create-walle 0.9.30 → 0.9.32

package/template/claude-task-manager/approval-agent.js

@@ -13,6 +13,7 @@ const { commandHead } = require('./lib/escalation-review');
 const { callBackgroundLlm } = require('./lib/background-llm');
 const { verifyIfEnabled } = require('./lib/auto-approval-verifier');
 const { matchPermission } = require('./lib/permission-match');
+const mcpRisk = require('./lib/mcp-risk');
 const approvalAiRefinement = require('./lib/approval-ai-refinement');
 
 // Dangerous-command blocklist: when enabled, any command matching
@@ -250,6 +251,24 @@ function getApproveKeystroke(context, options = {}) {
   return context.hasAllowAll ? '2' : '1';
 }
 
+// Fallback tool-name derivation when no tool header is recognized above the
+// prompt: read it from the durable grant option ("Yes, and don't ask again for
+// <X> commands in <dir>" / "Yes, allow reading from <dir>") so an unrecognized
+// tool is still targetable by a heuristic/learned rule instead of collapsing to
+// 'Unknown'. `lines` is the trimmed, non-empty line array; `proceedIdx` the
+// "Do you want to…?" line. Pure.
+function _toolNameFromDurableOption(lines, proceedIdx) {
+  for (let i = proceedIdx + 1; i < Math.min(proceedIdx + 8, lines.length); i++) {
+    const l = String(lines[i] || '');
+    const m = l.match(/don'?t ask again for\s+(.+?)\s+commands?\b/i);
+    if (m && m[1]) return m[1].trim();
+    if (/allow\s+reading\s+from\b/i.test(l)) return 'Read';
+    const a = l.match(/allow\s+all\s+(\w+)\b/i);
+    if (a && a[1]) return a[1].trim();
+  }
+  return '';
+}
+
 function _parseGenericApprovalContext(cleanText, providerId) {
   const lines = String(cleanText || '').split('\n').map(l => l.trim()).filter(Boolean);
   if (!lines.length) return null;
@@ -284,12 +303,16 @@ function _parseGenericApprovalContext(cleanText, providerId) {
   const contextLines = [];
   for (let i = proceedIdx - 1; i >= Math.max(0, proceedIdx - 30); i--) {
     const line = lines[i];
-    if (/^[⏺●]?\s*(Bash command|Bash|Edit|Write|Read|Glob|Grep|Fetch|WebFetch|NotebookEdit|TodoWrite|Agent|MCP)\b/i.test(line)) {
+    if (/^[⏺●]?\s*(Bash command|Bash|Edit|Write|Read|Glob|Grep|Fetch|WebFetch|Web ?Search|NotebookEdit|TodoWrite|Agent|MCP)\b/i.test(line)) {
       toolName = line.trim();
       break;
     }
     contextLines.unshift(line);
   }
+  if (toolName === 'Generic approval') {
+    const durable = _toolNameFromDurableOption(lines, proceedIdx);
+    if (durable) toolName = durable;
+  }
 
   const fullContext = lines.slice(Math.max(0, proceedIdx - 20), Math.min(lines.length, proceedIdx + 12)).join('\n');
   return {
@@ -373,7 +396,7 @@ function parseApprovalContext(cleanText, providerId) {
   for (let i = endIdx - 1; i >= Math.max(0, endIdx - 30); i--) {
     const line = lines[i];
     // Detect tool headers (Claude Code shows "Bash command", "⏺ Bash(...)", "Edit", etc.)
-    if (/^[⏺●]?\s*(Bash command|Bash|Edit|Write|Read|Glob|Grep|Fetch|WebFetch|NotebookEdit|TodoWrite|Agent)\b/.test(line)) {
+    if (/^[⏺●]?\s*(Bash command|Bash|Edit|Write|Read|Glob|Grep|Fetch|WebFetch|Web ?Search|NotebookEdit|TodoWrite|Agent)\b/.test(line)) {
       toolName = line.trim();
       break;
     }
@@ -403,6 +426,10 @@ function parseApprovalContext(cleanText, providerId) {
     if (fileOp) { toolName = fileOp.toolName; fileOpCommand = fileOp.command; }
   }
 
+  // Still no header → derive a name from the durable grant option so the tool is
+  // targetable instead of 'Unknown' (mirror of the claude-code provider path).
+  if (!toolName) toolName = _toolNameFromDurableOption(lines, proceedIdx);
+
   // Bash approvals render the command followed by one dimmed prose description
   // line; drop it from the command so titles/signatures stay command-shaped
   // (mirror of the claude-code provider parse path).
@@ -586,6 +613,17 @@ function cardTextFingerprint(cleanText) {
 function normalizeCommandSignature(toolName, command) {
   const tool = (toolName || '').replace(/^[⏺●\s]+/, '').trim();
   const cmd = (command || '').trim();
+
+  // Network-access approvals: the HOST is the meaningful, granular unit, so keep it
+  // in the signature ("network <host>"). Otherwise the non-Bash branch below would
+  // collapse every host to the bare tool name 'network' → one all-hosts group and a
+  // dangerously broad Network(*) rule. Runs before the empty-cmd guard so a host that
+  // only survives in the synthesized command is still captured.
+  if (/^network\b/i.test(tool)) {
+    const host = (cmd.match(/[a-z0-9-]+(?:\.[a-z0-9-]+)+/i) || [])[0];
+    return host ? `network ${host.toLowerCase()}` : 'network';
+  }
+
   if (!cmd) return tool.toLowerCase();
 
   // For non-Bash tools (Edit, Write, Read, etc.), signature is just the tool name
@@ -878,29 +916,121 @@ function _buildSessionContext(session) {
   return { goal, cwd };
 }
 
+// Hard ceiling on the auto-approval verifier's LLM round-trip. The inner builtin
+// verifier already has its own ~20s budget (lib/auto-approval-verifier BUILTIN_TIMEOUT_MS)
+// and the Wall-E status fetch a 2.5s AbortSignal — but the await at the call sites had no
+// overall guard, so a provider that ignores its abort signal could strand a live approval
+// prompt indefinitely (the symptom behind the stuck Codex `search_code` banner). This sits
+// just above the inner budget: it normally never fires (the inner timeout wins, preserving
+// the verifier verdict) and only trips on a true hang.
+const VERIFIER_OVERALL_TIMEOUT_MS = 25_000;
+
+// Resolve `promise`, but never settle later than `ms`. On timeout OR rejection, resolve to
+// `fallback`. The verifier is fail-OPEN (a disabled/unknown verdict → approve), so the safe
+// fallback for a wedged verifier is the same "no block" sentinel — a stuck banner is worse
+// than approving a medium-risk op the blocklist already cleared.
+function _withTimeout(promise, ms, fallback) {
+  let timer;
+  const guard = new Promise((resolve) => { timer = setTimeout(() => resolve(fallback), ms); });
+  return Promise.race([
+    Promise.resolve(promise).then(
+      (v) => { clearTimeout(timer); return v; },
+      () => { clearTimeout(timer); return fallback; },
+    ),
+    guard,
+  ]);
+}
+
+// Verifier posture (proposal P-E). The LLM verifier is fail-OPEN by design — when
+// it can't produce a confident "unsafe" verdict (disabled, timeout, errored,
+// 'unknown') the approval proceeds. That is correct for the bounded-blast-radius
+// MEDIUM tier, but for HIGH-risk commands it means "approved blind" whenever the
+// verifier can't vouch — which is exactly what happens to Codex sessions where the
+// background verifier ~100% times out. So HIGH risk fails CLOSED: unless the
+// verifier POSITIVELY cleared it (enabled + verdict==='safe'), escalate to the
+// human instead of auto-approving. The dangerous-command blocklist remains the
+// deterministic hard gate above all of this; this is the second net for the
+// high-risk heuristic patterns (rm -rf /, --force, drop table, sudo, dd, …).
+function _highRiskNeedsHumanWhenUnverified(riskLevel, verifier) {
+  if (riskLevel !== 'high') return false;
+  const positivelyCleared = !!(verifier && verifier.enabled && verifier.verdict === 'safe');
+  return !positivelyCleared;
+}
+
+// Approval posture (proposal P-G) — one global knob over the UNCERTAIN MEDIUM tier
+// only. It NEVER weakens the hard floors: the dangerous-command blocklist, deny
+// rules, the HIGH-risk fail-closed gate (_highRiskNeedsHumanWhenUnverified), and
+// forced egress escalation all run regardless of posture. User-allowed commands and
+// learned-rule matches are explicit trust and are never held. Low risk always
+// auto-approves. So posture moves exactly one boundary: what to do with a
+// pure-heuristic ('auto') MEDIUM-risk action.
+//   - cautious   → hold it for the human (escalate) instead of fail-open approving
+//   - balanced   → today's behavior (verifier second-opinion, then approve)
+//   - autonomous → trust the heuristic and skip the LLM verifier round-trip for medium
+const APPROVAL_POSTURES = new Set(['cautious', 'balanced', 'autonomous']);
+function _approvalPosture() {
+  try {
+    if (!dbModule || typeof dbModule.getSetting !== 'function') return 'balanced';
+    const v = String(dbModule.getSetting('approval_posture', 'balanced') || 'balanced').toLowerCase();
+    return APPROVAL_POSTURES.has(v) ? v : 'balanced';
+  } catch { return 'balanced'; }
+}
+// Autonomous trusts the heuristic for MEDIUM and skips the (slower, sometimes
+// timing-out) LLM verifier. HIGH still runs it. decidedBy guards keep this to the
+// pure-heuristic tier.
+function _postureSkipsMediumVerifier(posture, riskLevel) {
+  return posture === 'autonomous' && riskLevel === 'medium';
+}
+// Cautious holds an uncertain MEDIUM for the human. Only the 'auto' (pure-heuristic)
+// tier — never a user-allow, a learned rule, low, or high.
+function _postureHoldsMedium(posture, riskLevel, decidedBy) {
+  return posture === 'cautious' && riskLevel === 'medium' && decidedBy === 'auto';
+}
+
 async function _verifyAutoApprovalOrBlock(sessionId, session, context, broadcastFn, label, source, riskLevel, callModel) {
   // Verifier scope: medium+ risk only. Clearly low-risk/read-only approvals skip
   // the LLM second opinion — keeps the fast path fast and usable offline.
   if (riskLevel && riskLevel !== 'medium' && riskLevel !== 'high') return null;
+  // Posture (P-G): autonomous trusts the heuristic for the medium tier and skips
+  // the verifier entirely (HIGH still runs it below). Cautious is handled after the
+  // verdict so it can hold an otherwise-approved medium.
+  const posture = _approvalPosture();
+  if (_postureSkipsMediumVerifier(posture, riskLevel) && source === 'auto') return null;
   // Attach the warm session-context packet (goal + cwd) so the built-in verifier
   // can judge GOAL-ALIGNMENT, not just the command in isolation. Single point —
   // covers both call sites (allow-by-default + approval-rescue). Never overwrite a
   // packet the caller already supplied.
   if (context && !context.sessionContext) context.sessionContext = _buildSessionContext(session);
-  const verifier = await verifyIfEnabled({ context, dbModule, callModel });
-  // Approve-by-default: ONLY a confident "unsafe" verdict blocks an auto-approval.
-  // A disabled verifier, a 'safe' verdict, or an 'unknown'/errored verdict (AI
-  // unavailable, timeout, bad response) all fall through to APPROVE. The approver
-  // escalates only when it is sure the command is high risk — never merely because
-  // the AI gate could not produce an answer. (The dangerous-command blocklist
-  // remains the deterministic hard gate above this.)
-  if (!verifier.enabled || verifier.verdict !== 'unsafe') return null;
+  // Fail-open if the verifier wedges: a disabled-shaped verdict ⇒ the guard below
+  // returns null ⇒ the approval proceeds, same as an 'unknown'/timeout verdict.
+  const verifier = await _withTimeout(
+    verifyIfEnabled({ context, dbModule, callModel }),
+    VERIFIER_OVERALL_TIMEOUT_MS,
+    { enabled: false },
+  );
+  // Escalate when EITHER (a) the verifier is confidently "unsafe", OR (b) the
+  // command is HIGH risk and the verifier could not positively clear it (P-E posture
+  // — see _highRiskNeedsHumanWhenUnverified). MEDIUM risk stays fail-open: a disabled
+  // verifier or an 'unknown'/timeout verdict falls through to APPROVE, so the fast
+  // path stays fast and usable offline. The dangerous-command blocklist remains the
+  // deterministic hard gate above this.
+  const isUnsafe = !!(verifier.enabled && verifier.verdict === 'unsafe');
+  const highRiskUnverified = !isUnsafe && _highRiskNeedsHumanWhenUnverified(riskLevel, verifier);
+  // Cautious posture: hold an otherwise-approved pure-heuristic MEDIUM for the human.
+  const cautiousHold = !isUnsafe && !highRiskUnverified && _postureHoldsMedium(posture, riskLevel, source);
+  if (!isUnsafe && !highRiskUnverified && !cautiousHold) return null;
 
   // Prefer the OBJECTIVE block reason (the category — e.g. "Runs arbitrary code
   // (node -e)") over the verifier's vague free-text, so the banner + Pending group
-  // tell the user WHY it was held. Fall back to the verifier's reason, then a default.
+  // tell the user WHY it was held. Fall back to the verifier's reason (unsafe case),
+  // a cautious-posture message, or the high-risk-unverified message, then a default.
   const blocked = classifyBlockReason(context);
-  const reason = blocked.reason || verifier.reason || 'Auto-approval verifier flagged this command as high risk.';
+  const reason = blocked.reason
+    || (isUnsafe
+      ? (verifier.reason || 'Auto-approval verifier flagged this command as high risk.')
+      : cautiousHold
+        ? 'Cautious posture — holding this medium-risk action for your approval.'
+        : 'High-risk command could not be automatically verified — approve once to allow it.');
   const parts = escalationCommandParts(context);
   // The group key the Permission "Pending" tab will bucket this under — same fn the
   // endpoint uses (lib/escalation-review.commandHead over the signature), so the
@@ -917,8 +1047,8 @@ async function _verifyAutoApprovalOrBlock(sessionId, session, context, broadcast
     warning: context.warning || '',
     decision: 'escalated',
     reasoning: reason,
-    decidedBy: 'verifier',
-    riskLevel: 'high',
+    decidedBy: cautiousHold ? 'posture' : 'verifier',
+    riskLevel: cautiousHold ? 'medium' : 'high',
   };
   let decisionId;
   try { decisionId = dbModule.addApprovalDecision?.(decision); } catch (e) { console.error('[approval-agent] verifier DB error:', e.message); }
@@ -927,7 +1057,7 @@ async function _verifyAutoApprovalOrBlock(sessionId, session, context, broadcast
       type: 'approval-decision',
       sessionId,
       decision: 'escalated',
-      decidedBy: 'verifier',
+      decidedBy: cautiousHold ? 'posture' : 'verifier',
       decisionId,
       // Banner shows the actual command (matches the recorded commandSummary),
       // not the heuristic rule label.
@@ -939,7 +1069,7 @@ async function _verifyAutoApprovalOrBlock(sessionId, session, context, broadcast
       groupKey,
       riskLevel: decision.riskLevel,
       verifierSource: source || '',
-      verifierVerdict: verifier.verdict,
+      verifierVerdict: verifier.verdict || (highRiskUnverified ? 'unverified' : ''),
       command: String(context.command || '').slice(0, 500),
       warning: context.warning || '',
     });
@@ -1125,6 +1255,55 @@ function _isDevCleanupCommand(cmd) {
   return sawKill || sawTmpRm;
 }
 
+// Network egress is a genuine security boundary (a confused/compromised agent can
+// exfiltrate to any host), so it is NOT blanket-approved. Only a small allowlist of
+// the agent's OWN provider backends auto-approves — stalling Codex on OpenAI's own
+// infra (e.g. ab.chatgpt.com) is pure friction with no egress benefit. Every other
+// host force-escalates to a granular, one-click Network(<host>) Pending rule the user
+// approves once. Suffix match so subdomains of an allowlisted apex are covered.
+// EDIT THIS LIST to broaden/narrow the auto-approved egress set.
+const NETWORK_ALLOWLIST = ['chatgpt.com', 'openai.com', 'oaistatic.com', 'oaiusercontent.com'];
+function isAllowedNetworkHost(host) {
+  const h = String(host || '').toLowerCase().trim().replace(/:\d+$/, '').replace(/\.$/, '');
+  if (!h) return false;
+  return NETWORK_ALLOWLIST.some((d) => h === d || h.endsWith('.' + d));
+}
+// Pull a hostname out of a Codex network-access prompt's question/reason text — used
+// as a fallback when the provider did not already extract context.networkHost.
+function extractNetworkHost(text) {
+  const s = String(text || '');
+  let m = s.match(/network access to ['"]?([a-z0-9.-]+\.[a-z]{2,})['"]?/i)
+    || s.match(/([a-z0-9.-]+\.[a-z]{2,})\s+is\s+not\s+in\s+the\s+allowed[_ ]?domains/i)
+    || s.match(/\b([a-z0-9-]+(?:\.[a-z0-9-]+)+\.[a-z]{2,})\b/i)
+    || s.match(/\b([a-z0-9-]+\.[a-z]{2,})\b/i);
+  return m ? m[1].toLowerCase().replace(/[.'"]+$/, '') : '';
+}
+
+// Refresh the shared MCP annotation registry (lib/mcp-risk) from the persisted
+// `mcp_tool_annotations` setting so authoritative read/write classifications
+// override the verb heuristic. TTL-cached (and change-gated) so the hot approval
+// path doesn't re-read/re-parse every call; tolerant of a missing db or bad JSON
+// (leaves the registry as-is). An ABSENT setting is a no-op — only an explicit
+// value (e.g. `{}` to clear) replaces the registry. Shared by every decision path
+// because they all funnel through reviewWithHeuristics.
+const MCP_ANNO_TTL_MS = 5000;
+let _mcpAnnoRaw;
+let _mcpAnnoAt = 0;
+function _refreshMcpAnnotations() {
+  try {
+    if (!dbModule || typeof dbModule.getSetting !== 'function') return;
+    const now = Date.now();
+    if (now - _mcpAnnoAt < MCP_ANNO_TTL_MS) return;
+    _mcpAnnoAt = now;
+    const raw = dbModule.getSetting('mcp_tool_annotations', null);
+    if (raw === _mcpAnnoRaw) return; // unchanged since last load
+    _mcpAnnoRaw = raw;
+    if (raw == null) return; // absent → leave the registry untouched
+    const parsed = typeof raw === 'string' ? JSON.parse(raw) : raw;
+    mcpRisk.loadAnnotations(parsed);
+  } catch { /* keep whatever is registered; never block a decision on this */ }
+}
+
 // Simple heuristic review when no API key is available
 function reviewWithHeuristics(context) {
   const cmd = (context.command || '').toLowerCase();
@@ -1150,9 +1329,19 @@ function reviewWithHeuristics(context) {
   // "mcp__…" / "(mcp)" command text.
   const isMcp = /^(?:plugin:|mcp__|mcp\b)/i.test(tool) || /\(mcp\)/i.test(cmd);
   if (isMcp) {
-    const readOnlyMcp = /\b(navigate(?:_back)?|snapshot|take_screenshot|screenshot|read|list|get|query|search|console_messages|network_requests?|wait_for|hover|tabs|resolve[-_ ]library[-_ ]id|get[-_ ]library[-_ ]docs|browser_snapshot|browser_navigate)\b/i;
-    const mutatingMcp = /\b(click|type|fill|drag|drop|file_upload|upload|run_code|evaluate|press_key|select_option|handle_dialog|write|create|delete|remove|update|send|post|install|deploy|exec)\b/i;
-    if (readOnlyMcp.test(tool) && !mutatingMcp.test(tool)) {
+    _refreshMcpAnnotations(); // pick up any persisted authoritative annotations
+    // Read/write classification lives in lib/mcp-risk (shared with the MCP(...)
+    // permission-rule matcher so the two never drift) and is authoritative-first:
+    // a server's registered tool annotation wins, else the verb heuristic.
+    // Some providers (codex-mcp) emit a literal toolName='MCP' and carry the real tool
+    // verb in the structured `mcpTool` field, hiding it from a tool-name-only match — so
+    // a read-only `search_code` looked verb-less and fell through to the medium verifier
+    // path. Classify against the tool name PLUS `mcpTool` so the verb is visible wherever
+    // the provider put it. When mcpTool is absent (Claude's `mcp__…` ids already carry the
+    // verb in toolName), mcpTarget === tool, so nothing else changes.
+    const mcpTarget = context.mcpTool ? `${tool} ${String(context.mcpTool).toLowerCase()}` : tool;
+    const mcpClass = mcpRisk.classifyMcp({ server: context.mcpServer, tool: context.mcpTool, target: mcpTarget });
+    if (mcpClass === 'read') {
       return { decision: 'approve', reasoning: 'Read-only MCP operation (heuristic)', riskLevel: 'low',
         ruleLabel: context.toolName || 'MCP read-only operation',
         rulePattern: '',
@@ -1165,11 +1354,34 @@ function reviewWithHeuristics(context) {
       ruleDescription: 'Routed to AI reviewer/verifier for a decision' };
   }
 
+  // Network-access approvals (Codex "Do you want to approve network access to <host>?").
+  // Allowlisted provider-own hosts auto-approve (low). Every other host force-escalates
+  // to a granular, generalized Network(<host>) Pending rule — NOT to the LLM verifier,
+  // which can't reason about egress and would let it through when uncertain/down. The
+  // verifier is a fail-OPEN gate; egress must fail-CLOSED to the human.
+  if (/^network\b/.test(tool) || context.networkHost) {
+    const host = String(
+      context.networkHost || extractNetworkHost(context.command) || extractNetworkHost(context.warning),
+    ).toLowerCase();
+    if (host && isAllowedNetworkHost(host)) {
+      return { decision: 'approve', reasoning: `Network access to allowlisted host ${host} (heuristic)`, riskLevel: 'low',
+        ruleLabel: `Network access to ${host}`, rulePattern: `Network(${host})`,
+        ruleDescription: `Auto-approve network access to ${host}` };
+    }
+    return { decision: 'escalate', forceEscalate: true, riskLevel: 'medium',
+      reasoning: host
+        ? `Network access to ${host} is not on the egress allowlist — approve once to allow it for the future.`
+        : 'Network access requested — approve once to allow this host for the future.',
+      ruleLabel: host ? `Network access to ${host}` : 'Network access',
+      rulePattern: host ? `Network(${host})` : '',
+      ruleDescription: host ? `Allow network access to ${host}` : 'Allow network access' };
+  }
+
   // Low-risk tools — auto-approve immediately (before high-risk content check,
   // because Edit/Write diffs may contain code with "drop table" or "rm -rf" as
   // string literals — those are code content, not dangerous operations).
   const lowRisk = [
-    /^(read|glob|grep|webfetch|notebookedit)/, // Read-only tools
+    /^(read|glob|grep|webfetch|web ?search|notebookedit)/, // Read-only tools (incl. Web Search — read-only, no side effects, same tier as WebFetch)
     /^(edit|write)\b/, // Edit/Write to project files — normal dev workflow
   ];
   for (const re of lowRisk) {
@@ -2099,7 +2311,7 @@ async function decideApproval(context, session, options = {}) {
   // 2) Permission Manager rules (the user's explicit allow/deny).
   let permRules = [];
   try { permRules = typeof dbModule.listPermRules === 'function' ? dbModule.listPermRules({}) : []; } catch { permRules = []; }
-  const permMatch = matchPermission({ toolName: context.toolName, command }, permRules);
+  const permMatch = matchPermission({ toolName: context.toolName, command, mcpServer: context.mcpServer, mcpTool: context.mcpTool }, permRules);
   if (permMatch && permMatch.action === 'deny') {
     return {
       decision: 'ask', decidedBy: 'user-deny', riskLevel: 'high',
@@ -2127,13 +2339,39 @@ async function decideApproval(context, session, options = {}) {
     : matchingRule ? `Matched learned rule: ${matchingRule.label}`
     : 'Auto-approved by default (not on the denylist)';
 
+  // 3b) Heuristic-forced escalation (e.g. un-allowlisted network egress) — ask the
+  //     human deterministically, before the fail-open verifier, with the granular
+  //     Network(<host>) rule pre-suggested.
+  if (!userAllowed && !matchingRule && heuristic && heuristic.forceEscalate) {
+    return {
+      decision: 'ask', decidedBy: 'heuristic', riskLevel: heuristic.riskLevel || 'medium',
+      reason: heuristic.reasoning || 'Needs review before allowing.',
+      label: heuristic.ruleLabel || context.toolName,
+      suggestedRule: heuristic.rulePattern || '',
+    };
+  }
+
   // 4) Goal-aligned verifier — medium+ risk only; user-allowed commands skip it
   //    (the user has explicitly vouched). Only a confident "unsafe" verdict
   //    escalates; a disabled/safe/unknown verdict falls through to allow.
-  if (!userAllowed && (riskLevel === 'medium' || riskLevel === 'high')) {
+  //    Posture (P-G): autonomous trusts the heuristic for medium and skips the
+  //    verifier (HIGH still runs it); cautious is applied after, on the medium
+  //    fall-through, so it can hold an otherwise-approved action.
+  const posture = _approvalPosture();
+  const runVerifier = !userAllowed
+    && (riskLevel === 'high' || (riskLevel === 'medium' && !_postureSkipsMediumVerifier(posture, riskLevel)));
+  if (runVerifier) {
     if (context && !context.sessionContext) context.sessionContext = _buildSessionContext(session);
+    // Bounded like the live-path verifier (see _withTimeout / VERIFIER_OVERALL_TIMEOUT_MS):
+    // a wedged background model must not strand this approval. Fail-open on timeout/error.
     let verifier = { enabled: false, verdict: 'unknown' };
-    try { verifier = await verifyIfEnabled({ context, dbModule, callModel }); } catch { verifier = { enabled: false, verdict: 'unknown' }; }
+    try {
+      verifier = await _withTimeout(
+        verifyIfEnabled({ context, dbModule, callModel }),
+        VERIFIER_OVERALL_TIMEOUT_MS,
+        { enabled: false, verdict: 'unknown' },
+      );
+    } catch { verifier = { enabled: false, verdict: 'unknown' }; }
     if (verifier.enabled && verifier.verdict === 'unsafe') {
       const blocked = classifyBlockReason(context);
       return {
@@ -2142,6 +2380,32 @@ async function decideApproval(context, session, options = {}) {
         blockCategory: blocked.category || '', verifierVerdict: verifier.verdict, label,
       };
     }
+    // P-E posture: HIGH risk the verifier could not positively clear (disabled /
+    // timeout / unknown) fails CLOSED — ask the human rather than approve blind.
+    // MEDIUM falls through to allow (bounded blast radius). Mirrors the live-path
+    // _verifyAutoApprovalOrBlock so both entrypoints share one posture.
+    if (_highRiskNeedsHumanWhenUnverified(riskLevel, verifier)) {
+      const blocked = classifyBlockReason(context);
+      return {
+        decision: 'ask', decidedBy: 'heuristic', riskLevel: 'high',
+        reason: blocked.reason
+          || (heuristic && heuristic.reasoning)
+          || 'High-risk command could not be automatically verified — approve once to allow it.',
+        blockCategory: blocked.category || '', verifierVerdict: verifier.verdict || 'unverified',
+        label, suggestedRule: (heuristic && heuristic.rulePattern) || '',
+      };
+    }
+  }
+
+  // Posture (P-G): cautious holds an otherwise-approved pure-heuristic MEDIUM for
+  // the human. Runs after every hard gate (blocklist/deny/high-fail-closed) and
+  // never touches user-allow / learned-rule / low decisions.
+  if (_postureHoldsMedium(posture, riskLevel, decidedBy)) {
+    return {
+      decision: 'ask', decidedBy: 'posture', riskLevel: 'medium',
+      reason: 'Cautious posture — holding this medium-risk action for your approval.',
+      label, suggestedRule: (heuristic && heuristic.rulePattern) || '',
+    };
   }
 
   return {
@@ -2225,7 +2489,7 @@ async function handleApprovalCheck(sessionId, session, cleanText, broadcastFn, p
   // verifier (the user has explicitly vouched for it).
   let permRules = [];
   try { permRules = typeof dbModule.listPermRules === 'function' ? dbModule.listPermRules({}) : []; } catch { permRules = []; }
-  const permMatch = matchPermission({ toolName: context.toolName, command: context.command }, permRules);
+  const permMatch = matchPermission({ toolName: context.toolName, command: context.command, mcpServer: context.mcpServer, mcpTool: context.mcpTool }, permRules);
   if (permMatch && permMatch.action === 'deny') {
     const reasoning = `Permission Manager deny rule matched: ${permMatch.rule}`;
     try {
@@ -2270,6 +2534,37 @@ async function handleApprovalCheck(sessionId, session, cleanText, broadcastFn, p
     : matchingRule ? `Matched learned rule: ${matchingRule.label}`
     : 'Auto-approved by default (not on the denylist)';
 
+  // Heuristic-forced escalation (e.g. un-allowlisted network egress): route straight
+  // to the Pending "Needs Review" surface as a granular, generalized rule the user can
+  // approve once. Deterministic — does NOT depend on the fail-open LLM verifier, which
+  // could let an un-vouched host through when uncertain or down.
+  if (!userAllowed && !matchingRule && heuristic && heuristic.forceEscalate) {
+    const parts = escalationCommandParts(context);
+    const groupKey = (() => { try { return commandHead(parts.signature) || ''; } catch { return ''; } })();
+    const escReason = heuristic.reasoning || 'Needs review before allowing.';
+    const escRisk = heuristic.riskLevel || 'medium';
+    // Prefer the heuristic's human label (e.g. "Network access to <host>") over the
+    // bare operative command (the host) so the Pending row reads as a category.
+    const escLabel = heuristic.ruleLabel || parts.title || context.toolName || 'Approval needs review';
+    let decisionId;
+    try {
+      decisionId = dbModule.addApprovalDecision({
+        sessionId, toolName: context.toolName,
+        commandSummary: escLabel,
+        fullContext: context.fullContext.slice(0, 2000), warning: context.warning,
+        decision: 'escalated', reasoning: escReason, decidedBy: 'heuristic', riskLevel: escRisk,
+        commandSignature: parts.signature || commandSignature,
+      });
+    } catch (e) { console.error('[approval-agent] DB error:', e.message); }
+    broadcastFn(sessionId, session, {
+      type: 'approval-decision', sessionId, decision: 'escalated', decidedBy: 'heuristic', decisionId,
+      label: escLabel, reasoning: escReason, groupKey, riskLevel: escRisk,
+      suggestedRule: heuristic.rulePattern || '',
+      command: (context.command || '').slice(0, 500), warning: context.warning,
+    });
+    return true;
+  }
+
   if (!userAllowed) {
     // Verifier scope: medium+ risk only — read-only/low-risk ops auto-approve fast.
     const verifierBlock = await _verifyAutoApprovalOrBlock(sessionId, session, context, broadcastFn, label, decidedBy, riskLevel, callModel);
@@ -2309,6 +2604,8 @@ async function handleApprovalCheck(sessionId, session, cleanText, broadcastFn, p
 
 module.exports = {
   parseApprovalContext,
+  _refreshMcpAnnotations,
+  _resetMcpAnnotationCache: () => { _mcpAnnoAt = 0; _mcpAnnoRaw = undefined; },
   isLiveApprovalPrompt,
   isPlanApprovalPrompt,
   planCardFingerprint,
@@ -2323,6 +2620,7 @@ module.exports = {
   _isTmpScopedRmClause,
   _isPortScopedKillClause,
   _buildSessionContext,
+  _withTimeout,
   normalizeCommandSignature,
   escalationCommandParts,
   classifyBlockReason,