mixdog 1.3.0 → 1.3.2

package/src/runtime/agent/orchestrator/session/human-gate/gate.mjs

@@ -5,16 +5,31 @@
 // turns an outbound call (outbound-policy.mjs) into an `ask` whatever the
 // hooks or the agent's permission said short of a deny, unless the agent's
 // permission for that action kind (store.mjs) is `allow`; `block` denies it
-// without a card. Other surfaces (group rooms) call it with their own
+// without a card. The outbound rule applies ONLY while a bot acts (see
+// actingBotId); an ordinary coding session's outbound call passes with the
+// hook decision unchanged. Other surfaces (group rooms) call it with their own
 // decision to get the same outbound rule. After the user answered,
 // recordHumanDecision stores a "don't ask again" grant and the audit line. Unattended runs (schedule, webhook, room member) register a
 // port here (session-runtime/held-requests.mjs) that turns their asks into
 // held requests instead of an approval card.
-import { MIXY_AGENT_ID, agentIdOfHomeSession } from '../agent-home.mjs';
+import { MIXY_AGENT_ID, agentHomeSessionId, agentIdOfHomeSession } from '../agent-home.mjs';
 import { serverConnector } from '../../mcp/server-connectors.mjs';
+import { readAgentDefinitionKind } from '../../../../shared/agent-kind.mjs';
+import { isContactAgentId } from '../../../../shared/agent-route-config.mjs';
+import { mixdogRoot, resolvePluginData } from '../../../../shared/plugin-paths.mjs';
 import { roomMemberOfSession } from '../agent-room.mjs';
-import { classifyOutboundCall, isRememberableAction } from './outbound-policy.mjs';
+import { agentDisplayName } from '../../context/role-instructions.mjs';
+import { delegationOf } from './delegation.mjs';
+import { setUnattendedApprovalPort, unattendedApprovalPort } from './unattended-port.mjs';
+import { classifyAsDelete, classifyOutboundCall, isRememberableAction } from './outbound-policy.mjs';
 import { humanGateStore } from './store.mjs';
+import {
+  AUTOMATION_GRANT_REASON,
+  RUN_FORBIDDEN_REASON,
+  isGrantedRun,
+  isRemoteDeleteInRun,
+  savesAutomation,
+} from './run-policy.mjs';
 
 export const OUTBOUND_APPROVAL_REASON = 'This sends or posts outside Mixdog; it needs your approval.';
 export const BLOCKED_ACTION_REASON = "This agent's permission blocks this action.";
@@ -22,23 +37,100 @@ export const BLOCKED_ACTION_REASON = "This agent's permission blocks this action
  *  payments and deletes never. */
 const outboundRemember = (category) => (isRememberableAction(category) ? ['once', 'agent'] : ['once']);
 
-let unattendedPort = null;
-/** `{ runOf(sessionId) → { kind, agentId, name } | null, hold(request, { signal }) → Promise<approval>,
- *  humanNeeded(sessionId, outcome, site) → Promise<boolean> }` — the last ends a schedule/webhook
- *  run that would need a takeover (session-runtime/held-requests.mjs). */
-export function setUnattendedApprovalPort(port) {
-  unattendedPort = port || null;
+// The unattended runs' port lives in unattended-port.mjs (delegation.mjs reads
+// it when a session is created); its setter and getter are re-exported here.
+export { setUnattendedApprovalPort, unattendedApprovalPort };
+
+/** The agent a session is bound to by itself: its unattended run's owner, a
+ *  room member, a home thread's agent; '' for any other session. */
+function ownBoundAgentId(sessionId) {
+  const run = unattendedApprovalPort()?.runOf?.(sessionId);
+  if (run?.agentId) return run.agentId;
+  return roomMemberOfSession(sessionId)?.agentId || agentIdOfHomeSession(sessionId) || '';
 }
-export function unattendedApprovalPort() {
-  return unattendedPort;
+
+/** The agent a session is bound to: its own binding, else — a sub-agent at
+ *  any depth, a task session a bot created — the root recorded on it when it
+ *  was created (delegation.mjs); '' for a coding Lead and every agent under
+ *  it, and for a delegated session whose root is unknown (see isUnresolved). */
+function boundAgentId(sessionId) {
+  const own = ownBoundAgentId(sessionId);
+  if (own) return own;
+  const delegation = delegationOf(sessionId);
+  return delegation.state === 'resolved' ? delegation.rootAgentId : '';
 }
 
+/** A delegated session whose root could not be established: it may act for a
+ *  bot, so the gate fails closed (outbound asks, nothing is remembered). */
+const isUnresolved = (sessionId) => !ownBoundAgentId(sessionId) && delegationOf(sessionId).state === 'unresolved';
+
 /** The agent a session acts for: its unattended run's owner, a room member,
  *  a home thread's agent, else Mixy. */
 export function agentIdForSession(sessionId) {
-  const run = unattendedPort?.runOf?.(sessionId);
-  if (run?.agentId) return run.agentId;
-  return roomMemberOfSession(sessionId)?.agentId || agentIdOfHomeSession(sessionId) || MIXY_AGENT_ID;
+  return boundAgentId(sessionId) || MIXY_AGENT_ID;
+}
+
+/** The bot a session acts for, or '' when none: Mixy in her own home thread
+ *  (or her unattended run / room member session), or a contact agent (`kind:
+ *  bot`, isContactAgentId) in its home thread, room member session or
+ *  unattended run — or any session delegated from one of those (a sub-agent,
+ *  a task session the bot created, nested at any depth), which acts as that
+ *  root bot. A coding Lead (also id 'lead'), its workflow agents and their
+ *  sub-agent sessions are bound to nothing here, so they are no bot. */
+function actingBotId(sessionId) {
+  const id = boundAgentId(sessionId);
+  if (!id) return '';
+  if (id === MIXY_AGENT_ID) return id;
+  const kind = readAgentDefinitionKind({ dataDir: resolvePluginData(), shippedRoot: mixdogRoot(), id });
+  return isContactAgentId(id, kind) ? id : '';
+}
+
+/** The contact bot (`kind: bot`) a session acts for, or '' for Mixy, a coding
+ *  Lead, a workflow agent and every other session. Mixy shares the `lead` id
+ *  with the coding Lead (her connector policy is hers alone, never the Lead's:
+ *  connectorPolicyAgentOf), and a standing allow is a contact bot's own policy
+ *  entry: none is offered to Mixy, a Lead or a workflow agent. */
+export function actingContactBotId(sessionId) {
+  const id = actingBotId(sessionId);
+  // Only where a remembering answer can be given in the bot's OWN home thread
+  // (rememberSurfaceOf). A room member, an unattended run (a schedule, a
+  // webhook) and work they started act for the bot in a session that is not its chat.
+  return id && id !== MIXY_AGENT_ID && rememberSurfaceOf(sessionId) === agentHomeSessionId(id) ? id : '';
+}
+
+/** The one session where an answer to `sessionId`'s request may be
+ *  remembered ("don't ask again", "always allow"): the bot's home chat when
+ *  the request lives there, or surfaces there because the work was started
+ *  from that attended chat; '' otherwise (a room, a run, a coding Lead, an
+ *  unresolved delegation). The approval queue honours a remembering answer
+ *  only from that session (tui/session/tool-approval.mjs). */
+export function rememberSurfaceOf(sessionId) {
+  // A schedule/webhook running in the home itself is not the attended chat.
+  if (unattendedApprovalPort()?.runOf?.(sessionId)) return '';
+  if (agentIdOfHomeSession(sessionId)) return sessionId;
+  if (ownBoundAgentId(sessionId)) return '';
+  const delegation = delegationOf(sessionId);
+  return delegation.state === 'resolved' && delegation.via === 'home' ? delegation.rootSessionId : '';
+}
+
+// Chain tokens the desktop translates (ApprovalCard approvalChainLabel).
+const LEAD_NAME = 'Lead';
+const TASK_SESSION_NAME = 'Task session';
+
+/** Where a delegated session's approval cards also surface, and who is
+ *  asking: `{ sessionId, chain }` — the top-level conversation the user
+ *  watches (the root bot's home chat, a room member session, a coding Lead's
+ *  session) and the names from there down to the asker ("사무관 › Worker",
+ *  "사무관 › Task session", "Lead › Reviewer"). A sub-agent at any depth and
+ *  a task session a bot created have one; null for a top-level session. */
+export function approvalSurface(sessionId) {
+  const delegation = delegationOf(sessionId);
+  if (delegation.state !== 'resolved') return null;
+  const chain = [delegation.rootAgentId ? agentDisplayName(delegation.rootAgentId) : LEAD_NAME];
+  for (const step of delegation.path) {
+    chain.push(step.kind === 'agent' ? agentDisplayName(step.agent) || step.agent : TASK_SESSION_NAME);
+  }
+  return { sessionId: delegation.rootSessionId, chain };
 }
 
 const actionOf = (decision) => String(decision?.action || decision?.decision || '').toLowerCase();
@@ -88,20 +180,47 @@ async function describeEmails(call, outbound, ctx) {
  * @param {{ name: string, args: any }} call
  * @param {object|null} decision the PreToolUse decision so far
  * @param {{ sessionId?: string, mcpScopeId?: string, annotations?: object, store?: object }} ctx
- * @returns {Promise<{ decision: object|null, request: object|null, gate: object|null }>}
+ * @returns {Promise<{ decision: object|null, request: object|null, gate: object|null, remembered?: true }>}
  *   `request` holds the kind-specific fields an `ask` presents; `gate` the
- *   audit identity `{ agentId, kind, action, tool, target }`.
+ *   audit identity `{ agentId, kind, action, tool, target }`; `remembered`
+ *   marks an outbound call a stored grant already answered.
  */
 export async function humanGateDecision(call, decision, ctx = {}) {
   const action = actionOf(decision);
   if (action === 'deny' || action === 'block') return { decision, request: null, gate: null };
-  const agentId = agentIdForSession(ctx.sessionId);
+  // Delegated, but its root is unknown: treated as a bot whose identity, grants
+  // and remember surface are unknown — every outbound call asks, once only.
+  const unresolved = isUnresolved(ctx.sessionId);
+  const agentId = unresolved ? '' : agentIdForSession(ctx.sessionId);
   const annotations = ctx.annotations ?? (await mcpAnnotations(call?.name, ctx.mcpScopeId));
-  const outbound = classifyOutboundCall({ name: call?.name, args: call?.args, annotations });
+  let classified = classifyOutboundCall({ name: call?.name, args: call?.args, annotations });
+  const remoteDelete = isRemoteDeleteInRun({ name: call?.name, annotations }, classified);
+  // In a schedule/webhook run only a recoverable trash may delete remote items.
+  if (isGrantedRun(unattendedApprovalPort()?.runOf?.(ctx.sessionId)) && remoteDelete) {
+    const store = ctx.store || (await humanGateStore());
+    await store.recordAudit({
+      agentId,
+      kind: 'outbound',
+      action: 'delete',
+      tool: String(call?.name || ''),
+      target: '',
+      decision: 'run-forbidden',
+      device: '',
+    });
+    const base = decision && typeof decision === 'object' ? decision : {};
+    return { decision: { ...base, action: 'deny', reason: RUN_FORBIDDEN_REASON }, request: null, gate: null };
+  }
+  // Where a bot is attended, the same connector delete the runs refuse
+  // (delete_message, remove_member…) is a permanent delete: it asks, never remembered.
+  if (remoteDelete && classified?.category !== 'delete' && classified?.category !== 'payment') {
+    classified = classifyAsDelete({ name: call?.name, args: call?.args });
+  }
+  const outbound = classified && (unresolved || actingBotId(ctx.sessionId)) ? classified : null;
   if (!outbound) {
     if (action !== 'ask') return { decision, request: null, gate: null };
     return {
-      decision,
+      // Saving a schedule or webhook says plainly what the approval grants.
+      decision: savesAutomation(call) ? { ...decision, reason: AUTOMATION_GRANT_REASON } : decision,
       request: { kind: 'approval', agentId, remember: ['once'] },
       gate: { agentId, kind: 'approval', tool: String(call?.name || ''), target: '' },
     };
@@ -118,10 +237,16 @@ export async function humanGateDecision(call, decision, ctx = {}) {
       editable: outbound.editable,
       details: outbound.details,
     },
-    remember: outboundRemember(outbound.category),
+    remember: ['once'],
   };
+  // "Don't ask again" only where it can be answered in the bot's own chat.
+  const rememberAt = unresolved ? '' : rememberSurfaceOf(ctx.sessionId);
+  if (rememberAt && isRememberableAction(outbound.category)) {
+    request.remember = outboundRemember(outbound.category);
+    request.rememberAt = rememberAt;
+  }
   const store = ctx.store || (await humanGateStore());
-  const mode = await store.modeFor({ agentId, action: outbound.category });
+  const mode = unresolved ? 'ask' : await store.modeFor({ agentId, action: outbound.category });
   const base = decision && typeof decision === 'object' ? decision : {};
   if (mode === 'block') {
     await store.recordAudit({ ...gate, decision: 'blocked', device: '' });
@@ -129,7 +254,8 @@ export async function humanGateDecision(call, decision, ctx = {}) {
   }
   if (action !== 'ask' && mode === 'allow') {
     await store.recordAudit({ ...gate, decision: 'remembered', device: '' });
-    return { decision, request: null, gate: null };
+    // The remembered grant answers this call: no later layer asks it again.
+    return { decision, request: null, gate: null, remembered: true };
   }
   const described = await describeEmails(call, outbound, ctx);
   if (described) {
@@ -146,7 +272,8 @@ export async function humanGateDecision(call, decision, ctx = {}) {
   return {
     decision: { ...(rewriting ? base : unrewritten), action: 'ask', reason: base.reason || OUTBOUND_APPROVAL_REASON },
     request,
-    gate,
+    // The scopes this request offered: a grant is stored only for one of them.
+    gate: { ...gate, remember: request.remember },
   };
 }
 
@@ -158,8 +285,12 @@ export async function recordHumanDecision(gate, approval, { store } = {}) {
   let decision = approval?.response || (approval?.approved === true ? 'approve' : 'deny');
   if (approval?.timedOut) decision = 'timeout';
   const device = typeof approval?.device === 'string' ? approval.device : '';
-  if (approval?.approved === true && gate.action) {
+  // A scope the request did not offer (an answer from a place that may not
+  // remember) stores nothing.
+  const offered = !Array.isArray(gate.remember) || gate.remember.includes(approval?.remember);
+  if (approval?.approved === true && gate.action && offered) {
     await target.grant({ agentId: gate.agentId, action: gate.action, scope: approval.remember, device });
   }
-  await target.recordAudit({ ...gate, decision, device });
+  const { remember: _offered, ...audit } = gate;
+  await target.recordAudit({ ...audit, decision, device });
 }

package/src/runtime/agent/orchestrator/session/human-gate/outbound-policy.mjs

@@ -23,6 +23,14 @@ export const ACTION_KINDS = Object.freeze([
   'payment',
   'delete',
   'trash',
+  // Browser Use gated actions (main/browser/action-approval.ts): a form
+  // submit / Enter, a click on a send or post control, and a file upload. They
+  // are not classified here (the desktop browser host asks); only their grants
+  // live in this store. Operator-confirmed actions
+  // (MIXDOG_BROWSER_CONFIRM_ACTIONS) have no kind: they always ask.
+  'browser_submit',
+  'browser_post',
+  'browser_upload',
 ]);
 const UNREMEMBERED_ACTIONS = new Set(['payment', 'delete']);
 
@@ -204,6 +212,18 @@ export function classifyOutboundCall({ name, args, annotations } = {}) {
   if (!category && annotations?.readOnlyHint === true) return null;
   if (!category && annotations?.outboundHint === true) category = 'message';
   if (!category) return null;
+  return mcpOutbound(toolName, server, input, category);
+}
+
+/** The classification of connector tool `name` as a permanent delete — for a
+ *  delete the name-based list above does not know (run-policy.mjs decides which). */
+export function classifyAsDelete({ name, args } = {}) {
+  const toolName = String(name || '');
+  const [, server = ''] = toolName.split('__');
+  return mcpOutbound(toolName, server, isRecord(args) ? args : {}, 'delete');
+}
+
+function mcpOutbound(toolName, server, input, category) {
   const details = detailsOf(category, input);
   const spends = category === 'payment' || category === 'delete';
   return {

package/src/runtime/agent/orchestrator/session/human-gate/requests.mjs

@@ -84,6 +84,8 @@ export function humanRequestFields(input = {}) {
   const fields = { remember: rememberScopes(input.remember) };
   // The agent the request acts for (its name on the card and the remembered grant).
   if (text(input.agentId)) fields.agentId = text(input.agentId);
+  // The one session a remembering answer may come from (gate.mjs rememberSurfaceOf).
+  if (text(input.rememberAt)) fields.rememberAt = text(input.rememberAt);
   if (kind === 'outbound' && isRecord(input.outbound)) {
     const outbound = input.outbound;
     const details = isRecord(outbound.details) ? outbound.details : {};
@@ -119,13 +121,16 @@ export function humanRequestFields(input = {}) {
     // browser page ID, or a computer window id and app, so the card can bring
     // exactly that window forward on the user's click.
     const token = (value, limit) => (/^[\w.:#@-]+$/.test(text(value, limit)) ? text(value, limit) : '');
-    const identity =
-      surface === 'browser'
-        ? { ...(token(takeover.tab, 64) ? { tab: token(takeover.tab, 64) } : {}) }
-        : {
-            ...(token(takeover.windowId, 128) ? { windowId: token(takeover.windowId, 128) } : {}),
-            ...(text(takeover.app, 120) ? { app: text(takeover.app, 120) } : {}),
-          };
+    const tab = token(takeover.tab, 64);
+    const windowId = token(takeover.windowId, 128);
+    const app = text(takeover.app, 120);
+    const identity = {};
+    if (surface === 'browser') {
+      if (tab) identity.tab = tab;
+    } else {
+      if (windowId) identity.windowId = windowId;
+      if (app) identity.app = app;
+    }
     // A login takeover (purpose 'login') opens the desktop's sign-in window on
     // its validated page instead of handing over the side panel.
     const login = surface === 'browser' && takeover.purpose === 'login' ? loginPageUrl(takeover.url) : null;
@@ -143,7 +148,13 @@ export function humanRequestFields(input = {}) {
     fields.permission = {
       scopes: scopes
         .filter((scope) => isRecord(scope) && text(scope.id))
-        .map((scope) => ({ id: text(scope.id), label: text(scope.label) || text(scope.id) })),
+        .map((scope) => ({
+          id: text(scope.id),
+          label: text(scope.label) || text(scope.id),
+          // The option's kind (allow_always / allow_once / reject, as an ACP or
+          // MCP permission request names them); the card maps buttons by it.
+          ...(text(scope.kind) ? { kind: text(scope.kind) } : {}),
+        })),
     };
   }
   return fields;
@@ -191,5 +202,6 @@ export function normalizeHumanResponse(request, approved, extra = {}) {
 /** `args` with the card's edited fields in place of the model's. */
 export function applyEditedArgs(args, editedArgs, editable) {
   const edits = editableArgs(editedArgs, editable);
-  return Object.keys(edits).length ? { ...(isRecord(args) ? args : {}), ...edits } : args;
+  if (!Object.keys(edits).length) return args;
+  return { ...(isRecord(args) ? args : {}), ...edits };
 }

package/src/runtime/agent/orchestrator/session/human-gate/run-policy.mjs

@@ -0,0 +1,73 @@
+// session/human-gate/run-policy.mjs
+// Schedule and webhook runs never ask. Saving a schedule or webhook is the
+// user's explicit grant for its runs (and for the work they start: sub-agents,
+// a bot's task sessions): outbound actions and ordinary tool approvals are
+// allowed without a card, a held row or a push, inside the bot's own
+// permissions (a `block` is applied before any ask, gate.mjs). Payments and
+// permanent deletes (the action kinds that can never be remembered) are never
+// done in a run: denied at once, with a result the bot can report. Group-room
+// members are not runs of this kind and keep their held/approval behaviour.
+import { ACTION_KINDS, isRememberableAction } from './outbound-policy.mjs';
+
+export const RUN_FORBIDDEN_REASON =
+  "Payments and permanent deletes aren't allowed in schedule/webhook runs; do it from the chat.";
+
+/** The ask reason of a schedule/webhook save: the grant, said plainly. */
+export const AUTOMATION_GRANT_REASON =
+  "Approving lets this schedule's or webhook's runs act without asking, within the bot's permissions. Payments and permanent deletes are never done in runs.";
+
+/** Whether `run` (the unattended port's `runOf`) is a schedule or webhook run. */
+export const isGrantedRun = (run) => Boolean(run) && run.kind !== 'room';
+
+/** Whether an outbound request is a payment or permanent delete. */
+export function isForbiddenInRun(request) {
+  const category = request?.kind === 'outbound' ? request.outbound?.category : '';
+  return ACTION_KINDS.includes(category) && !isRememberableAction(category);
+}
+
+const READ_VERBS = new Set([
+  'get',
+  'list',
+  'search',
+  'read',
+  'fetch',
+  'retrieve',
+  'find',
+  'view',
+  'describe',
+  'lookup',
+]);
+const DELETE_TOKENS = new Set(['delete', 'remove', 'destroy', 'erase', 'purge', 'wipe']);
+
+/** Whether a connector/MCP tool deletes remote items without being a confirmed
+ *  recoverable `trash`: in a run that counts as a permanent delete. Read-verb
+ *  names (`list_deleted_items`) stay reads. `classified` is the outbound
+ *  classification of the call (outbound-policy.mjs), if any. */
+export function isRemoteDeleteInRun({ name, annotations }, classified) {
+  const toolName = String(name || '');
+  if (!toolName.startsWith('mcp__')) return false;
+  if (classified?.category === 'trash') return false;
+  if (classified?.category === 'delete') return true;
+  const bare = String(annotations?.mcpToolName || toolName.split('__').slice(2).join('__'))
+    .toLowerCase()
+    .replace(/-/g, '_');
+  const tokens = bare.split(/[^a-z0-9]+/).filter(Boolean);
+  if (READ_VERBS.has(tokens[0])) return false;
+  return tokens.some((token) => DELETE_TOKENS.has(token));
+}
+
+/** Whether `call` saves a schedule or webhook (the setup tool's `save_automation`). */
+export const savesAutomation = (call) => call?.name === 'setup' && call.args?.action === 'save_automation';
+
+/** The answer a granted run gets instead of a card: `{ approval }` to run the
+ *  call, or `{ denial, approval }` for a payment or permanent delete. The
+ *  `response` is the audit decision (`run-allowed`, `run-forbidden`). */
+export function runAskOutcome({ name, request }) {
+  if (isForbiddenInRun(request)) {
+    return {
+      denial: `Error: tool "${name}" denied: ${RUN_FORBIDDEN_REASON} Report this to the user; do not retry it or reach the same result another way.`,
+      approval: { approved: false, response: 'run-forbidden', reason: RUN_FORBIDDEN_REASON },
+    };
+  }
+  return { approval: { approved: true, response: 'run-allowed', reason: 'schedule/webhook run' } };
+}

package/src/runtime/agent/orchestrator/session/human-gate/store.mjs

@@ -11,7 +11,7 @@
 import { createHash } from 'node:crypto';
 import { appendFile, mkdir, readFile } from 'node:fs/promises';
 import { dirname, join } from 'node:path';
-import { parseJsonText, updateJsonAtomic } from '../../../../shared/atomic-file.mjs';
+import { readJsonState, updateJsonAtomic } from '../../../../shared/atomic-file.mjs';
 import { ACTION_KINDS, isRememberableAction } from './outbound-policy.mjs';
 
 const ANY_AGENT = '*';
@@ -22,52 +22,64 @@ export const PERMISSION_MODES = Object.freeze(['ask', 'allow', 'block']);
 const field = (value) => String(value ?? '').slice(0, FIELD_LIMIT);
 const grantId = (agentId, action) =>
   `grant_${createHash('sha256').update(`${agentId}\n${action}`).digest('hex').slice(0, 24)}`;
+const MODE_RANK = Object.freeze({ block: 0, ask: 1, allow: 2 });
+export const NO_WIDEN_MESSAGE = 'This change would widen what the bot may do without asking; make it on the desktop.';
 const isGrant = (row) => ACTION_KINDS.includes(row?.action) && (row.mode === 'allow' || row.mode === 'block');
 
+/** The effective mode among `grants`: the agent's own grant, else an every-agent one. */
+function effectiveMode(grants, agentId, action) {
+  const rows = grants.filter((grant) => grant.action === action);
+  const own = rows.find((grant) => grant.agentId === agentId) || rows.find((grant) => grant.agentId === ANY_AGENT);
+  if (own?.mode === 'allow' && !isRememberableAction(action)) return 'ask';
+  return own?.mode || 'ask';
+}
+
 export function createHumanGateStore(directory) {
   const grantsFile = join(directory, 'grants.json');
   const auditFile = join(directory, 'audit.jsonl');
   const grantsOf = (doc) => (Array.isArray(doc?.grants) ? doc.grants.filter(isGrant) : []);
-  async function readGrants() {
-    try {
-      return grantsOf(parseJsonText(await readFile(grantsFile, 'utf8')));
-    } catch (error) {
-      if (error?.code === 'ENOENT') return [];
-      throw error;
-    }
-  }
+  // A damaged file (empty, NUL, torn) is kept aside by readJsonState and reads
+  // as no grants: every action asks again, never "allowed". No `.bak` is ever
+  // written or restored (`restoreBackup: false`, also for a stale one left by
+  // an older build) — an older copy could bring back a revoked allow.
+  const readGrants = async () => grantsOf(await readJsonState(grantsFile, { fallback: null, restoreBackup: false }));
   async function updateGrants(mutate) {
     await mkdir(directory, { recursive: true });
     let result;
-    await updateJsonAtomic(grantsFile, (doc) => {
-      const out = mutate(grantsOf(doc));
-      if (!out) return undefined;
-      result = out.result;
-      return { grants: out.grants };
-    });
+    await updateJsonAtomic(
+      grantsFile,
+      (doc) => {
+        const out = mutate(grantsOf(doc));
+        if (!out) return undefined;
+        result = out.result;
+        return { grants: out.grants };
+      },
+      { restoreBackup: false }
+    );
     return result;
   }
   /** Set `agentId`'s mode for `action`; `ask` removes its grant. Returns the
    *  grant, or null for `ask` and for an `allow` that may not exist. */
-  async function setMode({ agentId, action, mode, device = '' }) {
+  async function setMode({ agentId, action, mode, device = '', noWiden = false }) {
     if (!ACTION_KINDS.includes(action) || !PERMISSION_MODES.includes(mode)) return null;
     if (mode === 'allow' && !isRememberableAction(action)) return null;
     const owner = field(agentId);
     const id = grantId(owner, action);
     const grant = mode === 'ask' ? null : { id, agentId: owner, action, mode, device: field(device), at: Date.now() };
-    await updateGrants((grants) => ({
-      grants: [...grants.filter((row) => row.id !== id), ...(grant ? [grant] : [])],
-      result: grant,
-    }));
+    await updateGrants((grants) => {
+      const next = [...grants.filter((row) => row.id !== id), ...(grant ? [grant] : [])];
+      // `noWiden` (a remote client's call): judged on the effective mode inside the
+      // same locked read-modify-write, so a block landing meanwhile is never lifted.
+      if (noWiden && MODE_RANK[effectiveMode(next, owner, action)] > MODE_RANK[effectiveMode(grants, owner, action)]) {
+        throw new Error(NO_WIDEN_MESSAGE);
+      }
+      return { grants: next, result: grant };
+    });
     return grant;
   }
   /** `allow`, `block` or `ask` for `agentId` + `action`; the agent's own grant wins. */
   async function modeFor({ agentId, action }) {
-    const grants = (await readGrants()).filter((grant) => grant.action === action);
-    const own =
-      grants.find((grant) => grant.agentId === agentId) || grants.find((grant) => grant.agentId === ANY_AGENT);
-    if (own?.mode === 'allow' && !isRememberableAction(action)) return 'ask';
-    return own?.mode || 'ask';
+    return effectiveMode(await readGrants(), agentId, action);
   }
   return {
     setMode,
@@ -151,16 +163,32 @@ export async function agentPermissions(agentId) {
 }
 
 /** Set one row of that table (capability setAgentPermission); returns the table. */
-export async function setAgentPermission(agentId, action, mode) {
+export async function setAgentPermission(agentId, action, mode, options) {
   const agent = requiredAgentId(agentId);
   if (!ACTION_KINDS.includes(action)) throw new Error(`action must be one of ${ACTION_KINDS.join(', ')}`);
   if (!PERMISSION_MODES.includes(mode)) throw new Error(`mode must be one of ${PERMISSION_MODES.join(', ')}`);
   if (mode === 'allow' && !isRememberableAction(action)) throw new Error(`${action} always asks; it cannot be allowed`);
   const store = await humanGateStore();
-  await store.setMode({ agentId: agent, action, mode });
+  await store.setMode({ agentId: agent, action, mode, noWiden: options?.noWiden === true });
   return store.permissions(agent);
 }
 
+const BROWSER_AUDIT_DECISIONS = Object.freeze(['approve', 'deny', 'granted', 'remembered', 'run-allowed', 'blocked']);
+
+/** Audit one Browser Use approval of a bot (capability recordAgentApprovalAudit):
+ *  the bot, the action kind and what happened — `approve` / `deny` for the card,
+ *  `granted` when "always allow" was saved, `remembered` when a saved allow let
+ *  a step run unasked. Never a page address, target or value. */
+export async function recordAgentApprovalAudit(agentId, action, decision) {
+  const agent = requiredAgentId(agentId);
+  if (!ACTION_KINDS.includes(action)) throw new Error(`action must be one of ${ACTION_KINDS.join(', ')}`);
+  if (!BROWSER_AUDIT_DECISIONS.includes(decision)) {
+    throw new Error(`decision must be one of ${BROWSER_AUDIT_DECISIONS.join(', ')}`);
+  }
+  await (await humanGateStore()).recordAudit({ agentId: agent, kind: 'browser', action, tool: 'browser', decision });
+  return null;
+}
+
 /** Replace the process store (tests); null restores the default. */
 export function setHumanGateStore(store) {
   processStore = store || null;

package/src/runtime/agent/orchestrator/session/human-gate/unattended-port.mjs

@@ -0,0 +1,15 @@
+// session/human-gate/unattended-port.mjs
+// The port unattended runs (schedule, webhook, room member) register
+// (session-runtime/held-requests.mjs): `{ runOf(sessionId) → { kind, agentId,
+// name } | null, hold(request, { signal }) → Promise<approval>,
+// humanNeeded(sessionId, outcome, site) → Promise<boolean> }` — the last ends
+// a schedule/webhook run that would need a takeover. gate.mjs re-exports it.
+let unattendedPort = null;
+
+export function setUnattendedApprovalPort(port) {
+  unattendedPort = port || null;
+}
+
+export function unattendedApprovalPort() {
+  return unattendedPort;
+}

package/src/runtime/agent/orchestrator/session/loop/compact-policy.mjs

@@ -838,10 +838,13 @@ function compactionTelemetryRecord(sessionRef, policy, meta, prev) {
       meta.compactError ?? meta.lastError,
       prev.lastError
     ),
+    // The last compaction's wall time: replaced only by a stage that reports
+    // a finished compaction's duration; a plain pre-send check keeps it (the
+    // other timing fields stay with `...prev`).
     lastDurationMs:
       meta.durationMs != null && Number.isFinite(Number(meta.durationMs))
         ? Math.max(0, Math.round(Number(meta.durationMs)))
-        : null,
+        : (prev.lastDurationMs ?? null),
     compactCount: (prev.compactCount || 0) + (changed ? 1 : 0),
     singleShotConsumed:
       policy.singleShot === true && meta.stage === 'compacting' ? true : prev.singleShotConsumed === true,