mixdog 1.2.6 → 1.3.0

package/src/runtime/agent/orchestrator/session/human-gate/requests.mjs

@@ -0,0 +1,195 @@
+// session/human-gate/requests.mjs
+// The data model of a human-in-the-loop prompt. A request has one `kind`:
+//   approval   — allow or deny one tool call;
+//   outbound   — a call that posts, sends, pays or deletes outside (its action
+//                kind, target, account, the exact payload text, which fields
+//                the card may edit, and the mail/payment/delete detail lines);
+//   secret     — the user types a value into a target field; the request names
+//                the target and the field label, never a value;
+//   takeover   — the user does a step themselves and says "done";
+//   permission — the user picks one of the offered scopes.
+// A response is one of HUMAN_RESPONSES plus a `remember` scope; a policy lists
+// the scopes it allows and can leave out `always`. Nothing here ever carries a
+// secret value: a decision that names one is stripped to its verdict.
+
+export const HUMAN_REQUEST_KINDS = Object.freeze(['approval', 'outbound', 'secret', 'takeover', 'permission']);
+export const HUMAN_RESPONSES = Object.freeze(['approve', 'deny', 'edit-and-approve', 'provide-secret', 'skip', 'done']);
+export const REMEMBER_SCOPES = Object.freeze(['once', 'agent', 'always']);
+export const SECRET_REQUEST_TIMEOUT_MS = 120_000;
+
+const RESPONSES_BY_KIND = Object.freeze({
+  approval: ['approve', 'deny'],
+  outbound: ['approve', 'edit-and-approve', 'deny'],
+  secret: ['provide-secret', 'skip'],
+  takeover: ['done', 'deny'],
+  permission: ['approve', 'deny'],
+});
+const GRANTING_RESPONSES = new Set(['approve', 'edit-and-approve', 'provide-secret', 'done']);
+const TEXT_LIMIT = 200;
+/** An outbound card's extra lines: mail headers, the payment, the delete, the
+ *  trash card's message list (gate.mjs describeEmails) and its remainder. */
+const DETAIL_FIELDS = [
+  'to',
+  'cc',
+  'subject',
+  'merchant',
+  'amount',
+  'currency',
+  'recurrence',
+  'count',
+  'size',
+  'messages',
+  'more',
+];
+const DETAIL_LIMITS = { messages: 1_000 };
+const PAYLOAD_LIMIT = 40_000;
+
+const isRecord = (value) => Boolean(value) && typeof value === 'object' && !Array.isArray(value);
+const text = (value, limit = TEXT_LIMIT) => (typeof value === 'string' ? value.trim().slice(0, limit) : '');
+
+/** The human kind of a request; anything else (ask_user's 'question', a
+ *  hook's bare ask) is an ordinary approval for responses. */
+export function humanRequestKind(request) {
+  return HUMAN_REQUEST_KINDS.includes(request?.kind) ? request.kind : 'approval';
+}
+
+/** A login takeover's sign-in page: https, or http on loopback only (a local
+ *  site); never embedded credentials. `{ url, origin }`, or null. */
+export function loginPageUrl(value) {
+  if (typeof value !== 'string' || !value.trim() || value.length > 2048) return null;
+  let parsed;
+  try {
+    parsed = new URL(value.trim());
+  } catch {
+    return null;
+  }
+  const host = parsed.hostname.replace(/^\[|\]$/g, '').toLowerCase();
+  const loopback =
+    host === 'localhost' || host.endsWith('.localhost') || host === '::1' || /^127(?:\.\d{1,3}){3}$/.test(host);
+  if (parsed.protocol !== 'https:' && !(parsed.protocol === 'http:' && loopback)) return null;
+  if (parsed.username || parsed.password) return null;
+  return { url: parsed.href, origin: parsed.origin };
+}
+
+function rememberScopes(value) {
+  const listed = Array.isArray(value) ? value.filter((scope) => REMEMBER_SCOPES.includes(scope)) : [];
+  return ['once', ...new Set(listed.filter((scope) => scope !== 'once'))];
+}
+
+/** The kind-specific fields of a request, whitelisted. Spread onto the
+ *  presented request; `args` is replaced for a secret so no value rides it. */
+export function humanRequestFields(input = {}) {
+  const kind = input?.kind;
+  if (!HUMAN_REQUEST_KINDS.includes(kind)) return {};
+  const fields = { remember: rememberScopes(input.remember) };
+  // The agent the request acts for (its name on the card and the remembered grant).
+  if (text(input.agentId)) fields.agentId = text(input.agentId);
+  if (kind === 'outbound' && isRecord(input.outbound)) {
+    const outbound = input.outbound;
+    const details = isRecord(outbound.details) ? outbound.details : {};
+    fields.outbound = {
+      category: text(outbound.category),
+      target: text(outbound.target),
+      account: text(outbound.account),
+      payload: typeof outbound.payload === 'string' ? outbound.payload.slice(0, PAYLOAD_LIMIT) : '',
+      editable: Array.isArray(outbound.editable) ? outbound.editable.filter((name) => typeof name === 'string') : [],
+      details: Object.fromEntries(
+        DETAIL_FIELDS.filter((name) => text(details[name])).map((name) => [
+          name,
+          text(details[name], DETAIL_LIMITS[name]),
+        ])
+      ),
+    };
+  }
+  if (kind === 'secret') {
+    const secret = isRecord(input.secret) ? input.secret : {};
+    fields.secret = {
+      requestId: text(secret.requestId),
+      surface: secret.surface === 'computer' ? 'computer' : 'browser',
+      target: text(secret.target),
+      field: text(secret.field),
+    };
+    fields.args = { surface: fields.secret.surface, target: fields.secret.target, field: fields.secret.field };
+    fields.remember = ['once'];
+  }
+  if (kind === 'takeover') {
+    const takeover = isRecord(input.takeover) ? input.takeover : {};
+    const surface = takeover.surface === 'computer' ? 'computer' : 'browser';
+    // The window it is about (ask-user-tool-defs.mjs handoffIdentity): a
+    // browser page ID, or a computer window id and app, so the card can bring
+    // exactly that window forward on the user's click.
+    const token = (value, limit) => (/^[\w.:#@-]+$/.test(text(value, limit)) ? text(value, limit) : '');
+    const identity =
+      surface === 'browser'
+        ? { ...(token(takeover.tab, 64) ? { tab: token(takeover.tab, 64) } : {}) }
+        : {
+            ...(token(takeover.windowId, 128) ? { windowId: token(takeover.windowId, 128) } : {}),
+            ...(text(takeover.app, 120) ? { app: text(takeover.app, 120) } : {}),
+          };
+    // A login takeover (purpose 'login') opens the desktop's sign-in window on
+    // its validated page instead of handing over the side panel.
+    const login = surface === 'browser' && takeover.purpose === 'login' ? loginPageUrl(takeover.url) : null;
+    fields.takeover = {
+      surface,
+      instructions: text(takeover.instructions, 2_000),
+      ...(text(takeover.target) ? { target: text(takeover.target) } : {}),
+      ...identity,
+      ...(login ? { purpose: 'login', url: login.url, origin: login.origin } : {}),
+    };
+    fields.remember = ['once'];
+  }
+  if (kind === 'permission') {
+    const scopes = Array.isArray(input.permission?.scopes) ? input.permission.scopes : [];
+    fields.permission = {
+      scopes: scopes
+        .filter((scope) => isRecord(scope) && text(scope.id))
+        .map((scope) => ({ id: text(scope.id), label: text(scope.label) || text(scope.id) })),
+    };
+  }
+  return fields;
+}
+
+/** Only `editable` string fields of `editedArgs`; {} when nothing applies. */
+function editableArgs(editedArgs, editable) {
+  if (!isRecord(editedArgs)) return {};
+  const out = {};
+  for (const name of editable || []) {
+    if (typeof editedArgs[name] === 'string') out[name] = editedArgs[name].slice(0, PAYLOAD_LIMIT);
+  }
+  return out;
+}
+
+/**
+ * The canonical response to `request` from a decision: `approved` (the card's
+ * polarity) plus optional `{ response, editedArgs, remember, scope }`. An
+ * unknown or contradicting response falls back to the polarity's default;
+ * edits survive only on an outbound request and only for its editable fields;
+ * `remember` only when the request allows it and the call was granted.
+ */
+export function normalizeHumanResponse(request, approved, extra = {}) {
+  const kind = humanRequestKind(request);
+  const allowed = RESPONSES_BY_KIND[kind];
+  const polarity = approved === true;
+  const fallback = polarity ? allowed[0] : allowed[allowed.length - 1];
+  const asked = isRecord(extra) && allowed.includes(extra.response) ? extra.response : '';
+  let response = asked && GRANTING_RESPONSES.has(asked) === polarity ? asked : fallback;
+  const result = { approved: polarity, response };
+  if (response === 'edit-and-approve') {
+    const edits = editableArgs(extra.editedArgs, request?.outbound?.editable);
+    if (Object.keys(edits).length) result.editedArgs = edits;
+    else response = result.response = 'approve';
+  }
+  const scopes = Array.isArray(request?.remember) ? request.remember : ['once'];
+  result.remember = polarity && scopes.includes(extra?.remember) ? extra.remember : 'once';
+  if (kind === 'permission' && polarity) {
+    const ids = (request?.permission?.scopes || []).map((scope) => scope.id);
+    if (ids.includes(extra?.scope)) result.scope = extra.scope;
+  }
+  return result;
+}
+
+/** `args` with the card's edited fields in place of the model's. */
+export function applyEditedArgs(args, editedArgs, editable) {
+  const edits = editableArgs(editedArgs, editable);
+  return Object.keys(edits).length ? { ...(isRecord(args) ? args : {}), ...edits } : args;
+}

package/src/runtime/agent/orchestrator/session/human-gate/store.mjs

@@ -0,0 +1,167 @@
+// session/human-gate/store.mjs
+// Per-agent permissions and the decision audit, both under the plugin data dir.
+// A grant is keyed by agent + action kind (outbound-policy.mjs ACTION_KINDS)
+// and says `allow` (never ask: "다시 묻지 않기") or `block` (deny without a
+// card); no grant means ask. `agent` scope names the agent, `always` stands for
+// every agent ('*'), and an agent's own grant wins over an every-agent one;
+// `once` is never stored. Payments and deletes are never allowed. Grants are
+// listed and revoked by id. The audit is one JSONL line per decision with
+// agent, kind, action, tool, target, decision, deciding device and time —
+// never a value, an argument or a payload — read back newest first.
+import { createHash } from 'node:crypto';
+import { appendFile, mkdir, readFile } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { parseJsonText, updateJsonAtomic } from '../../../../shared/atomic-file.mjs';
+import { ACTION_KINDS, isRememberableAction } from './outbound-policy.mjs';
+
+const ANY_AGENT = '*';
+const FIELD_LIMIT = 200;
+const AUDIT_KEYS = ['agentId', 'kind', 'action', 'tool', 'target', 'decision', 'device'];
+export const PERMISSION_MODES = Object.freeze(['ask', 'allow', 'block']);
+
+const field = (value) => String(value ?? '').slice(0, FIELD_LIMIT);
+const grantId = (agentId, action) =>
+  `grant_${createHash('sha256').update(`${agentId}\n${action}`).digest('hex').slice(0, 24)}`;
+const isGrant = (row) => ACTION_KINDS.includes(row?.action) && (row.mode === 'allow' || row.mode === 'block');
+
+export function createHumanGateStore(directory) {
+  const grantsFile = join(directory, 'grants.json');
+  const auditFile = join(directory, 'audit.jsonl');
+  const grantsOf = (doc) => (Array.isArray(doc?.grants) ? doc.grants.filter(isGrant) : []);
+  async function readGrants() {
+    try {
+      return grantsOf(parseJsonText(await readFile(grantsFile, 'utf8')));
+    } catch (error) {
+      if (error?.code === 'ENOENT') return [];
+      throw error;
+    }
+  }
+  async function updateGrants(mutate) {
+    await mkdir(directory, { recursive: true });
+    let result;
+    await updateJsonAtomic(grantsFile, (doc) => {
+      const out = mutate(grantsOf(doc));
+      if (!out) return undefined;
+      result = out.result;
+      return { grants: out.grants };
+    });
+    return result;
+  }
+  /** Set `agentId`'s mode for `action`; `ask` removes its grant. Returns the
+   *  grant, or null for `ask` and for an `allow` that may not exist. */
+  async function setMode({ agentId, action, mode, device = '' }) {
+    if (!ACTION_KINDS.includes(action) || !PERMISSION_MODES.includes(mode)) return null;
+    if (mode === 'allow' && !isRememberableAction(action)) return null;
+    const owner = field(agentId);
+    const id = grantId(owner, action);
+    const grant = mode === 'ask' ? null : { id, agentId: owner, action, mode, device: field(device), at: Date.now() };
+    await updateGrants((grants) => ({
+      grants: [...grants.filter((row) => row.id !== id), ...(grant ? [grant] : [])],
+      result: grant,
+    }));
+    return grant;
+  }
+  /** `allow`, `block` or `ask` for `agentId` + `action`; the agent's own grant wins. */
+  async function modeFor({ agentId, action }) {
+    const grants = (await readGrants()).filter((grant) => grant.action === action);
+    const own =
+      grants.find((grant) => grant.agentId === agentId) || grants.find((grant) => grant.agentId === ANY_AGENT);
+    if (own?.mode === 'allow' && !isRememberableAction(action)) return 'ask';
+    return own?.mode || 'ask';
+  }
+  return {
+    setMode,
+    modeFor,
+    /** Stores an `allow` for `agent`/`always` scope; `once` stores nothing. Returns the grant or null. */
+    async grant({ agentId, action, scope, device = '' }) {
+      if (scope !== 'agent' && scope !== 'always') return null;
+      return setMode({ agentId: scope === 'always' ? ANY_AGENT : agentId, action, mode: 'allow', device });
+    },
+    /** Every action kind with `agentId`'s mode, for the profile's permission table. */
+    async permissions(agentId) {
+      const out = [];
+      for (const action of ACTION_KINDS) {
+        out.push({ action, mode: await modeFor({ agentId, action }), rememberable: isRememberableAction(action) });
+      }
+      return out;
+    },
+    /** Grants that apply to `agentId` (its own and every-agent ones); all when omitted. */
+    async listGrants({ agentId } = {}) {
+      const grants = await readGrants();
+      return agentId ? grants.filter((grant) => grant.agentId === agentId || grant.agentId === ANY_AGENT) : grants;
+    },
+    async revokeGrant(id) {
+      return (
+        (await updateGrants((grants) => {
+          const rest = grants.filter((grant) => grant.id !== id);
+          return rest.length === grants.length ? null : { grants: rest, result: true };
+        })) === true
+      );
+    },
+    async recordAudit(entry) {
+      const line = { at: Number.isFinite(entry?.at) ? entry.at : Date.now() };
+      for (const key of AUDIT_KEYS) line[key] = field(entry?.[key]);
+      await mkdir(dirname(auditFile), { recursive: true });
+      await appendFile(auditFile, `${JSON.stringify(line)}\n`, 'utf8');
+      return line;
+    },
+    /** Newest first; `agentId` filters to one agent. */
+    async readAudit({ agentId = '', limit = 100 } = {}) {
+      let raw = '';
+      try {
+        raw = await readFile(auditFile, 'utf8');
+      } catch (error) {
+        if (error?.code === 'ENOENT') return [];
+        throw error;
+      }
+      const rows = [];
+      for (const line of raw.split('\n').reverse()) {
+        if (!line) continue;
+        try {
+          const row = JSON.parse(line);
+          if (!agentId || row.agentId === agentId) rows.push(row);
+        } catch {}
+        if (rows.length >= limit) break;
+      }
+      return rows;
+    },
+  };
+}
+
+let processStore = null;
+/** The process store under the plugin data dir; built on first use. */
+export async function humanGateStore() {
+  if (!processStore) {
+    const { getPluginData } = await import('../../config.mjs');
+    processStore = createHumanGateStore(join(getPluginData(), 'human-gate'));
+  }
+  return processStore;
+}
+
+function requiredAgentId(agentId) {
+  if (typeof agentId !== 'string' || !agentId.trim() || agentId.length > FIELD_LIMIT || agentId === ANY_AGENT) {
+    throw new Error('agent id is invalid');
+  }
+  return agentId;
+}
+
+/** The profile's "권한" table for `agentId` (capability getAgentPermissions). */
+export async function agentPermissions(agentId) {
+  return (await humanGateStore()).permissions(requiredAgentId(agentId));
+}
+
+/** Set one row of that table (capability setAgentPermission); returns the table. */
+export async function setAgentPermission(agentId, action, mode) {
+  const agent = requiredAgentId(agentId);
+  if (!ACTION_KINDS.includes(action)) throw new Error(`action must be one of ${ACTION_KINDS.join(', ')}`);
+  if (!PERMISSION_MODES.includes(mode)) throw new Error(`mode must be one of ${PERMISSION_MODES.join(', ')}`);
+  if (mode === 'allow' && !isRememberableAction(action)) throw new Error(`${action} always asks; it cannot be allowed`);
+  const store = await humanGateStore();
+  await store.setMode({ agentId: agent, action, mode });
+  return store.permissions(agent);
+}
+
+/** Replace the process store (tests); null restores the default. */
+export function setHumanGateStore(store) {
+  processStore = store || null;
+}

package/src/runtime/agent/orchestrator/session/loop/compact-policy.mjs

@@ -17,6 +17,7 @@ import { HANDOFF_TIMEOUT_MAX_MS } from '../compact/constants.mjs';
 import { envFlag, envPositiveInt } from '../../../../shared/env.mjs';
 import { positiveInt } from '../../../../shared/numbers.mjs';
 import { isAgentOwner } from '../../agent-owner.mjs';
+import { isAgentModeSession } from '../agent-mode.mjs';
 import { providerInputExcludesCache, providerNativePdf } from '../../providers/registry.mjs';
 import { contentMediaBytes, contentMediaCount } from '../../providers/media-normalization.mjs';
 import { splitProtectedContext } from '../compact/messages.mjs';
@@ -133,7 +134,8 @@ function effectiveContextWindowPercent(sessionRef, cfg) {
 export function resolveWorkerCompactPolicy(sessionRef, tools) {
   if (!sessionRef) return null;
   const cfg = sessionRef.compaction || {};
-  const auto = cfg.auto !== false && envFlag('MIXDOG_AGENT_COMPACT_AUTO', true);
+  // Agent mode always compacts on its own: the user is never asked to.
+  const auto = (cfg.auto !== false || isAgentModeSession(sessionRef)) && envFlag('MIXDOG_AGENT_COMPACT_AUTO', true);
   if (!auto) return { auto: false };
   const { contextWindow, boundaryTokens } = compactBoundaryFor(sessionRef, cfg);
   if (!boundaryTokens) return null;

package/src/runtime/agent/orchestrator/session/loop/pre-dispatch-deny.mjs

@@ -16,6 +16,7 @@ import { isOffReadonlySurface } from './deferred-call-through.mjs';
 import { BRIDGE_CALL_TOOL_NAME, bridgeErrorText, isToolBridgeEnabled } from '../../runtime-core/tool-bridge.mjs';
 import { sessionAllowlistExcludes, sessionDisallows } from '../../runtime-core/deferred-tool-availability.mjs';
 import { providerToolExclusionReason } from './provider-tool-exclusions.mjs';
+import { agentMcpToolPermission, projectMcpToolDisabled } from '../../mcp/agent-connectors.mjs';
 
 const WORKER_DENIED_TOOLS = new Set(['agent', 'ask_user', 'session']);
 const BRIDGE_DISCOVERY_TOOL_NAMES = new Set(['load_tool']);
@@ -122,6 +123,15 @@ export function preDispatchDenyForSession(sessionRef, call) {
   if (sessionDisallows(sessionRef, schemaName)) {
     return `Error: tool "${name}" is not available in this session.`;
   }
+  // An agent's connectors: a tool of a server it does not mount, or one set
+  // to `disabled`, stays refused though the process-wide registry knows it.
+  if (agentMcpToolPermission(sessionRef?.agent, schemaName) === 'disabled') {
+    return `Error: tool "${name}" is not available to this agent.`;
+  }
+  // The project the session runs in may switch a connector off as well.
+  if (projectMcpToolDisabled(sessionRef, schemaName)) {
+    return `Error: tool "${name}" is switched off in this project.`;
+  }
   if (isOffReadonlySurface(sessionRef, schemaName)) {
     return `Error: tool "${name}" is not available in this read-only session.`;
   }

package/src/runtime/agent/orchestrator/session/loop/send-phase.mjs

@@ -7,6 +7,7 @@ import { traceCacheBreak } from '../../cache-break-trace.mjs';
 import { resolveLiveToolCwd } from './tool-exec.mjs';
 import { notifySkillsApplied, prepareExplicitSkills, recordAppliedSkills } from '../explicit-skills.mjs';
 import { addUsage, usageDeltaEvent } from './usage.mjs';
+import { isVisibleStreamProgress } from '../../../../shared/stream-progress.mjs';
 import { prepareProviderRequest } from './request-boundary.mjs';
 import { applyStepEffort } from './step-auto-effort.mjs';
 import { projectProviderRequest } from './request-projection.mjs';
@@ -181,6 +182,15 @@ export async function sendProviderRequest(state, round) {
     tools: round.sendTools,
     opts,
   });
+  // The first visible token of this request, for its generation time (queue,
+  // preflight and time-to-first-token stay out of the speed figures).
+  let firstVisibleAt = 0;
+  const callerOnStreamDelta = opts.onStreamDelta;
+  const observeStreamDelta = (kind, ...rest) => {
+    if (!firstVisibleAt && isVisibleStreamProgress(kind)) firstVisibleAt = Date.now();
+    return callerOnStreamDelta?.(kind, ...rest);
+  };
+  opts.onStreamDelta = observeStreamDelta;
   let result;
   try {
     result = await runWithProviderRequestToolsScope(round.requestToolScope, () =>
@@ -208,15 +218,19 @@ export async function sendProviderRequest(state, round) {
     sideQuestion?.discard();
     if (!(await advanceAgentRoute(state, error))) throw error;
     result = { action: 'retry_route' };
+  } finally {
+    if (opts.onStreamDelta === observeStreamDelta) opts.onStreamDelta = callerOnStreamDelta;
   }
   if (result.action === 'proceed') sideQuestion?.settle(result.response);
   else sideQuestion?.discard();
+  const sendEndedAt = Date.now();
   return {
     result,
     providerMessages,
     prefixGuardCandidate,
     sendStartedAt,
-    sendEndedAt: Date.now(),
+    sendEndedAt,
+    generationMs: firstVisibleAt ? Math.max(0, sendEndedAt - firstVisibleAt) : 0,
     preSendMs,
     toolResumeMs,
   };
@@ -429,6 +443,7 @@ export function settleSendResult(state, round, sent) {
             usage: reportedUsage,
             sendTools: round.sendTools,
             toolCalls: response.toolCalls?.length || 0,
+            generationMs: sent.generationMs,
           })
         )
       );

package/src/runtime/agent/orchestrator/session/loop/tool-exec/before-hook.mjs

@@ -6,10 +6,16 @@ import { resolvePreToolAskApproval } from '../tool-helpers.mjs';
 import { runAbortable, throwIfAborted } from '../../../../../shared/abort-race.mjs';
 import { evaluateExecPolicy } from '../../../tools/bash-policy-scan.mjs';
 import { beginSessionApprovalWait } from '../../manager/runtime-liveness.mjs';
+import { agentMcpToolPermission } from '../../../mcp/agent-connectors.mjs';
+import { humanGateDecision, recordHumanDecision } from '../../human-gate/gate.mjs';
+import { applyEditedArgs } from '../../human-gate/requests.mjs';
 
 const isArgsObject = (value) => value && typeof value === 'object' && !Array.isArray(value);
 
-async function askApproval(call, { callerSessionId, executeOpts, toolApprovalHook, decision }) {
+async function askApproval(
+  call,
+  { callerSessionId, executeOpts, toolApprovalHook, decision, request = null, gate = null }
+) {
   const askReason = String(decision?.reason || 'approval requested by hook').trim();
   // While the user decides, the session is waiting on them, not working.
   const releaseApprovalWait = beginSessionApprovalWait(callerSessionId);
@@ -24,17 +30,45 @@ async function askApproval(call, { callerSessionId, executeOpts, toolApprovalHoo
         toolCallId: executeOpts.toolCallId || null,
         askReason,
         toolApprovalHook,
+        request,
       })
     );
   } finally {
     releaseApprovalWait();
   }
-  if (askOutcome.denial) return { denial: askOutcome.denial };
   const approval = askOutcome.approval;
+  await recordHumanDecision(gate, approval);
+  if (askOutcome.denial) return { denial: askOutcome.denial };
   if (approval && typeof approval === 'object' && isArgsObject(approval.args)) call.args = approval.args;
+  // The card's edited text replaces the model's before the call runs.
+  if (request?.kind === 'outbound' && approval?.editedArgs) {
+    call.args = applyEditedArgs(call.args, approval.editedArgs, request.outbound?.editable);
+  }
+  // The user approved this very call on the richer outbound card.
+  if (request?.kind === 'outbound') call.outboundApproved = true;
   return null;
 }
 
+export const CONNECTOR_APPROVAL_REASON = 'This connector tool is set to ask before it runs for this agent.';
+
+/**
+ * A connector tool the running agent set to `needs_approval` asks through the
+ * ordinary approval hook, whatever the PreToolUse hooks decided. Run after
+ * them, on the final call: a renamed call is judged under its final name.
+ * A call the outbound card already got approved is not asked a second time.
+ * @returns {Promise<{ denial: string } | null>} the denial, or null to run
+ */
+export function applyConnectorApproval(call, { agentId, callerSessionId, executeOpts, toolApprovalHook }) {
+  if (call.outboundApproved) return null;
+  if (agentMcpToolPermission(agentId, call.name) !== 'needs_approval') return null;
+  return askApproval(call, {
+    callerSessionId,
+    executeOpts,
+    toolApprovalHook,
+    decision: { reason: CONNECTOR_APPROVAL_REASON },
+  });
+}
+
 /**
  * Elevation pass for a shell call (or a terminal `run`) whose exec policy
  * decision is 'ask' (elevated launch). Runs after the final call is known.
@@ -62,22 +96,40 @@ export async function applyBeforeToolHook({
   executeOpts,
   beforeToolHook,
   toolApprovalHook,
+  mcpScopeId = null,
 }) {
   const call = { name, args, cwd };
   // ask_user is itself the user prompt; it never goes through the ordinary approval gate.
-  if (!beforeToolHook || name === 'ask_user') return call;
+  if (name === 'ask_user') return call;
   try {
-    const decision = await runAbortable(executeOpts.signal, () =>
-      beforeToolHook(
-        {
-          name,
-          args,
-          cwd,
-          sessionId: callerSessionId,
-          toolCallId: executeOpts.toolCallId || null,
-        },
-        { signal: executeOpts.signal }
-      )
+    const hookDecision = beforeToolHook
+      ? await runAbortable(executeOpts.signal, () =>
+          beforeToolHook(
+            {
+              name,
+              args,
+              cwd,
+              sessionId: callerSessionId,
+              toolCallId: executeOpts.toolCallId || null,
+            },
+            { signal: executeOpts.signal }
+          )
+        )
+      : null;
+    // Outbound sends ask the user whatever the hooks allowed (human-gate/gate.mjs).
+    // Judged as the call will run: only a rewriting decision changes name/args.
+    const hookAction = String(hookDecision?.action || hookDecision?.decision || '').toLowerCase();
+    const rewritten = hookAction === 'ask' || hookAction === 'modify' || hookAction === 'rewrite';
+    const { decision, request, gate } = await humanGateDecision(
+      {
+        name:
+          rewritten && typeof hookDecision?.name === 'string' && hookDecision.name.trim()
+            ? hookDecision.name.trim()
+            : name,
+        args: rewritten && isArgsObject(hookDecision?.args) ? hookDecision.args : args,
+      },
+      hookDecision,
+      { sessionId: callerSessionId, mcpScopeId }
     );
     const action = String(decision?.action || decision?.decision || '').toLowerCase();
     if (action === 'deny' || action === 'block') {
@@ -89,7 +141,14 @@ export async function applyBeforeToolHook({
       if (typeof decision?.name === 'string' && decision.name.trim()) call.name = decision.name.trim();
     }
     if (action === 'ask') {
-      const denied = await askApproval(call, { callerSessionId, executeOpts, toolApprovalHook, decision });
+      const denied = await askApproval(call, {
+        callerSessionId,
+        executeOpts,
+        toolApprovalHook,
+        decision,
+        request,
+        gate,
+      });
       if (denied) return denied;
     }
   } catch (error) {

package/src/runtime/agent/orchestrator/session/loop/tool-exec.mjs

@@ -14,7 +14,7 @@ import { runWithToolExecutionOwner } from '../../../../shared/tool-execution-own
 import { runWithLocalSearchTelemetry } from '../../tools/builtin/local-search-telemetry.mjs';
 import { throwIfAborted } from '../../../../shared/abort-race.mjs';
 import { prepareToolCall } from './tool-exec/call-prep.mjs';
-import { applyBeforeToolHook, applyShellElevationGate } from './tool-exec/before-hook.mjs';
+import { applyBeforeToolHook, applyConnectorApproval, applyShellElevationGate } from './tool-exec/before-hook.mjs';
 import { dispatchToolCall } from './tool-exec/dispatch.mjs';
 import { applyAfterToolHook } from './tool-exec/after-hook.mjs';
 import { runReadOnlyIoWithDeadline } from './tool-exec/read-only-deadline.mjs';
@@ -50,8 +50,16 @@ async function executeToolOwned(name, args, cwd, callerSessionId, sessionRef, ex
     executeOpts,
     beforeToolHook: hookFrom(executeOpts, sessionRef, 'beforeToolHook'),
     toolApprovalHook,
+    mcpScopeId: sessionRef?.mcpScopeId || null,
   });
   if (hooked.denial) return hooked.denial;
+  const connectorDenied = await applyConnectorApproval(hooked, {
+    agentId: sessionRef?.agent,
+    callerSessionId,
+    executeOpts,
+    toolApprovalHook,
+  });
+  if (connectorDenied) return connectorDenied.denial;
   // A decision can settle after its turn was cancelled. It must never
   // authorize a new mutation, even if the hook ignores the abort signal.
   throwIfAborted(executeOpts.signal);

package/src/runtime/agent/orchestrator/session/loop/tool-exposure-migration.mjs

@@ -27,12 +27,13 @@ function invalidateForToolSurfaceMigration(session) {
 }
 
 /**
- * After a surface re-apply outside a request (resume, provider switch)
- * migrated the exposure: the first send of the next turn carries the tag.
+ * After a surface re-apply outside a request (resume, provider switch, a
+ * workflow switch: `intent`) changed the request prefix: the first send of the
+ * next turn carries the tag.
  */
-export function markToolSurfaceMigrated(session) {
+export function markToolSurfaceMigrated(session, intent = TOOL_SURFACE_MIGRATION_INTENT) {
   invalidateForToolSurfaceMigration(session);
-  session.pendingCacheBreakIntent = TOOL_SURFACE_MIGRATION_INTENT;
+  session.pendingCacheBreakIntent = intent;
 }
 
 /** Provider switch: rebuild the surface for `provider`, migrating bridge ↔ native. */