chainlesschain 0.166.6 → 0.166.9

package/src/commands/team.js

@@ -17,7 +17,7 @@
 
 import fs from "fs";
 import path from "path";
-import { randomUUID } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { fileURLToPath } from "url";
 import { TaskLeaseRegistry } from "../lib/agent-team/task-lease.js";
 import { TeamRunner } from "../lib/agent-team/team-runner.js";
@@ -32,6 +32,8 @@ import {
   computeTeamGraphRevisionDigest,
   projectTeamGraphCollaboration,
 } from "../lib/agent-team/team-graph-projection.js";
+import { TeamGraphRuntimeAdapter } from "../lib/agent-team/team-graph-runtime-adapter.js";
+import { createRuntimeGraphCutoverAuthorityResolver } from "../lib/graph-kernel/cutover-authority-resolver.js";
 import { resolveTeamTaskContract } from "../lib/agent-team/team-task-contract.js";
 import {
   TeamScopeLock,
@@ -326,6 +328,41 @@ function teamExecutionMode(options) {
   return "dry-run";
 }
 
+export function teamGraphAuthorityMode(
+  options,
+  env = process.env,
+  { runKey = undefined, optIn = false, resolver = undefined } = {},
+) {
+  const executionMode = teamExecutionMode(options);
+  const configured = String(env.CHAINLESSCHAIN_GRAPH_CLI_TEAM || "")
+    .trim()
+    .toLowerCase();
+  if (configured && !["legacy", "shadow", "canonical"].includes(configured)) {
+    throw new Error(
+      "CHAINLESSCHAIN_GRAPH_CLI_TEAM must be legacy, shadow, or canonical",
+    );
+  }
+  const fallbackMode =
+    executionMode === "dry-run" ? "shadow" : configured || "legacy";
+  const authorityResolver =
+    resolver ||
+    createRuntimeGraphCutoverAuthorityResolver({
+      env,
+      surface: "cli_team",
+      entryId: "cli-team-local",
+      fallbackMode,
+    });
+  const resolved =
+    typeof authorityResolver === "function"
+      ? authorityResolver({ runKey, optIn })
+      : authorityResolver.resolve({ runKey, optIn, fallbackMode });
+  const mode = typeof resolved === "string" ? resolved : resolved?.mode;
+  if (!["legacy", "shadow", "canonical"].includes(mode)) {
+    throw new Error("Team Graph authority resolver returned an invalid mode");
+  }
+  return mode;
+}
+
 function optionWasProvided(command, name) {
   const source = command?.getOptionValueSource?.(name);
   return source != null && source !== "default";
@@ -1008,8 +1045,23 @@ export function makeShellRunTask() {
           settle(terminationError);
           return;
         }
-        if (code === 0) settle(null, { code });
-        else {
+        if (code === 0) {
+          settle(null, {
+            code,
+            terminalEvidence: {
+              outputDigest: `sha256:${createHash("sha256")
+                .update(
+                  JSON.stringify({
+                    command,
+                    cwd: process.cwd(),
+                    exitCode: code,
+                  }),
+                  "utf8",
+                )
+                .digest("hex")}`,
+            },
+          });
+        } else {
           const stderr = Buffer.concat(stderrChunks).toString("utf8");
           settle(new Error(safeProcessError(stderr, `command exited ${code}`)));
         }
@@ -1310,6 +1362,7 @@ function spawnAgentProcess(prompt, cwd, opts = {}) {
         return;
       }
       const result = { code };
+      result.terminalEvidence = parser.terminalEvidence();
       if (sawStdout || summary.usage || summary.provider || summary.model) {
         if (summary.usage) result.usage = summary.usage;
         if (summary.provider) result.provider = summary.provider;
@@ -1994,6 +2047,10 @@ export function registerTeamCommand(program, { logger } = {}) {
       "--resume",
       "Restore progress from --state (completed tasks stay done; stale leases freed)",
     )
+    .option(
+      "--graph-canary-opt-in",
+      "Opt this new Team run into an entry-scoped Graph canary",
+    )
     .option("--json", "Emit the event stream as JSON lines")
     .option(
       "--otlp <file>",
@@ -2642,6 +2699,42 @@ export function registerTeamCommand(program, { logger } = {}) {
               (_, index) => `teammate-${index + 1}`,
             ),
           });
+        const graphAuthorityMode =
+          resumeSnapshot?.graphProjection?.authorityMode ||
+          teamGraphAuthorityMode(options, process.env, {
+            runKey: teamGraphRunId,
+            optIn: options.graphCanaryOptIn === true,
+          });
+        let graphRuntime = null;
+        const shadowDivergences = [];
+        const recordShadowDivergence = (divergence) => {
+          shadowDivergences.push(divergence);
+          while (shadowDivergences.length > 256) shadowDivergences.shift();
+        };
+        if (["shadow", "canonical"].includes(graphAuthorityMode)) {
+          graphRuntime = new TeamGraphRuntimeAdapter();
+          graphRuntime.open({
+            registry: reg,
+            runId: teamGraphRunId,
+            executionMode: executionContract.mode,
+            worktree: options.worktree === true,
+            teammates,
+            budget: limits,
+            authorityMode: graphAuthorityMode,
+            dynamic: true,
+          });
+          if (graphAuthorityMode === "canonical") {
+            reg = graphRuntime.bindRegistry(reg);
+            mailbox = graphRuntime.bindMailbox(mailbox);
+          } else {
+            reg = graphRuntime.bindRegistry(reg, {
+              onDivergence: recordShadowDivergence,
+            });
+            mailbox = graphRuntime.bindMailbox(mailbox, {
+              onDivergence: recordShadowDivergence,
+            });
+          }
+        }
         const settleGovernance = (key, status, extra = {}) => {
           const governanceKey = sessionTaskKeyFor(key);
           const unit = collaborationUnits.get(governanceKey);
@@ -2704,6 +2797,9 @@ export function registerTeamCommand(program, { logger } = {}) {
               revisionDigest: teamGraphRevisionDigest,
               authorityDigest: teamGraphAuthorityDigest,
             }),
+            graphAuthorityMode,
+            graphAuthority: graphRuntime?.status() || null,
+            graphShadowDivergences: [...shadowDivergences],
           });
         };
 
@@ -2956,13 +3052,34 @@ export function registerTeamCommand(program, { logger } = {}) {
           realtimeMessaging: options.agent === true,
           scopeLock,
           recorder,
-          beforeTask: ({ key }) => {
-            settleGovernance(key, "running", {
-              startedAt: Date.now(),
-            });
+          beforeTask: (context) => {
+            const { key } = context;
+            if (graphAuthorityMode === "canonical") {
+              graphRuntime?.beforeTask(context);
+            } else if (graphAuthorityMode === "shadow") {
+              try {
+                graphRuntime?.beforeTask(context);
+              } catch (error) {
+                recordShadowDivergence({
+                  phase: "assignment",
+                  key,
+                  code: error?.code || "CC_TEAM_GRAPH_SHADOW_DIVERGED",
+                  error: error?.message || String(error),
+                });
+              }
+            }
             try {
+              settleGovernance(key, "running", {
+                startedAt: Date.now(),
+              });
               persist();
             } catch (error) {
+              try {
+                graphRuntime?.abandonTask(key, error);
+              } catch (canonicalError) {
+                canonicalError.cause ||= error;
+                throw canonicalError;
+              }
               try {
                 settleGovernance(key, "pending", {
                   startedAt: null,
@@ -2973,6 +3090,38 @@ export function registerTeamCommand(program, { logger } = {}) {
               throw error;
             }
           },
+          canonicalSettlement:
+            graphAuthorityMode === "canonical" && graphRuntime
+              ? (settlement) => graphRuntime.settleTask(settlement)
+              : null,
+          canonicalReady:
+            graphAuthorityMode === "canonical" && graphRuntime
+              ? ({ excludeKeys }) =>
+                  graphRuntime.nextReadyTaskKey({ excludeKeys })
+              : null,
+          shadowSettlement:
+            graphAuthorityMode === "shadow" && graphRuntime
+              ? (settlement) => graphRuntime.settleTask(settlement)
+              : null,
+          canonicalCancellation:
+            graphAuthorityMode === "canonical" && graphRuntime
+              ? ({ reason }) => graphRuntime.cancel(reason)
+              : null,
+          shadowCancellation:
+            graphAuthorityMode === "shadow" && graphRuntime
+              ? async ({ reason }) => {
+                  try {
+                    return await graphRuntime.cancel(reason);
+                  } catch (error) {
+                    recordShadowDivergence({
+                      phase: "run-cancel",
+                      code: error?.code || "CC_TEAM_GRAPH_SHADOW_DIVERGED",
+                      error: error?.message || String(error),
+                    });
+                    return null;
+                  }
+                }
+              : null,
           afterTask: ({ key, status, retry }) => {
             const governanceStatus =
               status === "completion-discarded" ||
@@ -3094,6 +3243,19 @@ export function registerTeamCommand(program, { logger } = {}) {
           }
           throw err;
         }
+        if (graphRuntime) {
+          const graphStatus = graphRuntime.finalize();
+          summary.graphAuthorityMode = graphAuthorityMode;
+          summary.graphRuntime = graphStatus;
+          summary.graphShadowDivergences = [...shadowDivergences];
+          if (
+            graphAuthorityMode === "canonical" &&
+            graphStatus.status !== "succeeded"
+          ) {
+            summary.success = false;
+            summary.done = false;
+          }
+        }
         if (controlStore) {
           for (const request of controlStore.pending({
             anchor: controlCursor,

package/src/data/changelog.json

@@ -1,6 +1,52 @@
 {
   "source": "CHANGELOG.md",
   "releases": [
+    {
+      "productVersion": null,
+      "cliVersion": "0.166.9",
+      "cliVersions": ["0.166.8", "0.166.9"],
+      "date": "2026-08-29",
+      "title": "",
+      "sections": [
+        {
+          "heading": "Added - cc CLI 0.166.9: governed UI replay and Codex compatibility gates",
+          "body": "> `chainlesschain` **0.166.8 -> 0.166.9** (release candidate,\n> 2026-08-29). Agent Protocol and TypeScript Agent SDK candidate versions\n> remain `0.1.6` and `0.2.5`; Python Agent SDK moves to `0.2.6` after the\n> immutable `0.2.5` candidate was withheld from PyPI because its release\n> metadata named an unpublished CLI.\n\n- **Real UI driver**: reviewed Record & Replay drafts can execute the bounded\n  `observe/click/type/select/assert` vocabulary in an ephemeral Playwright\n  Chromium context instead of relying on a fake executor.\n- **Fail-closed isolation**: the driver denies filesystem, HTTP(S), and\n  WebSocket requests, requires exact reviewed capabilities and selectors, and\n  rejects ambiguous targets, environment drift, network attempts, or missing\n  terminal evidence.\n- **Content-free receipts**: selectors, typed values, page text, URLs, and\n  screenshots never enter reports; only domain-separated state, page,\n  screenshot, target, and receipt digests plus bounded structural metadata are\n  retained.\n- **Cross-platform authority**: a dedicated exact-SHA GitHub Actions matrix\n  runs the positive journey and an active network-escape probe in real Chromium\n  on Linux, Windows, and macOS, then refuses partial evidence in its aggregate.\n- **Exact Codex admission**: the optional experimental App Server adapter now\n  admits only explicitly listed upstream patch versions; prereleases and\n  unverified future patches fail closed to the stable `codex exec --json`\n  fallback before turn admission.\n- **Version-bound App Server evidence**: a second exact-SHA Actions matrix\n  generates each upstream version's own schema and exercises the documented\n  `initialize -> initialized -> thread/list` stdio lifecycle on Linux,\n  Windows, and macOS without making a model request.\n- **Removal readiness**: every compatibility job proves that production CLI\n  source has no dependency on the optional adapter and that the stable Codex\n  JSONL fallback still executes and projects terminal output independently.\n- **Windows strict-sandbox cleanup**: target-identity cleanup remains bound to\n  the stable file object while tolerating size and timestamp metadata settling\n  after the native helper closes its writer; same-path replacement is still\n  rejected.\n- **JetBrains real-host gate**: plan-review document access now runs inside\n  explicit IntelliJ read/write actions, and the UI journey targets the current\n  one-time permission label on every supported host/version pair.\n- **Python release metadata**: the `0.2.6` patch keeps the `0.2.5` runtime API\n  and generated protocol bindings while pointing install guidance at the latest\n  CLI that is actually available from the public npm registry."
+        }
+      ]
+    },
+    {
+      "productVersion": null,
+      "cliVersion": "0.166.8",
+      "cliVersions": [
+        "0.1.6",
+        "0.2.5",
+        "0.4.104",
+        "0.37.73",
+        "0.166.7",
+        "0.166.8"
+      ],
+      "date": "2026-08-29",
+      "title": "",
+      "sections": [
+        {
+          "heading": "Added - cc CLI 0.166.8 + Agent Platform and IDE patches: durable Graph review and recovery",
+          "body": "> `chainlesschain` **0.166.7 -> 0.166.8**,\n> `@chainlesschain/agent-protocol` **0.1.5 -> 0.1.6**,\n> `@chainlesschain/agent-sdk` **0.2.4 -> 0.2.5**, and\n> `chainlesschain-agent-sdk` **0.2.4 -> 0.2.5** (release candidate,\n> 2026-08-29).\n> VS Code **0.37.72 -> 0.37.73** and JetBrains\n> **0.4.103 -> 0.4.104** carry the paired governed review surfaces.\n\n- **Durable Graph history**: fixed App Server/SDK clients expose bounded,\n  metadata-only event and snapshot history for blocked-root, revision-diff,\n  and time-travel debugging across CLI, Desktop, and VS Code.\n- **Recoverable HumanTask quorum**: Graph human nodes persist exact\n  revision/attempt/operation bindings, release Agent capacity while waiting,\n  and enforce single-winner cancel/decision CAS, quorum, and separation of\n  duties through the Desktop product surface.\n- **IDE review parity**: VS Code adds bounded Graph history/diff projection;\n  both IDEs enforce revision-bound approval grants and single-winner\n  settlement without accepting UI-derived authority.\n- **Migration and retirement evidence**: N-1 definition backups, rollback\n  digests, replay validation, replacement reachability, historical reads, and\n  zero-success legacy-writer observations are bound to durable exact-SHA\n  evidence rather than prose-only rollout claims.\n- **Reliability gates**: temporal message custody, dependency/scope fairness,\n  cross-process DAG recovery, effect idempotency, and worktree cleanup have\n  explicit bounded artifacts and fail-closed aggregate checks.\n- **Release validation**: publication requires this exact candidate to pass\n  Agent Protocol and Python SDK conformance, Linux/Windows/macOS `CLI CI` and\n  `CLI Strict Sandbox`, the Graph real-journey matrix, immutable package\n  checks, and public-registry provenance readback."
+        }
+      ]
+    },
+    {
+      "productVersion": null,
+      "cliVersion": "0.166.7",
+      "cliVersions": ["0.166.6", "0.166.7"],
+      "date": "2026-08-28",
+      "title": "",
+      "sections": [
+        {
+          "heading": "Added - cc CLI 0.166.7: authoritative Graph Kernel cutover",
+          "body": "> `chainlesschain` **0.166.6 -> 0.166.7**, published 2026-08-28 from exact\n> commit `19834a18457c1b763b5a7a2cfada713340e7c273`.\n\n- **Canonical execution authority**: CLI graph, Team, distributed-team,\n  Cowork, Scheduler, and App Server entry points now resolve through the\n  Graph Kernel cutover ledger instead of silently retaining parallel mutation\n  paths.\n- **Durable fencing and recovery**: graph writers, leases, receipts, takeover,\n  migration, and crash/resume flows are bound to persisted authority and\n  checked-out source evidence so stale owners cannot resume mutations.\n- **Legacy containment**: retired runtimes retain explicitly read-only history\n  access while unclassified or mutating legacy routes fail closed and report\n  their canonical replacement targets.\n- **Release validation**: the exact SHA passed Linux/Windows/macOS `CLI CI`\n  and `CLI Strict Sandbox`; immutable package, Trusted Publishing, npm\n  provenance, public-registry readback, Open VSX `0.37.72`, and JetBrains\n  Marketplace `0.4.103` were verified independently."
+        }
+      ]
+    },
     {
       "productVersion": null,
       "cliVersion": "0.166.6",

package/src/gateways/ws/message-dispatcher.js

@@ -182,6 +182,10 @@ export function createWsMessageDispatcher(server) {
           handleConfigSetSecret(server, id, ws, message),
         "slash-command": () => server._handleSlashCommand(id, ws, message),
         "session-answer": () => server._handleSessionAnswer(id, ws, message),
+        "approval-grants-list": () =>
+          server._handleApprovalGrantsList(id, ws, message),
+        "approval-grant-revoke": () =>
+          server._handleApprovalGrantRevoke(id, ws, message),
         "remote-session-create": () =>
           handleRemoteSessionCreate(server, clientId, ws, message),
         "remote-session-close": () =>

package/src/gateways/ws/session-protocol.js

@@ -606,9 +606,11 @@ async function ensureSessionHandler(
       if (budgetConfig.enabled) {
         const priceTable =
           budgetConfig.limits.maxUsd != null
-            ? wsBudgetDependency(server, "mergePricing", mergePricing)(
-                server.sessionManager.config?.llm?.pricing,
-              )
+            ? wsBudgetDependency(
+                server,
+                "mergePricing",
+                mergePricing,
+              )(server.sessionManager.config?.llm?.pricing)
             : undefined;
         sessionBudgetRoot = wsBudgetDependency(
           server,
@@ -627,9 +629,7 @@ async function ensureSessionHandler(
             sessionBudgetRoot.budget ||
           typeof sessionBudgetRoot.close !== "function"
         ) {
-          const error = new Error(
-            "WebSocket session budget root is invalid",
-          );
+          const error = new Error("WebSocket session budget root is invalid");
           error.code = "CC_SESSION_BUDGET_ROOT_INVALID";
           throw error;
         }
@@ -746,9 +746,7 @@ export async function handleSessionCreate(server, id, ws, message) {
       worktreeIsolation,
       systemPromptExtension,
       shellPolicyOverrides,
-      sessionBudgetRoot: sessionBudgetRoot.enabled
-        ? sessionBudgetRoot
-        : null,
+      sessionBudgetRoot: sessionBudgetRoot.enabled ? sessionBudgetRoot : null,
       requireDurable: sessionBudgetRoot.enabled,
     });
     createdSessionId = sessionId;
@@ -1487,16 +1485,96 @@ export function handleSessionAnswer(server, id, ws, message) {
   }
 
   const session = server.sessionManager.getSession(sessionId);
+  let settlement = null;
+  let settlementAttempted = false;
   if (session && session.interaction && session.interaction.resolveAnswer) {
-    session.interaction.resolveAnswer(requestId, answer, binding);
+    settlementAttempted = true;
+    settlement = session.interaction.resolveAnswer(requestId, answer, binding);
   }
 
+  // New adapters return an explicit settlement result. Legacy/custom
+  // interactions return undefined and preserve the historical success ACK.
+  const settled = settlementAttempted && settlement?.settled !== false;
+
   server._send(
     ws,
     envelopeResponse(
       CODING_AGENT_EVENT_TYPES.COMMAND_RESPONSE,
       id,
-      { success: true },
+      {
+        success: settled,
+        settled,
+        ...(settlement?.reason ? { reason: settlement.reason } : {}),
+      },
+      sessionId,
+    ),
+  );
+}
+
+export async function handleApprovalGrantsList(server, id, ws, message) {
+  const sessionId = message.sessionId;
+  const session = server.sessionManager?.getSession?.(sessionId) || null;
+  const handler = server.sessionHandlers?.get?.(sessionId) || null;
+  if (!session || !handler?.listApprovalGrants) {
+    server._send(
+      ws,
+      envelopeError(
+        id,
+        "APPROVAL_GRANT_SESSION_UNAVAILABLE",
+        "Approval grant session is not active",
+        sessionId,
+      ),
+    );
+    return;
+  }
+  const grants = await handler.listApprovalGrants();
+  server._send(
+    ws,
+    envelopeResponse(
+      CODING_AGENT_EVENT_TYPES.COMMAND_RESPONSE,
+      id,
+      { success: true, grants },
+      sessionId,
+    ),
+  );
+}
+
+export async function handleApprovalGrantRevoke(server, id, ws, message) {
+  const sessionId = message.sessionId;
+  const grantId = String(message.grantId || "");
+  const handler = server.sessionHandlers?.get?.(sessionId) || null;
+  if (!grantId || !handler?.revokeApprovalGrant) {
+    server._send(
+      ws,
+      envelopeError(
+        id,
+        "APPROVAL_GRANT_REVOKE_INVALID",
+        "An active approval grant and grantId are required",
+        sessionId,
+      ),
+    );
+    return;
+  }
+  const result = await handler.revokeApprovalGrant(grantId);
+  if (!result?.success) {
+    server._send(
+      ws,
+      envelopeError(
+        id,
+        "APPROVAL_GRANT_REVOKE_FAILED",
+        result?.error || "Approval grant could not be revoked",
+        sessionId,
+      ),
+    );
+    return;
+  }
+  const grants = await handler.listApprovalGrants();
+  server._send(
+    ws,
+    envelopeResponse(
+      CODING_AGENT_EVENT_TYPES.COMMAND_RESPONSE,
+      id,
+      { success: true, revoked: result.grant, grants },
       sessionId,
     ),
   );

package/src/gateways/ws/ws-agent-handler.js

@@ -29,6 +29,11 @@ import { runnableTaskModel } from "../../lib/runnable-provider.js";
 import { PlanState } from "../../lib/plan-mode.js";
 import { CLISlotFiller } from "../../lib/slot-filler.js";
 import { createAbortError, isAbortError } from "../../lib/abort-utils.js";
+import { addHooksV2EventObserver } from "../../lib/hooks-v2-producers.js";
+import {
+  projectHookPolicyDecision,
+  projectToolPolicyDecision,
+} from "../../lib/policy-decision-event.js";
 import {
   resolveRegisteredHostHooksV2Workspace,
   runWithHostHooksV2Workspace,
@@ -1081,6 +1086,7 @@ export class WSAgentHandler {
       this._approvalGate = await createWsApprovalGate({
         sessionId: this.session.id,
         interaction: this.interaction,
+        cwd: this.session.projectRoot,
       });
     }
     return this._approvalGate;
@@ -1234,7 +1240,11 @@ export class WSAgentHandler {
       });
       const mcpRecoveryRuntime = this._ensureMcpRecoveryRuntime();
 
-      // Run agent loop
+      // Run agent loop. Turn-scoped approval grants are reset before the
+      // model/tool boundary for every user message; session grants remain in
+      // the verified authority ledger owned by the session-scoped gate.
+      const approvalGate = await this._ensureApprovalGate();
+      approvalGate?.beginTurn?.(requestId || `turn-${Date.now()}`);
       const loopOptions = {
         provider: session.provider,
         model: activeModel,
@@ -1265,7 +1275,7 @@ export class WSAgentHandler {
         sessionBudget: this._sessionBudget,
         // P0 authority: null unless opted in (byte-identical default — agent
         // core already defaults `options.approvalGate || null`).
-        approvalGate: await this._ensureApprovalGate(),
+        approvalGate,
         // Canonical WS history is compacted before ws_turn_prepare. Compaction
         // inside agent-core would include the staged pending user, which is not
         // part of the canonical message projection until turn settlement.
@@ -1435,7 +1445,23 @@ export class WSAgentHandler {
                 tool: event.tool,
                 result: event.result,
                 error: event.error,
+                permission_decision_id: event.permission_decision_id || null,
+                permission_decision: event.permission_decision || null,
               });
+              {
+                const policyEvent = projectToolPolicyDecision(event, {
+                  sessionId: session.id,
+                  turnId: event.turn_id,
+                  toolUseId: event.tool_use_id,
+                });
+                if (policyEvent) {
+                  const { type: _type, ...payload } = policyEvent;
+                  this.interaction.emit("policy-decision", {
+                    requestId,
+                    ...payload,
+                  });
+                }
+              }
               if (
                 event.tool === "todo_write" &&
                 currentTodoWrite &&
@@ -1583,13 +1609,29 @@ export class WSAgentHandler {
             )
           : executeAgentTurn();
 
-      if (session.mcpClient?.withElicitationContext) {
-        await session.mcpClient.withElicitationContext(
-          session.id,
-          runAgentTurn,
-        );
-      } else {
-        await runAgentTurn();
+      const removeHookPolicyObserver = addHooksV2EventObserver(
+        session.id,
+        (event) => {
+          const policyEvent = projectHookPolicyDecision(event);
+          if (!policyEvent) return;
+          const { type: _type, ...payload } = policyEvent;
+          this.interaction.emit("policy-decision", {
+            requestId,
+            ...payload,
+          });
+        },
+      );
+      try {
+        if (session.mcpClient?.withElicitationContext) {
+          await session.mcpClient.withElicitationContext(
+            session.id,
+            runAgentTurn,
+          );
+        } else {
+          await runAgentTurn();
+        }
+      } finally {
+        removeHookPolicyObserver();
       }
       if (session.canonicalJsonlSession === true && !canonicalTurn?.settled) {
         const error = new Error(
@@ -1714,6 +1756,20 @@ export class WSAgentHandler {
     }
   }
 
+  async listApprovalGrants() {
+    const gate = await this._ensureApprovalGate();
+    if (!gate?.listGrants) return [];
+    return gate.listGrants();
+  }
+
+  async revokeApprovalGrant(grantId) {
+    const gate = await this._ensureApprovalGate();
+    if (!gate?.revokeGrant) {
+      return { success: false, error: "Approval grant authority unavailable" };
+    }
+    return gate.revokeGrant(grantId);
+  }
+
   async interrupt() {
     const wasProcessing = this._processing;
     const interruptedRequestId = this._activeRequestId || null;