chainlesschain 0.164.0 → 0.165.2

package/src/repl/agent-repl.js

@@ -3175,6 +3175,11 @@ async function startAgentReplInWorkspaceOwned(
     const { getApprovalGate } =
       await import("../lib/session-core-singletons.js");
     _approvalGate = await getApprovalGate();
+    _approvalGate =
+      _approvalGate?.createSessionScope?.(
+        sessionId || `repl-scope:${randomUUID()}`,
+      ) || _approvalGate;
+    _approvalGate?.setAuthorizationConsumer?.(null);
     // autoMode.decisions: wrap the gate with the configurable classifier
     // BEFORE setConfirmer so the wrapper captures the interactive confirmer.
     // Inactive (delegating) unless the session mode is "auto"; not installed
@@ -3252,29 +3257,53 @@ async function startAgentReplInWorkspaceOwned(
           },
         };
       };
-      _approvalGate.setConfirmer(async ({ tool, args, riskLevel }) => {
-        if (_dontAskActive()) {
-          process.stdout.write(
-            chalk.yellow(
-              `\n  ✕ denied without asking (dontAsk mode): ${riskLevel || "medium"}-risk ${tool || "run_shell"}${args?.command ? " — " + args.command : ""}\n`,
-            ),
+      _approvalGate.setConfirmer(
+        async ({
+          tool,
+          args,
+          riskLevel,
+          action,
+          cwd,
+          workspace,
+          sessionId,
+          session,
+          targetEnv,
+          policyVersion,
+        }) => {
+          if (_dontAskActive()) {
+            process.stdout.write(
+              chalk.yellow(
+                `\n  ✕ denied without asking (dontAsk mode): ${riskLevel || "medium"}-risk ${tool || "run_shell"}${args?.command ? " — " + args.command : ""}\n`,
+              ),
+            );
+            return false;
+          }
+          await _fireNotification(
+            `Permission needed: ${riskLevel || "medium"}-risk ${tool || "run_shell"}${args?.command ? " — " + args.command : ""}`,
+            "info",
+            _sessionHandle,
           );
-          return false;
-        }
-        await _fireNotification(
-          `Permission needed: ${riskLevel || "medium"}-risk ${tool || "run_shell"}${args?.command ? " — " + args.command : ""}`,
-          "info",
-          _sessionHandle,
-        );
-        const local = askGateApprovalLocally({ tool, args, riskLevel });
-        if (!_remoteApproval?.bridge) return local.promise;
-        return raceLocalAndRemote({
-          bridge: _remoteApproval.bridge,
-          ask: describeAskContext({ tool, args, riskLevel }),
-          local,
-          writeOut: (text) => process.stdout.write(chalk.cyan(text)),
-        });
-      });
+          const local = askGateApprovalLocally({ tool, args, riskLevel });
+          if (!_remoteApproval?.bridge) return local.promise;
+          return raceLocalAndRemote({
+            bridge: _remoteApproval.bridge,
+            ask: describeAskContext({
+              tool,
+              args,
+              riskLevel,
+              action,
+              cwd,
+              workspace,
+              sessionId,
+              session,
+              targetEnv,
+              policyVersion,
+            }),
+            local,
+            writeOut: (text) => process.stdout.write(chalk.cyan(text)),
+          });
+        },
+      );
     }
   } catch (_err) {
     _approvalGate = null;
@@ -3364,13 +3393,11 @@ async function startAgentReplInWorkspaceOwned(
         _sessionHandle,
       );
       const local = askPermissionLocally({ tool, args, rule, reason });
-      if (!_remoteApproval?.bridge) return local.promise;
-      return raceLocalAndRemote({
-        bridge: _remoteApproval.bridge,
-        ask: describeAskContext({ tool, args, rule, reason }),
-        local,
-        writeOut: (text) => process.stdout.write(chalk.cyan(text)),
-      });
+      // This confirmer is consumed as a legacy boolean by settings/hook
+      // admission. A remote lease must never be flattened there and then skip
+      // the ApprovalGate consume, so this path remains local-only until it can
+      // carry the opaque authorization through its own dispatch boundary.
+      return local.promise;
     };
   } catch (_err) {
     if (
@@ -3568,6 +3595,18 @@ async function startAgentReplInWorkspaceOwned(
   // purely how the confirmers consume it — they RACE the terminal prompt
   // against the paired device instead of gating on the remote alone.
   const _startRemoteApproval = async () => {
+    if (
+      !_approvalGate ||
+      typeof _approvalGate.setConfirmer !== "function" ||
+      typeof _approvalGate.setAuthorizationConsumer !== "function" ||
+      typeof _approvalGate.consumeAuthorization !== "function"
+    ) {
+      const error = new Error(
+        "installed session-core cannot bind and consume durable remote approval",
+      );
+      error.code = "CC_REMOTE_APPROVAL_GATE_UNAVAILABLE";
+      throw error;
+    }
     const { startHeadlessRemoteApproval } =
       await import("../lib/remote-approval-bridge.js");
     const started = await startHeadlessRemoteApproval({
@@ -3580,6 +3619,7 @@ async function startAgentReplInWorkspaceOwned(
       pairing: started.pairing,
       close: started.close,
     };
+    _approvalGate.setAuthorizationConsumer(started.consumeAuthorization);
     logger.log(
       chalk.cyan(
         "  remote-control: permission prompts can be answered from a paired device (first answer — terminal or device — wins)",
@@ -3597,6 +3637,7 @@ async function startAgentReplInWorkspaceOwned(
   const _stopRemoteApproval = async () => {
     const active = _remoteApproval;
     _remoteApproval = null; // confirmers fall back to local-only immediately
+    _approvalGate?.setAuthorizationConsumer?.(null);
     if (active) await active.close().catch(() => undefined);
   };
 

package/src/repl/remote-approval.js

@@ -19,14 +19,21 @@
 /**
  * Normalize the shapes the REPL's two confirmers receive (ApprovalGate
  * `{tool, args, riskLevel}` / settings-hook `{tool, args, rule, reason}`)
- * into the bridge's `{tool, action, detail}` ask payload.
+ * into the bridge's exact durable ask payload.
  */
 export function describeAskContext({
   tool,
   args,
+  action = null,
   rule = null,
   reason = null,
   riskLevel = null,
+  cwd = null,
+  workspace = null,
+  sessionId = null,
+  session = null,
+  targetEnv = null,
+  policyVersion = null,
 } = {}) {
   const detail =
     typeof args?.command === "string"
@@ -38,17 +45,24 @@ export function describeAskContext({
           : null;
   return {
     tool: tool || null,
-    action: rule
-      ? `ask-rule:${rule}`
-      : reason || (riskLevel ? `${riskLevel}-risk` : null),
+    action:
+      action ||
+      (rule
+        ? `ask-rule:${rule}`
+        : reason || (riskLevel ? `${riskLevel}-risk` : null)),
     detail,
+    operationArgs: args === undefined ? null : structuredClone(args),
+    workspace: workspace || cwd || null,
+    session: session || sessionId || null,
+    targetEnv: targetEnv || null,
+    policyVersion: policyVersion || null,
   };
 }
 
 // These outcomes are not a remote human decision. The terminal may still
 // answer, but its result is accepted only if resolveLocally can durably settle
 // the same live card.
-const NON_DECISIVE_REMOTE = new Set(["timeout", "closed"]);
+const NON_DECISIVE_REMOTE = new Set(["timeout", "closed", "lease-unavailable"]);
 
 /**
  * Race the local interactive prompt against the paired-device decision.
@@ -83,14 +97,22 @@ export async function raceLocalAndRemote({
     () => ({ src: "local", approved: false }),
   );
   let winner = await Promise.race([remoteLeg, localLeg]);
+  let remoteUnavailableWithoutCard = false;
   if (
     winner.src === "remote" &&
     NON_DECISIVE_REMOTE.has(winner.decision?.via)
   ) {
+    remoteUnavailableWithoutCard =
+      winner.decision?.via === "lease-unavailable" && !requestId;
     winner = await localLeg;
   }
   if (winner.src === "local") {
-    if (!requestId) return false;
+    // Unsupported tools have no durable remote card to settle. In that exact
+    // lease-unavailable case, preserve the existing local confirmation path;
+    // timeout/closed responses without a request id remain fail-closed.
+    if (!requestId) {
+      return remoteUnavailableWithoutCard && winner.approved === true;
+    }
     try {
       const persisted = bridge.resolveLocally(requestId, winner.approved);
       return persisted === true && winner.approved === true;
@@ -107,5 +129,5 @@ export async function raceLocalAndRemote({
   writeOut(
     `\n  ✓ ${winner.decision.approved ? "allowed" : "denied"} from paired device\n`,
   );
-  return winner.decision.approved === true;
+  return winner.decision;
 }