@vellumai/credential-executor 0.10.3 → 0.10.4-dev.202607010028.1a4efcc

package/node_modules/@vellumai/service-contracts/src/__tests__/package-boundary.test.ts

@@ -5,8 +5,7 @@
  * 1. Does NOT import from assistant, gateway, credential-executor, or other
  *    service runtime modules.
  * 2. Does NOT import from runtime shared packages that sit above it in the
- *    dependency hierarchy (@vellumai/credential-storage, @vellumai/egress-proxy,
- *    @vellumai/skill-host-contracts).
+ *    dependency hierarchy (@vellumai/credential-storage, @vellumai/egress-proxy).
  * 3. Does NOT import from x-client packages (@vellumai/assistant-client,
  *    @vellumai/ces-client, @vellumai/gateway-client).
  * 4. Remains a pure schema/type package — no runtime dependencies beyond zod.
@@ -73,8 +72,6 @@ const FORBIDDEN_IMPORT_PATTERNS = [
   /require\s*\(\s*["']@vellumai\/credential-storage(?:\/|["'])/,
   /from\s+["']@vellumai\/egress-proxy(?:\/|["'])/,
   /require\s*\(\s*["']@vellumai\/egress-proxy(?:\/|["'])/,
-  /from\s+["']@vellumai\/skill-host-contracts(?:\/|["'])/,
-  /require\s*\(\s*["']@vellumai\/skill-host-contracts(?:\/|["'])/,
 
   // x-client packages (higher layer)
   /from\s+["']@vellumai\/assistant-client(?:\/|["'])/,
@@ -143,7 +140,6 @@ describe("package boundary", () => {
         "@vellumai/assistant",
         "@vellumai/credential-storage",
         "@vellumai/egress-proxy",
-        "@vellumai/skill-host-contracts",
         "@vellumai/assistant-client",
         "@vellumai/ces-client",
         "@vellumai/gateway-client",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/credential-executor",
-  "version": "0.10.3",
+  "version": "0.10.4-dev.202607010028.1a4efcc",
   "license": "MIT",
   "type": "module",
   "exports": {

package/src/__tests__/command-executor.test.ts

@@ -1345,11 +1345,14 @@ describe("server — run_authenticated_command handler", () => {
       defaultWorkspaceDir: testWorkspaceDir,
     });
 
-    const response = await handler({
-      credentialHandle: "local_static:test/api_key",
-      command: "",
-      purpose: "Test empty command",
-    });
+    const response = await handler(
+      {
+        credentialHandle: "local_static:test/api_key",
+        command: "",
+        purpose: "Test empty command",
+      },
+      { sessionId: "test-session" },
+    );
 
     expect(response.success).toBe(false);
     expect(response.error?.code).toBe("INVALID_COMMAND");
@@ -1366,11 +1369,14 @@ describe("server — run_authenticated_command handler", () => {
       defaultWorkspaceDir: testWorkspaceDir,
     });
 
-    const response = await handler({
-      credentialHandle: "local_static:test/api_key",
-      command: "just-a-plain-command --with-args",
-      purpose: "Test plain command",
-    });
+    const response = await handler(
+      {
+        credentialHandle: "local_static:test/api_key",
+        command: "just-a-plain-command --with-args",
+        purpose: "Test plain command",
+      },
+      { sessionId: "test-session" },
+    );
 
     expect(response.success).toBe(false);
     expect(response.error?.code).toBe("INVALID_COMMAND");
@@ -1388,11 +1394,14 @@ describe("server — run_authenticated_command handler", () => {
     });
 
     // This will fail at bundle resolution (fake digest), but the parse succeeds
-    const response = await handler({
-      credentialHandle: "local_static:test/api_key",
-      command: `${"a".repeat(64)}/list api /repos --method GET`,
-      purpose: "Test command parsing",
-    });
+    const response = await handler(
+      {
+        credentialHandle: "local_static:test/api_key",
+        command: `${"a".repeat(64)}/list api /repos --method GET`,
+        purpose: "Test command parsing",
+      },
+      { sessionId: "test-session" },
+    );
 
     // Should fail at bundle resolution, not at command parsing
     expect(response.error?.code).not.toBe("INVALID_COMMAND");

package/src/__tests__/command-workspace.test.ts

@@ -112,6 +112,30 @@ describe("stageInputs", () => {
     }
   });
 
+  test("concurrent stagings get isolated scratch directories", () => {
+    // run_authenticated_command relies on each invocation getting its own
+    // scratch dir so that interleaved commands cannot read or clobber each
+    // other's staged inputs/outputs. Same config, two stagings → distinct dirs.
+    const config: WorkspaceStageConfig = {
+      workspaceDir,
+      inputs: [{ workspacePath: "input.txt" }],
+      outputs: [],
+      secrets: new Set(),
+    };
+
+    const a = stageInputs(config);
+    const b = stageInputs(config);
+
+    try {
+      expect(a.scratchDir).not.toBe(b.scratchDir);
+      expect(existsSync(a.scratchDir)).toBe(true);
+      expect(existsSync(b.scratchDir)).toBe(true);
+    } finally {
+      cleanupScratchDir(a.scratchDir);
+      cleanupScratchDir(b.scratchDir);
+    }
+  });
+
   test("staged inputs are read-only", () => {
     const config: WorkspaceStageConfig = {
       workspaceDir,

package/src/__tests__/grant-store.test.ts

@@ -419,6 +419,110 @@ describe("TemporaryGrantStore", () => {
       expect(store.check("allow_once", "hash-1")).toBe(false);
       expect(store.check("allow_once", "hash-2")).toBe(false);
     });
+
+    test("remains usable immediately (default TTL is not instantaneous)", () => {
+      // The default `allow_once` TTL must still allow a prompt retry of the
+      // just-approved operation.
+      store.add("allow_once", "hash-default-ttl");
+      expect(store.check("allow_once", "hash-default-ttl")).toBe(true);
+    });
+
+    test("expires after its TTL even if never consumed (ATL-935)", () => {
+      // An unconsumed single-use approval must not live forever.
+      store.add("allow_once", "hash-once-expire", { durationMs: 1 });
+
+      const start = Date.now();
+      while (Date.now() - start < 5) {
+        // spin
+      }
+
+      expect(store.check("allow_once", "hash-once-expire")).toBe(false);
+    });
+  });
+
+  // -------------------------------------------------------------------------
+  // ATL-935: ephemeral approvals are bounded by TTLs, not by connection
+  // teardown.
+  //
+  // In managed mode the store instance — contents included — is deliberately
+  // shared across assistant reconnects and, in the multi-process daemon model,
+  // across the connections that each talk to CES, so one guardian approval can
+  // be used by any connection entitled to it. The security boundary is the
+  // per-grant TTL: an approval that is recorded but never consumed must expire
+  // on its own rather than survive indefinitely and be replayed by a much later
+  // connection. These tests encode both halves of that contract — an approval
+  // stays usable across a reconnect (sharing preserved) but does not outlive
+  // its TTL (replay window bounded).
+  // -------------------------------------------------------------------------
+  describe("ATL-935: ephemeral approvals are bounded by TTLs, not teardown", () => {
+    test("every grant kind is bounded by a TTL (no unbounded approvals)", () => {
+      // The finding was that allow_once and allow_conversation had no time
+      // bound at all. Every kind must now expire on its own.
+      store.add("allow_once", "exp-once", { durationMs: 1 });
+      store.add("allow_10m", "exp-10m", { durationMs: 1 });
+      store.add("allow_conversation", "exp-conv", {
+        conversationId: "c",
+        durationMs: 1,
+      });
+
+      const start = Date.now();
+      while (Date.now() - start < 5) {
+        // spin until all three TTLs lapse
+      }
+
+      expect(store.check("allow_once", "exp-once")).toBe(false);
+      expect(store.check("allow_10m", "exp-10m")).toBe(false);
+      expect(store.check("allow_conversation", "exp-conv", "c")).toBe(false);
+    });
+
+    test("allow_once that is never consumed expires instead of lingering", () => {
+      // The headline scenario: an approval recorded but not consumed before a
+      // connection drops must not be replayable by a later connection.
+      store.add("allow_once", "hash-stale", { durationMs: 1 });
+
+      const start = Date.now();
+      while (Date.now() - start < 5) {
+        // spin
+      }
+
+      expect(store.checkAny("hash-stale")).toBeUndefined();
+    });
+
+    test("allow_conversation is bounded by an absolute TTL backstop", () => {
+      store.add("allow_conversation", "hash-conv-ttl", {
+        conversationId: "conv-1",
+        durationMs: 1,
+      });
+
+      const start = Date.now();
+      while (Date.now() - start < 5) {
+        // spin
+      }
+
+      expect(store.checkAny("hash-conv-ttl", "conv-1")).toBeUndefined();
+    });
+
+    test("an unexpired approval is still shared across a reconnect (no teardown)", () => {
+      // The multi-process daemon model depends on this: the store is NOT
+      // cleared on disconnect, so an approval granted while one connection was
+      // live remains usable by a later or sibling connection within its TTL.
+      store.add("allow_conversation", "hash-shared", {
+        conversationId: "conv-1",
+      });
+
+      // Simulate a reconnect — no clear() happens between connections.
+      expect(store.checkAny("hash-shared", "conv-1")).toBe(
+        "allow_conversation",
+      );
+      // Still usable again (conversation grants are not consumed on use).
+      expect(store.checkAny("hash-shared", "conv-1")).toBe(
+        "allow_conversation",
+      );
+
+      // An allow_10m approval likewise survives a reconnect within its window.
+      store.add("allow_10m", "hash-shared-10m");
+      expect(store.checkAny("hash-shared-10m")).toBe("allow_10m");
+    });
   });
 
   describe("allow_10m", () => {

package/src/__tests__/http-executor.test.ts

@@ -280,7 +280,7 @@ function buildDeps(
       metadataStore: fixture.metadataStore,
       oauthConnections: createOAuthLookup(oauthConnections),
     },
-    sessionId: { current: "test-session" },
+    sessionId: "test-session",
     logger: silentLogger,
     ...overrides,
     auditStore: overrides.auditStore ?? new AuditStore(fixture.tmpDir),

package/src/__tests__/manage-secure-command-tool.test.ts

@@ -0,0 +1,134 @@
+/**
+ * Tests for the manage_secure_command_tool handler's operation serialization.
+ *
+ * The register path awaits a bundle download mid-handler. Without
+ * serialization, a concurrent unregister could run its "still in use?" check
+ * and bundle delete during that await — against a registry that doesn't yet
+ * reflect the in-flight registration — transiently deleting a bundle another
+ * caller is publishing or executing. The handler runs operations one-at-a-time
+ * to close that window.
+ */
+
+import { describe, expect, test } from "bun:test";
+
+import type { ManageSecureCommandTool } from "@vellumai/service-contracts/credential-rpc";
+
+import {
+  createManageSecureCommandToolHandler,
+  type ManageSecureCommandToolHandlerDeps,
+} from "../server.js";
+
+const CTX = { sessionId: "test-session" };
+
+function registerRequest(toolName: string): ManageSecureCommandTool {
+  return {
+    action: "register",
+    toolName,
+    bundleId: "bundle-1",
+    version: "1.0.0",
+    sourceUrl: "https://example.com/bundle.tgz",
+    sha256: "deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef0",
+    credentialHandle: "local_static:svc/key",
+    description: "a tool",
+    // publishBundle is mocked in these tests, so the manifest contents are
+    // irrelevant — only its presence matters for the required-field check.
+    secureCommandManifest: {} as unknown as ManageSecureCommandTool["secureCommandManifest"],
+  };
+}
+
+function unregisterRequest(toolName: string): ManageSecureCommandTool {
+  return { action: "unregister", toolName };
+}
+
+describe("manage_secure_command_tool serialization", () => {
+  test("a slow register does not let a concurrent unregister interleave", async () => {
+    const events: string[] = [];
+
+    let releaseDownload!: () => void;
+    const downloadGate = new Promise<void>((resolve) => {
+      releaseDownload = resolve;
+    });
+
+    const deps: ManageSecureCommandToolHandlerDeps = {
+      downloadBundle: async () => {
+        events.push("download:start");
+        await downloadGate;
+        events.push("download:end");
+        return Buffer.from("bundle-bytes");
+      },
+      publishBundle: () => {
+        events.push("publish");
+        return { success: true, deduplicated: false, bundlePath: "/tmp/bundle" };
+      },
+      registerTool: () => {
+        events.push("register");
+      },
+      unregisterTool: (toolName: string) => {
+        events.push(`unregister:${toolName}`);
+        return true;
+      },
+    };
+
+    const handler = createManageSecureCommandToolHandler(deps);
+
+    // Fire a register (which blocks in downloadBundle) then an unregister.
+    const registerPromise = handler(registerRequest("tool-a"), CTX);
+    const unregisterPromise = handler(unregisterRequest("tool-b"), CTX);
+
+    // Let the event loop run: the register has reached its download await, and
+    // the unregister must be queued behind it — its delete must not have run.
+    await new Promise((resolve) => setTimeout(resolve, 0));
+    expect(events).toEqual(["download:start"]);
+
+    // Release the download; both operations complete in order.
+    releaseDownload();
+    const [registerResult, unregisterResult] = await Promise.all([
+      registerPromise,
+      unregisterPromise,
+    ]);
+
+    expect(registerResult.success).toBe(true);
+    expect(unregisterResult.success).toBe(true);
+
+    // The unregister ran only after the register fully completed.
+    expect(events).toEqual([
+      "download:start",
+      "download:end",
+      "publish",
+      "register",
+      "unregister:tool-b",
+    ]);
+  });
+
+  test("a rejected operation does not break serialization for later ones", async () => {
+    const events: string[] = [];
+
+    const deps: ManageSecureCommandToolHandlerDeps = {
+      downloadBundle: async () => {
+        throw new Error("network down");
+      },
+      publishBundle: () => ({
+        success: true,
+        deduplicated: false,
+        bundlePath: "/tmp/bundle",
+      }),
+      registerTool: () => {},
+      unregisterTool: (toolName: string) => {
+        events.push(`unregister:${toolName}`);
+        return true;
+      },
+    };
+
+    const handler = createManageSecureCommandToolHandler(deps);
+
+    // First op fails inside the handler (download error → structured failure),
+    // second op must still run.
+    const first = await handler(registerRequest("tool-a"), CTX);
+    const second = await handler(unregisterRequest("tool-b"), CTX);
+
+    expect(first.success).toBe(false);
+    expect(first.error?.code).toBe("DOWNLOAD_FAILED");
+    expect(second.success).toBe(true);
+    expect(events).toEqual(["unregister:tool-b"]);
+  });
+});

package/src/__tests__/managed-integration.test.ts

@@ -42,7 +42,7 @@ import {
   createListGrantsHandler,
   createListAuditRecordsHandler,
 } from "../grants/rpc-handlers.js";
-import { CesRpcServer, type RpcHandlerRegistry, type ServeEndReason, type SessionIdRef } from "../server.js";
+import { CesRpcServer, type RpcHandlerRegistry, type ServeEndReason } from "../server.js";
 import { createLocalSecureKeyBackend } from "../materializers/local-secure-key-backend.js";
 
 // ---------------------------------------------------------------------------
@@ -412,7 +412,7 @@ describe("managed CES integration (real Unix socket)", () => {
     // -- Server gets the connection and wires up RPC ---------------------------
     const conn = await connectionPromise;
 
-    const sessionIdRef: SessionIdRef = { current: `integ-${Date.now()}` };
+    let observedSessionId = "";
     const handlers = buildMinimalHandlers(dataDir);
 
     serverRpcServer = new CesRpcServer({
@@ -426,7 +426,7 @@ describe("managed CES integration (real Unix socket)", () => {
       },
       signal: controller.signal,
       onHandshakeComplete: (hsSessionId) => {
-        sessionIdRef.current = hsSessionId;
+        observedSessionId = hsSessionId;
       },
     });
 
@@ -449,8 +449,10 @@ describe("managed CES integration (real Unix socket)", () => {
     expect(ack.protocolVersion).toBe(CES_PROTOCOL_VERSION);
     expect(ack.sessionId).toBe(handshakeSessionId);
 
-    // Verify onHandshakeComplete callback fired
-    expect(sessionIdRef.current).toBe(handshakeSessionId);
+    // Verify onHandshakeComplete callback fired and the server populated its
+    // per-connection SessionContext.
+    expect(observedSessionId).toBe(handshakeSessionId);
+    expect(serverRpcServer.currentSessionId).toBe(handshakeSessionId);
 
     // -- Step 2: RPC dispatch (list_grants) ------------------------------------
     const rpcId = "rpc-1";

package/src/commands/executor.ts

@@ -79,7 +79,6 @@ import { hashProposal, type AuditRecordSummary, type CommandGrantProposal } from
 import type { AuditStore } from "../audit/store.js";
 import type { PersistentGrantStore } from "../grants/persistent-store.js";
 import type { TemporaryGrantStore } from "../grants/temporary-store.js";
-import type { SessionIdRef } from "../server.js";
 
 // ---------------------------------------------------------------------------
 // Types
@@ -171,8 +170,8 @@ export interface CommandExecutorDeps {
   materializeCredential: MaterializeCredentialFn;
   /** Audit store for persisting token-free audit records. */
   auditStore?: AuditStore;
-  /** Mutable reference to the session ID for audit records. Updated to the handshake session ID once the RPC handshake completes. */
-  sessionId?: SessionIdRef;
+  /** Session ID for audit records, taken from the calling connection's SessionContext at dispatch time. */
+  sessionId?: string;
   /** CES operating mode (for toolstore path resolution). */
   cesMode?: CesMode;
   /** Egress proxy session start hooks (for creating the proxy server). */
@@ -567,7 +566,7 @@ export async function executeAuthenticatedCommand(
       credentialHandle: request.credentialHandle,
       toolName: "command",
       target: `${request.bundleDigest}/${request.profileName}`,
-      sessionId: deps.sessionId?.current ?? "unknown",
+      sessionId: deps.sessionId ?? "unknown",
       success: execResult.success,
       ...(execResult.error ? { errorMessage: execResult.error } : {}),
       timestamp: new Date().toISOString(),

package/src/grants/temporary-store.ts

@@ -6,11 +6,29 @@
  * which is the desired behaviour for ephemeral approvals.
  *
  * Keying:
- * - `allow_once`: Keyed by proposal hash. Consumed (deleted) on first use.
+ * - `allow_once`: Keyed by proposal hash. Consumed (deleted) on first use, and
+ *   bounded by a short default TTL so an approval that is never consumed cannot
+ *   linger and be replayed long after the guardian approved the imminent
+ *   operation (see ATL-935).
  * - `allow_10m`: Keyed by proposal hash. Checked for expiry on every read;
  *   expired entries are lazily purged.
  * - `allow_conversation`: Keyed by proposal hash + conversation ID. Scoped to a
- *   single conversation.
+ *   single conversation and bounded by a generous absolute TTL backstop so an
+ *   approval cannot live for the store's entire (process-long) lifetime and be
+ *   replayed by a later connection that presents the same conversation ID
+ *   (see ATL-935).
+ *
+ * Lifetime note: in managed mode this store instance is process-scoped and
+ * deliberately shared across assistant reconnects — and, in the forthcoming
+ * multi-process daemon model, across the multiple connections that each talk to
+ * CES — so a single guardian approval can be used by any connection entitled to
+ * it. Grant lifetime is therefore bounded by per-grant TTLs rather than by
+ * connection teardown: every grant kind carries an expiry, so an unconsumed
+ * approval expires on its own instead of surviving indefinitely. (A future
+ * multi-connection daemon may additionally evict on quiescence — when the count
+ * of live CES connections reaches zero — to scope grants to assistant presence;
+ * that is connection-lifecycle machinery the multi-connection work should own,
+ * and is intentionally not built here.)
  */
 
 // ---------------------------------------------------------------------------
@@ -28,13 +46,41 @@ export interface TemporaryGrant {
   conversationId?: string;
   /** When the grant was created (epoch ms). */
   createdAt: number;
-  /** When the grant expires (epoch ms). Set for `allow_10m`; optionally set for `allow_once`. */
+  /** When the grant expires (epoch ms). Set for every grant kind: a short
+   *  default for `allow_once`, the timed window for `allow_10m`, and a generous
+   *  absolute backstop for `allow_conversation`. */
   expiresAt?: number;
 }
 
 /** Default TTL for timed grants (10 minutes). */
 const DEFAULT_TIMED_DURATION_MS = 10 * 60 * 1000;
 
+/**
+ * Default TTL for single-use (`allow_once`) grants (2 minutes).
+ *
+ * `allow_once` exists to bridge the gap between a guardian approval and the
+ * caller immediately retrying the just-approved operation. Without a TTL, an
+ * approval that is never consumed (e.g. the assistant connection drops before
+ * the retry) would live for the store's entire lifetime and could later be
+ * replayed without a fresh prompt (ATL-935). A short bound keeps the grant
+ * usable for a prompt retry while ensuring a stale, unconsumed approval
+ * expires on its own.
+ */
+const DEFAULT_ONCE_DURATION_MS = 2 * 60 * 1000;
+
+/**
+ * Absolute TTL backstop for `allow_conversation` grants (12 hours).
+ *
+ * `allow_conversation` is scoped to a conversation ID and is meant to persist
+ * for the life of that conversation, so it is not consumed on use and has no
+ * short timeout. But without any bound it would live for the store's entire
+ * process-long lifetime and could be replayed by a later connection that
+ * presents the same conversation ID long after the original approval (ATL-935).
+ * A generous backstop keeps the grant usable across a normal working session
+ * while ensuring a long-stale approval eventually requires a fresh prompt.
+ */
+const DEFAULT_CONVERSATION_DURATION_MS = 12 * 60 * 60 * 1000;
+
 // ---------------------------------------------------------------------------
 // Store implementation
 // ---------------------------------------------------------------------------
@@ -102,8 +148,19 @@ export class TemporaryGrantStore {
     if (kind === "allow_10m") {
       grant.expiresAt =
         Date.now() + (options?.durationMs ?? DEFAULT_TIMED_DURATION_MS);
-    } else if (kind === "allow_once" && options?.durationMs !== undefined) {
-      grant.expiresAt = Date.now() + options.durationMs;
+    } else if (kind === "allow_once") {
+      // `allow_once` is always bounded by a TTL — a caller-supplied duration
+      // when present, otherwise a short default — so an unconsumed single-use
+      // approval cannot be replayed indefinitely (ATL-935).
+      grant.expiresAt =
+        Date.now() + (options?.durationMs ?? DEFAULT_ONCE_DURATION_MS);
+    } else if (kind === "allow_conversation") {
+      // `allow_conversation` persists for the conversation and is not consumed
+      // on use, but it still carries a generous absolute TTL backstop so a
+      // conversation-scoped approval cannot linger for the store's entire
+      // process lifetime and be replayed by a later connection (ATL-935).
+      grant.expiresAt =
+        Date.now() + (options?.durationMs ?? DEFAULT_CONVERSATION_DURATION_MS);
     }
 
     this.store.set(key, grant);
@@ -115,8 +172,9 @@ export class TemporaryGrantStore {
    * - `allow_once`: Returns `true` and **consumes** the grant (deletes it).
    * - `allow_10m`: Returns `true` only if the grant has not expired.
    *   Expired grants are lazily purged.
-   * - `allow_conversation`: Returns `true` only if a grant exists for the given
-   *   proposal hash scoped to the specified conversation ID.
+   * - `allow_conversation`: Returns `true` only if a non-expired grant exists
+   *   for the given proposal hash scoped to the specified conversation ID.
+   *   Expired grants (past the absolute TTL backstop) are lazily purged.
    *
    * Returns `false` if no matching grant exists.
    */
@@ -149,7 +207,12 @@ export class TemporaryGrantStore {
       return true;
     }
 
-    // allow_conversation — no expiry, just existence check
+    // allow_conversation — bounded by an absolute TTL backstop; lazily purge an
+    // expired grant and deny, mirroring allow_10m.
+    if (grant.expiresAt !== undefined && Date.now() >= grant.expiresAt) {
+      this.store.delete(key);
+      return false;
+    }
     return true;
   }
 

package/src/http/executor.ts

@@ -43,7 +43,6 @@ import { materializeManagedToken, type ManagedMaterializerOptions } from "../mat
 import { resolveLocalSubject, type LocalSubjectResolverDeps } from "../subjects/local.js";
 import { checkCredentialPolicy } from "../subjects/policy.js";
 import { resolveManagedSubject, type ManagedSubjectResolverOptions } from "../subjects/managed.js";
-import type { SessionIdRef } from "../server.js";
 
 // ---------------------------------------------------------------------------
 // Auth injection constants
@@ -81,8 +80,8 @@ export interface HttpExecutorDeps {
   managedMaterializerOptions?: ManagedMaterializerOptions;
   /** Audit store for persisting token-free audit records. */
   auditStore: AuditStore;
-  /** Mutable reference to the session ID for audit records. Updated to the handshake session ID once the RPC handshake completes. */
-  sessionId: SessionIdRef;
+  /** Session ID for audit records, injected per call from the calling connection's SessionContext. */
+  sessionId?: string;
   /** Optional custom fetch implementation (for testing). */
   fetch?: typeof globalThis.fetch;
   /** Optional logger. */
@@ -185,7 +184,7 @@ export async function executeAuthenticatedHttpRequest(
     const audit = generateHttpAuditSummary({
       credentialHandle: request.credentialHandle,
       grantId,
-      sessionId: deps.sessionId.current,
+      sessionId: deps.sessionId ?? "unknown",
       method: request.method,
       url: request.url,
       success: false,
@@ -235,7 +234,7 @@ export async function executeAuthenticatedHttpRequest(
     const audit = generateHttpAuditSummary({
       credentialHandle: request.credentialHandle,
       grantId,
-      sessionId: deps.sessionId.current,
+      sessionId: deps.sessionId ?? "unknown",
       method: request.method,
       url: request.url,
       success: false,
@@ -261,7 +260,7 @@ export async function executeAuthenticatedHttpRequest(
   const audit = generateHttpAuditSummary({
     credentialHandle: request.credentialHandle,
     grantId,
-    sessionId: deps.sessionId.current,
+    sessionId: deps.sessionId ?? "unknown",
     method: request.method,
     url: request.url,
     success: true,

package/src/index.ts

@@ -29,7 +29,7 @@ export type {
   RpcHandlerRegistry,
   RpcMethodHandler,
   RunAuthenticatedCommandHandlerOptions,
-  SessionIdRef,
+  SessionContext,
 } from "./server.js";
 
 export {

package/src/main.ts

@@ -59,7 +59,6 @@ import {
   registerCommandExecutionHandler,
   registerManageSecureCommandToolHandler,
   type RpcHandlerRegistry,
-  type SessionIdRef,
 } from "./server.js";
 import {
   deleteBundleFromToolstore,
@@ -124,7 +123,6 @@ function getSecurityDir(): string {
 // ---------------------------------------------------------------------------
 
 function buildHandlers(
-  sessionIdRef: SessionIdRef,
   secureKeyBackend: SecureKeyBackend,
 ): RpcHandlerRegistry {
   // -- Grant stores ----------------------------------------------------------
@@ -174,7 +172,6 @@ function buildHandlers(
       oauthConnections,
     },
     auditStore,
-    sessionId: sessionIdRef,
   });
 
   // Register run_authenticated_command handler
@@ -216,7 +213,6 @@ function buildHandlers(
         };
       },
       auditStore,
-      sessionId: sessionIdRef,
       cesMode: "local",
       egressHooks: buildCesEgressHooks(),
     },
@@ -389,10 +385,9 @@ async function main(): Promise<void> {
   log.info("CES local startup: migrations complete");
 
   // Build the handler registry with all available RPC implementations.
-  // Use a mutable ref so audit records capture the handshake session ID
-  // once it's negotiated (the handshake completes before any RPC call).
-  const sessionIdRef: SessionIdRef = { current: `ces-local-${Date.now()}` };
-  const handlers = buildHandlers(sessionIdRef, secureKeyBackend);
+  // The handshake session ID is captured per connection in the server's
+  // SessionContext; handlers read it at call time for audit records.
+  const handlers = buildHandlers(secureKeyBackend);
 
   const rpcLog = getLogger("rpc");
   const server = new CesRpcServer({
@@ -405,10 +400,8 @@ async function main(): Promise<void> {
       error: (msg: string, ...args: unknown[]) => rpcLog.error({ args }, msg),
     },
     signal: controller.signal,
-    onHandshakeComplete: (hsSessionId) => {
-      sessionIdRef.current = hsSessionId;
-    },
-    // Local mode reads API keys from env/store directly — no-op handler.
+    // Local mode reads API keys from env/store directly — no-op handler so
+    // update_managed_credential is still registered and returns success.
     onApiKeyUpdate: () => {},
   });
 

package/src/managed-main.ts

@@ -57,7 +57,6 @@ import {
   registerManageSecureCommandToolHandler,
   type RpcHandlerRegistry,
   type ServeEndReason,
-  type SessionIdRef,
 } from "./server.js";
 import {
   deleteBundleFromToolstore,
@@ -120,11 +119,10 @@ function ensureDataDirs(): void {
 // ---------------------------------------------------------------------------
 
 function buildHandlers(
-  sessionIdRef: SessionIdRef,
   apiKeyRef: ApiKeyRef,
   assistantIdRef: AssistantIdRef,
   secureKeyBackend: SecureKeyBackend,
-): { handlers: RpcHandlerRegistry; temporaryGrantStore: TemporaryGrantStore } {
+): RpcHandlerRegistry {
   // -- Grant stores ----------------------------------------------------------
   const persistentGrantStore = new PersistentGrantStore(
     getCesGrantsDir("managed"),
@@ -214,7 +212,6 @@ function buildHandlers(
       return getManagedMaterializerOptions();
     },
     auditStore,
-    sessionId: sessionIdRef,
   };
 
   const handlers = buildHandlersWithHttp(httpDeps);
@@ -283,7 +280,6 @@ function buildHandlers(
         }
       },
       auditStore,
-      sessionId: sessionIdRef,
       cesMode: "managed",
       egressHooks: buildCesEgressHooks(),
     },
@@ -415,7 +411,7 @@ function buildHandlers(
     return { results };
   }) as (typeof handlers)[string];
 
-  return { handlers, temporaryGrantStore };
+  return handlers;
 }
 
 // ---------------------------------------------------------------------------
@@ -672,23 +668,32 @@ async function main(): Promise<void> {
   // `unregister` miss a tool registered in an earlier session and orphan its
   // bundle.
   //
-  // The in-memory temporary-grant store is the exception: `allow_once` /
-  // `allow_10m` grants are keyed by proposal hash only (not session), so they
-  // would otherwise leak ephemeral approvals across sessions. It is cleared at
-  // the end of every session below so a reconnecting assistant must re-prompt.
+  // The in-memory temporary-grant store instance is also process-scoped and is
+  // deliberately reused — contents included — across reconnects. Ephemeral
+  // approvals (`allow_once` / `allow_10m` / `allow_conversation`) are keyed by
+  // proposal hash (plus a caller-supplied conversation ID), not by the
+  // connection that produced them, precisely so a single guardian approval can
+  // be shared by any connection entitled to use it. That sharing is what the
+  // multi-process daemon model needs: several assistant processes will each
+  // talk to CES, and an approval granted while one is connected must remain
+  // usable by the others. Grant lifetime is therefore bounded by per-grant TTLs
+  // (every kind now carries an expiry), not by tearing the store down on
+  // disconnect — so an approval that is never consumed expires on its own
+  // instead of surviving indefinitely and being replayed by a much later
+  // connection without a fresh guardian prompt (ATL-935). A future
+  // multi-connection daemon may additionally evict on quiescence (when the
+  // count of live CES connections reaches zero) to scope grants to assistant
+  // presence; that is connection-lifecycle machinery the multi-connection work
+  // should own, and is intentionally not added here.
   //
-  // The mutable refs carry the handshake-provided session ID, API key, and
-  // assistant ID; handlers read them at call time, so updating the refs when
-  // each session's handshake completes is all that's needed per connection.
-  const sessionIdRef: SessionIdRef = { current: `ces-managed-${Date.now()}` };
+  // The mutable refs carry the handshake-provided API key and assistant ID;
+  // handlers read them at call time. These don't vary across a daemon's
+  // connections, so they stay process-global. The per-connection session ID,
+  // by contrast, lives in each CesRpcServer's SessionContext (handlers read it
+  // at call time for audit attribution).
   const apiKeyRef: ApiKeyRef = { current: "" };
   const assistantIdRef: AssistantIdRef = { current: "" };
-  const { handlers, temporaryGrantStore } = buildHandlers(
-    sessionIdRef,
-    apiKeyRef,
-    assistantIdRef,
-    secureKeyBackend,
-  );
+  const handlers = buildHandlers(apiKeyRef, assistantIdRef, secureKeyBackend);
 
   // Serve loop. CES is a long-lived sidecar that must outlive any single
   // assistant session: the assistant container can crash and be restarted
@@ -726,8 +731,7 @@ async function main(): Promise<void> {
         error: (msg: string, ...args: unknown[]) => rpcLog.error({ args }, msg),
       },
       signal: controller.signal,
-      onHandshakeComplete: (hsSessionId, hsApiKey, hsAssistantId) => {
-        sessionIdRef.current = hsSessionId;
+      onHandshakeComplete: (_hsSessionId, hsApiKey, hsAssistantId) => {
         // Overwrite the credential refs on every handshake. The handler
         // registry persists across reconnects, so a new session that omits
         // the API key / assistant ID must fail closed (falling back to the
@@ -785,14 +789,6 @@ async function main(): Promise<void> {
 
     rpcConnected = false;
 
-    // Drop all ephemeral approvals when the session ends. `allow_once` /
-    // `allow_10m` grants are keyed by proposal hash only, so reusing the
-    // store across a reconnect would let a pre-disconnect approval be
-    // consumed by a later session without re-prompting. Clearing here
-    // restores the prior behavior, where the process exited on stream end
-    // and these grants never survived.
-    temporaryGrantStore.clear();
-
     // A signal-driven end means the process is shutting down; exit the loop.
     // Any other end reason (the assistant disconnected, its stream closed,
     // or the transport errored) means we keep the sidecar up and await a

package/src/server.ts

@@ -54,20 +54,33 @@ import {
 // ---------------------------------------------------------------------------
 
 /**
- * Mutable reference to the current session ID. Allows handlers that are
- * registered before the RPC handshake to read the actual handshake session
- * ID at call time (after the handshake completes and sets `.current`).
+ * Per-connection session context.
+ *
+ * Each accepted connection owns one `SessionContext`, created when the server
+ * is constructed and populated with the negotiated session ID at handshake.
+ * Handlers receive it as their second argument and read the session ID at call
+ * time — so a handler registry shared across connections attributes each call
+ * (e.g. audit records) to the originating connection.
+ *
+ * Identity that does not vary across a daemon's connections — the assistant
+ * API key and assistant ID — deliberately lives outside this context
+ * (process-global, see `managed-lazy-getters.ts`); only the per-connection
+ * session ID belongs here.
  */
-export interface SessionIdRef {
-  current: string;
+export interface SessionContext {
+  /** The RPC session ID negotiated at handshake. */
+  sessionId: string;
 }
 
 /**
- * Handler function for a single RPC method. Receives the validated
- * request payload and returns the response payload (or throws).
+ * Handler function for a single RPC method. Receives the validated request
+ * payload and the originating connection's `SessionContext`, and returns the
+ * response payload (or throws). Handlers that don't need the context may omit
+ * the second parameter.
  */
 export type RpcMethodHandler<TReq = unknown, TRes = unknown> = (
   request: TReq,
+  ctx: SessionContext,
 ) => Promise<TRes> | TRes;
 
 /**
@@ -112,7 +125,12 @@ export class CesRpcServer {
   private readonly onHandshakeComplete?: (sessionId: string, assistantApiKey?: string, assistantId?: string) => void;
 
   private handshakeComplete = false;
-  private sessionId: string | null = null;
+  /**
+   * This connection's session context. The object identity is stable for the
+   * life of the server and passed by reference to every handler; `sessionId` is
+   * populated when the handshake completes.
+   */
+  private readonly sessionContext: SessionContext = { sessionId: "" };
   private buffer = "";
   private closed = false;
 
@@ -187,7 +205,7 @@ export class CesRpcServer {
 
   /** The session ID established during handshake (null before handshake). */
   get currentSessionId(): string | null {
-    return this.sessionId;
+    return this.sessionContext.sessionId || null;
   }
 
   /** Shut down the server gracefully, destroying transport streams. */
@@ -270,7 +288,7 @@ export class CesRpcServer {
 
     if (accepted) {
       this.handshakeComplete = true;
-      this.sessionId = req.sessionId;
+      this.sessionContext.sessionId = req.sessionId;
       this.logger.log(`[ces-server] Handshake accepted for session ${req.sessionId}`);
       this.onHandshakeComplete?.(req.sessionId, req.assistantApiKey, req.assistantId);
     } else {
@@ -320,7 +338,7 @@ export class CesRpcServer {
     }
 
     try {
-      const result = await handler(validatedPayload);
+      const result = await handler(validatedPayload, this.sessionContext);
       this.sendRpcResponse(envelope, result);
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
@@ -373,17 +391,19 @@ export class CesRpcServer {
 /**
  * Create a handler function for the `make_authenticated_request` RPC method.
  *
- * Binds the executor to the provided dependencies so it can be registered
- * in the RPC handler registry.
+ * Binds the executor to the provided dependencies so it can be registered in
+ * the RPC handler registry. The per-connection session ID is merged in from
+ * the SessionContext at call time (for audit attribution); all other deps —
+ * including the managed subject/materializer options — are taken as supplied.
  */
 export function createMakeAuthenticatedRequestHandler(
   deps: HttpExecutorDeps,
 ): RpcMethodHandler {
-  return async (request: unknown) => {
-    return executeAuthenticatedHttpRequest(
-      request as MakeAuthenticatedRequest,
-      deps,
-    );
+  return async (request: unknown, ctx: SessionContext) => {
+    return executeAuthenticatedHttpRequest(request as MakeAuthenticatedRequest, {
+      ...deps,
+      sessionId: ctx.sessionId,
+    });
   };
 }
 
@@ -452,7 +472,7 @@ export interface RunAuthenticatedCommandHandlerOptions {
 export function createRunAuthenticatedCommandHandler(
   options: RunAuthenticatedCommandHandlerOptions,
 ): RpcMethodHandler<RunAuthenticatedCommand, RunAuthenticatedCommandResponse> {
-  return async (request) => {
+  return async (request, ctx) => {
     // Parse the command string into bundle-digest/profile and argv
     const parseResult = parseCommandString(request.command);
     if (!parseResult.ok) {
@@ -504,10 +524,12 @@ export function createRunAuthenticatedCommandHandler(
       conversationId: request.conversationId,
     };
 
-    const result = await executeAuthenticatedCommand(
-      execRequest,
-      options.executorDeps,
-    );
+    // Bind the per-connection session ID (for audit attribution) into the
+    // executor deps for this call.
+    const result = await executeAuthenticatedCommand(execRequest, {
+      ...options.executorDeps,
+      sessionId: ctx.sessionId,
+    });
 
     // If the failure was due to a missing grant, return a structured
     // APPROVAL_REQUIRED response with the proposal so the approval
@@ -656,7 +678,19 @@ export interface ManageSecureCommandToolHandlerDeps {
 export function createManageSecureCommandToolHandler(
   deps: ManageSecureCommandToolHandlerDeps,
 ): RpcMethodHandler<ManageSecureCommandTool, ManageSecureCommandToolResponse> {
-  return async (request) => {
+  // Serialize all manage_secure_command_tool operations. The register path
+  // awaits a bundle download mid-handler; during that await a concurrent
+  // unregister would run its "still in use?" check + bundle delete against a
+  // registry that doesn't yet reflect the in-flight registration — transiently
+  // deleting a bundle another caller is publishing or executing. Running these
+  // operations one-at-a-time closes that window. The registry and toolstore are
+  // process-global, so this single chain serializes tool management across
+  // every connection.
+  let tail: Promise<unknown> = Promise.resolve();
+
+  const handle = async (
+    request: ManageSecureCommandTool,
+  ): Promise<ManageSecureCommandToolResponse> => {
     if (request.action === "unregister") {
       const removed = deps.unregisterTool(request.toolName);
       if (!removed) {
@@ -762,6 +796,18 @@ export function createManageSecureCommandToolHandler(
 
     return { success: true };
   };
+
+  return (request) => {
+    // Chain each operation onto the previous one so they never interleave.
+    const result = tail.then(() => handle(request));
+    // Keep the chain alive regardless of this op's outcome — a rejection must
+    // not break serialization for subsequent operations.
+    tail = result.then(
+      () => undefined,
+      () => undefined,
+    );
+    return result;
+  };
 }
 
 /**