chainlesschain 0.166.7 → 0.166.9

package/src/gateways/ws/session-protocol.js

@@ -606,9 +606,11 @@ async function ensureSessionHandler(
       if (budgetConfig.enabled) {
         const priceTable =
           budgetConfig.limits.maxUsd != null
-            ? wsBudgetDependency(server, "mergePricing", mergePricing)(
-                server.sessionManager.config?.llm?.pricing,
-              )
+            ? wsBudgetDependency(
+                server,
+                "mergePricing",
+                mergePricing,
+              )(server.sessionManager.config?.llm?.pricing)
             : undefined;
         sessionBudgetRoot = wsBudgetDependency(
           server,
@@ -627,9 +629,7 @@ async function ensureSessionHandler(
             sessionBudgetRoot.budget ||
           typeof sessionBudgetRoot.close !== "function"
         ) {
-          const error = new Error(
-            "WebSocket session budget root is invalid",
-          );
+          const error = new Error("WebSocket session budget root is invalid");
           error.code = "CC_SESSION_BUDGET_ROOT_INVALID";
           throw error;
         }
@@ -746,9 +746,7 @@ export async function handleSessionCreate(server, id, ws, message) {
       worktreeIsolation,
       systemPromptExtension,
       shellPolicyOverrides,
-      sessionBudgetRoot: sessionBudgetRoot.enabled
-        ? sessionBudgetRoot
-        : null,
+      sessionBudgetRoot: sessionBudgetRoot.enabled ? sessionBudgetRoot : null,
       requireDurable: sessionBudgetRoot.enabled,
     });
     createdSessionId = sessionId;
@@ -1487,16 +1485,96 @@ export function handleSessionAnswer(server, id, ws, message) {
   }
 
   const session = server.sessionManager.getSession(sessionId);
+  let settlement = null;
+  let settlementAttempted = false;
   if (session && session.interaction && session.interaction.resolveAnswer) {
-    session.interaction.resolveAnswer(requestId, answer, binding);
+    settlementAttempted = true;
+    settlement = session.interaction.resolveAnswer(requestId, answer, binding);
   }
 
+  // New adapters return an explicit settlement result. Legacy/custom
+  // interactions return undefined and preserve the historical success ACK.
+  const settled = settlementAttempted && settlement?.settled !== false;
+
   server._send(
     ws,
     envelopeResponse(
       CODING_AGENT_EVENT_TYPES.COMMAND_RESPONSE,
       id,
-      { success: true },
+      {
+        success: settled,
+        settled,
+        ...(settlement?.reason ? { reason: settlement.reason } : {}),
+      },
+      sessionId,
+    ),
+  );
+}
+
+export async function handleApprovalGrantsList(server, id, ws, message) {
+  const sessionId = message.sessionId;
+  const session = server.sessionManager?.getSession?.(sessionId) || null;
+  const handler = server.sessionHandlers?.get?.(sessionId) || null;
+  if (!session || !handler?.listApprovalGrants) {
+    server._send(
+      ws,
+      envelopeError(
+        id,
+        "APPROVAL_GRANT_SESSION_UNAVAILABLE",
+        "Approval grant session is not active",
+        sessionId,
+      ),
+    );
+    return;
+  }
+  const grants = await handler.listApprovalGrants();
+  server._send(
+    ws,
+    envelopeResponse(
+      CODING_AGENT_EVENT_TYPES.COMMAND_RESPONSE,
+      id,
+      { success: true, grants },
+      sessionId,
+    ),
+  );
+}
+
+export async function handleApprovalGrantRevoke(server, id, ws, message) {
+  const sessionId = message.sessionId;
+  const grantId = String(message.grantId || "");
+  const handler = server.sessionHandlers?.get?.(sessionId) || null;
+  if (!grantId || !handler?.revokeApprovalGrant) {
+    server._send(
+      ws,
+      envelopeError(
+        id,
+        "APPROVAL_GRANT_REVOKE_INVALID",
+        "An active approval grant and grantId are required",
+        sessionId,
+      ),
+    );
+    return;
+  }
+  const result = await handler.revokeApprovalGrant(grantId);
+  if (!result?.success) {
+    server._send(
+      ws,
+      envelopeError(
+        id,
+        "APPROVAL_GRANT_REVOKE_FAILED",
+        result?.error || "Approval grant could not be revoked",
+        sessionId,
+      ),
+    );
+    return;
+  }
+  const grants = await handler.listApprovalGrants();
+  server._send(
+    ws,
+    envelopeResponse(
+      CODING_AGENT_EVENT_TYPES.COMMAND_RESPONSE,
+      id,
+      { success: true, revoked: result.grant, grants },
       sessionId,
     ),
   );

package/src/gateways/ws/ws-agent-handler.js

@@ -29,6 +29,11 @@ import { runnableTaskModel } from "../../lib/runnable-provider.js";
 import { PlanState } from "../../lib/plan-mode.js";
 import { CLISlotFiller } from "../../lib/slot-filler.js";
 import { createAbortError, isAbortError } from "../../lib/abort-utils.js";
+import { addHooksV2EventObserver } from "../../lib/hooks-v2-producers.js";
+import {
+  projectHookPolicyDecision,
+  projectToolPolicyDecision,
+} from "../../lib/policy-decision-event.js";
 import {
   resolveRegisteredHostHooksV2Workspace,
   runWithHostHooksV2Workspace,
@@ -1081,6 +1086,7 @@ export class WSAgentHandler {
       this._approvalGate = await createWsApprovalGate({
         sessionId: this.session.id,
         interaction: this.interaction,
+        cwd: this.session.projectRoot,
       });
     }
     return this._approvalGate;
@@ -1234,7 +1240,11 @@ export class WSAgentHandler {
       });
       const mcpRecoveryRuntime = this._ensureMcpRecoveryRuntime();
 
-      // Run agent loop
+      // Run agent loop. Turn-scoped approval grants are reset before the
+      // model/tool boundary for every user message; session grants remain in
+      // the verified authority ledger owned by the session-scoped gate.
+      const approvalGate = await this._ensureApprovalGate();
+      approvalGate?.beginTurn?.(requestId || `turn-${Date.now()}`);
       const loopOptions = {
         provider: session.provider,
         model: activeModel,
@@ -1265,7 +1275,7 @@ export class WSAgentHandler {
         sessionBudget: this._sessionBudget,
         // P0 authority: null unless opted in (byte-identical default — agent
         // core already defaults `options.approvalGate || null`).
-        approvalGate: await this._ensureApprovalGate(),
+        approvalGate,
         // Canonical WS history is compacted before ws_turn_prepare. Compaction
         // inside agent-core would include the staged pending user, which is not
         // part of the canonical message projection until turn settlement.
@@ -1435,7 +1445,23 @@ export class WSAgentHandler {
                 tool: event.tool,
                 result: event.result,
                 error: event.error,
+                permission_decision_id: event.permission_decision_id || null,
+                permission_decision: event.permission_decision || null,
               });
+              {
+                const policyEvent = projectToolPolicyDecision(event, {
+                  sessionId: session.id,
+                  turnId: event.turn_id,
+                  toolUseId: event.tool_use_id,
+                });
+                if (policyEvent) {
+                  const { type: _type, ...payload } = policyEvent;
+                  this.interaction.emit("policy-decision", {
+                    requestId,
+                    ...payload,
+                  });
+                }
+              }
               if (
                 event.tool === "todo_write" &&
                 currentTodoWrite &&
@@ -1583,13 +1609,29 @@ export class WSAgentHandler {
             )
           : executeAgentTurn();
 
-      if (session.mcpClient?.withElicitationContext) {
-        await session.mcpClient.withElicitationContext(
-          session.id,
-          runAgentTurn,
-        );
-      } else {
-        await runAgentTurn();
+      const removeHookPolicyObserver = addHooksV2EventObserver(
+        session.id,
+        (event) => {
+          const policyEvent = projectHookPolicyDecision(event);
+          if (!policyEvent) return;
+          const { type: _type, ...payload } = policyEvent;
+          this.interaction.emit("policy-decision", {
+            requestId,
+            ...payload,
+          });
+        },
+      );
+      try {
+        if (session.mcpClient?.withElicitationContext) {
+          await session.mcpClient.withElicitationContext(
+            session.id,
+            runAgentTurn,
+          );
+        } else {
+          await runAgentTurn();
+        }
+      } finally {
+        removeHookPolicyObserver();
       }
       if (session.canonicalJsonlSession === true && !canonicalTurn?.settled) {
         const error = new Error(
@@ -1714,6 +1756,20 @@ export class WSAgentHandler {
     }
   }
 
+  async listApprovalGrants() {
+    const gate = await this._ensureApprovalGate();
+    if (!gate?.listGrants) return [];
+    return gate.listGrants();
+  }
+
+  async revokeApprovalGrant(grantId) {
+    const gate = await this._ensureApprovalGate();
+    if (!gate?.revokeGrant) {
+      return { success: false, error: "Approval grant authority unavailable" };
+    }
+    return gate.revokeGrant(grantId);
+  }
+
   async interrupt() {
     const wasProcessing = this._processing;
     const interruptedRequestId = this._activeRequestId || null;

package/src/gateways/ws/ws-approval-gate.js

@@ -26,6 +26,32 @@
  */
 
 import { approvalBindingDigest } from "../../lib/agent-authority.js";
+import {
+  APPROVAL_GRANTS_EVENT,
+  ApprovalGrantLedger,
+  approvalPermissionForContext,
+} from "../../lib/approval-grant-ledger.js";
+
+function approvalDecision(value) {
+  const candidate =
+    value?.decision && typeof value.decision === "object"
+      ? value.decision
+      : value;
+  if (
+    candidate &&
+    [
+      "acceptOnce",
+      "acceptForTurn",
+      "acceptForSession",
+      "decline",
+      "cancel",
+    ].includes(candidate.kind)
+  ) {
+    return candidate;
+  }
+  if (value === true) return { kind: "acceptOnce" };
+  return { kind: "decline" };
+}
 
 /**
  * Build the binding-attaching confirmer for one WS session.
@@ -35,9 +61,19 @@ import { approvalBindingDigest } from "../../lib/agent-authority.js";
  * @param {string} opts.sessionId
  * @returns {(ctx?: object) => Promise<boolean>}
  */
-export function buildWsApprovalConfirmer({ interaction, sessionId }) {
+export function buildWsApprovalConfirmer({
+  interaction,
+  sessionId,
+  cwd = null,
+  ledgerState = { ledger: new ApprovalGrantLedger({ sessionId }) },
+  persistApprovalGrants = () => false,
+}) {
   let approvalSeq = 0;
   return async (ctx = {}) => {
+    const requiredPermission = approvalPermissionForContext(ctx, {
+      cwd: cwd || ctx.cwd || null,
+    });
+    if (ledgerState.ledger.allows(requiredPermission)) return true;
     const command = ctx.command ?? ctx.args?.command ?? null;
     const risk = ctx.riskLevel || ctx.risk || "unknown";
     // Bind this approval to the exact call it authorizes (same recipe as the
@@ -51,22 +87,66 @@ export function buildWsApprovalConfirmer({ interaction, sessionId }) {
     const what = ctx.tool || ctx.toolName || "tool";
     const detail = command != null ? `: ${String(command).slice(0, 200)}` : "";
     try {
-      const ok = await interaction.askConfirm(
-        `Approve ${what}${detail}? (risk: ${risk})`,
-        {
-          default: false,
-          binding,
-          // Structured context so UIs can render a proper approval card
-          // instead of parsing the question text.
-          approval: {
-            tool: what,
-            command,
-            risk,
-            rule: ctx.rule || null,
-          },
+      const options = {
+        default: false,
+        binding,
+        // Structured context so UIs can render a proper approval card
+        // instead of parsing the question text. Reusable permissions are
+        // host-issued and exact; the renderer may choose a lifetime but may
+        // never widen this set.
+        approval: {
+          tool: what,
+          command,
+          risk,
+          rule: ctx.rule || null,
+          requestedPermissions: [requiredPermission],
         },
+      };
+      const rawDecision = interaction.askApproval
+        ? await interaction.askApproval(
+            `Approve ${what}${detail}? (risk: ${risk})`,
+            options,
+          )
+        : await interaction.askConfirm(
+            `Approve ${what}${detail}? (risk: ${risk})`,
+            options,
+          );
+      let decision = approvalDecision(rawDecision);
+      const approved = [
+        "acceptOnce",
+        "acceptForTurn",
+        "acceptForSession",
+      ].includes(decision.kind);
+      if (
+        approved &&
+        (decision.kind === "acceptForTurn" ||
+          decision.kind === "acceptForSession")
+      ) {
+        const priorSessionGrants = new Map(ledgerState.ledger.sessionGrants);
+        const priorRevision = ledgerState.ledger.revision;
+        const applied = ledgerState.ledger.applyDecision(
+          decision,
+          requiredPermission,
+          binding,
+        );
+        decision = applied.decision;
+        if (applied.granted.length === 0) return false;
+        if (applied.persistedScope && !persistApprovalGrants()) {
+          ledgerState.ledger.sessionGrants = priorSessionGrants;
+          ledgerState.ledger.revision = priorRevision;
+          // Match the stream-json contract: persistence failure never creates
+          // a phantom session grant, but the exact operation may proceed once.
+          decision = { kind: "acceptOnce" };
+        }
+      }
+      interaction.recordApprovalDecision?.({
+        binding,
+        decision,
+        requiredPermission,
+      });
+      return ["acceptOnce", "acceptForTurn", "acceptForSession"].includes(
+        decision.kind,
       );
-      return ok === true;
     } catch {
       // timeout / disconnect / interrupt → fail closed, never approve
       return false;
@@ -91,6 +171,7 @@ export function buildWsApprovalConfirmer({ interaction, sessionId }) {
 export async function createWsApprovalGate({
   sessionId,
   interaction,
+  cwd = null,
   deps = {},
 }) {
   try {
@@ -104,8 +185,59 @@ export async function createWsApprovalGate({
       loadSessionCore(),
     ]);
     const inner = await singletons.getApprovalGate();
+    const store =
+      deps.sessionStore ||
+      (await import("../../harness/jsonl-session-store.js"));
+    const ledgerState = {
+      ledger: new ApprovalGrantLedger({ sessionId }),
+    };
+    let approvalGrantPersistenceError = null;
+    try {
+      const event = store.findLatestEvent(
+        sessionId,
+        APPROVAL_GRANTS_EVENT,
+        (candidate) => candidate?.data && typeof candidate.data === "object",
+      );
+      if (event) {
+        ledgerState.ledger = ApprovalGrantLedger.fromJSON(event.data, {
+          sessionId,
+        });
+      }
+    } catch (error) {
+      approvalGrantPersistenceError = error;
+      ledgerState.ledger = new ApprovalGrantLedger({ sessionId });
+      interaction.emit?.("recovery-degraded", {
+        component: "approval_grants",
+        error:
+          "Persisted approval grants could not be verified; all grants were discarded",
+      });
+    }
+    const persistApprovalGrants = () => {
+      if (approvalGrantPersistenceError) return false;
+      try {
+        const persisted = store.appendAuthorityEvent(
+          sessionId,
+          APPROVAL_GRANTS_EVENT,
+          ledgerState.ledger.toJSON(),
+        );
+        if (persisted === false) {
+          throw new Error("session store rejected approval grants");
+        }
+        return true;
+      } catch (error) {
+        approvalGrantPersistenceError = error;
+        return false;
+      }
+    };
     const confirmer =
-      deps.confirmer || buildWsApprovalConfirmer({ interaction, sessionId });
+      deps.confirmer ||
+      buildWsApprovalConfirmer({
+        interaction,
+        sessionId,
+        cwd,
+        ledgerState,
+        persistApprovalGrants,
+      });
     const gate = new core.ApprovalGate({
       defaultPolicy: core.APPROVAL_POLICY?.STRICT || "strict",
       confirm: confirmer,
@@ -129,6 +261,39 @@ export async function createWsApprovalGate({
       getSessionPolicy: (sid) => inner.getSessionPolicy(sid || sessionId),
       setSessionPolicy: (sid, policy) =>
         inner.setSessionPolicy(sid || sessionId, policy),
+      beginTurn: (turnId) => ledgerState.ledger.beginTurn(turnId),
+      listGrants: () => ledgerState.ledger.listGrants(),
+      revokeGrant: (grantId) => {
+        const existing = ledgerState.ledger
+          .listGrants()
+          .find((grant) => grant.grantId === String(grantId || ""));
+        if (!existing) {
+          return { success: false, error: "Approval grant was not found" };
+        }
+        if (existing.lifetime === "turn") {
+          const result = ledgerState.ledger.revoke(grantId);
+          return { success: result.revoked, grant: result.grant };
+        }
+
+        const candidate = ApprovalGrantLedger.fromJSON(
+          ledgerState.ledger.toJSON(),
+          { sessionId },
+        );
+        const result = candidate.revoke(grantId);
+        if (!result.revoked) {
+          return { success: false, error: "Approval grant was not found" };
+        }
+        const previous = ledgerState.ledger;
+        ledgerState.ledger = candidate;
+        if (!persistApprovalGrants()) {
+          ledgerState.ledger = previous;
+          return {
+            success: false,
+            error: "Approval grant revocation could not be persisted",
+          };
+        }
+        return { success: true, grant: result.grant };
+      },
     };
   } catch {
     return null; // degrade to the legacy no-gate path

package/src/gateways/ws/ws-server.js

@@ -53,6 +53,8 @@ import {
   handleSessionClose,
   handleSessionInterrupt,
   handleSessionAnswer,
+  handleApprovalGrantsList,
+  handleApprovalGrantRevoke,
   handleHostToolResult,
   handleSubAgentList,
   handleSubAgentGet,
@@ -746,9 +748,8 @@ export class ChainlessChainWSServer extends EventEmitter {
   /** Read the same static + scoped authority used by the Agent Core. */
   async _handlePermissionRulesGet(id, ws) {
     try {
-      const { loadPermissionAuthority } = await import(
-        "../../lib/permission-authority.js"
-      );
+      const { loadPermissionAuthority } =
+        await import("../../lib/permission-authority.js");
       const loaded = loadPermissionAuthority({ cwd: this.projectRoot });
       this._send(ws, {
         id,
@@ -1416,6 +1417,16 @@ export class ChainlessChainWSServer extends EventEmitter {
     return handleSessionAnswer(this, id, ws, message);
   }
 
+  /** @private */
+  _handleApprovalGrantsList(id, ws, message) {
+    return handleApprovalGrantsList(this, id, ws, message);
+  }
+
+  /** @private */
+  _handleApprovalGrantRevoke(id, ws, message) {
+    return handleApprovalGrantRevoke(this, id, ws, message);
+  }
+
   _handleHostToolResult(id, ws, message) {
     return handleHostToolResult(this, id, ws, message);
   }
@@ -1498,9 +1509,8 @@ export class ChainlessChainWSServer extends EventEmitter {
   /** @private — ping/pong heartbeat to detect dead connections */
   async _ensureTaskManager() {
     if (this._taskManager) return this._taskManager;
-    const { BackgroundTaskManager } = await import(
-      "../../harness/background-task-manager.js"
-    );
+    const { BackgroundTaskManager } =
+      await import("../../harness/background-task-manager.js");
     this._taskManager = new BackgroundTaskManager({
       recoverOnStart: true,
       policyCwd: this.projectRoot,