chainlesschain 0.166.2 → 0.166.4

package/src/lib/session-message-fabric.js

@@ -38,11 +38,15 @@ export const SESSION_MESSAGE_RECEIPT_STATUSES = Object.freeze([
   "full",
   "rate_limited",
   "expired",
+  "read",
+  "processed",
+  "dead_letter",
 ]);
 
 export const SESSION_MESSAGE_FABRIC_LIMITS = Object.freeze({
   maxMessageBytes: 256 * 1024,
   maxPendingPerRecipient: 100,
+  maxPendingBytes: 32 * 1024 * 1024,
   maxReceiptHistory: 5_000,
   maxMessagesPerSenderWindow: 120,
   senderRateWindowMs: 60_000,
@@ -62,9 +66,21 @@ export const SESSION_MESSAGE_FABRIC_ERROR_CODES = Object.freeze({
 });
 
 const PENDING_STATUSES = new Set(["held", "delivered"]);
+const MESSAGE_STATUSES = new Set([
+  "delivered",
+  "held",
+  "refused",
+  "full",
+  "rate_limited",
+  "expired",
+]);
+const PROCESSING_STATUSES = new Set(["read", "processed", "dead_letter"]);
+const TERMINAL_PROCESSING_STATUSES = new Set(["processed", "dead_letter"]);
 const RECEIPT_STATUSES = new Set(SESSION_MESSAGE_RECEIPT_STATUSES);
 const POLICIES = new Set(SESSION_MESSAGE_POLICIES);
 const NAME_PATTERN = /^[a-z0-9](?:[a-z0-9._-]{0,62}[a-z0-9])?$/u;
+// Bounded ids explicitly reject ASCII control characters.
+// eslint-disable-next-line no-control-regex
 const ID_PATTERN = /^[^\u0000-\u001f\u007f]{1,256}$/u;
 const MESSAGE_ID_PATTERN = /^[a-zA-Z0-9._:-]{1,128}$/u;
 
@@ -324,6 +340,11 @@ function updateReceipt(state, message, status, reason, now) {
       updatedAt: now,
       idleNotifiedAt: null,
       readAt: null,
+      processedAt: null,
+      deadLetteredAt: null,
+      deliveryCount: 0,
+      consumerKey: null,
+      recipientAttempt: null,
     };
     state.receipts.push(receipt);
   } else {
@@ -402,6 +423,7 @@ function compactSettledMessages(state) {
   state.messages = state.messages.filter((message) => {
     if (!PENDING_STATUSES.has(message.status)) return false;
     if (message.acknowledgedAt == null) return true;
+    if (message.retainAfterAck === true) return true;
     if (message.notifyWhenIdle !== true) return false;
     const receipt = receiptFor(
       state,
@@ -413,6 +435,30 @@ function compactSettledMessages(state) {
   return state.messages.length !== before;
 }
 
+function trimRetainedSettledMessages(state, limit) {
+  const retained = state.messages
+    .filter(
+      (message) =>
+        message.retainAfterAck === true && message.acknowledgedAt != null,
+    )
+    .sort(
+      (left, right) =>
+        left.acknowledgedAt - right.acknowledgedAt ||
+        left.createdAt - right.createdAt ||
+        left.messageId.localeCompare(right.messageId),
+    );
+  let changed = false;
+  while (retained.length > limit) {
+    const target = retained.shift();
+    const index = state.messages.indexOf(target);
+    if (index >= 0) {
+      state.messages.splice(index, 1);
+      changed = true;
+    }
+  }
+  return changed;
+}
+
 function applyExpectedMessage(state, channel, message, recipient, now) {
   if (recipient.policy === "refuse") {
     updateReceipt(state, message, "refused", "policy_refuse", now);
@@ -556,7 +602,7 @@ function validateState(state) {
       !MESSAGE_ID_PATTERN.test(message?.messageId || "") ||
       !Number.isSafeInteger(message?.sequence) ||
       message.sequence < 1 ||
-      !RECEIPT_STATUSES.has(message?.status) ||
+      !MESSAGE_STATUSES.has(message?.status) ||
       !channelIds.has(message?.channelId) ||
       typeof message?.payloadDigest !== "string"
     ) {
@@ -572,6 +618,13 @@ function validateState(state) {
     ) {
       fail("invalid receipt");
     }
+    if (
+      receipt.deliveryCount != null &&
+      (!Number.isSafeInteger(receipt.deliveryCount) ||
+        receipt.deliveryCount < 0)
+    ) {
+      fail("invalid receipt delivery count");
+    }
   }
   const bucketAuthorities = new Set();
   for (const bucket of state.rateBuckets || []) {
@@ -606,6 +659,7 @@ export class SessionMessageFabric {
       lockTimeoutMs = 10_000,
       maxMessageBytes = SESSION_MESSAGE_FABRIC_LIMITS.maxMessageBytes,
       maxPendingPerRecipient = SESSION_MESSAGE_FABRIC_LIMITS.maxPendingPerRecipient,
+      maxPendingBytes = SESSION_MESSAGE_FABRIC_LIMITS.maxPendingBytes,
       maxReceiptHistory = SESSION_MESSAGE_FABRIC_LIMITS.maxReceiptHistory,
       maxMessagesPerSenderWindow = SESSION_MESSAGE_FABRIC_LIMITS.maxMessagesPerSenderWindow,
       senderRateWindowMs = SESSION_MESSAGE_FABRIC_LIMITS.senderRateWindowMs,
@@ -636,6 +690,10 @@ export class SessionMessageFabric {
         maxPendingPerRecipient,
         SESSION_MESSAGE_FABRIC_LIMITS.maxPendingPerRecipient,
       ),
+      maxPendingBytes: positiveInteger(
+        maxPendingBytes,
+        SESSION_MESSAGE_FABRIC_LIMITS.maxPendingBytes,
+      ),
       maxReceiptHistory: positiveInteger(
         maxReceiptHistory,
         SESSION_MESSAGE_FABRIC_LIMITS.maxReceiptHistory,
@@ -770,6 +828,10 @@ export class SessionMessageFabric {
           );
           const outcome = mutator(state, now) || { value: undefined };
           const compacted = compactSettledMessages(state);
+          const trimmedSettled = trimRetainedSettledMessages(
+            state,
+            this._limits.maxReceiptHistory,
+          );
           const trimmed = trimReceiptHistory(
             state,
             this._limits.maxReceiptHistory,
@@ -778,6 +840,7 @@ export class SessionMessageFabric {
             swept ||
             prunedRateBuckets ||
             compacted ||
+            trimmedSettled ||
             trimmed ||
             outcome.changed === true
           ) {
@@ -985,6 +1048,7 @@ export class SessionMessageFabric {
     sequence = null,
     ttlMs = this._limits.defaultTtlMs,
     notifyWhenIdle = false,
+    retainAfterAck = false,
   } = {}) {
     const id = messageId(requestedMessageId, this._createId);
     const cleanSubject = subject == null ? null : String(subject).slice(0, 512);
@@ -1108,6 +1172,7 @@ export class SessionMessageFabric {
         status: "held",
         reason: "out_of_order",
         notifyWhenIdle: notifyWhenIdle === true,
+        retainAfterAck: retainAfterAck === true,
         createdAt: now,
         updatedAt: now,
         deliveredAt: null,
@@ -1137,10 +1202,17 @@ export class SessionMessageFabric {
           value: clone(receiptFor(state, sender.authorityId, id)),
         };
       }
+      const pendingBytes = state.messages
+        .filter(
+          (entry) =>
+            PENDING_STATUSES.has(entry.status) && entry.acknowledgedAt == null,
+        )
+        .reduce((sum, entry) => sum + (entry.messageBytes || 0), 0);
       if (
         recipient.policy !== "refuse" &&
-        pendingForRecipient(state, recipient).length >=
-          this._limits.maxPendingPerRecipient
+        (pendingForRecipient(state, recipient).length >=
+          this._limits.maxPendingPerRecipient ||
+          pendingBytes + messageBytes > this._limits.maxPendingBytes)
       ) {
         updateReceipt(state, message, "full", "queue_capacity", now);
         return {
@@ -1194,6 +1266,196 @@ export class SessionMessageFabric {
     });
   }
 
+  /**
+   * Deliver an at-least-once batch without retiring it. This is deliberately
+   * separate from `inbox(..., { acknowledge: true })`, whose historical API
+   * means "read and remove". Processing callers must explicitly settle each
+   * message with `acknowledge()`.
+   */
+  receive(selector, { limit = 100, markRead = false } = {}) {
+    const boundedLimit = positiveInteger(limit, 100, 100);
+    return this._transaction((state, now) => {
+      const endpoint = requireEndpoint(state, selector);
+      const messages = pendingForRecipient(state, endpoint)
+        .filter((message) => message.status === "delivered")
+        .sort(
+          (left, right) =>
+            (left.senderAuthority === right.senderAuthority
+              ? left.sequence - right.sequence
+              : left.createdAt - right.createdAt) ||
+            left.senderAuthority.localeCompare(right.senderAuthority),
+        )
+        .slice(0, boundedLimit);
+      for (const message of messages) {
+        const receipt = receiptFor(
+          state,
+          message.senderAuthority,
+          message.messageId,
+        );
+        if (!receipt) continue;
+        receipt.deliveryCount = (receipt.deliveryCount || 0) + 1;
+        receipt.deliveredAt ||= message.deliveredAt || now;
+        if (markRead) {
+          receipt.status = "read";
+          receipt.readAt ||= now;
+        } else if (!PROCESSING_STATUSES.has(receipt.status)) {
+          receipt.status = "delivered";
+        }
+        receipt.updatedAt = now;
+      }
+      return {
+        changed: messages.length > 0,
+        value: clone(
+          messages.map((message) => ({
+            ...message,
+            delivery: receiptFor(
+              state,
+              message.senderAuthority,
+              message.messageId,
+            ),
+          })),
+        ),
+      };
+    });
+  }
+
+  /** Persist read/processed/dead-letter evidence for explicit physical ids. */
+  acknowledge(
+    selector,
+    {
+      messageIds = [],
+      consumerKey,
+      status = "processed",
+      reason = null,
+      recipientAttempt = null,
+    } = {},
+  ) {
+    if (
+      !Array.isArray(messageIds) ||
+      messageIds.length === 0 ||
+      messageIds.length > 100 ||
+      messageIds.some((id) => !MESSAGE_ID_PATTERN.test(String(id || ""))) ||
+      new Set(messageIds.map(String)).size !== messageIds.length
+    ) {
+      throw fabricError(
+        SESSION_MESSAGE_FABRIC_ERROR_CODES.INVALID_ARGUMENT,
+        "messageIds must contain 1-100 unique message identifiers",
+      );
+    }
+    if (!PROCESSING_STATUSES.has(status)) {
+      throw fabricError(
+        SESSION_MESSAGE_FABRIC_ERROR_CODES.INVALID_ARGUMENT,
+        "processing status must be read, processed or dead_letter",
+      );
+    }
+    const safeConsumerKey = boundedId(consumerKey, "consumerKey");
+    const safeAttempt =
+      recipientAttempt == null ? null : jsonBody(recipientAttempt).value;
+    const safeReason = String(reason || "poison_message").slice(0, 1024);
+    const ids = messageIds.map(String);
+    return this._transaction((state, now) => {
+      const endpoint = requireEndpoint(state, selector);
+      const plans = ids.map((id) => {
+        const receipt = state.receipts.find(
+          (candidate) =>
+            candidate.messageId === id &&
+            candidate.recipientAuthority === endpoint.authorityId &&
+            candidate.recipientEpoch === endpoint.epoch,
+        );
+        const message = state.messages.find(
+          (candidate) =>
+            candidate.messageId === id &&
+            candidate.recipientAuthority === endpoint.authorityId &&
+            candidate.recipientEpoch === endpoint.epoch,
+        );
+        if (
+          !receipt ||
+          (!message && !TERMINAL_PROCESSING_STATUSES.has(receipt.status))
+        ) {
+          throw fabricError(
+            SESSION_MESSAGE_FABRIC_ERROR_CODES.INVALID_ARGUMENT,
+            `message is not addressed to the active recipient: ${id}`,
+          );
+        }
+        if (TERMINAL_PROCESSING_STATUSES.has(receipt.status)) {
+          if (receipt.consumerKey !== safeConsumerKey) {
+            throw fabricError(
+              SESSION_MESSAGE_FABRIC_ERROR_CODES.MESSAGE_ID_CONFLICT,
+              `message was settled by another consumer: ${id}`,
+            );
+          }
+          if (receipt.status !== status) {
+            throw fabricError(
+              SESSION_MESSAGE_FABRIC_ERROR_CODES.MESSAGE_ID_CONFLICT,
+              `message already has terminal status ${receipt.status}: ${id}`,
+            );
+          }
+          return { receipt, message, replay: true };
+        }
+        return { receipt, message, replay: false };
+      });
+      const receipts = [];
+      for (const plan of plans) {
+        const { receipt, message, replay } = plan;
+        if (replay) {
+          receipts.push(clone(receipt));
+          continue;
+        }
+        receipt.status = status;
+        receipt.consumerKey = safeConsumerKey;
+        receipt.recipientAttempt = safeAttempt;
+        receipt.updatedAt = now;
+        if (status === "read") receipt.readAt ||= now;
+        if (status === "processed") {
+          receipt.readAt ||= now;
+          receipt.processedAt ||= now;
+          message.acknowledgedAt = now;
+        }
+        if (status === "dead_letter") {
+          receipt.deadLetteredAt ||= now;
+          receipt.reason = safeReason;
+          message.acknowledgedAt = now;
+        }
+        receipts.push(clone(receipt));
+      }
+      return { changed: plans.some((plan) => !plan.replay), value: receipts };
+    });
+  }
+
+  /** Bounded retained history for authoritative adapters and audit reducers. */
+  history() {
+    return this._transaction((state) => ({
+      value: clone(
+        state.messages.sort(
+          (left, right) =>
+            left.createdAt - right.createdAt ||
+            left.messageId.localeCompare(right.messageId),
+        ),
+      ),
+    }));
+  }
+
+  /**
+   * One-revision authority view for host adapters and deterministic reducers.
+   * Unlike a sequence of projection/history/receipt reads, this cannot combine
+   * fields from different concurrent commits.
+   */
+  auditSnapshot() {
+    return this._transaction((state) => ({
+      value: {
+        schema: SESSION_MESSAGE_FABRIC_SCHEMA,
+        version: state.version,
+        authority: "cli",
+        revision: state.revision,
+        digest: state.digest,
+        limits: clone(this._limits),
+        endpoints: clone(state.endpoints),
+        messages: clone(state.messages),
+        receipts: clone(state.receipts),
+      },
+    }));
+  }
+
   receipts(selector) {
     return this._transaction((state) => {
       const endpoint = requireEndpoint(state, selector);

package/src/runtime/headless-stream.js

@@ -22,6 +22,12 @@ import {
   approvalBindingDigest,
   verifyApprovalBinding,
 } from "../lib/agent-authority.js";
+import { validateApprovalDecision } from "../lib/app-server/protocol.js";
+import {
+  APPROVAL_GRANTS_EVENT,
+  ApprovalGrantLedger,
+  approvalPermissionForContext,
+} from "../lib/approval-grant-ledger.js";
 import {
   normalizeInteractionBinding,
   sameInteractionBinding,
@@ -572,14 +578,57 @@ export function parseInputEvent(line) {
   if (obj && typeof obj === "object" && obj.type === "compact") {
     return { compact: true };
   }
-  // Approval verdicts (panel Approve/Deny for --interactive-approvals):
-  //   {"type":"approval","id":"appr-1","approve":true|false}
+  // Approval verdicts (panel/SDK for --interactive-approvals). New clients
+  // send the canonical structured decision and echo the request binding. The
+  // boolean remains an N-1 migration field for older clients only.
+  //   {"type":"approval","id":"appr-1","decision":{"kind":"acceptOnce"},"binding":"..."}
+  //   {"type":"approval","id":"appr-1","approve":true|false} // legacy
   if (obj && typeof obj === "object" && obj.type === "approval") {
     if (!obj.id) return null;
+    const structured = obj.decision !== undefined;
+    let decision;
+    let invalidReason = null;
+    if (structured) {
+      const validation = validateApprovalDecision(obj.decision);
+      if (validation.ok) {
+        decision = obj.decision;
+      } else {
+        invalidReason = "invalid-decision";
+        decision = {
+          kind: "decline",
+          reason: "Invalid structured approval decision",
+        };
+      }
+    } else {
+      decision =
+        obj.approve === true
+          ? { kind: "acceptOnce" }
+          : { kind: "decline", reason: "Legacy boolean denial" };
+    }
+    const approve = [
+      "acceptOnce",
+      "acceptForTurn",
+      "acceptForSession",
+    ].includes(decision.kind);
+    if (
+      !invalidReason &&
+      structured &&
+      typeof obj.approve === "boolean" &&
+      obj.approve !== approve
+    ) {
+      invalidReason = "decision-boolean-mismatch";
+      decision = {
+        kind: "decline",
+        reason: "Structured and legacy approval verdicts disagree",
+      };
+    }
     return {
       approval: {
         id: String(obj.id),
-        approve: obj.approve === true,
+        approve: invalidReason ? false : approve,
+        decision,
+        structured,
+        invalidReason,
         // Optional approval binding (authority §"权限来源与跨 Agent 授权边界"):
         // when present it must match the digest the matching approval_request
         // advertised, so a stale/mis-routed/param-substituted verdict can't
@@ -2035,12 +2084,61 @@ async function runAgentHeadlessStreamInWorkspace(
     }
   };
 
+  // Structured approval grants are exact tool+args+cwd capabilities. Turn
+  // grants are memory-only and reset before every model turn; session grants
+  // are restored only from a verified authority event and are appended under
+  // the same anchored transcript contract as other session authority state.
+  let approvalGrantLedger = new ApprovalGrantLedger({ sessionId });
+  let approvalGrantPersistenceError = null;
+  if (persist) {
+    try {
+      const event = store.findLatestEvent(
+        sessionId,
+        APPROVAL_GRANTS_EVENT,
+        (candidate) => candidate?.data && typeof candidate.data === "object",
+      );
+      if (event) {
+        approvalGrantLedger = ApprovalGrantLedger.fromJSON(event.data, {
+          sessionId,
+        });
+      }
+    } catch (error) {
+      approvalGrantPersistenceError = error;
+      approvalGrantLedger = new ApprovalGrantLedger({ sessionId });
+      emit({
+        type: "recovery_degraded",
+        component: "approval_grants",
+        session_id: sessionId,
+        error:
+          "Persisted approval grants could not be verified; all grants were discarded",
+      });
+    }
+  }
+  const persistApprovalGrants = () => {
+    if (!persist || approvalGrantPersistenceError) return false;
+    try {
+      const persisted = store.appendAuthorityEvent(
+        sessionId,
+        APPROVAL_GRANTS_EVENT,
+        approvalGrantLedger.toJSON(),
+      );
+      if (persisted === false) {
+        throw new Error("session store rejected approval grants");
+      }
+      return true;
+    } catch (error) {
+      approvalGrantPersistenceError = error;
+      return false;
+    }
+  };
+
   // ── Interactive approvals (--interactive-approvals; chat-panel UX) ────────
   // CONFIRM-tier decisions (risky shell via the ApprovalGate, settings/hook
   // `ask`) normally fail closed in headless. With this opt-in they become a
   // structured round-trip instead: emit `approval_request`, BLOCK the tool
-  // until a {"type":"approval",id,approve} arrives on stdin (handled by the
-  // concurrent pump below, so the wait never deadlocks), fail closed on
+  // until a canonical structured decision (or an N-1 boolean response) arrives
+  // on stdin (handled by the concurrent pump below, so the wait never
+  // deadlocks), fail closed on
   // timeout (CC_APPROVAL_TIMEOUT_MS, default 120s) or stdin close. The
   // resolution is echoed as `approval_resolved` so UIs can settle their cards.
   const interactive = options.interactiveApprovals === true;
@@ -2050,45 +2148,87 @@ async function runAgentHeadlessStreamInWorkspace(
     Number(process.env.CC_APPROVAL_TIMEOUT_MS) > 0
       ? Number(process.env.CC_APPROVAL_TIMEOUT_MS)
       : 120000;
-  const settleApproval = (id, approve, via, incomingBinding = null) => {
+  const settleApproval = (
+    id,
+    decision,
+    via,
+    incomingBinding = null,
+    { structured = false, invalidReason = null } = {},
+  ) => {
     const p = pendingApprovals.get(id);
     if (!p) return;
+    const approve = [
+      "acceptOnce",
+      "acceptForTurn",
+      "acceptForSession",
+    ].includes(decision?.kind);
     // Approval binding (authority §"权限来源与跨 Agent 授权边界"): an *approve*
     // verdict that carries a binding which does NOT match the one the request
     // advertised is stale / mis-routed / argument-tampered — reject it (deny,
     // fail closed) instead of green-lighting a different or changed tool call.
-    // A verdict with no binding stays backward-compatible; a deny always wins.
+    // A legacy boolean verdict with no binding stays backward-compatible. A
+    // structured approval must echo the binding; a deny always wins.
     if (
       approve === true &&
-      incomingBinding &&
       p.binding &&
-      !verifyApprovalBinding(p.binding, incomingBinding)
+      ((structured && !incomingBinding) ||
+        (incomingBinding && !verifyApprovalBinding(p.binding, incomingBinding)))
     ) {
       pendingApprovals.delete(id);
       clearTimeout(p.timer);
+      const rejectionReason = incomingBinding
+        ? "binding-mismatch"
+        : "binding-missing";
       emit({
         type: "approval_resolved",
         id,
         approved: false,
-        via: "binding-mismatch",
+        decision: {
+          kind: "decline",
+          reason: `Approval ${rejectionReason}`,
+        },
+        via: rejectionReason,
         session_id: sessionId,
       });
       p.resolve(false);
       return;
     }
+    if (
+      approve &&
+      (decision.kind === "acceptForTurn" ||
+        decision.kind === "acceptForSession")
+    ) {
+      const priorSessionGrants = new Map(approvalGrantLedger.sessionGrants);
+      const priorRevision = approvalGrantLedger.revision;
+      const applied = approvalGrantLedger.applyDecision(
+        decision,
+        p.requiredPermission,
+        p.binding,
+      );
+      decision = applied.decision;
+      if (applied.persistedScope && persist && !persistApprovalGrants()) {
+        approvalGrantLedger.sessionGrants = priorSessionGrants;
+        approvalGrantLedger.revision = priorRevision;
+        decision = { kind: "acceptOnce" };
+        via = "session-grant-persistence-failed";
+      }
+    }
     pendingApprovals.delete(id);
     clearTimeout(p.timer);
     emit({
       type: "approval_resolved",
       id,
-      approved: approve === true,
-      via,
+      approved: invalidReason ? false : approve,
+      decision,
+      via: invalidReason || via,
       session_id: sessionId,
     });
-    p.resolve(approve === true);
+    p.resolve(!invalidReason && approve);
   };
-  const interactiveConfirm = (ctx = {}) =>
-    new Promise((resolve) => {
+  const interactiveConfirm = (ctx = {}) => {
+    const requiredPermission = approvalPermissionForContext(ctx, { cwd });
+    if (approvalGrantLedger.allows(requiredPermission)) return true;
+    return new Promise((resolve) => {
       const id = `appr-${++approvalSeq}`;
       // Bind this approval request to the exact call it authorizes: the request
       // id, its normalized arguments, and the policy/rule in force. The digest
@@ -2101,11 +2241,21 @@ async function runAgentHeadlessStreamInWorkspace(
         policyDigest: ctx.rule || ctx.riskLevel || ctx.risk || null,
       });
       const timer = setTimeout(
-        () => settleApproval(id, false, "timeout"),
+        () =>
+          settleApproval(
+            id,
+            { kind: "decline", reason: "Approval timed out" },
+            "timeout",
+          ),
         approvalTimeoutMs,
       );
       timer.unref?.();
-      pendingApprovals.set(id, { resolve, timer, binding });
+      pendingApprovals.set(id, {
+        resolve,
+        timer,
+        binding,
+        requiredPermission,
+      });
       emit({
         type: "approval_request",
         id,
@@ -2116,8 +2266,10 @@ async function runAgentHeadlessStreamInWorkspace(
         rule: ctx.rule || null,
         reason: ctx.reason || null,
         binding,
+        requested_permissions: [requiredPermission],
       });
     });
+  };
 
   let approvalGate = null;
   try {
@@ -2206,6 +2358,10 @@ async function runAgentHeadlessStreamInWorkspace(
           type: "approval_resolved",
           id,
           approved: false,
+          decision: {
+            kind: "decline",
+            reason: `Approval ${via}`,
+          },
           via,
           session_id: sessionId,
         });
@@ -3260,9 +3416,13 @@ async function runAgentHeadlessStreamInWorkspace(
           // Approval verdicts settle a BLOCKED tool — never queued.
           settleApproval(
             parsed.approval.id,
-            parsed.approval.approve,
+            parsed.approval.decision,
             parsed.approval.approve ? "user-approve" : "user-deny",
             parsed.approval.binding,
+            {
+              structured: parsed.approval.structured,
+              invalidReason: parsed.approval.invalidReason,
+            },
           );
           continue;
         }
@@ -3321,7 +3481,11 @@ async function runAgentHeadlessStreamInWorkspace(
     // stdin closed while approvals were pending → fail closed so the blocked
     // turn can finish and the process can exit.
     for (const id of [...pendingApprovals.keys()]) {
-      settleApproval(id, false, "stdin-closed");
+      settleApproval(
+        id,
+        { kind: "decline", reason: "Approval input closed" },
+        "stdin-closed",
+      );
     }
     // stdin closed while a question was pending → user_timeout (model proceeds).
     for (const id of [...pendingQuestions.keys()]) {
@@ -4112,6 +4276,7 @@ async function runAgentHeadlessStreamInWorkspace(
       }
     }
     turns += 1;
+    approvalGrantLedger.beginTurn(turns);
     if (persistenceFailure) {
       terminalPersistenceFailure = persistenceFailure;
       sawError = true;