@vess-id/vess 0.0.0-dev-20261015070513 → 0.0.0-dev-20261015130518

package/dist/core/approval-pull.d.ts

@@ -23,7 +23,10 @@
 import type { AgentdGatewayClient, DelegatedApprovalView } from '../gateway/gateway-client';
 /** What the pull hands to a holder: the API's row, nothing from an LLM. */
 export type ApprovedRow = Pick<DelegatedApprovalView, 'id' | 'action' | 'actionParams'>;
-/** `executed` = the PEP ran it; `failed` = presented and failed; `skipped` = nothing was run. */
+/**
+ * `executed` = it ran; `failed` = it was issued but did not run successfully (presented and failed, or
+ * refused at presentation); `skipped` = nothing was asked or run.
+ */
 export type PullOutcome = 'executed' | 'failed' | 'skipped';
 /** A holder that runs in this process (an `ExecutionEngine`). */
 export interface PullHolder {

package/dist/core/approval-pull.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"approval-pull.d.ts","sourceRoot":"","sources":["../../src/core/approval-pull.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,KAAK,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAA;AAE3F,2EAA2E;AAC3E,MAAM,MAAM,WAAW,GAAG,IAAI,CAAC,qBAAqB,EAAE,IAAI,GAAG,QAAQ,GAAG,cAAc,CAAC,CAAA;AAEvF,iGAAiG;AACjG,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG,QAAQ,GAAG,SAAS,CAAA;AAE3D,iEAAiE;AACjE,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,gFAAgF;IAChF,eAAe,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;CACxD;AASD,qBAAa,YAAY;IAWrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,GAAG;IAZtB,MAAM,CAAC,QAAQ,CAAC,WAAW,SAAS;IACpC,OAAO,CAAC,KAAK,CAAC,CAAgB;IAC9B,OAAO,CAAC,OAAO,CAAQ;IAEvB;;;;OAIG;gBAEgB,OAAO,EAAE,IAAI,CAAC,mBAAmB,EAAE,uBAAuB,CAAC,EAC3D,OAAO,EAAE,MAAM,SAAS,UAAU,EAAE,EACpC,GAAG,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAe;IAGzD,KAAK,IAAI,IAAI;IAOb,IAAI,IAAI,IAAI;IAKZ,sFAAsF;IAChF,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;YAgBb,OAAO;CAqBtB"}
+{"version":3,"file":"approval-pull.d.ts","sourceRoot":"","sources":["../../src/core/approval-pull.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,KAAK,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAA;AAE3F,2EAA2E;AAC3E,MAAM,MAAM,WAAW,GAAG,IAAI,CAAC,qBAAqB,EAAE,IAAI,GAAG,QAAQ,GAAG,cAAc,CAAC,CAAA;AAEvF;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG,QAAQ,GAAG,SAAS,CAAA;AAE3D,iEAAiE;AACjE,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,gFAAgF;IAChF,eAAe,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;CACxD;AASD,qBAAa,YAAY;IAWrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,GAAG;IAZtB,MAAM,CAAC,QAAQ,CAAC,WAAW,SAAS;IACpC,OAAO,CAAC,KAAK,CAAC,CAAgB;IAC9B,OAAO,CAAC,OAAO,CAAQ;IAEvB;;;;OAIG;gBAEgB,OAAO,EAAE,IAAI,CAAC,mBAAmB,EAAE,uBAAuB,CAAC,EAC3D,OAAO,EAAE,MAAM,SAAS,UAAU,EAAE,EACpC,GAAG,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAe;IAGzD,KAAK,IAAI,IAAI;IAOb,IAAI,IAAI,IAAI;IAKZ,sFAAsF;IAChF,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;YAgBb,OAAO;CAqBtB"}

package/dist/core/approval-pull.js.map

@@ -1 +1 @@
-{"version":3,"file":"approval-pull.js","sourceRoot":"","sources":["../../src/core/approval-pull.ts"],"names":[],"mappings":";;;AAqCA,MAAM,OAAO,GAAG,CAAC,GAAY,EAAU,EAAE,CAAC,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;AAE5F,wEAAwE;AACxE,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAQ,EAAE;IACtC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,IAAI,IAAI,CAAC,CAAA;AAC1C,CAAC,CAAA;AAED,MAAa,YAAY;IAWJ;IACA;IACA;IAZnB,MAAM,CAAU,WAAW,GAAG,MAAM,CAAA;IAC5B,KAAK,CAAiB;IACtB,OAAO,GAAG,KAAK,CAAA;IAEvB;;;;OAIG;IACH,YACmB,OAA2D,EAC3D,OAAoC,EACpC,MAA8B,QAAQ;QAFtC,YAAO,GAAP,OAAO,CAAoD;QAC3D,YAAO,GAAP,OAAO,CAA6B;QACpC,QAAG,GAAH,GAAG,CAAmC;IACtD,CAAC;IAEJ,KAAK;QACH,IAAI,IAAI,CAAC,KAAK;YAAE,OAAM;QACtB,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,CAAC,IAAI,EAAE,EAAE,YAAY,CAAC,WAAW,CAAC,CAAA;QAC1E,sDAAsD;QACtD,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAA;IACtB,CAAC;IAED,IAAI;QACF,IAAI,IAAI,CAAC,KAAK;YAAE,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACzC,IAAI,CAAC,KAAK,GAAG,SAAS,CAAA;IACxB,CAAC;IAED,sFAAsF;IACtF,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,OAAO;YAAE,OAAM;QACxB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAA;QACnB,IAAI,CAAC;YACH,sFAAsF;YACtF,MAAM,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAA;YAC3C,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE;gBAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;oBAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;YAEpF,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;QACnF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,+BAA+B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACzD,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,OAAO,GAAG,KAAK,CAAA;QACtB,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,MAAkB;QACtC,IAAI,IAA6B,CAAA;QACjC,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,qBAAqB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;QAClE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,8BAA8B,MAAM,CAAC,QAAQ,YAAY,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACjF,OAAM;QACR,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC;oBAC3C,EAAE,EAAE,GAAG,CAAC,EAAE;oBACV,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,YAAY,EAAE,GAAG,CAAC,YAAY;iBAC/B,CAAC,CAAA;gBACF,IAAI,CAAC,GAAG,CAAC,kBAAkB,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,MAAM,OAAO,OAAO,EAAE,CAAC,CAAA;YACnE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,GAAG,CAAC,kBAAkB,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,MAAM,aAAa,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YAC9E,CAAC;QACH,CAAC;IACH,CAAC;;AAjEH,oCAkEC"}
+{"version":3,"file":"approval-pull.js","sourceRoot":"","sources":["../../src/core/approval-pull.ts"],"names":[],"mappings":";;;AAwCA,MAAM,OAAO,GAAG,CAAC,GAAY,EAAU,EAAE,CAAC,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;AAE5F,wEAAwE;AACxE,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAQ,EAAE;IACtC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,IAAI,IAAI,CAAC,CAAA;AAC1C,CAAC,CAAA;AAED,MAAa,YAAY;IAWJ;IACA;IACA;IAZnB,MAAM,CAAU,WAAW,GAAG,MAAM,CAAA;IAC5B,KAAK,CAAiB;IACtB,OAAO,GAAG,KAAK,CAAA;IAEvB;;;;OAIG;IACH,YACmB,OAA2D,EAC3D,OAAoC,EACpC,MAA8B,QAAQ;QAFtC,YAAO,GAAP,OAAO,CAAoD;QAC3D,YAAO,GAAP,OAAO,CAA6B;QACpC,QAAG,GAAH,GAAG,CAAmC;IACtD,CAAC;IAEJ,KAAK;QACH,IAAI,IAAI,CAAC,KAAK;YAAE,OAAM;QACtB,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,CAAC,IAAI,EAAE,EAAE,YAAY,CAAC,WAAW,CAAC,CAAA;QAC1E,sDAAsD;QACtD,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAA;IACtB,CAAC;IAED,IAAI;QACF,IAAI,IAAI,CAAC,KAAK;YAAE,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACzC,IAAI,CAAC,KAAK,GAAG,SAAS,CAAA;IACxB,CAAC;IAED,sFAAsF;IACtF,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,OAAO;YAAE,OAAM;QACxB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAA;QACnB,IAAI,CAAC;YACH,sFAAsF;YACtF,MAAM,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAA;YAC3C,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE;gBAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;oBAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;YAEpF,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;QACnF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,+BAA+B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACzD,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,OAAO,GAAG,KAAK,CAAA;QACtB,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,MAAkB;QACtC,IAAI,IAA6B,CAAA;QACjC,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,qBAAqB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;QAClE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,8BAA8B,MAAM,CAAC,QAAQ,YAAY,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACjF,OAAM;QACR,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC;oBAC3C,EAAE,EAAE,GAAG,CAAC,EAAE;oBACV,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,YAAY,EAAE,GAAG,CAAC,YAAY;iBAC/B,CAAC,CAAA;gBACF,IAAI,CAAC,GAAG,CAAC,kBAAkB,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,MAAM,OAAO,OAAO,EAAE,CAAC,CAAA;YACnE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,GAAG,CAAC,kBAAkB,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,MAAM,aAAa,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YAC9E,CAAC;QACH,CAAC;IACH,CAAC;;AAjEH,oCAkEC"}

package/dist/core/execution-engine.d.ts

@@ -120,8 +120,11 @@ export declare class ExecutionEngine {
      *    question — an approval card the owner never asked for, every 10 s.
      * 🔴 Only `allow` runs. `in_flight` / `done` (another path got there first), `closed`, `ask`, a
      *    refusal or a failure run nothing; the issuer's CAS is what keeps a row to one execution.
-     * 🪤 Local actions (`os.*`) stay on the legacy path until B3b: not asked, not run.
-     * The PEP records the outcome against the credential, which is what `aidentity_get_result` reads.
+     * 🔴 Local actions (`os.*`, B3b) take the same route; `allow` is then presented at `local/present`
+     *    and the executor runs that answer's arguments (`executeLocalDelegated`). A permanent present
+     *    failure closes the row, so it is not pulled again.
+     * The PEP (the api, or agentd for a local action via `local/result`) records the outcome against the
+     * credential, which is what `aidentity_get_result` reads.
      */
     executeApproved(row: ApprovedRow): Promise<PullOutcome>;
     /**
@@ -161,7 +164,6 @@ export declare class ExecutionEngine {
      */
     private isPolicyForbiddenError;
     private policyForbiddenReason;
-    private executeLocal;
     /**
      * Execute locally with an already-acquired VC (skips ensureVC).
      * Used by both the normal path (after ensureVC) and handleApprovalResponse (after quickApprove).
@@ -185,6 +187,8 @@ export declare class ExecutionEngine {
      *      not decided in time → `pending` + `request_id` (read later with `aidentity_get_result`);
      *   3. `allow` → present the credential and call the PEP with `allow.actionParams` only
      *      (`executeWithCredential`; `FrozenParams` makes the LLM input unpassable).
+     *      A local action (`os.*`, PR B3b) takes this same route; its `allow` is presented at
+     *      `local/present` and run here with that answer's arguments (`executeLocalDelegated`).
      * 🔴 No legacy endpoint is reached from here: no wallet VC, no auto-issue / claim / OOB request /
      *    resource resolution, no in-band approval token. Only the issuer raises approval requests.
      */
@@ -200,6 +204,26 @@ export declare class ExecutionEngine {
     private auditHandoffRefused;
     /** One audit entry for a call that ended without execution on the delegated arm. */
     private auditNotExecuted;
+    /** Audit kind of the delegated arms: a local action is executed (and enforced) on this machine. */
+    private delegatedAuditKind;
+    /** `allow` from the issuer: a local action is presented and run here, a gateway action at the PEP. */
+    private executeAllowed;
+    /**
+     * A local action (`os.*`) after the issuer's `allow` (plan B, PR B3b): present the credential at
+     * `local/present`, run EXACTLY the arguments it returns, write the outcome once
+     * (`core/local-invoke.ts`). No wallet, no `verify-authorize`, no offline arm.
+     */
+    private executeLocalDelegated;
+    /**
+     * Run the local executor on the present answer's arguments.
+     * 🔴 `params` is the only input (`FrozenParams`): the env profile, the working directory, the file
+     *    path and the content all come from it.
+     * 🔴 `approvedResource` = the frozen `file_path`: the executor resolves the path again right before it
+     *    reads / writes and refuses if it now points elsewhere (a symlink swapped in after the approval,
+     *    plan B I-E). `approvedFingerprint` (inode binding) is not passed — Q21 default (a), the same
+     *    protection as the legacy path.
+     */
+    private runLocalExecutor;
     /** Present the credential and call the PEP with the issuer's arguments (`FrozenParams`). */
     private executeDelegated;
     /** The issuer refused (403 = the owner's settings forbid it: terminal) or could not be reached. */
@@ -243,8 +267,11 @@ export declare class ExecutionEngine {
     private createInBandApprovalResponse;
     /**
      * Pre-request permissions for multiple actions (batch).
-     * Triggers VC acquisition for each action without executing.
-     * This allows the user to approve multiple actions at once.
+     * 🔴 There is no pre-approval any more (B1 for gateway actions, B3b for local ones): every
+     *    credential is issued per call by the api's issuer (`aidentity_call_tool` → `pending` +
+     *    `request_id` when the owner must approve). Raising a legacy approval request here would create
+     *    a card that no new build ever executes. Only the device's own deny is reported (a local action
+     *    that the local / org policy forbids would be refused before the issuer is asked).
      */
     requestPermissions(actions: string[]): Promise<ExecuteResult>;
     listAvailableTools(): Promise<ListToolsResult>;

package/dist/core/execution-engine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"execution-engine.d.ts","sourceRoot":"","sources":["../../src/core/execution-engine.ts"],"names":[],"mappings":"AA4BA,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAA;AAC5D,OAAO,EAAE,MAAM,EAAuC,MAAM,kBAAkB,CAAA;AAC9E,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACnD,OAAO,EACL,mBAAmB,EAMpB,MAAM,2BAA2B,CAAA;AAGlC,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AAUjE,OAAO,EACL,cAAc,EACd,aAAa,EACb,eAAe,EACf,gBAAgB,EAIjB,MAAM,SAAS,CAAA;AAEhB,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAmDrD,qBAAa,eAAe;IAgCxB,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;IAtCjC,OAAO,CAAC,kBAAkB,CAAsB;IAChD,OAAO,CAAC,UAAU,CAAC,CAAmC;IACtD,OAAO,CAAC,eAAe,CAAQ;IAC/B;;;;OAIG;IACH,OAAO,CAAC,yBAAyB,CAAI;IACrC;;;;;OAKG;IACH,OAAO,CAAC,oBAAoB,CAA6B;IACzD,OAAO,CAAC,iBAAiB,CAA4B;IACrD,+FAA+F;IAC/F,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAoB;IACrD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAS;IAChD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAO;IAC/C;;;;;;OAMG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,8BAA8B,CAAQ;gBAG3C,eAAe,EAAE,eAAe,EAChC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,SAAS,EACpB,WAAW,EAAE,WAAW,GAAG,IAAI,EAC/B,aAAa,EAAE,mBAAmB,EAClC,OAAO,EAAE,gBAAgB,EACzB,YAAY,EAAE,oBAAoB,EAClC,aAAa,CAAC,EAAE,aAAa,YAAA;IAGhD;;OAEG;IACH,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAIzC;;;OAGG;IACH,aAAa,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAI5D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACH,OAAO,CAAC,qBAAqB;IAgG7B;;;;;;;;;;OAUG;IACH,IAAI,oBAAoB,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAE/C;IAED;;;OAGG;IACG,OAAO,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;IA4G9D,qFAAqF;IACrF,IAAI,QAAQ,IAAI,MAAM,CAErB;IAED;;;;;;;;;;;OAWG;IACG,eAAe,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAqD7D;;;;;OAKG;IACG,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IA4D1D;;;;;;;;;;;;;;;OAeG;YACW,QAAQ;IA2JtB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,sBAAsB;IAO9B,OAAO,CAAC,qBAAqB;YAoBf,YAAY;IAiD1B;;;OAGG;YACW,kBAAkB;IAmMhC;;;;;;;OAOG;YACW,mBAAmB;IAqHjC;;;;;;;;;;;OAWG;YACW,iBAAiB;IAmF/B;;;OAGG;IACH,OAAO,CAAC,SAAS;IAejB,iFAAiF;YACnE,MAAM;IAyCpB,8FAA8F;IAC9F,OAAO,CAAC,mBAAmB;IAY3B,oFAAoF;IACpF,OAAO,CAAC,gBAAgB;IAYxB,4FAA4F;YAC9E,gBAAgB;IA6C9B,mGAAmG;IACnG,OAAO,CAAC,aAAa;IAuDrB;;;;OAIG;IACH,OAAO,CAAC,QAAQ;IAehB,4EAA4E;IAC5E,OAAO,CAAC,QAAQ;YAaF,uBAAuB;IAwRrC;;OAEG;YACW,qBAAqB;IA0NnC;;;;;;;;;;OAUG;YACW,wBAAwB;IAmDtC;;;;;OAKG;YACW,kCAAkC;IA8ChD;;;OAGG;IACH,OAAO,CAAC,4BAA4B;IAgDpC;;;;OAIG;IACG,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,aAAa,CAAC;IAyI7D,kBAAkB,IAAI,OAAO,CAAC,eAAe,CAAC;IAYpD;;;OAGG;YACW,iBAAiB;IA2B/B,OAAO,CAAC,kBAAkB;IAe1B,OAAO,CAAC,eAAe;YAUT,sBAAsB;IAkPpC,OAAO,CAAC,eAAe;IASvB;;;;;OAKG;IACH,OAAO,CAAC,0BAA0B;IAiBlC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,OAAO,CAAC,+BAA+B;IAOvC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,uBAAuB;IAkB/B;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,OAAO,CAAC,2BAA2B;IASnC,OAAO,CAAC,kBAAkB;IAM1B,OAAO,CAAC,eAAe;IAavB,iHAAiH;YACnG,cAAc;YA4Bd,sBAAsB;IA8CpC,OAAO,CAAC,QAAQ;CA4CjB"}
+{"version":3,"file":"execution-engine.d.ts","sourceRoot":"","sources":["../../src/core/execution-engine.ts"],"names":[],"mappings":"AA4BA,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAA;AAC5D,OAAO,EAAE,MAAM,EAAuC,MAAM,kBAAkB,CAAA;AAC9E,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACnD,OAAO,EACL,mBAAmB,EAMpB,MAAM,2BAA2B,CAAA;AAIlC,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AAWjE,OAAO,EACL,cAAc,EACd,aAAa,EACb,eAAe,EACf,gBAAgB,EAIjB,MAAM,SAAS,CAAA;AAEhB,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAoErD,qBAAa,eAAe;IAgCxB,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;IAtCjC,OAAO,CAAC,kBAAkB,CAAsB;IAChD,OAAO,CAAC,UAAU,CAAC,CAAmC;IACtD,OAAO,CAAC,eAAe,CAAQ;IAC/B;;;;OAIG;IACH,OAAO,CAAC,yBAAyB,CAAI;IACrC;;;;;OAKG;IACH,OAAO,CAAC,oBAAoB,CAA6B;IACzD,OAAO,CAAC,iBAAiB,CAA4B;IACrD,+FAA+F;IAC/F,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAoB;IACrD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAS;IAChD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAO;IAC/C;;;;;;OAMG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,8BAA8B,CAAQ;gBAG3C,eAAe,EAAE,eAAe,EAChC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,SAAS,EACpB,WAAW,EAAE,WAAW,GAAG,IAAI,EAC/B,aAAa,EAAE,mBAAmB,EAClC,OAAO,EAAE,gBAAgB,EACzB,YAAY,EAAE,oBAAoB,EAClC,aAAa,CAAC,EAAE,aAAa,YAAA;IAGhD;;OAEG;IACH,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAIzC;;;OAGG;IACH,aAAa,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAI5D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACH,OAAO,CAAC,qBAAqB;IAgG7B;;;;;;;;;;OAUG;IACH,IAAI,oBAAoB,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAE/C;IAED;;;OAGG;IACG,OAAO,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;IAmG9D,qFAAqF;IACrF,IAAI,QAAQ,IAAI,MAAM,CAErB;IAED;;;;;;;;;;;;;;OAcG;IACG,eAAe,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAoD7D;;;;;OAKG;IACG,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IA0E1D;;;;;;;;;;;;;;;OAeG;YACW,QAAQ;IA2JtB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,sBAAsB;IAO9B,OAAO,CAAC,qBAAqB;IAoB7B;;;OAGG;YACW,kBAAkB;IAmMhC;;;;;;;OAOG;YACW,mBAAmB;IAqHjC;;;;;;;;;;;;;OAaG;YACW,iBAAiB;IAmF/B;;;OAGG;IACH,OAAO,CAAC,SAAS;IAejB,iFAAiF;YACnE,MAAM;IAyCpB,8FAA8F;IAC9F,OAAO,CAAC,mBAAmB;IAY3B,oFAAoF;IACpF,OAAO,CAAC,gBAAgB;IAWxB,mGAAmG;IACnG,OAAO,CAAC,kBAAkB;IAS1B,sGAAsG;IACtG,OAAO,CAAC,cAAc;IAUtB;;;;OAIG;YACW,qBAAqB;IA4DnC;;;;;;;;OAQG;YACW,gBAAgB;IAc9B,4FAA4F;YAC9E,gBAAgB;IA6C9B,mGAAmG;IACnG,OAAO,CAAC,aAAa;IAsDrB;;;;OAIG;IACH,OAAO,CAAC,QAAQ;IAqBhB,4EAA4E;IAC5E,OAAO,CAAC,QAAQ;YAaF,uBAAuB;IAwRrC;;OAEG;YACW,qBAAqB;IA0NnC;;;;;;;;;;OAUG;YACW,wBAAwB;IAmDtC;;;;;OAKG;YACW,kCAAkC;IA8ChD;;;OAGG;IACH,OAAO,CAAC,4BAA4B;IAgDpC;;;;;;;OAOG;IACG,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,aAAa,CAAC;IA2C7D,kBAAkB,IAAI,OAAO,CAAC,eAAe,CAAC;IAYpD;;;OAGG;YACW,iBAAiB;IA2B/B,OAAO,CAAC,kBAAkB;IAe1B,OAAO,CAAC,eAAe;YAUT,sBAAsB;IAkPpC,OAAO,CAAC,eAAe;IASvB;;;;;OAKG;IACH,OAAO,CAAC,0BAA0B;IAiBlC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,OAAO,CAAC,+BAA+B;IAOvC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,uBAAuB;IAkB/B;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,OAAO,CAAC,2BAA2B;IASnC,OAAO,CAAC,kBAAkB;IAM1B,OAAO,CAAC,eAAe;IAavB,iHAAiH;YACnG,cAAc;YA4Bd,sBAAsB;IA8CpC,OAAO,CAAC,QAAQ;CA4CjB"}

package/dist/core/execution-engine.js

@@ -57,6 +57,7 @@ const fs = __importStar(require("fs"));
 const wallet_1 = require("../wallet/wallet");
 const gateway_client_1 = require("../gateway/gateway-client");
 const delegated_invoke_1 = require("./delegated-invoke");
+const local_invoke_1 = require("./local-invoke");
 const call_budget_1 = require("./call-budget");
 const resource_canonicalizer_1 = require("../utils/resource-canonicalizer");
 const vc_utils_1 = require("../utils/vc-utils");
@@ -84,6 +85,19 @@ const POLICY_SYNC_TTL_MS = 30 * 60 * 1000;
 /** Fallback OOB approval expiration (seconds) when the API doesn't return a value.
  *  Kept short (5 min) so the agent doesn't wait on a possibly-expired request. */
 const OOB_APPROVAL_DEFAULT_EXPIRES_IN_SECONDS = 300;
+/**
+ * The resource of a local action for the audit log (same rule as `execute()`): the file path, or the
+ * command line of `os.process.run`. Only the path / command — never `content`.
+ */
+function localAuditResource(action, params) {
+    if (typeof params.file_path === 'string' && params.file_path !== '') {
+        return { requestedResource: params.file_path, normalizedResource: params.file_path };
+    }
+    if (action === 'os.process.run' && Array.isArray(params.command)) {
+        return { requestedResource: params.command.map(String).join(' ') };
+    }
+    return {};
+}
 class ExecutionEngine {
     policyEvaluator;
     wallet;
@@ -296,11 +310,10 @@ class ExecutionEngine {
             return { success: false, error: LEGACY_HANDOFF_REFUSED };
         }
         const { action, input } = request;
-        // 🔴 `pendingRequestId` (claim of a legacy OOB approval) is refused for gateway actions: the gateway
-        //    arm only executes approvals the issuer hands back for THIS holder. Local actions (`os.*`)
-        //    keep the legacy claim until B3b (they are all high / critical risk and approved by a human
-        //    in the browser; the claim is not a self-approval).
-        if (request.pendingRequestId && !(0, executor_registry_1.isLocalAction)(action)) {
+        // 🔴 `pendingRequestId` (claim of a legacy OOB approval) is refused for EVERY action (B1 for gateway
+        //    actions, B3b for local ones): both arms only execute approvals the issuer hands back for THIS
+        //    holder, and an approved call runs without being resent (the pull, B2).
+        if (request.pendingRequestId) {
             this.auditHandoffRefused(action, 'pendingRequestId');
             return { success: false, error: LEGACY_HANDOFF_REFUSED };
         }
@@ -315,11 +328,9 @@ class ExecutionEngine {
         // (incl. local os.* actions) pass through unchanged. Skipped on the
         // approval-retry / pending-approval paths, which carry the already
         // validated original input plus an approval token / request id.
-        if (!request.pendingRequestId) {
-            const inputCheck = (0, ai_identity_1.validateActionInput)(action, input ?? {});
-            if (!inputCheck.valid) {
-                return { success: false, error: inputCheck.errors.join(' ') };
-            }
+        const inputCheck = (0, ai_identity_1.validateActionInput)(action, input ?? {});
+        if (!inputCheck.valid) {
+            return { success: false, error: inputCheck.errors.join(' ') };
         }
         // 1. Extract provider from action (e.g., 'os' from 'os.secret.read')
         const provider = action.split('.')[0];
@@ -352,19 +363,20 @@ class ExecutionEngine {
             });
             return { success: false, error: `Action denied by policy: ${policyResult.reason}` };
         }
-        // Handle OOB approval polling (pendingRequestId) — local actions only (checked above).
-        if (request.pendingRequestId) {
-            return this.handlePendingApproval(request);
-        }
         // 4. Determine execution routing
         const routing = (0, executor_registry_1.determineRouting)(provider, action);
-        // 5. Execute based on routing
+        // 5. Both arms ask the api's issuer (B1 gateway, B3b local). 🔴 A local action asks with the
+        //    RESOLVED path (`canonicalizePath`: `~`, `..`, symlinks): the issued digest, the approval row's
+        //    frozen arguments and the approval card all carry the real file, and the executor compares
+        //    that path again at execution time (`approvedResource`, plan B I-E).
         if (routing.executor === 'local') {
-            return this.executeLocal(action, input, provider, normalizedResource, resourceFingerprint, requestedResource);
-        }
-        else {
-            return this.executeViaGateway(provider, action, input, startedAt);
+            if (!(0, executor_registry_1.getLocalExecutor)(action)) {
+                return { success: false, error: `No local executor for action: ${action}` };
+            }
+            const sent = normalizedResource ? { ...input, file_path: normalizedResource } : input;
+            return this.executeViaGateway(provider, action, sent, startedAt);
         }
+        return this.executeViaGateway(provider, action, input, startedAt);
     }
     /** The holder DID of this engine (the approval pull lists approved rows per DID). */
     get agentDid() {
@@ -379,13 +391,14 @@ class ExecutionEngine {
      *    question — an approval card the owner never asked for, every 10 s.
      * 🔴 Only `allow` runs. `in_flight` / `done` (another path got there first), `closed`, `ask`, a
      *    refusal or a failure run nothing; the issuer's CAS is what keeps a row to one execution.
-     * 🪤 Local actions (`os.*`) stay on the legacy path until B3b: not asked, not run.
-     * The PEP records the outcome against the credential, which is what `aidentity_get_result` reads.
+     * 🔴 Local actions (`os.*`, B3b) take the same route; `allow` is then presented at `local/present`
+     *    and the executor runs that answer's arguments (`executeLocalDelegated`). A permanent present
+     *    failure closes the row, so it is not pulled again.
+     * The PEP (the api, or agentd for a local action via `local/result`) records the outcome against the
+     * credential, which is what `aidentity_get_result` reads.
      */
     async executeApproved(row) {
         const { id, action } = row;
-        if ((0, executor_registry_1.isLocalAction)(action))
-            return 'skipped';
         // 🔴 Never ask unnamed: an empty id would read as "no approval named" and raise a NEW question.
         if (typeof id !== 'string' || id === '')
             return 'skipped';
@@ -411,7 +424,7 @@ class ExecutionEngine {
                     decisionSource: 'local_policy',
                     decisionReason: `approval_pull ${id}: ${policyResult.reason}`,
                     ...(typeof filePath === 'string' ? { requestedResource: filePath } : {}),
-                    executionType: 'gateway',
+                    executionType: (0, executor_registry_1.isLocalAction)(action) ? 'local' : 'gateway',
                 });
             }
             return 'skipped';
@@ -427,7 +440,7 @@ class ExecutionEngine {
         }
         if (answer.status !== 'allow')
             return 'skipped';
-        const result = await this.executeDelegated(provider, action, answer);
+        const result = await this.executeAllowed(provider, action, answer);
         return result.success ? 'executed' : 'failed';
     }
     /**
@@ -471,8 +484,21 @@ class ExecutionEngine {
                 break;
         }
         const outcome = r.execution?.outcome;
-        if (outcome === 'executed')
+        if (outcome === 'executed') {
+            // 🔴 No stored content (a secret read keeps none, owner decision 2): say it ran, and that the
+            //    content is not available — never an empty value the LLM could read as "the file is empty".
+            if (r.result === null || r.result === undefined) {
+                return {
+                    success: true,
+                    data: {
+                        status: 'executed',
+                        request_id: requestId,
+                        note: 'It was carried out; no result content is stored for it, so none can be returned here.',
+                    },
+                };
+            }
             return { success: true, data: r.result };
+        }
         // 🔴 `expired` = not executed: unanswered until it expired / closed after approval without running /
         //    withdrawn. An executed row is `consumed` + `executed` (the branch above).
         if (r.status === 'expired') {
@@ -676,36 +702,6 @@ class ExecutionEngine {
     // ===========================================================================
     // Local execution with VP verification (spec §7.4)
     // ===========================================================================
-    async executeLocal(action, params, provider, normalizedResource, resourceFingerprint, requestedResource) {
-        const resourceInfo = normalizedResource && resourceFingerprint
-            ? { normalizedResource, fingerprint: resourceFingerprint }
-            : undefined;
-        // 1. Ensure VC (4-step acquisition)
-        const vcResult = await this.ensureVC(action, provider, resourceInfo, params);
-        if ('approvalRequired' in vcResult) {
-            return { success: false, approvalRequired: vcResult.approvalRequired };
-        }
-        if ('waitingForApproval' in vcResult) {
-            return { success: false, waitingForApproval: vcResult.waitingForApproval };
-        }
-        if ('denied' in vcResult) {
-            this.logAudit({
-                action,
-                provider,
-                decision: 'deny',
-                enforcementType: 'local',
-                decisionSource: 'local_policy',
-                decisionReason: vcResult.reason,
-                requestedResource,
-                normalizedResource,
-                resourceFingerprint,
-                executionType: 'local',
-            });
-            return { success: false, error: `Permission denied: ${vcResult.reason}` };
-        }
-        // 2. Execute with the acquired VC
-        return this.executeLocalWithVC(action, params, provider, vcResult, normalizedResource, resourceFingerprint, requestedResource);
-    }
     /**
      * Execute locally with an already-acquired VC (skips ensureVC).
      * Used by both the normal path (after ensureVC) and handleApprovalResponse (after quickApprove).
@@ -972,6 +968,8 @@ class ExecutionEngine {
      *      not decided in time → `pending` + `request_id` (read later with `aidentity_get_result`);
      *   3. `allow` → present the credential and call the PEP with `allow.actionParams` only
      *      (`executeWithCredential`; `FrozenParams` makes the LLM input unpassable).
+     *      A local action (`os.*`, PR B3b) takes this same route; its `allow` is presented at
+     *      `local/present` and run here with that answer's arguments (`executeLocalDelegated`).
      * 🔴 No legacy endpoint is reached from here: no wallet VC, no auto-issue / claim / OOB request /
      *    resource resolution, no in-band approval token. Only the issuer raises approval requests.
      */
@@ -1021,7 +1019,7 @@ class ExecutionEngine {
                 }
                 if (second.status === 'ask') {
                     // The approved row could not be used and a different question stands. Do not execute.
-                    return this.deferred(second.approvalId, second.approvalUrl);
+                    return this.deferred(second.approvalId, second.approvalUrl, action);
                 }
                 return this.settle(provider, action, second);
             }
@@ -1048,7 +1046,7 @@ class ExecutionEngine {
                 return this.inFlight(first.approvalId);
             default:
                 // Still pending, or no time was left to wait.
-                return this.deferred(first.approvalId, first.approvalUrl);
+                return this.deferred(first.approvalId, first.approvalUrl, action);
         }
     }
     /**
@@ -1069,7 +1067,7 @@ class ExecutionEngine {
     async settle(provider, action, answer) {
         switch (answer.status) {
             case 'allow':
-                return this.executeDelegated(provider, action, answer);
+                return this.executeAllowed(provider, action, answer);
             case 'done':
                 return { success: true, data: answer.result };
             case 'not_executed':
@@ -1117,10 +1115,97 @@ class ExecutionEngine {
             action,
             provider,
             decision: 'deny',
-            enforcementType: 'gateway',
+            ...this.delegatedAuditKind(action),
             decisionSource: 'delegated_issuer',
             decisionReason: reason,
-            executionType: 'gateway',
+        });
+    }
+    /** Audit kind of the delegated arms: a local action is executed (and enforced) on this machine. */
+    delegatedAuditKind(action) {
+        return (0, executor_registry_1.isLocalAction)(action)
+            ? { enforcementType: 'gateway_verified_local', executionType: 'local' }
+            : { enforcementType: 'gateway', executionType: 'gateway' };
+    }
+    /** `allow` from the issuer: a local action is presented and run here, a gateway action at the PEP. */
+    executeAllowed(provider, action, allow) {
+        return (0, executor_registry_1.isLocalAction)(action)
+            ? this.executeLocalDelegated(provider, action, allow)
+            : this.executeDelegated(provider, action, allow);
+    }
+    /**
+     * A local action (`os.*`) after the issuer's `allow` (plan B, PR B3b): present the credential at
+     * `local/present`, run EXACTLY the arguments it returns, write the outcome once
+     * (`core/local-invoke.ts`). No wallet, no `verify-authorize`, no offline arm.
+     */
+    async executeLocalDelegated(provider, action, allow) {
+        // No executor → do not present (presenting consumes the credential and burns the approval).
+        if (!(0, executor_registry_1.getLocalExecutor)(action)) {
+            await this.gatewayClient
+                .delegatedRelease({ vcJti: allow.vcJti, subjectDid: this.context.agentDid })
+                .catch(err => {
+                process.stderr.write(`[vess] release of ${allow.vcJti} failed: ${err instanceof Error ? err.message : String(err)}\n`);
+            });
+            this.logAudit({
+                action,
+                provider,
+                decision: 'deny',
+                enforcementType: 'gateway_verified_local',
+                decisionSource: 'delegated_issuer',
+                decisionReason: 'no_local_executor',
+                executionType: 'local',
+                credentialId: allow.vcJti,
+            });
+            return { success: false, error: `No local executor for action: ${action}` };
+        }
+        const execution = await (0, local_invoke_1.executeLocalWithCredential)({ gateway: this.gatewayClient, vpBuilder: this.vpBuilder }, {
+            agentDid: this.context.agentDid,
+            projectId: this.context.projectId,
+            agentPrivateKeyJwk: this.context.agentPrivateKeyJwk,
+            gatewayUrl: this.context.gatewayUrl,
+        }, action, allow, params => this.runLocalExecutor(action, params));
+        this.logAudit({
+            action,
+            provider,
+            decision: execution.success ? 'allow' : 'deny',
+            enforcementType: 'gateway_verified_local',
+            decisionSource: 'delegated_issuer',
+            decisionReason: execution.success
+                ? undefined
+                : `${execution.outcome}: ${execution.error ?? ''}`,
+            executionType: 'local',
+            credentialId: allow.vcJti,
+            // 🔴 Which file / command: what RAN (the present's answer), or what was asked for when nothing ran.
+            ...localAuditResource(action, execution.ran ?? allow.actionParams),
+            ...(execution.normalizedResource ? { normalizedResource: execution.normalizedResource } : {}),
+            ...(execution.resourceFingerprint
+                ? { resourceFingerprint: execution.resourceFingerprint }
+                : {}),
+        });
+        if (execution.success)
+            return { success: true, data: execution.data };
+        return { success: false, data: execution.data, error: execution.error };
+    }
+    /**
+     * Run the local executor on the present answer's arguments.
+     * 🔴 `params` is the only input (`FrozenParams`): the env profile, the working directory, the file
+     *    path and the content all come from it.
+     * 🔴 `approvedResource` = the frozen `file_path`: the executor resolves the path again right before it
+     *    reads / writes and refuses if it now points elsewhere (a symlink swapped in after the approval,
+     *    plan B I-E). `approvedFingerprint` (inode binding) is not passed — Q21 default (a), the same
+     *    protection as the legacy path.
+     */
+    async runLocalExecutor(action, params) {
+        const executor = (0, executor_registry_1.getLocalExecutor)(action);
+        if (!executor)
+            return { success: false, error: `No local executor for action: ${action}` };
+        const args = params;
+        if (action === 'os.process.run') {
+            const resolvedEnv = await this.resolveProcessEnv(args);
+            return executor(args, { resolvedEnv });
+        }
+        return executor(args, {
+            rootDid: this.context.rootDid,
+            approvedResource: typeof args.file_path === 'string' ? args.file_path : undefined,
         });
     }
     /** Present the credential and call the PEP with the issuer's arguments (`FrozenParams`). */
@@ -1172,10 +1257,9 @@ class ExecutionEngine {
                 action,
                 provider,
                 decision: 'deny',
-                enforcementType: 'gateway',
                 decisionSource: 'delegated_issuer',
                 decisionReason: `refused: ${reason}`,
-                executionType: 'gateway',
+                ...this.delegatedAuditKind(action),
             });
             return { success: false, error: `"${action}" was refused: ${reason}. Nothing was done.` };
         }
@@ -1185,10 +1269,9 @@ class ExecutionEngine {
                 action,
                 provider,
                 decision: 'deny',
-                enforcementType: 'gateway',
                 decisionSource: 'delegated_issuer',
                 decisionReason: `policy_forbidden: ${reason}`,
-                executionType: 'gateway',
+                ...this.delegatedAuditKind(action),
             });
             // 🔴 Terminal: an approval cannot lift it, so no approval URL is offered.
             return {
@@ -1202,14 +1285,15 @@ class ExecutionEngine {
             action,
             provider,
             decision: 'deny',
-            enforcementType: 'gateway',
             decisionSource: 'delegated_issuer',
             decisionReason: `Gateway unreachable: ${msg}`,
-            executionType: 'gateway',
+            ...this.delegatedAuditKind(action),
         });
         return {
             success: false,
-            error: `Gateway required for SaaS operations but unreachable: ${msg}. Nothing was done.`,
+            error: (0, executor_registry_1.isLocalAction)(action)
+                ? `Gateway required to authorize local actions but unreachable: ${msg}. Nothing was done.`
+                : `Gateway required for SaaS operations but unreachable: ${msg}. Nothing was done.`,
         };
     }
     /**
@@ -1217,7 +1301,7 @@ class ExecutionEngine {
      * "call again once approved": an approved call is executed with the frozen arguments, and a resend
      * whose arguments differ by one character is a different question.
      */
-    deferred(approvalId, approvalUrl) {
+    deferred(approvalId, approvalUrl, action) {
         return {
             success: true,
             data: {
@@ -1226,7 +1310,13 @@ class ExecutionEngine {
                 approvalUrl,
                 next: 'The owner must approve this at approvalUrl. Show them the URL. Do NOT call ' +
                     'aidentity_call_tool again for this action: once approved it runs with exactly the ' +
-                    'arguments you sent. Read the outcome with aidentity_get_result { request_id }.',
+                    'arguments you sent. Read the outcome with aidentity_get_result { request_id }.' +
+                    // 🔴 Owner decision (2): a secret's content is kept nowhere, so a late approval cannot
+                    //    deliver it. Say so, or an empty result reads as "the file is empty".
+                    (action && (0, local_invoke_1.readsSecret)(action)
+                        ? ' This action handles a secret: its content is not kept, so if it is approved after ' +
+                            'this call, aidentity_get_result reports only that it ran, not the content.'
+                        : ''),
             },
         };
     }
@@ -1781,112 +1871,32 @@ class ExecutionEngine {
     // ===========================================================================
     /**
      * Pre-request permissions for multiple actions (batch).
-     * Triggers VC acquisition for each action without executing.
-     * This allows the user to approve multiple actions at once.
+     * 🔴 There is no pre-approval any more (B1 for gateway actions, B3b for local ones): every
+     *    credential is issued per call by the api's issuer (`aidentity_call_tool` → `pending` +
+     *    `request_id` when the owner must approve). Raising a legacy approval request here would create
+     *    a card that no new build ever executes. Only the device's own deny is reported (a local action
+     *    that the local / org policy forbids would be refused before the issuer is asked).
      */
     async requestPermissions(actions) {
         const approved = [];
         const denied = [];
         const pending = [];
-        // 🔴 B1: gateway actions have no pre-approval. Their credential is issued per call by the api's
-        //    issuer (`aidentity_call_tool` → `pending` + `request_id` when the owner must approve). Raising a
-        //    legacy approval request here would create a card that no new build ever executes.
         const callDirectly = [];
         for (const action of actions) {
             const provider = action.split('.')[0];
-            if (!(0, executor_registry_1.isLocalAction)(action)) {
-                callDirectly.push(action);
-                continue;
-            }
-            // Policy check
-            const policyResult = this.policyEvaluator.evaluate(provider, action.replace(`${provider}.`, ''), { type: this.getResourceType(action) });
-            if (!policyResult.allowed) {
-                denied.push(action);
-                continue;
-            }
-            // Try VC acquisition (steps 1-3 only, no terminal prompt for batch)
-            try {
-                const walletVC = this.wallet.findCredential(this.context.agentDid, action, this.context.projectId);
-                if (walletVC) {
-                    approved.push(action);
+            if ((0, executor_registry_1.isLocalAction)(action)) {
+                const policyResult = this.policyEvaluator.evaluate(provider, action.replace(`${provider}.`, ''), { type: this.getResourceType(action) });
+                if (!policyResult.allowed) {
+                    denied.push(action);
                     continue;
                 }
-                // Try auto-issue
-                const autoResult = await this.gatewayClient.autoIssueVC({
-                    subjectDid: this.context.agentDid,
-                    projectId: this.context.projectId,
-                    actions: [action],
-                });
-                if (autoResult?.autoIssued && autoResult.credential) {
-                    this.wallet.storeCredential({
-                        holderDid: this.context.agentDid,
-                        projectId: this.context.projectId,
-                        credentialJwt: autoResult.credential.jwt,
-                        actions: autoResult.actions || [action],
-                        provider,
-                        expiresAt: autoResult.credential.expiresAt,
-                        resources: (0, wallet_1.validateResources)(autoResult.resources),
-                        metadata: autoResult.metadata,
-                    });
-                    approved.push(action);
-                    continue;
-                }
-                pending.push(action);
-            }
-            catch {
-                pending.push(action);
             }
+            callDirectly.push(action);
         }
-        const allApproved = denied.length === 0 && pending.length === 0 && callDirectly.length === 0;
         const callDirectlyNote = callDirectly.length > 0
             ? ` No pre-approval for [${callDirectly.join(', ')}]: call aidentity_call_tool directly; if the owner ` +
                 `must approve, it answers status "pending" with a request_id, read later with aidentity_get_result.`
             : '';
-        // Create approval URL for pending actions (matches remote-mcp behavior)
-        if (pending.length > 0) {
-            try {
-                const approvalResult = await this.gatewayClient.createApprovalRequest({
-                    subjectDid: this.context.agentDid,
-                    projectId: this.context.projectId,
-                    actions: pending,
-                });
-                if (!approvalResult.approvalUrl) {
-                    throw new Error('Gateway returned empty approval URL');
-                }
-                return {
-                    success: true,
-                    data: {
-                        approved,
-                        denied,
-                        pending,
-                        ...(callDirectly.length > 0 ? { callDirectly } : {}),
-                        requestId: approvalResult.requestId,
-                        approvalUrl: approvalResult.approvalUrl,
-                        expiresAt: approvalResult.expiresAt,
-                        status: 'pending',
-                        message: approved.length > 0
-                            ? `Approved: [${approved.join(', ')}]. Approval required for: [${pending.join(', ')}]. See approvalUrl field.` +
-                                callDirectlyNote
-                            : `Permission required for: [${pending.join(', ')}]. See approvalUrl field.` +
-                                callDirectlyNote,
-                    },
-                };
-            }
-            catch (err) {
-                // Fallback: return pending without URL if approval request creation fails
-                return {
-                    success: true,
-                    data: {
-                        approved,
-                        denied,
-                        pending,
-                        ...(callDirectly.length > 0 ? { callDirectly } : {}),
-                        status: 'partial',
-                        message: `Approved: [${approved.join(', ')}]. Pending: [${pending.join(', ')}]. Denied: [${denied.join(', ')}]. Failed to create approval URL: ${err instanceof Error ? err.message : String(err)}. Use aidentity_call_tool for pending actions — you will be prompted to approve.${callDirectlyNote}`,
-                    },
-                };
-            }
-        }
         return {
             success: true,
             data: {
@@ -1894,11 +1904,9 @@ class ExecutionEngine {
                 denied,
                 pending,
                 ...(callDirectly.length > 0 ? { callDirectly } : {}),
-                status: allApproved ? 'approved' : 'partial',
-                message: allApproved
-                    ? 'All requested permissions have been granted. You can now use aidentity_call_tool.'
-                    : `Approved: [${approved.join(', ')}]. Denied: [${denied.join(', ')}].` +
-                        callDirectlyNote,
+                // Nothing to call and nothing denied (an empty request) is the only "approved".
+                status: denied.length === 0 && callDirectly.length === 0 ? 'approved' : 'partial',
+                message: `Approved: [${approved.join(', ')}]. Denied: [${denied.join(', ')}].` + callDirectlyNote,
             },
         };
     }