mixdog 1.3.1 → 1.3.3

package/src/runtime/agent/orchestrator/session/compact/text-utils.mjs

@@ -1,6 +1,10 @@
 // Text/token/message helpers and secret redaction for compaction.
 import { createHash } from 'node:crypto';
-import { attachmentTextForPart, isAttachmentReference, isPermanentAttachmentError } from '../../../../attachments/store.mjs';
+import {
+  attachmentTextForPart,
+  isAttachmentReference,
+  isPermanentAttachmentError,
+} from '../../../../attachments/store.mjs';
 import { estimateMessagesTokens } from '../context-utils.mjs';
 import { inlineFileKind } from '../../../../shared/inline-file-kind.mjs';
 
@@ -44,7 +48,7 @@ const SENSITIVE_RAW_KEY_RES = [
 // string. Consumes the WHOLE value after the key — spaces, `Bearer `/`Basic `
 // scheme words, quoted values with internal spaces, and `;`-separated cookie
 // pairs — so no secret fragment survives.
-function redactRawSecretString(text) {
+export function redactRawSecretString(text) {
   let value = String(text ?? '');
   if (!value) return value;
   for (const keyRe of SENSITIVE_RAW_KEY_RES) {

package/src/runtime/agent/orchestrator/session/compact/user-message-kind.mjs

@@ -5,6 +5,7 @@
 import { SUMMARY_PREFIX_ANCHOR } from './summary-anchor.mjs';
 import { isImportedMessage } from '../imported-message.mjs';
 import {
+  CONTROL_MARKER_RE,
   isInternalRuntimeNotificationText,
   isModelVisibleToolCompletionWrapper,
 } from '../../../../shared/tool-execution-contract.mjs';
@@ -86,6 +87,9 @@ export function isContextAckMessage(message, previous = null) {
 const SYNTHETIC_USER_SOURCES = new Set([
   // A schedule's output posted into its owner's home thread: untrusted data.
   'schedule-result',
+  // A delivered task or channel notification: turn input, never the human's
+  // request, whatever its text looks like.
+  'task-notification',
   'goal-continuation',
   'goal-closeout',
   'compact-context',
@@ -132,7 +136,6 @@ export function isActualUserInstructionMessage(message) {
 // isActualUserInstructionMessage deliberately keeps treating "[truncated]" as
 // an instruction (compaction tail selection depends on it), so the real-turn
 // predicate below recognizes it on its own.
-const CONTROL_MARKER_RE = /^\[(?:truncated|request interrupted(?: by user(?: for tool use)?| by process restart)?)\]$/i;
 
 /** Whether a message stands for real human conversation: a compact summary
  *  (it replaced earlier human turns), imported prose, or the user's own

package/src/runtime/agent/orchestrator/session/compaction-archive-capture.mjs

@@ -226,7 +226,7 @@ const recordExists = (dir, sessionId) => existsSync(join(dir, `${sessionId}.json
  *  since `epoch` was captured wins. Any outcome but a rename removes the temp
  *  file. */
 async function publishArchive({ dir, path, sessionId, text, epoch }) {
-  const tmp = join(dir, `.${basename(path)}.${randomBytes(8).toString('hex')}.tmp`);
+  const tmp = join(dir, `${basename(path)}.mixdog-tmp-${randomBytes(4).toString('hex')}`);
   const removeTmp = () => {
     try {
       unlinkSync(tmp);

package/src/runtime/agent/orchestrator/session/context-utils.mjs

@@ -260,24 +260,55 @@ function messageImageAllowance(m) {
   if (!m || typeof m !== 'object') return 0;
   return messageImageDescriptors(m).reduce((sum, descriptor) => sum + imageDescriptorAllowance(descriptor), 0);
 }
-// Inline document (PDF) allowance: Anthropic bills ~1,500-3,000 tokens per
-// page and a typical PDF page is ~50-100KB, so ~bytes/16 with a floor and a
-// cap. The base64 payload itself is excluded from text estimates (see
+// Inline document (PDF) allowance. A native PDF reader turns every page into
+// one image AND sends the text it extracts from that page (the provider PDF
+// docs: each page is billed as an image plus its text, typically
+// 1,500-3,000 text tokens for a dense page). The page image is bounded like
+// any image — the reader downscales it to the vision ceiling — so a page costs
+// at most IMAGE_TOKEN_ALLOWANCE for its picture whatever its file size. A
+// scanned page has no text layer and costs only its picture.
+//
+// The base64 payload itself is excluded from text estimates (see
 // jsonFallbackFromPart), so this allowance is the document's entire cost.
 const FILE_TOKEN_ALLOWANCE_FLOOR = 1_500;
 const FILE_MAX_TOKEN_ALLOWANCE = 300_000;
-// A PDF that records its page count (intake and the read tool do) is priced per
-// page; the size-based figure stays as the floor, so a dense scan still costs
-// at least its bytes. Inline and stored parts carry the same count.
-const FILE_TOKENS_PER_PAGE = 2_500;
+// Extracted PDF text is priced at two characters per token: the low end of
+// the documented per-page range for Latin text, and close to the measured
+// density of Korean/CJK text, so neither is read low.
+const PDF_TEXT_CHARS_PER_TOKEN = 2;
+// A PDF that records its page count but not its text layer (older parts, an
+// inline part from a path that did not measure it) keeps the documented
+// mid-range per-page figure.
+const FILE_TOKENS_PER_PAGE_UNMEASURED = 2_500;
 // A PDF that lowers to text costs at most its extraction budget (~4 bytes/token).
 const PDF_TEXT_MAX_TOKENS = Math.ceil(PDF_TEXT_MAX_BYTES / 4);
+// Without a page count only the file size is known: ~bytes/16 (a typical page
+// is 50-100KB) with a floor and a cap. Never used once pages are known — a
+// scan's bytes are its image data, which the reader downscales, so bytes/16
+// priced a 5 MB, 37-page scan at ~330k tokens instead of ~58k.
 function fileDescriptorAllowance(descriptor, nativePdf = true) {
-  const bySize = Math.ceil((descriptor.sizeBytes || 0) / 16);
-  const byPage = (descriptor.pageCount || 0) * FILE_TOKENS_PER_PAGE;
-  const native = Math.min(FILE_MAX_TOKEN_ALLOWANCE, Math.max(FILE_TOKEN_ALLOWANCE_FLOOR, bySize, byPage));
+  const pages = descriptor.pageCount || 0;
+  let native;
+  if (pages > 0 && Number.isFinite(descriptor.textChars)) {
+    native = pages * IMAGE_TOKEN_ALLOWANCE + Math.ceil(descriptor.textChars / PDF_TEXT_CHARS_PER_TOKEN);
+  } else if (pages > 0) {
+    native = pages * FILE_TOKENS_PER_PAGE_UNMEASURED;
+  } else {
+    native = Math.max(FILE_TOKEN_ALLOWANCE_FLOOR, Math.ceil((descriptor.sizeBytes || 0) / 16));
+  }
+  native = Math.min(FILE_MAX_TOKEN_ALLOWANCE, native);
   return nativePdf ? native : Math.min(native, PDF_TEXT_MAX_TOKENS);
 }
+
+/** The tokens one PDF part costs inline (native reader unless `nativePdf` is false). */
+export function pdfPartAllowance(part, { nativePdf = true } = {}) {
+  return contentFileDescriptors([part]).reduce((sum, d) => sum + fileDescriptorAllowance(d, nativePdf), 0);
+}
+
+/** The tokens one image part costs inline. */
+export function imagePartAllowance(part) {
+  return contentImageDescriptors([part]).reduce((sum, d) => sum + imageDescriptorAllowance(d), 0);
+}
 /**
  * How many tokens the native-PDF meter overstates `messages` for a provider
  * that takes PDFs as text (nativePdf === false); subtract it from the

package/src/runtime/agent/orchestrator/session/human-gate/delegation.mjs

@@ -0,0 +1,240 @@
+// session/human-gate/delegation.mjs
+// Who a delegated session works for, recorded when it is created and re-bound
+// only when another session sends it work (rebindDelegation): a sub-agent (any
+// depth) carries `delegation` on its session record —
+//   { rootSessionId, via, path }
+// `rootSessionId` is the top-level conversation the work started in; `via`
+// says what it is: 'coding' (a coding Lead's session or a task session a bot
+// created) or 'bot' (a bot's own home chat or room member session); either way
+// the agents under it mirror their ordinary approval cards into that root, but
+// a 'bot' root's sub-agents are no bot: they ask no bot approval and use no
+// bot grant. `path` is the agent steps from the root down
+// ({ kind: 'agent', agent }).
+// A task session a bot created is an ordinary coding Lead session: top-level,
+// never delegated from the bot, and its sub-agents are rooted at it.
+// It is copied from the parent's record (or bound from the parent itself when
+// the parent is top-level) by the host at creation — never from tool input —
+// so no parent walk happens at gate time. When a session sends an existing
+// worker a new request, the record is re-bound to that sender's root. A
+// record from before this field existed, or one stored in an older shape (a
+// task step in its path, a home/room/run/unknown `via`), is derived again from
+// its parent by the same rules (backfillOf) and kept on the in-memory record,
+// which its next save persists. A session that has a parent link but no valid
+// or derivable root has no delegation (it is no bot's own session either).
+// Work a schedule/webhook run started (a sub-agent, a task session) carries the
+// `run` it was started under on its record, stamped at creation from its
+// creator (never from creation options or tool input) and re-stamped, whether
+// or not a root resolves, when another session sends it work (`run: null` =
+// attended). A record from before the stamp keeps the run it recorded (an old
+// `via: 'run'` delegation, an `agent:<bot>@run` task source, or its parent's
+// run when it recorded no delegation): that is stamped before its delegation is
+// derived again, which would drop it.
+import { agentIdOfHomeSession } from '../agent-home.mjs';
+import { roomMemberOfSession } from '../agent-room.mjs';
+import { loadSession } from '../store/load-session.mjs';
+import { _liveSessions } from '../store/live-state.mjs';
+import { saveSessionAsync } from '../store/save-worker.mjs';
+import { isTurnInFlight, runtimeState } from '../manager/runtime-state.mjs';
+import { unattendedApprovalPort } from './unattended-port.mjs';
+
+const VIA = new Set(['coding', 'bot']);
+const MAX_PATH = 32;
+const clean = (value) => (typeof value === 'string' ? value.trim() : '');
+const isRecord = (value) => Boolean(value) && typeof value === 'object' && !Array.isArray(value);
+
+const agentOwned = (record) =>
+  clean(record?.owner).toLowerCase() === 'agent' || clean(record?.visibility).toLowerCase() === 'agent-only';
+
+/** The session that spawned `record`, or '' for a top-level session (a task
+ *  session a bot created is top-level, like any coding Lead). */
+function parentOf(record) {
+  return agentOwned(record) ? clean(record.parentSessionId) || clean(record.ownerSessionId) : '';
+}
+
+/** The step a new session adds to its parent's path. */
+const stepOf = (record) => ({ kind: 'agent', agent: clean(record.agent) });
+
+/** A recorded delegation, or null when it is malformed or carries a step that
+ *  is not an agent (a stored task step: derived again, never trusted). */
+function validDelegation(value) {
+  if (!isRecord(value) || !clean(value.rootSessionId) || !VIA.has(value.via)) return null;
+  if (!Array.isArray(value.path) || value.path.length === 0 || value.path.length > MAX_PATH) return null;
+  if (!value.path.every((step) => step?.kind === 'agent')) return null;
+  return value;
+}
+
+/** The recorded delegation of `record`, else its legacy backfill; null when
+ *  it has none and none can be derived. */
+function delegationOfRecord(id, record, depth) {
+  stampRun(id, record);
+  return validDelegation(record.delegation) || backfillOf(id, record, depth);
+}
+
+const RUN_TASK_SOURCE = /^agent:([A-Za-z0-9_-]+)@run$/;
+const runStamp = (kind, agentId, name) =>
+  clean(agentId)
+    ? { kind: kind === 'webhook' ? 'webhook' : 'schedule', agentId: clean(agentId), name: String(name || '') }
+    : null;
+
+/** The run a record from before the `run` stamp was started by, from what it
+ *  recorded itself: an old `via: 'run'` delegation, a host-set `@run` task
+ *  source, else — a sub-agent that recorded no delegation — its parent's run. */
+function legacyRunOf(id, record, depth) {
+  const old = record.delegation;
+  if (isRecord(old) && old.via === 'run' && isRecord(old.run)) {
+    return runStamp(old.run.kind, old.rootAgentId || agentIdOfHomeSession(old.rootSessionId), old.run.name);
+  }
+  const taskBot =
+    !agentOwned(record) && clean(record.sourceType) === 'lead'
+      ? RUN_TASK_SOURCE.exec(clean(record.sourceName))?.[1]
+      : '';
+  if (taskBot) return runStamp('schedule', taskBot, '');
+  const parent = parentOf(record);
+  if (!parent || parent === id || isRecord(old) || depth >= MAX_PATH) return null;
+  const parentRecord = loadRecord(parent);
+  return parentRecord ? stampRun(parent, parentRecord, depth + 1) : null;
+}
+
+/** The `run` of `record`: its stamp (`null` = attended), else the run it
+ *  recorded before stamps existed, kept on the live record. */
+function stampRun(id, record, depth = 0) {
+  if (record.run !== undefined) return isRecord(record.run) ? record.run : null;
+  const run = legacyRunOf(id, record, depth);
+  if (run && _liveSessions.get(id) === record) record.run = run;
+  return run;
+}
+
+/** The run stamped on session `sessionId` (human-gate/delegation.mjs), or null. */
+export function runStampOf(sessionId) {
+  const id = clean(sessionId);
+  const record = id ? loadRecord(id) : null;
+  return record ? stampRun(id, record) : null;
+}
+
+/** The schedule/webhook run `sessionId` is, or inherited from the session that
+ *  started it, as `{ kind, agentId, name }`; null otherwise (a room member's
+ *  own session is no run here). */
+function runOfSession(sessionId) {
+  const run = unattendedApprovalPort()?.runOf?.(sessionId);
+  return run && run.kind !== 'room' ? { kind: run.kind, agentId: run.agentId, name: String(run.name || '') } : null;
+}
+
+/**
+ * The `run` to stamp on a session being created with `opts`: the run its
+ * creator (the spawning session, or the chat a task session was created from)
+ * is or inherited, else null. Work a run started stays the run's, however long
+ * ago the run ended; it is read from the creator, never from tool input.
+ */
+export function runForNewSession(opts = {}) {
+  const creator = parentOf(opts) || clean(opts.taskOrigin?.sessionId);
+  return creator && creator !== clean(opts.id) ? runOfSession(creator) : null;
+}
+
+function loadRecord(sessionId) {
+  try {
+    return loadSession(sessionId);
+  } catch {
+    return null;
+  }
+}
+
+/** What a top-level session `sessionId` is to a child: a bot's own home chat
+ *  or room member session ('bot', no record needed, the id names its agent),
+ *  a record-bearing coding session ('coding'), else nothing. */
+function viaOf(sessionId, record) {
+  if (roomMemberOfSession(sessionId) || agentIdOfHomeSession(sessionId)) return 'bot';
+  return record && !agentOwned(record) ? 'coding' : null;
+}
+
+/** The root of a top-level `parent` for a child taking `step`. */
+function rootFrom(parent, record, step) {
+  const via = viaOf(parent, record);
+  return via ? { rootSessionId: parent, via, path: [step] } : null;
+}
+
+/** The delegation a legacy `record` (id `id`, a parent link, none valid
+ *  recorded) is given, derived now from its parent, and kept on the live
+ *  record; null when it cannot be derived. */
+function backfillOf(id, record, depth = 0) {
+  const parent = parentOf(record);
+  if (!parent || parent === id || depth >= MAX_PATH) return null;
+  const parentRecord = loadRecord(parent);
+  const step = stepOf(record);
+  let delegation = null;
+  if (parentOf(parentRecord)) {
+    const inherited = delegationOfRecord(parent, parentRecord, depth + 1);
+    if (!inherited || inherited.path.length >= MAX_PATH) return null;
+    delegation = { ...inherited, path: [...inherited.path, step] };
+  } else {
+    delegation = rootFrom(parent, parentRecord, step);
+  }
+  if (delegation && _liveSessions.get(id) === record) record.delegation = delegation;
+  return delegation;
+}
+
+/**
+ * The `delegation` to record on a session being created with `opts` (its
+ * owner/visibility, parentSessionId/ownerSessionId and agent), or
+ * null: none for a top-level session, none for one whose parent's root cannot
+ * be established (it is no bot's session: nothing is asked or mirrored for it).
+ */
+export function delegationForNewSession(opts = {}) {
+  const parent = parentOf(opts);
+  if (!parent || parent === clean(opts.id)) return null;
+  return delegationUnder(parent, stepOf(opts));
+}
+
+/** The delegation of a session taking `step` under the session `parent`. */
+function delegationUnder(parent, step) {
+  const record = loadRecord(parent);
+  if (record && parentOf(record)) {
+    // The parent is delegated itself: its recorded root, one step deeper.
+    const inherited = delegationOfRecord(parent, record);
+    if (!inherited || inherited.path.length >= MAX_PATH) return null;
+    return { ...inherited, path: [...inherited.path, step] };
+  }
+  return rootFrom(parent, record, step);
+}
+
+/**
+ * Session `callerSessionId` sends the sub-agent or task session `sessionId`
+ * new work (`agent send`, a spawn of its tag, a task-session send): from now
+ * on it is run-stamped as it would have been created under the caller, and a
+ * sub-agent is rooted under the caller's root when one can be established; the
+ * record is saved, so a restart keeps it — work an unattended run started is
+ * attended when the chat later reuses it, and the reverse. The run is passed on
+ * whether or not a root resolves. A turn already running is never made a run
+ * mid-turn. Resolves true when the record changed; false when nothing applies
+ * (no record, neither a sub-agent nor a task session, no or the same caller,
+ * nothing different).
+ */
+export async function rebindDelegation(sessionId, callerSessionId) {
+  const id = clean(sessionId);
+  const caller = clean(callerSessionId);
+  const record = id ? loadRecord(id) : null;
+  if (!record || record.closed === true || !caller || caller === id) return false;
+  const delegated = Boolean(parentOf(record));
+  if (!delegated && !record.taskOrigin) return false;
+  const next = delegated ? delegationUnder(caller, stepOf(record)) : null;
+  const run = runOfSession(caller);
+  const current = stampRun(id, record);
+  const same = (a, b) => JSON.stringify(a ?? null) === JSON.stringify(b ?? null);
+  const reroot = Boolean(next) && !same(validDelegation(record.delegation), next);
+  if (!reroot && same(current, run)) return false;
+  if (run && !current && isTurnInFlight(runtimeState.get(id))) return false;
+  if (reroot) record.delegation = next;
+  if (run || current) record.run = run; // null = attended: legacy provenance no longer applies
+  await saveSessionAsync(record, { expectedGeneration: record.generation });
+  return true;
+}
+
+/** `{ state: 'resolved', ...delegation }` for a sub-agent whose root is known,
+ *  else `{ state: 'top' }`: a top-level session, one with no record, or one
+ *  with a parent link and no derivable root (no bot's session either). */
+export function delegationOf(sessionId) {
+  const id = clean(sessionId);
+  const record = id ? loadRecord(id) : null;
+  const parent = record ? parentOf(record) : '';
+  const delegation = parent && parent !== id ? delegationOfRecord(id, record) : null;
+  return delegation ? { state: 'resolved', ...delegation } : { state: 'top' };
+}

package/src/runtime/agent/orchestrator/session/human-gate/gate.mjs

@@ -9,17 +9,29 @@
 // actingBotId); an ordinary coding session's outbound call passes with the
 // hook decision unchanged. Other surfaces (group rooms) call it with their own
 // decision to get the same outbound rule. After the user answered,
-// recordHumanDecision stores a "don't ask again" grant and the audit line. Unattended runs (schedule, webhook, room member) register a
-// port here (session-runtime/held-requests.mjs) that turns their asks into
-// held requests instead of an approval card.
+// recordHumanDecision stores a "don't ask again" grant and the audit line.
+// Schedule and webhook runs never ask (run-policy.mjs): ordinary actions are
+// allowed, payments and permanent deletes denied. Group-room members register
+// a port here (session-runtime/held-requests.mjs) that turns their asks into
+// held requests when no approval card is attached.
 import { MIXY_AGENT_ID, agentIdOfHomeSession } from '../agent-home.mjs';
 import { serverConnector } from '../../mcp/server-connectors.mjs';
 import { readAgentDefinitionKind } from '../../../../shared/agent-kind.mjs';
 import { isContactAgentId } from '../../../../shared/agent-route-config.mjs';
 import { mixdogRoot, resolvePluginData } from '../../../../shared/plugin-paths.mjs';
 import { roomMemberOfSession } from '../agent-room.mjs';
-import { classifyOutboundCall, isRememberableAction } from './outbound-policy.mjs';
+import { agentDisplayName } from '../../context/role-instructions.mjs';
+import { delegationOf } from './delegation.mjs';
+import { setUnattendedApprovalPort, unattendedApprovalPort } from './unattended-port.mjs';
+import { classifyAsDelete, classifyOutboundCall, isRememberableAction } from './outbound-policy.mjs';
 import { humanGateStore } from './store.mjs';
+import {
+  AUTOMATION_GRANT_REASON,
+  RUN_FORBIDDEN_REASON,
+  isGrantedRun,
+  isRemoteDeleteInRun,
+  savesAutomation,
+} from './run-policy.mjs';
 
 export const OUTBOUND_APPROVAL_REASON = 'This sends or posts outside Mixdog; it needs your approval.';
 export const BLOCKED_ACTION_REASON = "This agent's permission blocks this action.";
@@ -27,46 +39,70 @@ export const BLOCKED_ACTION_REASON = "This agent's permission blocks this action
  *  payments and deletes never. */
 const outboundRemember = (category) => (isRememberableAction(category) ? ['once', 'agent'] : ['once']);
 
-let unattendedPort = null;
-/** `{ runOf(sessionId) → { kind, agentId, name } | null, hold(request, { signal }) → Promise<approval>,
- *  humanNeeded(sessionId, outcome, site) → Promise<boolean> }` — the last ends a schedule/webhook
- *  run that would need a takeover (session-runtime/held-requests.mjs). */
-export function setUnattendedApprovalPort(port) {
-  unattendedPort = port || null;
-}
-export function unattendedApprovalPort() {
-  return unattendedPort;
-}
+// The unattended runs' port lives in unattended-port.mjs; its setter and
+// getter are re-exported here.
+export { setUnattendedApprovalPort, unattendedApprovalPort };
 
-/** The agent a session is bound to: its unattended run's owner, a room
- *  member, a home thread's agent; '' for any other (coding) session. */
-function boundAgentId(sessionId) {
-  const run = unattendedPort?.runOf?.(sessionId);
+/** The agent a session is bound to by itself: its unattended run's owner, a
+ *  room member, a home thread's agent; '' for any other session. */
+function ownBoundAgentId(sessionId) {
+  const run = unattendedApprovalPort()?.runOf?.(sessionId);
   if (run?.agentId) return run.agentId;
   return roomMemberOfSession(sessionId)?.agentId || agentIdOfHomeSession(sessionId) || '';
 }
 
 /** The agent a session acts for: its unattended run's owner, a room member,
- *  a home thread's agent, else Mixy. */
+ *  a home thread's agent, else Mixy. Work a schedule/webhook run started (a
+ *  sub-agent, a task session) acts for the run's owner; a chat's sub-agent, a
+ *  chat-created task session and a coding Lead are bound to nothing. */
 export function agentIdForSession(sessionId) {
-  return boundAgentId(sessionId) || MIXY_AGENT_ID;
+  return ownBoundAgentId(sessionId) || MIXY_AGENT_ID;
 }
 
 /** The bot a session acts for, or '' when none: Mixy in her own home thread
  *  (or her unattended run / room member session), or a contact agent (`kind:
  *  bot`, isContactAgentId) in its home thread, room member session or
- *  unattended run. A coding Lead (also id 'lead'), its workflow agents and
- *  their sub-agent sessions are bound to nothing here, so they are no bot.
- *  A sub-agent of a bot has its own session id and no link back to the
- *  caller in this layer, so it is not gated either. */
-function actingBotId(sessionId) {
-  const id = boundAgentId(sessionId);
+ *  unattended run. Work a schedule/webhook run started (a sub-agent, a task
+ *  session) resolves to the run's bot (ownBoundAgentId → runOf). A coding Lead
+ *  (also id 'lead'), a task session a bot created in a chat, their workflow
+ *  agents and every sub-agent of a chat (also a bot's) are bound to nothing
+ *  here, so they are no bot. */
+export function actingBotId(sessionId) {
+  const id = ownBoundAgentId(sessionId);
   if (!id) return '';
   if (id === MIXY_AGENT_ID) return id;
   const kind = readAgentDefinitionKind({ dataDir: resolvePluginData(), shippedRoot: mixdogRoot(), id });
   return isContactAgentId(id, kind) ? id : '';
 }
 
+/** The contact bot (`kind: bot`) a session acts for, or '' for Mixy, a coding
+ *  Lead, a workflow agent and every other session. Mixy shares the `lead` id
+ *  with the coding Lead (her connector policy is hers alone, never the Lead's:
+ *  connectorPolicyAgentOf), and a standing allow is a contact bot's own policy
+ *  entry: none is offered to Mixy, a Lead or a workflow agent. */
+export function actingContactBotId(sessionId) {
+  const id = actingBotId(sessionId);
+  return id && id !== MIXY_AGENT_ID ? id : '';
+}
+
+// Chain token the desktop translates (ApprovalCard approvalChainLabel).
+const LEAD_NAME = 'Lead';
+
+/** Where a sub-agent's approval cards also surface, and who is asking:
+ *  `{ sessionId, chain }` — the session it works under (a coding Lead, a
+ *  bot-created task session, a bot's home chat or room member session) and
+ *  the names from there down to the asker ("Lead › Reviewer", "사무관 ›
+ *  Worker"). Only where the card shows: no bot identity, grant or remember
+ *  scope follows from it. Null for a top-level session. */
+export function approvalSurface(sessionId) {
+  const delegation = delegationOf(sessionId);
+  if (delegation.state !== 'resolved') return null;
+  const bot = delegation.via === 'bot' ? ownBoundAgentId(delegation.rootSessionId) : '';
+  const chain = [bot ? agentDisplayName(bot) || bot : LEAD_NAME];
+  for (const step of delegation.path) chain.push(agentDisplayName(step.agent) || step.agent);
+  return { sessionId: delegation.rootSessionId, chain };
+}
+
 const actionOf = (decision) => String(decision?.action || decision?.decision || '').toLowerCase();
 
 async function mcpAnnotations(name, scopeId) {
@@ -114,21 +150,44 @@ async function describeEmails(call, outbound, ctx) {
  * @param {{ name: string, args: any }} call
  * @param {object|null} decision the PreToolUse decision so far
  * @param {{ sessionId?: string, mcpScopeId?: string, annotations?: object, store?: object }} ctx
- * @returns {Promise<{ decision: object|null, request: object|null, gate: object|null }>}
+ * @returns {Promise<{ decision: object|null, request: object|null, gate: object|null, remembered?: true }>}
  *   `request` holds the kind-specific fields an `ask` presents; `gate` the
- *   audit identity `{ agentId, kind, action, tool, target }`.
+ *   audit identity `{ agentId, kind, action, tool, target }`; `remembered`
+ *   marks an outbound call a stored grant already answered.
  */
 export async function humanGateDecision(call, decision, ctx = {}) {
   const action = actionOf(decision);
   if (action === 'deny' || action === 'block') return { decision, request: null, gate: null };
   const agentId = agentIdForSession(ctx.sessionId);
   const annotations = ctx.annotations ?? (await mcpAnnotations(call?.name, ctx.mcpScopeId));
-  const classified = classifyOutboundCall({ name: call?.name, args: call?.args, annotations });
+  let classified = classifyOutboundCall({ name: call?.name, args: call?.args, annotations });
+  const remoteDelete = isRemoteDeleteInRun({ name: call?.name, annotations }, classified);
+  // In a schedule/webhook run only a recoverable trash may delete remote items.
+  if (isGrantedRun(unattendedApprovalPort()?.runOf?.(ctx.sessionId)) && remoteDelete) {
+    const store = ctx.store || (await humanGateStore());
+    await store.recordAudit({
+      agentId,
+      kind: 'outbound',
+      action: 'delete',
+      tool: String(call?.name || ''),
+      target: '',
+      decision: 'run-forbidden',
+      device: '',
+    });
+    const base = decision && typeof decision === 'object' ? decision : {};
+    return { decision: { ...base, action: 'deny', reason: RUN_FORBIDDEN_REASON }, request: null, gate: null };
+  }
+  // Where a bot is attended, the same connector delete the runs refuse
+  // (delete_message, remove_member…) is a permanent delete: it asks, never remembered.
+  if (remoteDelete && classified?.category !== 'delete' && classified?.category !== 'payment') {
+    classified = classifyAsDelete({ name: call?.name, args: call?.args });
+  }
   const outbound = classified && actingBotId(ctx.sessionId) ? classified : null;
   if (!outbound) {
     if (action !== 'ask') return { decision, request: null, gate: null };
     return {
-      decision,
+      // Saving a schedule or webhook says plainly what the approval grants.
+      decision: savesAutomation(call) ? { ...decision, reason: AUTOMATION_GRANT_REASON } : decision,
       request: { kind: 'approval', agentId, remember: ['once'] },
       gate: { agentId, kind: 'approval', tool: String(call?.name || ''), target: '' },
     };
@@ -145,8 +204,10 @@ export async function humanGateDecision(call, decision, ctx = {}) {
       editable: outbound.editable,
       details: outbound.details,
     },
-    remember: outboundRemember(outbound.category),
+    remember: ['once'],
   };
+  // "Don't ask again" is the bot's permission.
+  request.remember = outboundRemember(outbound.category);
   const store = ctx.store || (await humanGateStore());
   const mode = await store.modeFor({ agentId, action: outbound.category });
   const base = decision && typeof decision === 'object' ? decision : {};
@@ -156,7 +217,8 @@ export async function humanGateDecision(call, decision, ctx = {}) {
   }
   if (action !== 'ask' && mode === 'allow') {
     await store.recordAudit({ ...gate, decision: 'remembered', device: '' });
-    return { decision, request: null, gate: null };
+    // The remembered grant answers this call: no later layer asks it again.
+    return { decision, request: null, gate: null, remembered: true };
   }
   const described = await describeEmails(call, outbound, ctx);
   if (described) {
@@ -173,7 +235,8 @@ export async function humanGateDecision(call, decision, ctx = {}) {
   return {
     decision: { ...(rewriting ? base : unrewritten), action: 'ask', reason: base.reason || OUTBOUND_APPROVAL_REASON },
     request,
-    gate,
+    // The scopes this request offered: a grant is stored only for one of them.
+    gate: { ...gate, remember: request.remember },
   };
 }
 
@@ -185,8 +248,12 @@ export async function recordHumanDecision(gate, approval, { store } = {}) {
   let decision = approval?.response || (approval?.approved === true ? 'approve' : 'deny');
   if (approval?.timedOut) decision = 'timeout';
   const device = typeof approval?.device === 'string' ? approval.device : '';
-  if (approval?.approved === true && gate.action) {
+  // A scope the request did not offer (a payment or permanent delete is only
+  // ever answered once) stores nothing.
+  const offered = !Array.isArray(gate.remember) || gate.remember.includes(approval?.remember);
+  if (approval?.approved === true && gate.action && offered) {
     await target.grant({ agentId: gate.agentId, action: gate.action, scope: approval.remember, device });
   }
-  await target.recordAudit({ ...gate, decision, device });
+  const { remember: _offered, ...audit } = gate;
+  await target.recordAudit({ ...audit, decision, device });
 }

package/src/runtime/agent/orchestrator/session/human-gate/outbound-policy.mjs

@@ -23,6 +23,14 @@ export const ACTION_KINDS = Object.freeze([
   'payment',
   'delete',
   'trash',
+  // Browser Use gated actions (main/browser/action-approval.ts): a form
+  // submit / Enter, a click on a send or post control, and a file upload. They
+  // are not classified here (the desktop browser host asks); only their grants
+  // live in this store. Operator-confirmed actions
+  // (MIXDOG_BROWSER_CONFIRM_ACTIONS) have no kind: they always ask.
+  'browser_submit',
+  'browser_post',
+  'browser_upload',
 ]);
 const UNREMEMBERED_ACTIONS = new Set(['payment', 'delete']);
 
@@ -204,6 +212,18 @@ export function classifyOutboundCall({ name, args, annotations } = {}) {
   if (!category && annotations?.readOnlyHint === true) return null;
   if (!category && annotations?.outboundHint === true) category = 'message';
   if (!category) return null;
+  return mcpOutbound(toolName, server, input, category);
+}
+
+/** The classification of connector tool `name` as a permanent delete — for a
+ *  delete the name-based list above does not know (run-policy.mjs decides which). */
+export function classifyAsDelete({ name, args } = {}) {
+  const toolName = String(name || '');
+  const [, server = ''] = toolName.split('__');
+  return mcpOutbound(toolName, server, isRecord(args) ? args : {}, 'delete');
+}
+
+function mcpOutbound(toolName, server, input, category) {
   const details = detailsOf(category, input);
   const spends = category === 'payment' || category === 'delete';
   return {