkC,EAAE,MAAM,CAAC,CAAC;YACvF,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gEAAgE,EAAE;gBACvF,SAAS,EAAE,kBAAkB;gBAC7B,QAAQ,EAAE,UAAU;gBACpB,KAAK,EAAE,OAAO;gBACd,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS;gBAC9B,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE;aAC7C,CAAC,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QACnC,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED,cAAc;QACZ,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,cAAc,EAAE,CAAC;IAClD,CAAC;IAED,gBAAgB;QACd,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,cAAc,EAAE,CAAC;QACzD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC1B,CAAC;QACD,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC;QACpC,IAAI,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;QAC/C,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC3B,CAAC;IAED;;;;;OAKG;IACH,sBAAsB,CAAC,cAAsC,EAAE,QAAgB;QAC7E,MAAM,cAAc,GAAG,mBAAmB,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;QACxE,MAAM,gBAAgB,GAAG,qEAAqE,QAAQ,EAAE,CAAC;QAEzG,+BAA+B,CAAC,cAAc,CAAC,CAAC;QAEhD,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,cAAc,CAAC,YAAmB,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACjG,cAAc,CAAC,iBAAiB,KAAK,IAAI,GAAG,EAAE,CAAC;QAC/C,IAAI,cAAc,EAAE,CAAC;YACnB,cAAc,CAAC,iBAAiB,CAAC,GAAG,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;QACnE,CAAC;QAED,OAAO,EAAE,cAAc,EAAE,CAAC;IAC5B,CAAC;IAED;;;OAGG;IACH,mBAAmB,CACjB,MAAc,EACd,eAAmC,EACnC,MAAM,GAA2B,MAAM;QAEvC,MAAM,sBAAsB,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC;QACpE,IAAI,CAAC,sBAAsB,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC;YAC5C,sBAAsB;YACtB,MAAM;YACN,eAAe;YACf,MAAM;SACP,CAAC,CAAC;QACH,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,CAAC;IAC/E,CAAC;IAED,aAAa,CAAC,OAA+B;QAC3C,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED,YAAY;QACV,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,CAAC;IACzC,CAAC;IAED,UAAU;QACR,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC;IAC9C,CAAC;IAED,sBAAsB;QACpB,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,EAAE,YAAY,CAAC;IAC5D,CAAC;IAED,2BAA2B,CAAC,YAAqB;QAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC;QACrD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC;YACjC,GAAG,OAAO;YACV,YAAY;YACZ,cAAc,EAAE,mBAAmB,CAAC,YAAY,CAAC;YACjD,KAAK,EAAE,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC;SACvC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC;IAC9C,CAAC;CACF"}