@qduc/term2 0.20.0 → 0.22.0

package/dist/services/approval/approval-decision-executor.js

@@ -1,13 +1,9 @@
-import path from 'node:path';
 import { ToolCallMarkerStore } from '../../utils/streaming/extract-command-messages.js';
 import { getCallIdFromObject, getToolInfoFromInterruption } from '../interruption-info.js';
 import { parseToolCallArguments } from '../tool-call-arguments.js';
 import { createInvalidToolCallDiagnostic } from '../logging/logging-contract.js';
-import { getProjectAllowReadStore } from '../../utils/shell/sandbox/denied-read-stores.js';
-import { isDeniedReadApproveAnswer, isDockerHostControlApproveAnswer, isReadFileSessionApproveAnswer, supportsFolderSessionRead, } from '../../contracts/conversation.js';
-import { isDockerHostControlShellApproval } from './shell-sandbox-approval.js';
-import { resolveSessionReadFolder } from './session-read-grant-target.js';
-import { getActiveWorkspaceRoot } from '../workspace/active-workspace-root.js';
+import { applyApprovalGrant } from './approval-grant-executor.js';
+import { resolveSessionId } from '../session/session-identity.js';
 /**
  * Applies one already-authorized approval decision to the continuation that
  * owns it. This is deliberately independent of root `ApprovalState`, turn
@@ -36,63 +32,41 @@ export class ApprovalDecisionExecutor {
         const decisionCallId = getCallIdFromObject(interruption);
         pendingApprovalContext.decisionsByCallId ??= new Map();
         const { toolName: decisionToolName, rawArguments: decisionRawArguments } = getToolInfoFromInterruption(interruption);
-        const parsedDecisionArgs = parseToolCallArguments(decisionRawArguments, {
-            callId: decisionCallId ?? String(Date.now()),
+        const grant = applyApprovalGrant({
+            sessionId: resolveSessionId(this.deps.sessionId),
+            sessionAccess: this.deps.sessionAccess,
+            nestedCompatibility: this.deps.nestedCompatibility,
+            logger: this.deps.logger,
+        }, {
+            answer,
             toolName: decisionToolName,
-            sessionId: this.deps.sessionId,
-            traceId: this.deps.logger.getCorrelationId() ?? 'trace-unknown',
-        }).arguments;
-        const deniedReadDecision = isDeniedReadApproveAnswer(answer);
-        const dockerDecision = isDockerHostControlApproveAnswer(answer);
-        const isDockerRequest = isDockerHostControlShellApproval(decisionToolName, parsedDecisionArgs, this.deps.sessionId, this.deps.sessionAccess, this.deps.nestedCompatibility);
-        const allowReadFolderForSession = isReadFileSessionApproveAnswer(answer) && supportsFolderSessionRead(decisionToolName);
-        const editSessionGrant = this.#getEditSessionGrant(answer, decisionToolName, parsedDecisionArgs);
-        if (allowReadFolderForSession) {
-            const folder = resolveSessionReadFolder(decisionToolName, parsedDecisionArgs);
-            if (folder) {
-                if (this.deps.sessionAccess)
-                    this.deps.sessionAccess.allowReadFolder(folder);
-                else
-                    this.deps.nestedCompatibility?.readAccess.allowFolder(this.deps.sessionId, folder);
-            }
-        }
-        if (editSessionGrant) {
-            if (this.deps.sessionAccess) {
-                if (editSessionGrant.kind === 'file')
-                    this.deps.sessionAccess.allowEditFile(editSessionGrant.path);
-                else
-                    this.deps.sessionAccess.allowEditFolder(editSessionGrant.path);
-            }
-        }
-        // Docker host control is a distinct capability. Generic resume answers
-        // remain rejected even if the tool call otherwise looks approvable.
-        const isApproved = isDockerRequest
-            ? dockerDecision
-            : answer === 'y' || deniedReadDecision || allowReadFolderForSession || editSessionGrant !== null;
+            rawArguments: decisionRawArguments,
+            callId: decisionCallId,
+            interruption,
+        });
+        const isApproved = grant.isApproved;
         let toolStartedEvent;
         if (isApproved) {
-            this.#applyDeniedReadDecision(answer, deniedReadDecision, interruption, decisionCallId);
-            this.#applyDockerDecision(answer, dockerDecision, isDockerRequest, parsedDecisionArgs);
             this.deps.logger.debug('Tool approval granted', {
                 eventType: 'approval.granted',
                 category: 'approval',
                 phase: 'approval',
-                sessionId: this.deps.sessionId,
+                sessionId: resolveSessionId(this.deps.sessionId),
                 traceId: this.deps.logger.getCorrelationId(),
-                ...(deniedReadDecision ? { deniedReadDecision: answer } : {}),
+                ...(grant.deniedReadDecision ? { deniedReadDecision: answer } : {}),
             });
             const { toolName, rawArguments } = getToolInfoFromInterruption(interruption);
             const parseResult = parseToolCallArguments(rawArguments, {
                 callId: decisionCallId ?? String(Date.now()),
                 toolName,
-                sessionId: this.deps.sessionId,
+                sessionId: resolveSessionId(this.deps.sessionId),
                 traceId: this.deps.logger.getCorrelationId() ?? 'trace-unknown',
             });
             if (parseResult.invalidJsonDiagnostic) {
                 const diagnostic = createInvalidToolCallDiagnostic(parseResult.invalidJsonDiagnostic);
                 this.deps.logger.error('Invalid tool call argument payload', {
                     ...diagnostic,
-                    sessionId: this.deps.sessionId,
+                    sessionId: resolveSessionId(this.deps.sessionId),
                     messageId: decisionCallId ?? String(Date.now()),
                 });
             }
@@ -123,11 +97,11 @@ export class ApprovalDecisionExecutor {
                 : 'Tool execution was not approved.';
             // Rejection settles an indirect Docker denial, otherwise the same
             // command would require the abandoned prompt again forever.
-            if (isDockerRequest && typeof parsedDecisionArgs?.command === 'string') {
+            if (grant.isDockerRequest && typeof grant.parsedArguments?.command === 'string') {
                 if (this.deps.sessionAccess)
-                    this.deps.sessionAccess.consumeDockerDenial(parsedDecisionArgs.command);
+                    this.deps.sessionAccess.consumeDockerDenial(grant.parsedArguments.command);
                 else
-                    this.deps.nestedCompatibility?.docker.consumeDenial(this.deps.sessionId, parsedDecisionArgs.command);
+                    this.deps.nestedCompatibility?.docker.consumeDenial(resolveSessionId(this.deps.sessionId), grant.parsedArguments.command);
             }
             this.#toolCallMarkers.markToolCallAsApprovalRejection(decisionCallId);
             state.reject?.(interruption, { message });
@@ -137,7 +111,7 @@ export class ApprovalDecisionExecutor {
                 eventType: 'approval.rejected',
                 category: 'approval',
                 phase: 'approval',
-                sessionId: this.deps.sessionId,
+                sessionId: resolveSessionId(this.deps.sessionId),
                 traceId: this.deps.logger.getCorrelationId(),
             });
         }
@@ -150,73 +124,5 @@ export class ApprovalDecisionExecutor {
         }
         return { pendingApprovalContext, isApproved, toolStartedEvent };
     }
-    #getEditSessionGrant(answer, toolName, args) {
-        if (toolName !== 'apply_patch' && toolName !== 'create_file' && toolName !== 'search_replace')
-            return null;
-        const record = args && typeof args === 'object' ? args : null;
-        const operation = Array.isArray(record?.operations) ? record.operations[0] : record;
-        const rawPath = operation && typeof operation === 'object' && typeof operation.path === 'string'
-            ? operation.path
-            : undefined;
-        if (!rawPath)
-            return null;
-        const target = path.resolve(rawPath);
-        if (answer === 'allow-edit-file-session')
-            return { kind: 'file', path: target };
-        if (answer === 'allow-edit-folder-session')
-            return { kind: 'folder', path: path.dirname(target) };
-        return null;
-    }
-    #applyDeniedReadDecision(answer, deniedReadDecision, interruption, decisionCallId) {
-        if (!deniedReadDecision)
-            return;
-        const { rawArguments } = getToolInfoFromInterruption(interruption);
-        const parsedArgs = parseToolCallArguments(rawArguments, {
-            callId: decisionCallId ?? String(Date.now()),
-            toolName: 'shell',
-            sessionId: this.deps.sessionId,
-            traceId: this.deps.logger.getCorrelationId() ?? 'trace-unknown',
-        });
-        const shellCommand = parsedArgs.arguments?.command;
-        if (typeof shellCommand !== 'string')
-            return;
-        const stagedInfo = this.deps.nestedCompatibility?.deniedReads.consumeStaged(shellCommand);
-        if (!stagedInfo)
-            return;
-        if (answer === 'allow-once' || answer === 'allow-remember') {
-            this.deps.nestedCompatibility?.executionOverrides.set(shellCommand, {
-                extraAllowRead: [stagedInfo.suggestedParent],
-            });
-            if (answer === 'allow-remember') {
-                // Key the grant to the root the command actually ran under, so a grant
-                // made in one worktree does not silently authorize another.
-                getProjectAllowReadStore(getActiveWorkspaceRoot()).append(stagedInfo.suggestedParent);
-                this.deps.logger.security('Sandbox allowed-read path remembered for project', {
-                    path: stagedInfo.suggestedParent,
-                    deniedPath: stagedInfo.path,
-                    sensitive: stagedInfo.sensitive,
-                    sessionId: this.deps.sessionId,
-                });
-            }
-        }
-        else if (answer === 'unsandboxed-once') {
-            this.deps.nestedCompatibility?.executionOverrides.set(shellCommand, { forceUnsandboxed: true });
-        }
-    }
-    #applyDockerDecision(answer, dockerDecision, isDockerRequest, parsedDecisionArgs) {
-        if (!dockerDecision || !isDockerRequest || typeof parsedDecisionArgs?.command !== 'string')
-            return;
-        const cwd = typeof parsedDecisionArgs.cwd === 'string' ? parsedDecisionArgs.cwd : getActiveWorkspaceRoot();
-        const scope = answer === 'docker-allow-once' ? 'once' : answer === 'docker-allow-session' ? 'session' : 'project';
-        if (this.deps.sessionAccess)
-            this.deps.sessionAccess.grantDocker(parsedDecisionArgs.command, cwd, scope);
-        else
-            this.deps.nestedCompatibility?.docker.grant({
-                command: parsedDecisionArgs.command,
-                cwd,
-                scope,
-                sessionId: this.deps.sessionId,
-            });
-    }
 }
 //# sourceMappingURL=approval-decision-executor.js.map

package/dist/services/approval/approval-decision-executor.js.map

@@ -1 +1 @@
-{"version":3,"file":"approval-decision-executor.js","sourceRoot":"","sources":["../../../source/services/approval/approval-decision-executor.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,mDAAmD,CAAC;AACxF,OAAO,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AAC3F,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EAAE,+BAA+B,EAAE,MAAM,gCAAgC,CAAC;AACjF,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,EACL,yBAAyB,EACzB,gCAAgC,EAChC,8BAA8B,EAC9B,yBAAyB,GAC1B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,gCAAgC,EAAE,MAAM,6BAA6B,CAAC;AAC/E,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAM1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAgC/E;;;;;GAKG;AACH,MAAM,OAAO,wBAAwB;IAGN,IAAI;IAFxB,gBAAgB,CAAsB;IAE/C,YAA6B,IAAkC;oBAAlC,IAAI;QAC/B,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,eAAe,IAAI,IAAI,mBAAmB,EAAE,CAAC;IAC5E,CAAC;IAED,OAAO,CAAC,KAAmC;QACzC,MAAM,cAAc,GAAG,mBAAmB,CAAC,KAAK,CAAC,sBAAsB,CAAC,YAAY,CAAC,CAAC;QACtF,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;gBAAS,CAAC;YACT,IAAI,cAAc;gBAAE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAED,QAAQ,CAAC,EACP,sBAAsB,EACtB,MAAM,EACN,eAAe,EACf,MAAM,GAAG,MAAM,GACc;QAC7B,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,sBAAsB,CAAC;QACvD,MAAM,cAAc,GAAG,mBAAmB,CAAC,YAAY,CAAC,CAAC;QACzD,sBAAsB,CAAC,iBAAiB,KAAK,IAAI,GAAG,EAAE,CAAC;QAEvD,MAAM,EAAE,QAAQ,EAAE,gBAAgB,EAAE,YAAY,EAAE,oBAAoB,EAAE,GACtE,2BAA2B,CAAC,YAAY,CAAC,CAAC;QAC5C,MAAM,kBAAkB,GAAG,sBAAsB,CAAC,oBAAoB,EAAE;YACtE,MAAM,EAAE,cAAc,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YAC5C,QAAQ,EAAE,gBAAgB;YAC1B,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS;YAC9B,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,IAAI,eAAe;SAChE,CAAC,CAAC,SAAwD,CAAC;QAC5D,MAAM,kBAAkB,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;QAC7D,MAAM,cAAc,GAAG,gCAAgC,CAAC,MAAM,CAAC,CAAC;QAChE,MAAM,eAAe,GAAG,gCAAgC,CACtD,gBAAgB,EAChB,kBAAkB,EAClB,IAAI,CAAC,IAAI,CAAC,SAAS,EACnB,IAAI,CAAC,IAAI,CAAC,aAAa,EACvB,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAC9B,CAAC;QACF,MAAM,yBAAyB,GAC7B,8BAA8B,CAAC,MAAM,CAAC,IAAI,yBAAyB,CAAC,gBAAgB,CAAC,CAAC;QACxF,MAAM,gBAAgB,GAAG,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;QAEjG,IAAI,yBAAyB,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,wBAAwB,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;YAC9E,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa;oBAAE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;;oBACxE,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YAC1F,CAAC;QACH,CAAC;QACD,IAAI,gBAAgB,EAAE,CAAC;YACrB,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;gBAC5B,IAAI,gBAAgB,CAAC,IAAI,KAAK,MAAM;oBAAE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;;oBAC9F,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;YACtE,CAAC;QACH,CAAC;QAED,uEAAuE;QACvE,oEAAoE;QACpE,MAAM,UAAU,GAAG,eAAe;YAChC,CAAC,CAAC,cAAc;YAChB,CAAC,CAAC,MAAM,KAAK,GAAG,IAAI,kBAAkB,IAAI,yBAAyB,IAAI,gBAAgB,KAAK,IAAI,CAAC;QACnG,IAAI,gBAA+C,CAAC;QAEpD,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,CAAC,wBAAwB,CAAC,MAAM,EAAE,kBAAkB,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC;YACxF,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,cAAc,EAAE,eAAe,EAAE,kBAAkB,CAAC,CAAC;YAEvF,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,EAAE;gBAC9C,SAAS,EAAE,kBAAkB;gBAC7B,QAAQ,EAAE,UAAU;gBACpB,KAAK,EAAE,UAAU;gBACjB,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS;gBAC9B,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE;gBAC5C,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9D,CAAC,CAAC;YAEH,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,2BAA2B,CAAC,YAAY,CAAC,CAAC;YAC7E,MAAM,WAAW,GAAG,sBAAsB,CAAC,YAAY,EAAE;gBACvD,MAAM,EAAE,cAAc,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;gBAC5C,QAAQ;gBACR,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS;gBAC9B,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,IAAI,eAAe;aAChE,CAAC,CAAC;YACH,IAAI,WAAW,CAAC,qBAAqB,EAAE,CAAC;gBACtC,MAAM,UAAU,GAAG,+BAA+B,CAAC,WAAW,CAAC,qBAAqB,CAAC,CAAC;gBACtF,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oCAAoC,EAAE;oBAC3D,GAAG,UAAU;oBACb,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS;oBAC9B,SAAS,EAAE,cAAc,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;iBAChD,CAAC,CAAC;YACL,CAAC;YAED,MAAM,UAAU,GAAG,cAAc,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YACxD,gBAAgB;gBACd,sBAAsB,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU;oBAC9C,CAAC,CAAC;wBACE,IAAI,EAAE,uBAAuB;wBAC7B,OAAO,EAAE,sBAAsB,CAAC,KAAK,CAAC,OAAO;wBAC7C,IAAI,EAAE,sBAAsB,CAAC,KAAK,CAAC,IAAI;wBACvC,UAAU;wBACV,QAAQ;wBACR,SAAS,EAAE,WAAW,CAAC,SAAS;qBACjC;oBACH,CAAC,CAAC;wBACE,IAAI,EAAE,cAAc;wBACpB,UAAU;wBACV,QAAQ;wBACR,SAAS,EAAE,WAAW,CAAC,SAAS;qBACjC,CAAC;YAER,KAAK,CAAC,OAAO,EAAE,CAAC,YAAY,CAAC,CAAC;YAC9B,IAAI,cAAc;gBAAE,sBAAsB,CAAC,iBAAiB,CAAC,GAAG,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;QAC/F,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,eAAe;gBAC7B,CAAC,CAAC,mDAAmD,eAAe,EAAE;gBACtE,CAAC,CAAC,kCAAkC,CAAC;YAEvC,kEAAkE;YAClE,4DAA4D;YAC5D,IAAI,eAAe,IAAI,OAAO,kBAAkB,EAAE,OAAO,KAAK,QAAQ,EAAE,CAAC;gBACvE,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa;oBAAE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;;oBAChG,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,kBAAkB,CAAC,OAAO,CAAC,CAAC;YAC5G,CAAC;YAED,IAAI,CAAC,gBAAgB,CAAC,+BAA+B,CAAC,cAAc,CAAC,CAAC;YACtE,KAAK,CAAC,MAAM,EAAE,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YAC1C,IAAI,cAAc;gBAAE,sBAAsB,CAAC,iBAAiB,CAAC,GAAG,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;YAE7F,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE;gBAC/C,SAAS,EAAE,mBAAmB;gBAC9B,QAAQ,EAAE,UAAU;gBACpB,KAAK,EAAE,UAAU;gBACjB,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS;gBAC9B,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE;aAC7C,CAAC,CAAC;QACL,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACpD,KAAK,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAC/B,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CACzB,mBAAmB,EACnB;gBACE,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU;gBAC1F,MAAM;gBACN,iBAAiB,EAAE,UAAU;aAC9B,EACD,EAAE,UAAU,EAAE,cAAc,EAAE,CAC/B,CACF,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,gBAAgB,EAAE,CAAC;IAClE,CAAC;IAED,oBAAoB,CAClB,MAAc,EACd,QAA4B,EAC5B,IAAa;QAEb,IAAI,QAAQ,KAAK,aAAa,IAAI,QAAQ,KAAK,aAAa,IAAI,QAAQ,KAAK,gBAAgB;YAAE,OAAO,IAAI,CAAC;QAC3G,MAAM,MAAM,GAAG,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAiD,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5G,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QACpF,MAAM,OAAO,GACX,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,OAAQ,SAAgC,CAAC,IAAI,KAAK,QAAQ;YACtG,CAAC,CAAE,SAA8B,CAAC,IAAI;YACtC,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,MAAM,KAAK,yBAAyB;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAChF,IAAI,MAAM,KAAK,2BAA2B;YAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClG,OAAO,IAAI,CAAC;IACd,CAAC;IAED,wBAAwB,CACtB,MAAc,EACd,kBAA2B,EAC3B,YAAqB,EACrB,cAAkC;QAElC,IAAI,CAAC,kBAAkB;YAAE,OAAO;QAEhC,MAAM,EAAE,YAAY,EAAE,GAAG,2BAA2B,CAAC,YAAY,CAAC,CAAC;QACnE,MAAM,UAAU,GAAG,sBAAsB,CAAC,YAAY,EAAE;YACtD,MAAM,EAAE,cAAc,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YAC5C,QAAQ,EAAE,OAAO;YACjB,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS;YAC9B,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,IAAI,eAAe;SAChE,CAAC,CAAC;QACH,MAAM,YAAY,GAAI,UAAU,CAAC,SAAyC,EAAE,OAAO,CAAC;QACpF,IAAI,OAAO,YAAY,KAAK,QAAQ;YAAE,OAAO;QAE7C,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,WAAW,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QAC1F,IAAI,CAAC,UAAU;YAAE,OAAO;QAExB,IAAI,MAAM,KAAK,YAAY,IAAI,MAAM,KAAK,gBAAgB,EAAE,CAAC;YAC3D,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,kBAAkB,CAAC,GAAG,CAAC,YAAY,EAAE;gBAClE,cAAc,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC;aAC7C,CAAC,CAAC;YACH,IAAI,MAAM,KAAK,gBAAgB,EAAE,CAAC;gBAChC,uEAAuE;gBACvE,4DAA4D;gBAC5D,wBAAwB,CAAC,sBAAsB,EAAE,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;gBACtF,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,kDAAkD,EAAE;oBAC5E,IAAI,EAAE,UAAU,CAAC,eAAe;oBAChC,UAAU,EAAE,UAAU,CAAC,IAAI;oBAC3B,SAAS,EAAE,UAAU,CAAC,SAAS;oBAC/B,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS;iBAC/B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;aAAM,IAAI,MAAM,KAAK,kBAAkB,EAAE,CAAC;YACzC,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,kBAAkB,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;QAClG,CAAC;IACH,CAAC;IAED,oBAAoB,CAClB,MAAc,EACd,cAAuB,EACvB,eAAwB,EACxB,kBAA+D;QAE/D,IAAI,CAAC,cAAc,IAAI,CAAC,eAAe,IAAI,OAAO,kBAAkB,EAAE,OAAO,KAAK,QAAQ;YAAE,OAAO;QAEnG,MAAM,GAAG,GAAG,OAAO,kBAAkB,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,sBAAsB,EAAE,CAAC;QAC3G,MAAM,KAAK,GAAG,MAAM,KAAK,mBAAmB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,KAAK,sBAAsB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QAClH,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa;YAAE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,kBAAkB,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;;YAEvG,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAC,KAAK,CAAC;gBAC1C,OAAO,EAAE,kBAAkB,CAAC,OAAO;gBACnC,GAAG;gBACH,KAAK;gBACL,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS;aAC/B,CAAC,CAAC;IACP,CAAC;CACF"}
+{"version":3,"file":"approval-decision-executor.js","sourceRoot":"","sources":["../../../source/services/approval/approval-decision-executor.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,mDAAmD,CAAC;AACxF,OAAO,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AAC3F,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EAAE,+BAA+B,EAAE,MAAM,gCAAgC,CAAC;AACjF,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAQlE,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AA+BlE;;;;;GAKG;AACH,MAAM,OAAO,wBAAwB;IAGN,IAAI;IAFxB,gBAAgB,CAAsB;IAE/C,YAA6B,IAAkC;oBAAlC,IAAI;QAC/B,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,eAAe,IAAI,IAAI,mBAAmB,EAAE,CAAC;IAC5E,CAAC;IAED,OAAO,CAAC,KAAmC;QACzC,MAAM,cAAc,GAAG,mBAAmB,CAAC,KAAK,CAAC,sBAAsB,CAAC,YAAY,CAAC,CAAC;QACtF,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;gBAAS,CAAC;YACT,IAAI,cAAc;gBAAE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAED,QAAQ,CAAC,EACP,sBAAsB,EACtB,MAAM,EACN,eAAe,EACf,MAAM,GAAG,MAAM,GACc;QAC7B,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,sBAAsB,CAAC;QACvD,MAAM,cAAc,GAAG,mBAAmB,CAAC,YAAY,CAAC,CAAC;QACzD,sBAAsB,CAAC,iBAAiB,KAAK,IAAI,GAAG,EAAE,CAAC;QAEvD,MAAM,EAAE,QAAQ,EAAE,gBAAgB,EAAE,YAAY,EAAE,oBAAoB,EAAE,GACtE,2BAA2B,CAAC,YAAY,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,kBAAkB,CAC9B;YACE,SAAS,EAAE,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;YAChD,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa;YACtC,mBAAmB,EAAE,IAAI,CAAC,IAAI,CAAC,mBAAmB;YAClD,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM;SACzB,EACD;YACE,MAAM;YACN,QAAQ,EAAE,gBAAgB;YAC1B,YAAY,EAAE,oBAAoB;YAClC,MAAM,EAAE,cAAc;YACtB,YAAY;SACb,CACF,CAAC;QACF,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;QACpC,IAAI,gBAA+C,CAAC;QAEpD,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,EAAE;gBAC9C,SAAS,EAAE,kBAAkB;gBAC7B,QAAQ,EAAE,UAAU;gBACpB,KAAK,EAAE,UAAU;gBACjB,SAAS,EAAE,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;gBAChD,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE;gBAC5C,GAAG,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACpE,CAAC,CAAC;YAEH,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,2BAA2B,CAAC,YAAY,CAAC,CAAC;YAC7E,MAAM,WAAW,GAAG,sBAAsB,CAAC,YAAY,EAAE;gBACvD,MAAM,EAAE,cAAc,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;gBAC5C,QAAQ;gBACR,SAAS,EAAE,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;gBAChD,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,IAAI,eAAe;aAChE,CAAC,CAAC;YACH,IAAI,WAAW,CAAC,qBAAqB,EAAE,CAAC;gBACtC,MAAM,UAAU,GAAG,+BAA+B,CAAC,WAAW,CAAC,qBAAqB,CAAC,CAAC;gBACtF,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oCAAoC,EAAE;oBAC3D,GAAG,UAAU;oBACb,SAAS,EAAE,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;oBAChD,SAAS,EAAE,cAAc,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;iBAChD,CAAC,CAAC;YACL,CAAC;YAED,MAAM,UAAU,GAAG,cAAc,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YACxD,gBAAgB;gBACd,sBAAsB,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU;oBAC9C,CAAC,CAAC;wBACE,IAAI,EAAE,uBAAuB;wBAC7B,OAAO,EAAE,sBAAsB,CAAC,KAAK,CAAC,OAAO;wBAC7C,IAAI,EAAE,sBAAsB,CAAC,KAAK,CAAC,IAAI;wBACvC,UAAU;wBACV,QAAQ;wBACR,SAAS,EAAE,WAAW,CAAC,SAAS;qBACjC;oBACH,CAAC,CAAC;wBACE,IAAI,EAAE,cAAc;wBACpB,UAAU;wBACV,QAAQ;wBACR,SAAS,EAAE,WAAW,CAAC,SAAS;qBACjC,CAAC;YAER,KAAK,CAAC,OAAO,EAAE,CAAC,YAAY,CAAC,CAAC;YAC9B,IAAI,cAAc;gBAAE,sBAAsB,CAAC,iBAAiB,CAAC,GAAG,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;QAC/F,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,eAAe;gBAC7B,CAAC,CAAC,mDAAmD,eAAe,EAAE;gBACtE,CAAC,CAAC,kCAAkC,CAAC;YAEvC,kEAAkE;YAClE,4DAA4D;YAC5D,IAAI,KAAK,CAAC,eAAe,IAAI,OAAO,KAAK,CAAC,eAAe,EAAE,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAChF,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa;oBAAE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,mBAAmB,CAAC,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;;oBAEtG,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAC,aAAa,CACjD,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EACrC,KAAK,CAAC,eAAe,CAAC,OAAO,CAC9B,CAAC;YACN,CAAC;YAED,IAAI,CAAC,gBAAgB,CAAC,+BAA+B,CAAC,cAAc,CAAC,CAAC;YACtE,KAAK,CAAC,MAAM,EAAE,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YAC1C,IAAI,cAAc;gBAAE,sBAAsB,CAAC,iBAAiB,CAAC,GAAG,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;YAE7F,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE;gBAC/C,SAAS,EAAE,mBAAmB;gBAC9B,QAAQ,EAAE,UAAU;gBACpB,KAAK,EAAE,UAAU;gBACjB,SAAS,EAAE,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;gBAChD,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE;aAC7C,CAAC,CAAC;QACL,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACpD,KAAK,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAC/B,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CACzB,mBAAmB,EACnB;gBACE,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU;gBAC1F,MAAM;gBACN,iBAAiB,EAAE,UAAU;aAC9B,EACD,EAAE,UAAU,EAAE,cAAc,EAAE,CAC/B,CACF,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,gBAAgB,EAAE,CAAC;IAClE,CAAC;CACF"}

package/dist/services/approval/approval-decision-policy.js

@@ -1,4 +1,4 @@
-import { shouldBypassToolApproval } from './shell-auto-approval-resolver.js';
+import { shouldBypassToolApproval, isAutoApprovableTool } from './shell-auto-approval-resolver.js';
 export class ManualApprovalDecisionPolicy {
     async decide() {
         return 'prompt';
@@ -12,7 +12,7 @@ export class ShellAutoApprovalDecisionPolicy {
     async decide(context) {
         if (shouldBypassToolApproval(context.toolName, this.shellAutoApproval.getAutoApproveMode()))
             return 'approve';
-        if (context.toolName !== 'shell' && context.toolName !== 'bash')
+        if (!isAutoApprovableTool(context.toolName))
             return 'prompt';
         if (this.shellAutoApproval.shouldAutoApprove(context.llmAdvisory))
             return 'approve';

package/dist/services/approval/approval-decision-policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"approval-decision-policy.js","sourceRoot":"","sources":["../../../source/services/approval/approval-decision-policy.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAa7E,MAAM,OAAO,4BAA4B;IACvC,KAAK,CAAC,MAAM;QACV,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF;AAED,MAAM,OAAO,+BAA+B;IACb,iBAAiB;IAA9C,YAA6B,iBAA4C;iCAA5C,iBAAiB;IAA8B,CAAC;IAE7E,KAAK,CAAC,MAAM,CAAC,OAAwB;QACnC,IAAI,wBAAwB,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,iBAAiB,CAAC,kBAAkB,EAAE,CAAC;YAAE,OAAO,SAAS,CAAC;QAC9G,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM;YAAE,OAAO,QAAQ,CAAC;QACjF,IAAI,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,OAAO,CAAC,WAAW,CAAC;YAAE,OAAO,SAAS,CAAC;QACpF,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}
+{"version":3,"file":"approval-decision-policy.js","sourceRoot":"","sources":["../../../source/services/approval/approval-decision-policy.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAanG,MAAM,OAAO,4BAA4B;IACvC,KAAK,CAAC,MAAM;QACV,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF;AAED,MAAM,OAAO,+BAA+B;IACb,iBAAiB;IAA9C,YAA6B,iBAA4C;iCAA5C,iBAAiB;IAA8B,CAAC;IAE7E,KAAK,CAAC,MAAM,CAAC,OAAwB;QACnC,IAAI,wBAAwB,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,iBAAiB,CAAC,kBAAkB,EAAE,CAAC;YAAE,OAAO,SAAS,CAAC;QAC9G,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,QAAQ,CAAC;YAAE,OAAO,QAAQ,CAAC;QAC7D,IAAI,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,OAAO,CAAC,WAAW,CAAC;YAAE,OAAO,SAAS,CAAC;QACpF,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}

package/dist/services/approval/approval-descriptor.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Computes the authority metadata used by both provider approval prompts and
+ * nested run_code prompts. The caller supplies the root that prepared the
+ * tool call so relative paths cannot silently fall back to process.cwd().
+ */
+export declare function resolveOutsideWorkspaceEdit(toolName: string | undefined, args: unknown, workspaceRoot?: string): {
+    path: string;
+    folder: string;
+} | undefined;
+//# sourceMappingURL=approval-descriptor.d.ts.map

package/dist/services/approval/approval-descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-descriptor.d.ts","sourceRoot":"","sources":["../../../source/services/approval/approval-descriptor.ts"],"names":[],"mappings":"AAKA;;;;GAIG;AACH,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,OAAO,EACb,aAAa,GAAE,MAAiC,GAC/C;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAW9C"}

package/dist/services/approval/approval-descriptor.js

@@ -0,0 +1,23 @@
+import path from 'node:path';
+import { homedir } from 'node:os';
+import { getActiveWorkspaceRoot } from '../workspace/active-workspace-root.js';
+import { extractToolTargetPaths } from './shell-auto-approval-resolver.js';
+/**
+ * Computes the authority metadata used by both provider approval prompts and
+ * nested run_code prompts. The caller supplies the root that prepared the
+ * tool call so relative paths cannot silently fall back to process.cwd().
+ */
+export function resolveOutsideWorkspaceEdit(toolName, args, workspaceRoot = getActiveWorkspaceRoot()) {
+    if (toolName !== 'apply_patch' && toolName !== 'create_file' && toolName !== 'search_replace')
+        return undefined;
+    const targets = extractToolTargetPaths(toolName, args);
+    const resolvedRoot = path.resolve(workspaceRoot);
+    const target = targets
+        .map((rawPath) => {
+        const expandedPath = rawPath.startsWith('~') ? rawPath.replace(/^~/, homedir()) : rawPath;
+        return path.isAbsolute(expandedPath) ? path.normalize(expandedPath) : path.resolve(resolvedRoot, expandedPath);
+    })
+        .find((candidate) => candidate !== resolvedRoot && !candidate.startsWith(resolvedRoot + path.sep));
+    return target ? { path: target, folder: path.dirname(target) } : undefined;
+}
+//# sourceMappingURL=approval-descriptor.js.map

package/dist/services/approval/approval-descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-descriptor.js","sourceRoot":"","sources":["../../../source/services/approval/approval-descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAE3E;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CACzC,QAA4B,EAC5B,IAAa,EACb,aAAa,GAAW,sBAAsB,EAAE;IAEhD,IAAI,QAAQ,KAAK,aAAa,IAAI,QAAQ,KAAK,aAAa,IAAI,QAAQ,KAAK,gBAAgB;QAAE,OAAO,SAAS,CAAC;IAChH,MAAM,OAAO,GAAG,sBAAsB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACvD,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,OAAO;SACnB,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QACf,MAAM,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QAC1F,OAAO,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;IACjH,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,YAAY,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACrG,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7E,CAAC"}

package/dist/services/approval/approval-flow-coordinator.d.ts

@@ -12,11 +12,12 @@ import type { NestedToolCompatibilityState } from '../session/nested-tool-compat
 import type { HookLifecyclePort } from '../hooks/hook-service.js';
 import type { HookEventFactory } from '../hooks/hook-event-factory.js';
 import { type ApprovalDecisionSource } from './approval-decision-executor.js';
+import type { SessionIdSource } from '../session/session-identity.js';
 export interface ApprovalFlowCoordinatorDeps {
     agentClient: ConversationAgentClient;
     approvalState: ApprovalState;
     logger: ILoggingService;
-    sessionId: string;
+    sessionId: SessionIdSource;
     toolTracker: SessionToolTracker;
     generationGuard: GenerationGuard;
     /** Session-owned registry shared with nested subagent runners. */

package/dist/services/approval/approval-flow-coordinator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"approval-flow-coordinator.d.ts","sourceRoot":"","sources":["../../../source/services/approval/approval-flow-coordinator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAChF,OAAO,EAAE,aAAa,EAAE,KAAK,sBAAsB,EAAE,KAAK,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC9G,OAAO,EAAE,mBAAmB,EAAE,MAAM,mDAAmD,CAAC;AAExF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC/E,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAC7E,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,+CAA+C,CAAC;AAClG,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EAA4B,KAAK,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAGxG,MAAM,WAAW,2BAA2B;IAC1C,WAAW,EAAE,uBAAuB,CAAC;IACrC,aAAa,EAAE,aAAa,CAAC;IAC7B,MAAM,EAAE,eAAe,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,kBAAkB,CAAC;IAChC,eAAe,EAAE,eAAe,CAAC;IACjC,kEAAkE;IAClE,aAAa,EAAE,qBAAqB,CAAC;IACrC,mFAAmF;IACnF,aAAa,CAAC,EAAE,kBAAkB,CAAC;IACnC,uDAAuD;IACvD,mBAAmB,CAAC,EAAE,4BAA4B,CAAC;IACnD,aAAa,CAAC,EAAE,iBAAiB,CAAC;IAClC,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,eAAe,CAAC,EAAE,mBAAmB,CAAC;CACvC;AAED,MAAM,WAAW,mBAAmB;IAClC,cAAc,EAAE,sBAAsB,CAAC;CACxC;AAED,MAAM,WAAW,gBAAgB;IAC/B,sBAAsB,EAAE,sBAAsB,CAAC;IAC/C,gBAAgB,CAAC,EAAE,iBAAiB,CAAC;CACtC;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC,IAAI,EAAE,mBAAmB,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,2BAA2B,CAAC,EAAE,OAAO,CAAC;CACvC,CAAC;AAEF,qBAAa,uBAAuB;;IAKtB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAjC,YAA6B,IAAI,EAAE,2BAA2B,EAa7D;IAED;;;OAGG;IACH,YAAY,CAAC,YAAY,EAAE,OAAO,GAAG,SAAS,CAE7C;IAED,qBAAqB,CACnB,MAAM,EAAE,MAAM,EACd,eAAe,CAAC,EAAE,MAAM,EACxB,2BAA2B,CAAC,EAAE,OAAO,GACpC,qBAAqB,CAQvB;IAED,KAAK,IAAI;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAiB7C;IAED,cAAc,IAAI,sBAAsB,GAAG,IAAI,CAE9C;IAED,gBAAgB,IAAI;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,IAAI,EAAE,SAAS,CAAC;QAAC,OAAO,EAAE,sBAAsB,CAAA;KAAE,GAAG;QAAE,IAAI,EAAE,OAAO,CAAA;KAAE,CAU9G;IAED;;;;;OAKG;IACH,sBAAsB,CAAC,cAAc,EAAE,sBAAsB,EAAE,QAAQ,EAAE,MAAM,GAAG,mBAAmB,CAapG;IAED;;;OAGG;IACH,mBAAmB,CACjB,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,MAAM,GAAG,SAAS,EACnC,MAAM,GAAE,sBAA+B,GACtC,gBAAgB,GAAG,IAAI,CAmBzB;IAED,aAAa,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI,CAEnD;IAED,YAAY,IAAI,IAAI,CAEnB;IAED,UAAU,IAAI,sBAAsB,GAAG,IAAI,CAE1C;IAED,sBAAsB,IAAI,OAAO,CAEhC;IAED,2BAA2B,CAAC,YAAY,EAAE,OAAO,GAAG,sBAAsB,GAAG,IAAI,CAahF;CACF"}
+{"version":3,"file":"approval-flow-coordinator.d.ts","sourceRoot":"","sources":["../../../source/services/approval/approval-flow-coordinator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAChF,OAAO,EAAE,aAAa,EAAE,KAAK,sBAAsB,EAAE,KAAK,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC9G,OAAO,EAAE,mBAAmB,EAAE,MAAM,mDAAmD,CAAC;AAExF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC/E,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAC7E,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,+CAA+C,CAAC;AAClG,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EAA4B,KAAK,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAExG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAGtE,MAAM,WAAW,2BAA2B;IAC1C,WAAW,EAAE,uBAAuB,CAAC;IACrC,aAAa,EAAE,aAAa,CAAC;IAC7B,MAAM,EAAE,eAAe,CAAC;IACxB,SAAS,EAAE,eAAe,CAAC;IAC3B,WAAW,EAAE,kBAAkB,CAAC;IAChC,eAAe,EAAE,eAAe,CAAC;IACjC,kEAAkE;IAClE,aAAa,EAAE,qBAAqB,CAAC;IACrC,mFAAmF;IACnF,aAAa,CAAC,EAAE,kBAAkB,CAAC;IACnC,uDAAuD;IACvD,mBAAmB,CAAC,EAAE,4BAA4B,CAAC;IACnD,aAAa,CAAC,EAAE,iBAAiB,CAAC;IAClC,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,eAAe,CAAC,EAAE,mBAAmB,CAAC;CACvC;AAED,MAAM,WAAW,mBAAmB;IAClC,cAAc,EAAE,sBAAsB,CAAC;CACxC;AAED,MAAM,WAAW,gBAAgB;IAC/B,sBAAsB,EAAE,sBAAsB,CAAC;IAC/C,gBAAgB,CAAC,EAAE,iBAAiB,CAAC;CACtC;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC,IAAI,EAAE,mBAAmB,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,2BAA2B,CAAC,EAAE,OAAO,CAAC;CACvC,CAAC;AAEF,qBAAa,uBAAuB;;IAKtB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAjC,YAA6B,IAAI,EAAE,2BAA2B,EAa7D;IAED;;;OAGG;IACH,YAAY,CAAC,YAAY,EAAE,OAAO,GAAG,SAAS,CAE7C;IAED,qBAAqB,CACnB,MAAM,EAAE,MAAM,EACd,eAAe,CAAC,EAAE,MAAM,EACxB,2BAA2B,CAAC,EAAE,OAAO,GACpC,qBAAqB,CAQvB;IAED,KAAK,IAAI;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAiB7C;IAED,cAAc,IAAI,sBAAsB,GAAG,IAAI,CAE9C;IAED,gBAAgB,IAAI;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,IAAI,EAAE,SAAS,CAAC;QAAC,OAAO,EAAE,sBAAsB,CAAA;KAAE,GAAG;QAAE,IAAI,EAAE,OAAO,CAAA;KAAE,CAU9G;IAED;;;;;OAKG;IACH,sBAAsB,CAAC,cAAc,EAAE,sBAAsB,EAAE,QAAQ,EAAE,MAAM,GAAG,mBAAmB,CAapG;IAED;;;OAGG;IACH,mBAAmB,CACjB,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,MAAM,GAAG,SAAS,EACnC,MAAM,GAAE,sBAA+B,GACtC,gBAAgB,GAAG,IAAI,CAmBzB;IAED,aAAa,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI,CAEnD;IAED,YAAY,IAAI,IAAI,CAEnB;IAED,UAAU,IAAI,sBAAsB,GAAG,IAAI,CAE1C;IAED,sBAAsB,IAAI,OAAO,CAEhC;IAED,2BAA2B,CAAC,YAAY,EAAE,OAAO,GAAG,sBAAsB,GAAG,IAAI,CAahF;CACF"}

package/dist/services/approval/approval-flow-coordinator.js

@@ -2,6 +2,7 @@ import { ToolCallMarkerStore } from '../../utils/streaming/extract-command-messa
 import { getCallIdFromObject } from '../interruption-info.js';
 import { ApprovalDecisionExecutor } from './approval-decision-executor.js';
 import { isRunBudgetInteraction } from '../agent-runtime/run-budget.js';
+import { resolveSessionId } from '../session/session-identity.js';
 export class ApprovalFlowCoordinator {
     deps;
     #toolOwnership;
@@ -50,7 +51,7 @@ export class ApprovalFlowCoordinator {
                 eventType: 'approval.aborted',
                 category: 'approval',
                 phase: 'abort',
-                sessionId: this.deps.sessionId,
+                sessionId: resolveSessionId(this.deps.sessionId),
                 traceId: this.deps.logger.getCorrelationId(),
             });
             return { aborted: true, callId };

package/dist/services/approval/approval-flow-coordinator.js.map

@@ -1 +1 @@
-{"version":3,"file":"approval-flow-coordinator.js","sourceRoot":"","sources":["../../../source/services/approval/approval-flow-coordinator.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,mBAAmB,EAAE,MAAM,mDAAmD,CAAC;AACxF,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAU9D,OAAO,EAAE,wBAAwB,EAA+B,MAAM,iCAAiC,CAAC;AACxG,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAqCxE,MAAM,OAAO,uBAAuB;IAKL,IAAI;IAJxB,cAAc,CAAwB;IACtC,gBAAgB,CAAsB;IACtC,iBAAiB,CAA2B;IAErD,YAA6B,IAAiC;oBAAjC,IAAI;QAC/B,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,aAAa,CAAC;QACzC,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,eAAe,IAAI,IAAI,mBAAmB,EAAE,CAAC;QAC1E,IAAI,CAAC,iBAAiB,GAAG,IAAI,wBAAwB,CAAC;YACpD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;YAC7C,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,eAAe,EAAE,IAAI,CAAC,gBAAgB;SACvC,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,YAAY,CAAC,YAAqB;QAChC,OAAO,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,mBAAmB,CAAC,YAAY,CAAC,CAAC,CAAC;IACxE,CAAC;IAED,qBAAqB,CACnB,MAAc,EACd,eAAwB,EACxB,2BAAqC;QAErC,OAAO;YACL,IAAI,EAAE,mBAAmB;YACzB,MAAM;YACN,eAAe;YACf,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,EAAE,KAAK,IAAI,CAAC;YAC5D,GAAG,CAAC,2BAA2B,CAAC,CAAC,CAAC,EAAE,2BAA2B,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9E,CAAC;IACJ,CAAC;IAED,KAAK;QACH,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC;QACrD,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/E,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,EAAE,CAAC;YAC3C,IAAI,MAAM;gBAAE,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAChD,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,oBAAoB,CAAC,kCAAkC,EAAE,MAAM,CAAC,CAAC;YACvF,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gEAAgE,EAAE;gBACvF,SAAS,EAAE,kBAAkB;gBAC7B,QAAQ,EAAE,UAAU;gBACpB,KAAK,EAAE,OAAO;gBACd,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS;gBAC9B,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE;aAC7C,CAAC,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QACnC,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED,cAAc;QACZ,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,cAAc,EAAE,CAAC;IAClD,CAAC;IAED,gBAAgB;QACd,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,cAAc,EAAE,CAAC;QACzD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC1B,CAAC;QACD,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC;QACpC,IAAI,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;QAC/C,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC3B,CAAC;IAED;;;;;OAKG;IACH,sBAAsB,CAAC,cAAsC,EAAE,QAAgB;QAC7E,MAAM,cAAc,GAAG,mBAAmB,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;QACxE,MAAM,gBAAgB,GAAG,qEAAqE,QAAQ,EAAE,CAAC;QAEzG,IAAI,CAAC,gBAAgB,CAAC,+BAA+B,CAAC,cAAc,CAAC,CAAC;QAEtE,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,cAAc,CAAC,YAAmB,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACjG,cAAc,CAAC,iBAAiB,KAAK,IAAI,GAAG,EAAE,CAAC;QAC/C,IAAI,cAAc,EAAE,CAAC;YACnB,cAAc,CAAC,iBAAiB,CAAC,GAAG,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;QACnE,CAAC;QAED,OAAO,EAAE,cAAc,EAAE,CAAC;IAC5B,CAAC;IAED;;;OAGG;IACH,mBAAmB,CACjB,MAAc,EACd,eAAmC,EACnC,MAAM,GAA2B,MAAM;QAEvC,MAAM,sBAAsB,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC;QACpE,IAAI,CAAC,sBAAsB,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,yEAAyE;QACzE,uEAAuE;QACvE,IAAI,sBAAsB,CAAC,sBAAsB,CAAC,YAAY,CAAC,EAAE,CAAC;YAChE,OAAO,EAAE,sBAAsB,EAAE,CAAC;QACpC,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC;YAC5C,sBAAsB;YACtB,MAAM;YACN,eAAe;YACf,MAAM;SACP,CAAC,CAAC;QACH,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,CAAC;IAC/E,CAAC;IAED,aAAa,CAAC,OAA+B;QAC3C,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED,YAAY;QACV,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,CAAC;IACzC,CAAC;IAED,UAAU;QACR,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC;IAC9C,CAAC;IAED,sBAAsB;QACpB,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,EAAE,YAAY,CAAC;IAC5D,CAAC;IAED,2BAA2B,CAAC,YAAqB;QAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC;QACrD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC;YACjC,GAAG,OAAO;YACV,YAAY;YACZ,cAAc,EAAE,mBAAmB,CAAC,YAAY,CAAC;YACjD,KAAK,EAAE,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC;SACvC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC;IAC9C,CAAC;CACF"}
+{"version":3,"file":"approval-flow-coordinator.js","sourceRoot":"","sources":["../../../source/services/approval/approval-flow-coordinator.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,mBAAmB,EAAE,MAAM,mDAAmD,CAAC;AACxF,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAU9D,OAAO,EAAE,wBAAwB,EAA+B,MAAM,iCAAiC,CAAC;AACxG,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAExE,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAqClE,MAAM,OAAO,uBAAuB;IAKL,IAAI;IAJxB,cAAc,CAAwB;IACtC,gBAAgB,CAAsB;IACtC,iBAAiB,CAA2B;IAErD,YAA6B,IAAiC;oBAAjC,IAAI;QAC/B,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,aAAa,CAAC;QACzC,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,eAAe,IAAI,IAAI,mBAAmB,EAAE,CAAC;QAC1E,IAAI,CAAC,iBAAiB,GAAG,IAAI,wBAAwB,CAAC;YACpD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;YAC7C,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,eAAe,EAAE,IAAI,CAAC,gBAAgB;SACvC,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,YAAY,CAAC,YAAqB;QAChC,OAAO,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,mBAAmB,CAAC,YAAY,CAAC,CAAC,CAAC;IACxE,CAAC;IAED,qBAAqB,CACnB,MAAc,EACd,eAAwB,EACxB,2BAAqC;QAErC,OAAO;YACL,IAAI,EAAE,mBAAmB;YACzB,MAAM;YACN,eAAe;YACf,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,EAAE,KAAK,IAAI,CAAC;YAC5D,GAAG,CAAC,2BAA2B,CAAC,CAAC,CAAC,EAAE,2BAA2B,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9E,CAAC;IACJ,CAAC;IAED,KAAK;QACH,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC;QACrD,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/E,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,EAAE,CAAC;YAC3C,IAAI,MAAM;gBAAE,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAChD,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,oBAAoB,CAAC,kCAAkC,EAAE,MAAM,CAAC,CAAC;YACvF,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gEAAgE,EAAE;gBACvF,SAAS,EAAE,kBAAkB;gBAC7B,QAAQ,EAAE,UAAU;gBACpB,KAAK,EAAE,OAAO;gBACd,SAAS,EAAE,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;gBAChD,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE;aAC7C,CAAC,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QACnC,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED,cAAc;QACZ,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,cAAc,EAAE,CAAC;IAClD,CAAC;IAED,gBAAgB;QACd,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,cAAc,EAAE,CAAC;QACzD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC1B,CAAC;QACD,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC;QACpC,IAAI,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;QAC/C,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC3B,CAAC;IAED;;;;;OAKG;IACH,sBAAsB,CAAC,cAAsC,EAAE,QAAgB;QAC7E,MAAM,cAAc,GAAG,mBAAmB,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;QACxE,MAAM,gBAAgB,GAAG,qEAAqE,QAAQ,EAAE,CAAC;QAEzG,IAAI,CAAC,gBAAgB,CAAC,+BAA+B,CAAC,cAAc,CAAC,CAAC;QAEtE,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,cAAc,CAAC,YAAmB,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACjG,cAAc,CAAC,iBAAiB,KAAK,IAAI,GAAG,EAAE,CAAC;QAC/C,IAAI,cAAc,EAAE,CAAC;YACnB,cAAc,CAAC,iBAAiB,CAAC,GAAG,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;QACnE,CAAC;QAED,OAAO,EAAE,cAAc,EAAE,CAAC;IAC5B,CAAC;IAED;;;OAGG;IACH,mBAAmB,CACjB,MAAc,EACd,eAAmC,EACnC,MAAM,GAA2B,MAAM;QAEvC,MAAM,sBAAsB,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC;QACpE,IAAI,CAAC,sBAAsB,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,yEAAyE;QACzE,uEAAuE;QACvE,IAAI,sBAAsB,CAAC,sBAAsB,CAAC,YAAY,CAAC,EAAE,CAAC;YAChE,OAAO,EAAE,sBAAsB,EAAE,CAAC;QACpC,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC;YAC5C,sBAAsB;YACtB,MAAM;YACN,eAAe;YACf,MAAM;SACP,CAAC,CAAC;QACH,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,CAAC;IAC/E,CAAC;IAED,aAAa,CAAC,OAA+B;QAC3C,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED,YAAY;QACV,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,CAAC;IACzC,CAAC;IAED,UAAU;QACR,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC;IAC9C,CAAC;IAED,sBAAsB;QACpB,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,EAAE,YAAY,CAAC;IAC5D,CAAC;IAED,2BAA2B,CAAC,YAAqB;QAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC;QACrD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC;YACjC,GAAG,OAAO;YACV,YAAY;YACZ,cAAc,EAAE,mBAAmB,CAAC,YAAY,CAAC;YACjD,KAAK,EAAE,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC;SACvC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC;IAC9C,CAAC;CACF"}

package/dist/services/approval/approval-grant-executor.d.ts

@@ -0,0 +1,25 @@
+import type { SessionAccessState } from '../session/session-access-state.js';
+import type { NestedToolCompatibilityState } from '../session/nested-tool-compatibility-state.js';
+import type { ILoggingService } from '../service-interfaces.js';
+export type ApprovalGrantExecutorDeps = {
+    sessionId: string;
+    sessionAccess?: SessionAccessState;
+    nestedCompatibility?: NestedToolCompatibilityState;
+    logger?: ILoggingService;
+};
+export type ApprovalGrantInput = {
+    answer: string;
+    toolName?: string;
+    rawArguments?: unknown;
+    callId?: string;
+    interruption?: unknown;
+};
+export type ApprovalGrantResult = {
+    isApproved: boolean;
+    isDockerRequest: boolean;
+    deniedReadDecision: boolean;
+    parsedArguments: Record<string, unknown> | null;
+};
+/** The one domain seam that applies the existing approval grants. */
+export declare function applyApprovalGrant(deps: ApprovalGrantExecutorDeps, input: ApprovalGrantInput): ApprovalGrantResult;
+//# sourceMappingURL=approval-grant-executor.d.ts.map

package/dist/services/approval/approval-grant-executor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-grant-executor.d.ts","sourceRoot":"","sources":["../../../source/services/approval/approval-grant-executor.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAC7E,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,+CAA+C,CAAC;AAClG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAMhE,MAAM,MAAM,yBAAyB,GAAG;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,kBAAkB,CAAC;IACnC,mBAAmB,CAAC,EAAE,4BAA4B,CAAC;IACnD,MAAM,CAAC,EAAE,eAAe,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,UAAU,EAAE,OAAO,CAAC;IACpB,eAAe,EAAE,OAAO,CAAC;IACzB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CACjD,CAAC;AAEF,qEAAqE;AACrE,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,yBAAyB,EAAE,KAAK,EAAE,kBAAkB,GAAG,mBAAmB,CAgElH"}

package/dist/services/approval/approval-grant-executor.js

@@ -0,0 +1,125 @@
+import path from 'node:path';
+import { getProjectAllowReadStore } from '../../utils/shell/sandbox/denied-read-stores.js';
+import { isDeniedReadApproveAnswer, isDockerHostControlApproveAnswer, isReadFileSessionApproveAnswer, supportsFolderSessionRead, } from '../../contracts/conversation.js';
+import { getActiveWorkspaceRoot } from '../workspace/active-workspace-root.js';
+import { isDockerHostControlShellApproval } from './shell-sandbox-approval.js';
+import { resolveSessionReadFolder } from './session-read-grant-target.js';
+import { getToolInfoFromInterruption } from '../interruption-info.js';
+import { parseToolCallArguments } from '../tool-call-arguments.js';
+import { extractToolTargetPaths } from './shell-auto-approval-resolver.js';
+import { resolveOutsideWorkspaceEdit } from './approval-descriptor.js';
+/** The one domain seam that applies the existing approval grants. */
+export function applyApprovalGrant(deps, input) {
+    const toolName = input.toolName;
+    const parsed = parseToolCallArguments(input.rawArguments, {
+        callId: input.callId ?? String(Date.now()),
+        toolName: toolName ?? 'unknown',
+        sessionId: deps.sessionId,
+        traceId: typeof deps.logger?.getCorrelationId === 'function'
+            ? deps.logger.getCorrelationId() ?? 'trace-unknown'
+            : 'trace-unknown',
+    }).arguments;
+    const parsedArguments = parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : null;
+    const deniedRead = isDeniedReadApproveAnswer(input.answer);
+    const dockerDecision = isDockerHostControlApproveAnswer(input.answer);
+    const isDockerRequest = isDockerHostControlShellApproval(toolName, parsedArguments, deps.sessionId, deps.sessionAccess, deps.nestedCompatibility);
+    const allowReadFolderForSession = isReadFileSessionApproveAnswer(input.answer) && supportsFolderSessionRead(toolName);
+    const editSessionGrants = getEditSessionGrants(input.answer, toolName, parsedArguments);
+    const isApproved = isDockerRequest
+        ? dockerDecision
+        : input.answer === 'y' || deniedRead || allowReadFolderForSession || editSessionGrants.length > 0;
+    if (isApproved && allowReadFolderForSession) {
+        const folder = resolveSessionReadFolder(toolName, parsedArguments);
+        if (folder) {
+            if (deps.sessionAccess)
+                deps.sessionAccess.allowReadFolder(folder);
+            else
+                deps.nestedCompatibility?.readAccess.allowFolder(deps.sessionId, folder);
+        }
+    }
+    if (isApproved && deps.sessionAccess) {
+        for (const editSessionGrant of editSessionGrants) {
+            if (editSessionGrant.kind === 'file')
+                deps.sessionAccess.allowEditFile(editSessionGrant.path);
+            else
+                deps.sessionAccess.allowEditFolder(editSessionGrant.path);
+        }
+    }
+    if (isApproved && deniedRead && input.interruption) {
+        applyDeniedReadDecision(deps, input.answer, input.interruption, input.callId);
+    }
+    if (isApproved && dockerDecision && isDockerRequest && typeof parsedArguments?.command === 'string') {
+        const cwd = typeof parsedArguments.cwd === 'string' ? parsedArguments.cwd : getActiveWorkspaceRoot();
+        const scope = input.answer === 'docker-allow-once' ? 'once' : input.answer === 'docker-allow-session' ? 'session' : 'project';
+        if (deps.sessionAccess)
+            deps.sessionAccess.grantDocker(parsedArguments.command, cwd, scope);
+        else {
+            deps.nestedCompatibility?.docker.grant({
+                command: parsedArguments.command,
+                cwd,
+                scope,
+                sessionId: deps.sessionId,
+            });
+        }
+    }
+    return {
+        isApproved,
+        isDockerRequest,
+        deniedReadDecision: deniedRead,
+        parsedArguments,
+    };
+}
+function getEditSessionGrants(answer, toolName, args) {
+    if (answer !== 'allow-edit-file-session' && answer !== 'allow-edit-folder-session')
+        return [];
+    // Persistent grants must match the singular scope the descriptor/prompt discloses.
+    // One-time approval of the current call is independent: isApproved is true as
+    // long as this returns at least one grant.
+    const disclosed = resolveOutsideWorkspaceEdit(toolName, args);
+    if (disclosed) {
+        return answer === 'allow-edit-file-session'
+            ? [{ kind: 'file', path: disclosed.path }]
+            : [{ kind: 'folder', path: disclosed.folder }];
+    }
+    return extractToolTargetPaths(toolName ?? '', args).map((rawPath) => {
+        const target = path.resolve(getActiveWorkspaceRoot(), rawPath);
+        return answer === 'allow-edit-file-session'
+            ? { kind: 'file', path: target }
+            : { kind: 'folder', path: path.dirname(target) };
+    });
+}
+function applyDeniedReadDecision(deps, answer, interruption, callId) {
+    const { rawArguments } = getToolInfoFromInterruption(interruption);
+    const parsedArgs = parseToolCallArguments(rawArguments, {
+        callId: callId ?? String(Date.now()),
+        toolName: 'shell',
+        sessionId: deps.sessionId,
+        traceId: typeof deps.logger?.getCorrelationId === 'function'
+            ? deps.logger.getCorrelationId() ?? 'trace-unknown'
+            : 'trace-unknown',
+    });
+    const shellCommand = parsedArgs.arguments?.command;
+    if (typeof shellCommand !== 'string')
+        return;
+    const stagedInfo = deps.nestedCompatibility?.deniedReads.consumeStaged(shellCommand);
+    if (!stagedInfo)
+        return;
+    if (answer === 'allow-once' || answer === 'allow-remember') {
+        deps.nestedCompatibility?.executionOverrides.set(shellCommand, {
+            extraAllowRead: [stagedInfo.suggestedParent],
+        });
+        if (answer === 'allow-remember') {
+            getProjectAllowReadStore(getActiveWorkspaceRoot()).append(stagedInfo.suggestedParent);
+            deps.logger?.security('Sandbox allowed-read path remembered for project', {
+                path: stagedInfo.suggestedParent,
+                deniedPath: stagedInfo.path,
+                sensitive: stagedInfo.sensitive,
+                sessionId: deps.sessionId,
+            });
+        }
+    }
+    else if (answer === 'unsandboxed-once') {
+        deps.nestedCompatibility?.executionOverrides.set(shellCommand, { forceUnsandboxed: true });
+    }
+}
+//# sourceMappingURL=approval-grant-executor.js.map

package/dist/services/approval/approval-grant-executor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-grant-executor.js","sourceRoot":"","sources":["../../../source/services/approval/approval-grant-executor.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,EACL,yBAAyB,EACzB,gCAAgC,EAChC,8BAA8B,EAC9B,yBAAyB,GAC1B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,EAAE,gCAAgC,EAAE,MAAM,6BAA6B,CAAC;AAC/E,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAI1E,OAAO,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAC3E,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AAwBvE,qEAAqE;AACrE,MAAM,UAAU,kBAAkB,CAAC,IAA+B,EAAE,KAAyB;IAC3F,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IAChC,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,YAAY,EAAE;QACxD,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QAC1C,QAAQ,EAAE,QAAQ,IAAI,SAAS;QAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,OAAO,EACL,OAAO,IAAI,CAAC,MAAM,EAAE,gBAAgB,KAAK,UAAU;YACjD,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,IAAI,eAAe;YACnD,CAAC,CAAC,eAAe;KACtB,CAAC,CAAC,SAAS,CAAC;IACb,MAAM,eAAe,GACnB,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,MAAkC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9G,MAAM,UAAU,GAAG,yBAAyB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3D,MAAM,cAAc,GAAG,gCAAgC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACtE,MAAM,eAAe,GAAG,gCAAgC,CACtD,QAAQ,EACR,eAAe,EACf,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,mBAAmB,CACzB,CAAC;IACF,MAAM,yBAAyB,GAAG,8BAA8B,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IACtH,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC;IACxF,MAAM,UAAU,GAAG,eAAe;QAChC,CAAC,CAAC,cAAc;QAChB,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,GAAG,IAAI,UAAU,IAAI,yBAAyB,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,CAAC;IAEpG,IAAI,UAAU,IAAI,yBAAyB,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,wBAAwB,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;QACnE,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,IAAI,CAAC,aAAa;gBAAE,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;;gBAC9D,IAAI,CAAC,mBAAmB,EAAE,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IACD,IAAI,UAAU,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QACrC,KAAK,MAAM,gBAAgB,IAAI,iBAAiB,EAAE,CAAC;YACjD,IAAI,gBAAgB,CAAC,IAAI,KAAK,MAAM;gBAAE,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;;gBACzF,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IACD,IAAI,UAAU,IAAI,UAAU,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACnD,uBAAuB,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,UAAU,IAAI,cAAc,IAAI,eAAe,IAAI,OAAO,eAAe,EAAE,OAAO,KAAK,QAAQ,EAAE,CAAC;QACpG,MAAM,GAAG,GAAG,OAAO,eAAe,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,sBAAsB,EAAE,CAAC;QACrG,MAAM,KAAK,GACT,KAAK,CAAC,MAAM,KAAK,mBAAmB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,sBAAsB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QAClH,IAAI,IAAI,CAAC,aAAa;YAAE,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,eAAe,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;aACvF,CAAC;YACJ,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAC,KAAK,CAAC;gBACrC,OAAO,EAAE,eAAe,CAAC,OAAO;gBAChC,GAAG;gBACH,KAAK;gBACL,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO;QACL,UAAU;QACV,eAAe;QACf,kBAAkB,EAAE,UAAU;QAC9B,eAAe;KAChB,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAC3B,MAAc,EACd,QAA4B,EAC5B,IAAoC;IAEpC,IAAI,MAAM,KAAK,yBAAyB,IAAI,MAAM,KAAK,2BAA2B;QAAE,OAAO,EAAE,CAAC;IAC9F,mFAAmF;IACnF,8EAA8E;IAC9E,2CAA2C;IAC3C,MAAM,SAAS,GAAG,2BAA2B,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC9D,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,MAAM,KAAK,yBAAyB;YACzC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC;YAC1C,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,sBAAsB,CAAC,QAAQ,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QAClE,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,sBAAsB,EAAE,EAAE,OAAO,CAAC,CAAC;QAC/D,OAAO,MAAM,KAAK,yBAAyB;YACzC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,MAAM,EAAE;YACzC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAiB,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;IAC9D,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,uBAAuB,CAC9B,IAA+B,EAC/B,MAAc,EACd,YAAqB,EACrB,MAA0B;IAE1B,MAAM,EAAE,YAAY,EAAE,GAAG,2BAA2B,CAAC,YAAY,CAAC,CAAC;IACnE,MAAM,UAAU,GAAG,sBAAsB,CAAC,YAAY,EAAE;QACtD,MAAM,EAAE,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QACpC,QAAQ,EAAE,OAAO;QACjB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,OAAO,EACL,OAAO,IAAI,CAAC,MAAM,EAAE,gBAAgB,KAAK,UAAU;YACjD,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,IAAI,eAAe;YACnD,CAAC,CAAC,eAAe;KACtB,CAAC,CAAC;IACH,MAAM,YAAY,GAAI,UAAU,CAAC,SAAyC,EAAE,OAAO,CAAC;IACpF,IAAI,OAAO,YAAY,KAAK,QAAQ;QAAE,OAAO;IAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,mBAAmB,EAAE,WAAW,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;IACrF,IAAI,CAAC,UAAU;QAAE,OAAO;IACxB,IAAI,MAAM,KAAK,YAAY,IAAI,MAAM,KAAK,gBAAgB,EAAE,CAAC;QAC3D,IAAI,CAAC,mBAAmB,EAAE,kBAAkB,CAAC,GAAG,CAAC,YAAY,EAAE;YAC7D,cAAc,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC;SAC7C,CAAC,CAAC;QACH,IAAI,MAAM,KAAK,gBAAgB,EAAE,CAAC;YAChC,wBAAwB,CAAC,sBAAsB,EAAE,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;YACtF,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,kDAAkD,EAAE;gBACxE,IAAI,EAAE,UAAU,CAAC,eAAe;gBAChC,UAAU,EAAE,UAAU,CAAC,IAAI;gBAC3B,SAAS,EAAE,UAAU,CAAC,SAAS;gBAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;SAAM,IAAI,MAAM,KAAK,kBAAkB,EAAE,CAAC;QACzC,IAAI,CAAC,mBAAmB,EAAE,kBAAkB,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7F,CAAC;AACH,CAAC"}

package/dist/services/approval/background-subagent-approval-controller.d.ts

@@ -3,6 +3,7 @@ import type { NestedToolCompatibilityState } from '../session/nested-tool-compat
 import { type BackgroundSubagentApprovalResolutionRequest, type BackgroundSubagentApprovalSnapshot } from './background-subagent-approval-queue.js';
 import type { BackgroundSubagentApprovalPause } from '../subagents/foreground-subagent-lease.js';
 import type { ToolOwnershipRegistry } from './tool-ownership-registry.js';
+import type { SessionIdSource } from '../session/session-identity.js';
 /**
  * Session-owned policy/control boundary for approvals paused by adopted child
  * leases. Root ApprovalState is deliberately not involved: its continuation
@@ -13,7 +14,7 @@ export declare class BackgroundSubagentApprovalController {
     #private;
     constructor({ logger, sessionId, toolOwnership, nestedCompatibility, }: {
         logger: ILoggingService;
-        sessionId: string;
+        sessionId: SessionIdSource;
         toolOwnership: ToolOwnershipRegistry;
         nestedCompatibility?: NestedToolCompatibilityState;
     });

package/dist/services/approval/background-subagent-approval-controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"background-subagent-approval-controller.d.ts","sourceRoot":"","sources":["../../../source/services/approval/background-subagent-approval-controller.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,+CAA+C,CAAC;AAElG,OAAO,EAGL,KAAK,2CAA2C,EAChD,KAAK,kCAAkC,EACxC,MAAM,yCAAyC,CAAC;AAEjD,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,2CAA2C,CAAC;AACjG,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAE1E;;;;;GAKG;AACH,qBAAa,oCAAoC;;IAK/C,YAAY,EACV,MAAM,EACN,SAAS,EACT,aAAa,EACb,mBAAmB,GACpB,EAAE;QACD,MAAM,EAAE,eAAe,CAAC;QACxB,SAAS,EAAE,MAAM,CAAC;QAClB,aAAa,EAAE,qBAAqB,CAAC;QACrC,mBAAmB,CAAC,EAAE,4BAA4B,CAAC;KACpD,EAGA;IAED,WAAW,IAAI,kCAAkC,CAEhD;IAED,SAAS,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI,CAE1C;IAED,KAAK,IAAI,SAAS,OAAO,EAAE,CAE1B;IAED,OAAO,CAAC,OAAO,EAAE,2CAA2C,6FAE3D;IAED,iFAAiF;IACjF,OAAO,UAAW,+BAA+B,KAAG,IAAI,CAqBtD;CAuBH"}
+{"version":3,"file":"background-subagent-approval-controller.d.ts","sourceRoot":"","sources":["../../../source/services/approval/background-subagent-approval-controller.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,+CAA+C,CAAC;AAElG,OAAO,EAGL,KAAK,2CAA2C,EAChD,KAAK,kCAAkC,EACxC,MAAM,yCAAyC,CAAC;AAEjD,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,2CAA2C,CAAC;AACjG,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAEtE;;;;;GAKG;AACH,qBAAa,oCAAoC;;IAK/C,YAAY,EACV,MAAM,EACN,SAAS,EACT,aAAa,EACb,mBAAmB,GACpB,EAAE;QACD,MAAM,EAAE,eAAe,CAAC;QACxB,SAAS,EAAE,eAAe,CAAC;QAC3B,aAAa,EAAE,qBAAqB,CAAC;QACrC,mBAAmB,CAAC,EAAE,4BAA4B,CAAC;KACpD,EAGA;IAED,WAAW,IAAI,kCAAkC,CAEhD;IAED,SAAS,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI,CAE1C;IAED,KAAK,IAAI,SAAS,OAAO,EAAE,CAE1B;IAED,OAAO,CAAC,OAAO,EAAE,2CAA2C,6FAE3D;IAED,iFAAiF;IACjF,OAAO,UAAW,+BAA+B,KAAG,IAAI,CAqBtD;CAuBH"}

package/dist/services/approval/background-subagent-approval-controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"background-subagent-approval-controller.js","sourceRoot":"","sources":["../../../source/services/approval/background-subagent-approval-controller.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AAG3F,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,EACL,+BAA+B,GAIhC,MAAM,yCAAyC,CAAC;AAKjD;;;;;GAKG;AACH,MAAM,OAAO,oCAAoC;IACtC,MAAM,GAAG,IAAI,+BAA+B,EAAE,CAAC;IAC/C,SAAS,CAA2B;IACpC,cAAc,CAAwB;IAE/C,YAAY,EACV,MAAM,EACN,SAAS,EACT,aAAa,EACb,mBAAmB,GAMpB;QACC,IAAI,CAAC,cAAc,GAAG,aAAa,CAAC;QACpC,IAAI,CAAC,SAAS,GAAG,IAAI,wBAAwB,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAC3G,CAAC;IAED,WAAW;QACT,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;IACnC,CAAC;IAED,SAAS,CAAC,QAAoB;QAC5B,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC;IAED,KAAK;QACH,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IAC7B,CAAC;IAED,OAAO,CAAC,OAAoD;QAC1D,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;IAED,iFAAiF;IACjF,OAAO,GAAG,CAAC,KAAsC,EAAQ,EAAE;QACzD,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,2BAA2B,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACnF,MAAM,UAAU,GAAG,mBAAmB,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QACnG,MAAM,KAAK,GAAG;YACZ,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,UAAU;YACV,QAAQ;YACR,aAAa,EAAE,OAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,IAAI,IAAI,CAAC;SACtG,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE;YACzB,SAAS,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,CAC9B,KAAK,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;gBAC1E,CAAC,CAAC,EAAE,IAAI,EAAE,SAAkB,EAAE;gBAC9B,CAAC,CAAC,EAAE,IAAI,EAAE,UAAmB,EAAE;YACnC,SAAS,EAAE,GAAG,EAAE;gBACd,uEAAuE;gBACvE,oEAAoE;gBACpE,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YAC1C,CAAC;SACF,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,MAAM,CACJ,WAES,EACT,IAAY,EACZ,QAA4C;QAE5C,MAAM,OAAO,GAA2B;YACtC,KAAK,EAAE,WAAW,CAAC,MAAM;YACzB,YAAY,EAAE,WAAW,CAAC,YAAY;YACtC,iBAAiB,EAAE,IAAI,GAAG,EAAE;YAC5B,qBAAqB,EAAE,IAAI,GAAG,EAAE;YAChC,KAAK,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE;SAC9D,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;YACrB,sBAAsB,EAAE,OAAO;YAC/B,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,eAAe,EAAE,QAAQ,CAAC,eAAe;SAC1C,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}
+{"version":3,"file":"background-subagent-approval-controller.js","sourceRoot":"","sources":["../../../source/services/approval/background-subagent-approval-controller.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AAG3F,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,EACL,+BAA+B,GAIhC,MAAM,yCAAyC,CAAC;AAMjD;;;;;GAKG;AACH,MAAM,OAAO,oCAAoC;IACtC,MAAM,GAAG,IAAI,+BAA+B,EAAE,CAAC;IAC/C,SAAS,CAA2B;IACpC,cAAc,CAAwB;IAE/C,YAAY,EACV,MAAM,EACN,SAAS,EACT,aAAa,EACb,mBAAmB,GAMpB;QACC,IAAI,CAAC,cAAc,GAAG,aAAa,CAAC;QACpC,IAAI,CAAC,SAAS,GAAG,IAAI,wBAAwB,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAC3G,CAAC;IAED,WAAW;QACT,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;IACnC,CAAC;IAED,SAAS,CAAC,QAAoB;QAC5B,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC;IAED,KAAK;QACH,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IAC7B,CAAC;IAED,OAAO,CAAC,OAAoD;QAC1D,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;IAED,iFAAiF;IACjF,OAAO,GAAG,CAAC,KAAsC,EAAQ,EAAE;QACzD,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,2BAA2B,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACnF,MAAM,UAAU,GAAG,mBAAmB,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QACnG,MAAM,KAAK,GAAG;YACZ,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,UAAU;YACV,QAAQ;YACR,aAAa,EAAE,OAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,IAAI,IAAI,CAAC;SACtG,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE;YACzB,SAAS,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,CAC9B,KAAK,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;gBAC1E,CAAC,CAAC,EAAE,IAAI,EAAE,SAAkB,EAAE;gBAC9B,CAAC,CAAC,EAAE,IAAI,EAAE,UAAmB,EAAE;YACnC,SAAS,EAAE,GAAG,EAAE;gBACd,uEAAuE;gBACvE,oEAAoE;gBACpE,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YAC1C,CAAC;SACF,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,MAAM,CACJ,WAES,EACT,IAAY,EACZ,QAA4C;QAE5C,MAAM,OAAO,GAA2B;YACtC,KAAK,EAAE,WAAW,CAAC,MAAM;YACzB,YAAY,EAAE,WAAW,CAAC,YAAY;YACtC,iBAAiB,EAAE,IAAI,GAAG,EAAE;YAC5B,qBAAqB,EAAE,IAAI,GAAG,EAAE;YAChC,KAAK,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE;SAC9D,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;YACrB,sBAAsB,EAAE,OAAO;YAC/B,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,eAAe,EAAE,QAAQ,CAAC,eAAe;SAC1C,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}