pi-codex-auto-review 0.1.4 → 0.2.0

package/dist/tools/controller.js

@@ -1,26 +1,28 @@
-import { randomUUID } from 'node:crypto';
-import { createBashToolDefinition } from '@earendil-works/pi-coding-agent';
-import { pathToFileURL } from 'node:url';
-import { createAction, canonicalJson, digest, GuardError, TOOL_NAMES } from '../contracts.js';
-import { PolicyEngine, canonicalPath, resolveToolPath } from '../policy/index.js';
-import { PiReviewProvider } from '../reviewer.js';
-import { redact } from '../audit.js';
-import { reviewEnvironment, redactedEnvironmentNames } from './environment.js';
-import { withApprovalMutationQueue } from './mutation-queue.js';
-import { ReviewContextStore, safeEvidence } from '../review/context.js';
-import { LocalInvestigation } from '../review/investigation.js';
-import { reviewFeedback } from '../review/lifecycle.js';
-import { observeToolUserInput } from '../review/user-input.js';
-import { externalInvocations, externalPolicy } from './external.js';
+import { randomUUID } from "node:crypto";
+import { pathToFileURL } from "node:url";
+import { createBashToolDefinition, } from "@earendil-works/pi-coding-agent";
+import { redact } from "../audit.js";
+import { canonicalJson, createAction, digest, GuardError, TOOL_NAMES, } from "../contracts.js";
+import { canonicalPath, PolicyEngine, resolveToolPath, } from "../policy/index.js";
+import { ReviewContextStore, safeEvidence } from "../review/context.js";
+import { LocalInvestigation } from "../review/investigation.js";
+import { reviewFeedback } from "../review/lifecycle.js";
+import { observeToolUserInput } from "../review/user-input.js";
+import { PiReviewProvider, } from "../reviewer.js";
+import { redactedEnvironmentNames, reviewEnvironment } from "./environment.js";
+import { externalInvocations, externalPolicy, } from "./external.js";
+import { withApprovalMutationQueue } from "./mutation-queue.js";
 export class GuardController {
     options;
     currentPolicy;
-    get policy() { return this.currentPolicy; }
+    get policy() {
+        return this.currentPolicy;
+    }
     approvals;
     sources = new Map();
     ownedOperations = new WeakSet();
     stopped = new AbortController();
-    sessionId = 'not-started';
+    sessionId = "not-started";
     isReady = false;
     reviewContext;
     activeReviews = new Set();
@@ -48,26 +50,32 @@ export class GuardController {
             await policy.initialize(cwd);
             this.assertReady();
             await persist(settings);
-            this.stopped.abort(new GuardError('SETTINGS_CHANGED', 'Approval settings changed'));
+            this.stopped.abort(new GuardError("SETTINGS_CHANGED", "Approval settings changed"));
             this.stopped = new AbortController();
             this.approvals.invalidate();
             this.activeReviews.clear();
             this.retryArguments.clear();
             this.options.settings = settings;
             Object.assign(this.approvals.options, {
-                approvalsReviewer: settings.approvalsReviewer, approvalPolicy: settings.approvalPolicy,
-                reviewTimeoutMs: settings.reviewTimeoutMs, approvalTimeoutMs: settings.approvalTimeoutMs,
+                approvalsReviewer: settings.approvalsReviewer,
+                approvalPolicy: settings.approvalPolicy,
+                reviewTimeoutMs: settings.reviewTimeoutMs,
+                approvalTimeoutMs: settings.approvalTimeoutMs,
             });
             this.currentPolicy = policy;
         });
         this.settingsUpdates = task.catch(() => { });
         await task;
     }
-    assertReady() { if (!this.isReady || this.stopped.signal.aborted)
-        throw new GuardError('GUARD_NOT_READY', 'Guard is not ready for execution'); }
-    isBoundToSession(sessionId) { return this.sessionId === sessionId && !this.stopped.signal.aborted; }
+    assertReady() {
+        if (!this.isReady || this.stopped.signal.aborted)
+            throw new GuardError("GUARD_NOT_READY", "Guard is not ready for execution");
+    }
+    isBoundToSession(sessionId) {
+        return this.sessionId === sessionId && !this.stopped.signal.aborted;
+    }
     reset(sessionId, manager) {
-        this.stopped.abort(new GuardError('SESSION_CHANGED', 'Session changed'));
+        this.stopped.abort(new GuardError("SESSION_CHANGED", "Session changed"));
         this.stopped = new AbortController();
         this.sessionId = sessionId;
         this.reviewContext.reset(sessionId, manager);
@@ -86,25 +94,50 @@ export class GuardController {
     }
     async authorizeRetry(id, context) {
         this.assertReady();
-        const denial = this.approvals.lifecycle.authorizeRetry(id, { sessionId: context.sessionManager.getSessionId(), contextId: this.reviewContext.identity, cwd: await canonicalPath(context.cwd, context.cwd), policyRevision: this.policy.revision, permissionDigest: digest(this.policy.profile) });
+        const denial = this.approvals.lifecycle.authorizeRetry(id, {
+            sessionId: context.sessionManager.getSessionId(),
+            contextId: this.reviewContext.identity,
+            cwd: await canonicalPath(context.cwd, context.cwd),
+            policyRevision: this.policy.revision,
+            permissionDigest: digest(this.policy.profile),
+        });
         const args = this.retryArguments.get(id) ?? denial.action.args;
         this.retryArguments.delete(id);
         return { denial, args };
     }
     async retryUserBash(action, context) {
         const next = createAction({ ...action, toolCallId: randomUUID() }, this.policy.profile);
-        const command = String(next.args.command), shellPath = String(next.args.shellPath ?? '/bin/bash');
-        await this.admitAndExecute(next, { kind: 'shell', command, shellPath, cwd: next.cwd }, context, { timeoutSeconds: typeof next.args.timeout === 'number' ? next.args.timeout : undefined, env: next.args.environment });
+        const command = String(next.args.command), shellPath = String(next.args.shellPath ?? "/bin/bash");
+        await this.admitAndExecute(next, { kind: "shell", command, shellPath, cwd: next.cwd }, context, {
+            timeoutSeconds: typeof next.args.timeout === "number"
+                ? next.args.timeout
+                : undefined,
+            env: next.args.environment,
+        });
+    }
+    authorizeUser(text) {
+        this.reviewContext.authorize(text);
+        this.approvals.lifecycle.invalidateRetries();
     }
-    authorizeUser(text) { this.reviewContext.authorize(text); this.approvals.lifecycle.invalidateRetries(); }
     noteCall(event) {
-        this.sources.set(event.toolCallId, event.parentToolCallId ? 'nested' : 'model');
+        this.sources.set(event.toolCallId, event.parentToolCallId ? "nested" : "model");
         const callIdentity = this.reviewContext.callIdentity(event.toolCallId);
-        this.reviewContext.toolCall({ tool: event.toolName, toolCallId: event.toolCallId, callIdentity, args: JSON.parse(canonicalJson(event.input)),
-            ...(event.parentToolCallId ? { parentToolCallId: event.parentToolCallId, parentCallIdentity: this.reviewContext.callIdentity(event.parentToolCallId) } : {}),
+        this.reviewContext.toolCall({
+            tool: event.toolName,
+            toolCallId: event.toolCallId,
+            callIdentity,
+            args: JSON.parse(canonicalJson(event.input)),
+            ...(event.parentToolCallId
+                ? {
+                    parentToolCallId: event.parentToolCallId,
+                    parentCallIdentity: this.reviewContext.callIdentity(event.parentToolCallId),
+                }
+                : {}),
         }, callIdentity);
     }
-    completeCall(toolCallId) { this.sources.delete(toolCallId); }
+    completeCall(toolCallId) {
+        this.sources.delete(toolCallId);
+    }
     async close() {
         this.isReady = false;
         this.stopped.abort();
@@ -115,40 +148,88 @@ export class GuardController {
         await this.settingsUpdates;
     }
     ui(context, isOnceOnly = false) {
-        if (!context.hasUI || (context.mode !== 'tui' && context.mode !== 'rpc'))
+        if (!context.hasUI ||
+            (context.mode !== "tui" && context.mode !== "rpc"))
             return undefined;
-        const scopes = { 'Allow once': 'once', 'Allow for this session': 'session', 'Save as an allow rule': 'persistent', 'Deny': 'deny' };
-        return { select: async (action, delta, options) => {
+        const scopes = {
+            "Allow once": "once",
+            "Allow for this session": "session",
+            "Save as an allow rule": "persistent",
+            Deny: "deny",
+        };
+        return {
+            select: async (action, delta, options) => {
                 const text = `Tool: ${action.tool}\nWorking directory: ${action.cwd}\nInput: ${canonicalJson(action.args)}\nRequested scope: ${canonicalJson(delta)}`;
-                const selected = await context.ui.select(`Approve this action?\n${text}`, isOnceOnly ? ['Allow once', 'Deny'] : Object.keys(scopes), { signal: options.signal, timeout: options.timeoutMs });
+                const selected = await context.ui.select(`Approve this action?\n${text}`, isOnceOnly ? ["Allow once", "Deny"] : Object.keys(scopes), { signal: options.signal, timeout: options.timeoutMs });
                 if (selected && selected in scopes)
                     this.reviewContext.confirm({
-                        actionDigest: action.digest, action: JSON.parse(canonicalJson(action)), requestedScope: JSON.parse(canonicalJson(delta)), choice: selected, scope: scopes[selected],
+                        actionDigest: action.digest,
+                        action: JSON.parse(canonicalJson(action)),
+                        requestedScope: JSON.parse(canonicalJson(delta)),
+                        choice: selected,
+                        scope: scopes[selected],
                     });
-                return selected ? scopes[selected] : undefined;
-            } };
+                return selected
+                    ? scopes[selected]
+                    : undefined;
+            },
+        };
     }
-    async requestAdmission(action, policyDecision, context, signal, trustedAuthorization = '') {
+    async requestAdmission(action, policyDecision, context, signal, trustedAuthorization = "") {
         this.reviewContext.refreshInstructions();
         if (context.getSystemPrompt)
             this.reviewContext.mainPrompt(context.getSystemPrompt());
         this.reviewContext.preparedAction(action);
         const executionContext = {
-            environmentId: 'local', platform: process.platform, architecture: process.arch, osIsolation: false,
-            permissionProfile: this.policy.profile, approvalPolicy: this.options.settings.approvalPolicy, approvalsReviewer: this.options.settings.approvalsReviewer,
+            environmentId: "local",
+            platform: process.platform,
+            architecture: process.arch,
+            osIsolation: false,
+            permissionProfile: this.policy.profile,
+            approvalPolicy: this.options.settings.approvalPolicy,
+            approvalsReviewer: this.options.settings.approvalsReviewer,
         };
-        let reviewContext = policyDecision.kind === 'ask' ? this.reviewContext.snapshot(this.options.settings.reviewContextChars, canonicalJson({ action, delta: policyDecision.delta, executionContext, policyReason: policyDecision.reason }).length + 1000) : undefined;
+        let reviewContext = policyDecision.kind === "ask"
+            ? this.reviewContext.snapshot(this.options.settings.reviewContextChars, canonicalJson({
+                action,
+                delta: policyDecision.delta,
+                executionContext,
+                policyReason: policyDecision.reason,
+            }).length + 1000)
+            : undefined;
         if (reviewContext && trustedAuthorization) {
             const { digest: previousDigest, ...fields } = reviewContext;
-            const data = { ...fields, items: [...reviewContext.items, { id: 'direct-user-bash', source: 'user', trust: 'authorization', content: safeEvidence(trustedAuthorization) }] };
+            const data = {
+                ...fields,
+                items: [
+                    ...reviewContext.items,
+                    {
+                        id: "direct-user-bash",
+                        source: "user",
+                        trust: "authorization",
+                        content: safeEvidence(trustedAuthorization),
+                    },
+                ],
+            };
             reviewContext = { ...data, digest: digest(data) };
         }
         const turnIdentity = this.reviewContext.turnIdentity;
         return this.approvals.admit(action, policyDecision, {
-            provider: this.options.provider ?? new PiReviewProvider(context, this.options.settings, new LocalInvestigation(this.options.executor, this.policy.profile, action.cwd)), ui: this.ui(context, policyDecision.requiresFreshReview || policyDecision.requiresUserInput), trustedAuthorization, signal, reviewContext, settings: this.options.settings, executionContext,
-            onReviewStart: () => { this.activeReviews.add(action.digest); if (context.hasUI)
-                context.ui.setStatus('auto-review', `Auto-review running (${this.activeReviews.size})`); },
-            onReviewResult: result => {
+            provider: this.options.provider ??
+                new PiReviewProvider(context, this.options.settings, new LocalInvestigation(this.options.executor, this.policy.profile, action.cwd)),
+            ui: this.ui(context, policyDecision.requiresFreshReview ||
+                policyDecision.requiresUserInput),
+            trustedAuthorization,
+            signal,
+            reviewContext,
+            settings: this.options.settings,
+            executionContext,
+            onReviewStart: () => {
+                this.activeReviews.add(action.digest);
+                if (context.hasUI)
+                    context.ui.setStatus("auto-review", `Auto-review running (${this.activeReviews.size})`);
+            },
+            onReviewResult: (result) => {
                 this.activeReviews.delete(action.digest);
                 if (turnIdentity !== this.reviewContext.turnIdentity)
                     return;
@@ -156,19 +237,34 @@ export class GuardController {
                     this.reviewContext.assessment(action, result);
                 if (!context.hasUI)
                     return;
-                const labels = { 'approved': 'approved', 'denied': 'denied', 'timed-out': 'timed out', 'aborted': 'cancelled', 'failed': 'failed' };
-                context.ui.setStatus('auto-review', this.activeReviews.size ? `Auto-review running (${this.activeReviews.size})` : result ? `Auto-review: ${labels[result.status]}` : undefined);
-                if (result && result.status !== 'approved' && result.status !== 'aborted')
-                    context.ui.notify(`Auto-review ${labels[result.status]}: ${redact('assessment' in result ? result.assessment.rationale : result.reason).slice(0, 1000)}`, 'warning');
+                const labels = {
+                    approved: "approved",
+                    denied: "denied",
+                    "timed-out": "timed out",
+                    aborted: "cancelled",
+                    failed: "failed",
+                };
+                context.ui.setStatus("auto-review", this.activeReviews.size
+                    ? `Auto-review running (${this.activeReviews.size})`
+                    : result
+                        ? `Auto-review: ${labels[result.status]}`
+                        : undefined);
+                if (result &&
+                    result.status !== "approved" &&
+                    result.status !== "aborted")
+                    context.ui.notify(`Auto-review ${labels[result.status]}: ${redact("assessment" in result ? result.assessment.rationale : result.reason).slice(0, 1000)}`, "warning");
+            },
+            onInterrupt: () => {
+                if (context.hasUI)
+                    context.ui.notify("Auto-review stopped this turn after repeated denials.", "warning");
+                context.abort?.();
             },
-            onInterrupt: () => { if (context.hasUI)
-                context.ui.notify('Auto-review stopped this turn after repeated denials.', 'warning'); context.abort?.(); },
         });
     }
     denied(admission, retryArguments) {
         if (admission.denialId && retryArguments)
             this.retryArguments.set(admission.denialId, retryArguments);
-        const retained = new Set(this.approvals.lifecycle.recentDenials.map(item => item.id));
+        const retained = new Set(this.approvals.lifecycle.recentDenials.map((item) => item.id));
         for (const id of this.retryArguments.keys())
             if (!retained.has(id))
                 this.retryArguments.delete(id);
@@ -176,34 +272,78 @@ export class GuardController {
             const feedback = reviewFeedback(admission.review);
             return new GuardError(feedback.code, `[${feedback.code}] ${feedback.message}`);
         }
-        return new GuardError('PERMISSION_DENIED', admission.reason);
+        return new GuardError("PERMISSION_DENIED", admission.reason);
+    }
+    isExternalTool(name) {
+        return this.externalTools.get(name)?.isEnabled === true;
     }
-    isExternalTool(name) { return this.externalTools.get(name)?.isEnabled === true; }
     wrapExternalTool(definition, identify) {
-        if (TOOL_NAMES.includes(definition.name) || definition.name === 'codemode')
-            throw new GuardError('RESERVED_TOOL', 'An external adapter cannot replace guarded local tools');
+        if (TOOL_NAMES.includes(definition.name) ||
+            definition.name === "codemode")
+            throw new GuardError("RESERVED_TOOL", "An external adapter cannot replace guarded local tools");
         const token = randomUUID(), execute = definition.execute;
-        this.externalTools.set(definition.name, { token, isEnabled: definition.exposure !== 'hidden' });
-        const schema = JSON.parse(JSON.stringify({ parameters: definition.parameters, description: definition.description, annotations: definition.annotations ?? {}, ...(definition.namespace ? { namespace: definition.namespace } : {}) }));
-        return { ...definition, execute: async (toolCallId, params, callerSignal, onUpdate, context) => {
+        this.externalTools.set(definition.name, {
+            token,
+            isEnabled: definition.exposure !== "hidden",
+        });
+        const schema = JSON.parse(JSON.stringify({
+            parameters: definition.parameters,
+            description: definition.description,
+            annotations: definition.annotations ?? {},
+            ...(definition.namespace
+                ? { namespace: definition.namespace }
+                : {}),
+        }));
+        return {
+            ...definition,
+            execute: async (toolCallId, params, callerSignal, onUpdate, context) => {
                 this.assertReady();
                 const lifetime = new AbortController();
-                const signal = AbortSignal.any([lifetime.signal, this.stopped.signal, this.approvals.lifecycle.signal, ...(callerSignal ? [callerSignal] : [])]);
+                const signal = AbortSignal.any([
+                    lifetime.signal,
+                    this.stopped.signal,
+                    this.approvals.lifecycle.signal,
+                    ...(callerSignal ? [callerSignal] : []),
+                ]);
                 signal.throwIfAborted();
                 const args = JSON.parse(canonicalJson(params ?? {}));
                 const identity = JSON.parse(JSON.stringify(identify()));
                 const identityDigest = digest(identity), cwd = await canonicalPath(context.cwd, context.cwd);
-                const action = createAction({ toolCallId, tool: definition.name, args: { arguments: args, externalTool: JSON.parse(JSON.stringify(identity)), schema,
-                        ...(identity.connectedAccountEmail ? { connected_account_email: identity.connectedAccountEmail } : {}),
-                    }, cwd, source: this.sources.get(toolCallId) ?? 'model', sessionId: context.sessionManager.getSessionId(), policyRevision: this.policy.revision }, this.policy.profile);
+                const action = createAction({
+                    toolCallId,
+                    tool: definition.name,
+                    args: {
+                        arguments: args,
+                        externalTool: JSON.parse(JSON.stringify(identity)),
+                        schema,
+                        ...(identity.connectedAccountEmail
+                            ? {
+                                connected_account_email: identity.connectedAccountEmail,
+                            }
+                            : {}),
+                    },
+                    cwd,
+                    source: this.sources.get(toolCallId) ?? "model",
+                    sessionId: context.sessionManager.getSessionId(),
+                    policyRevision: this.policy.revision,
+                }, this.policy.profile);
                 const authorizationVersion = this.reviewContext.scopeVersion, turn = this.reviewContext.turnIdentity;
                 const checkCurrent = async () => {
                     this.assertReady();
                     signal.throwIfAborted();
-                    if (this.externalTools.get(definition.name)?.token !== token || !this.isExternalTool(definition.name) || digest(JSON.parse(JSON.stringify(identify()))) !== identityDigest)
-                        throw new GuardError('STALE_EXTERNAL_TOOL', 'External registration changed; a fresh action must be reviewed');
-                    if (this.reviewContext.scopeVersion !== authorizationVersion || this.reviewContext.turnIdentity !== turn || this.sessionId !== action.sessionId || this.policy.revision !== action.policyRevision || await canonicalPath(context.cwd, context.cwd) !== cwd)
-                        throw new GuardError('STALE_APPROVAL', 'External execution context changed after admission');
+                    if (this.externalTools.get(definition.name)?.token !==
+                        token ||
+                        !this.isExternalTool(definition.name) ||
+                        digest(JSON.parse(JSON.stringify(identify()))) !==
+                            identityDigest)
+                        throw new GuardError("STALE_EXTERNAL_TOOL", "External registration changed; a fresh action must be reviewed");
+                    if (this.reviewContext.scopeVersion !==
+                        authorizationVersion ||
+                        this.reviewContext.turnIdentity !== turn ||
+                        this.sessionId !== action.sessionId ||
+                        this.policy.revision !== action.policyRevision ||
+                        (await canonicalPath(context.cwd, context.cwd)) !== cwd)
+                        throw new GuardError("STALE_APPROVAL", "External execution context changed after admission");
                     signal.throwIfAborted();
                 };
                 const approve = async (candidate, candidateIdentity) => {
@@ -215,12 +355,36 @@ export class GuardController {
                 };
                 try {
                     await approve(action, identity);
-                    const result = await externalInvocations.run({ toolCallId, identity, arguments: args, signal, checkCurrent, approveNested: async (nestedIdentity, nestedArgs) => {
-                            if (nestedIdentity.server !== identity.server || nestedIdentity.registration !== identity.registration)
+                    const result = await externalInvocations.run({
+                        toolCallId,
+                        identity,
+                        arguments: args,
+                        signal,
+                        checkCurrent,
+                        approveNested: async (nestedIdentity, nestedArgs) => {
+                            if (nestedIdentity.server !== identity.server ||
+                                nestedIdentity.registration !==
+                                    identity.registration)
                                 return false;
-                            const nested = createAction({ toolCallId: `${toolCallId}:elicitation:${randomUUID()}`, tool: definition.name, args: { arguments: nestedArgs, externalTool: JSON.parse(JSON.stringify(nestedIdentity)), schema, originatingActionDigest: action.digest,
-                                    ...(nestedIdentity.connectedAccountEmail ? { connected_account_email: nestedIdentity.connectedAccountEmail } : {}),
-                                }, cwd, source: 'nested', sessionId: action.sessionId, policyRevision: action.policyRevision }, this.policy.profile);
+                            const nested = createAction({
+                                toolCallId: `${toolCallId}:elicitation:${randomUUID()}`,
+                                tool: definition.name,
+                                args: {
+                                    arguments: nestedArgs,
+                                    externalTool: JSON.parse(JSON.stringify(nestedIdentity)),
+                                    schema,
+                                    originatingActionDigest: action.digest,
+                                    ...(nestedIdentity.connectedAccountEmail
+                                        ? {
+                                            connected_account_email: nestedIdentity.connectedAccountEmail,
+                                        }
+                                        : {}),
+                                },
+                                cwd,
+                                source: "nested",
+                                sessionId: action.sessionId,
+                                policyRevision: action.policyRevision,
+                            }, this.policy.profile);
                             try {
                                 await approve(nested, nestedIdentity);
                                 return true;
@@ -228,23 +392,31 @@ export class GuardController {
                             catch {
                                 return false;
                             }
-                        } }, () => execute.call(definition, toolCallId, args, signal, onUpdate, observeToolUserInput(context, action, this.reviewContext, signal)));
-                    await this.options.audit.record(action, 'execution', 'settled');
+                        },
+                    }, () => execute.call(definition, toolCallId, args, signal, onUpdate, observeToolUserInput(context, action, this.reviewContext, signal)));
+                    await this.options.audit.record(action, "execution", "settled");
                     return result;
                 }
                 catch (error) {
-                    await this.options.audit.record(action, 'execution', 'failed');
+                    await this.options.audit.record(action, "execution", "failed");
                     throw error;
                 }
                 finally {
                     lifetime.abort();
                     this.completeCall(toolCallId);
                 }
-            } };
+            },
+        };
     }
-    async admitAndExecute(action, job, context, options, trustedAuthorization = '', retryArguments) {
+    async admitAndExecute(action, job, context, options, trustedAuthorization = "", retryArguments) {
         this.assertReady();
-        const signal = AbortSignal.any([this.stopped.signal, ...(action.source === 'user-bash' ? [] : [this.approvals.lifecycle.signal]), ...(options.signal ? [options.signal] : [])]);
+        const signal = AbortSignal.any([
+            this.stopped.signal,
+            ...(action.source === "user-bash"
+                ? []
+                : [this.approvals.lifecycle.signal]),
+            ...(options.signal ? [options.signal] : []),
+        ]);
         const authorizationVersion = this.reviewContext.scopeVersion;
         const policyDecision = await this.policy.evaluate(action, signal);
         const admission = await this.requestAdmission(action, policyDecision, context, signal, trustedAuthorization);
@@ -252,25 +424,32 @@ export class GuardController {
             throw this.denied(admission, retryArguments);
         signal.throwIfAborted();
         if (this.reviewContext.scopeVersion !== authorizationVersion)
-            throw new GuardError('STALE_AUTHORIZATION', 'User authorization changed during review; request a fresh review');
-        if (this.sessionId !== action.sessionId || await canonicalPath(context.cwd, context.cwd) !== action.cwd || this.policy.revision !== action.policyRevision)
-            throw new GuardError('STALE_APPROVAL', 'Execution context changed after admission');
+            throw new GuardError("STALE_AUTHORIZATION", "User authorization changed during review; request a fresh review");
+        if (this.sessionId !== action.sessionId ||
+            (await canonicalPath(context.cwd, context.cwd)) !== action.cwd ||
+            this.policy.revision !== action.policyRevision)
+            throw new GuardError("STALE_APPROVAL", "Execution context changed after admission");
         const finalDecision = await this.policy.evaluate(action, signal);
-        if (finalDecision.kind === 'deny')
-            throw new GuardError('PERMISSION_DENIED', finalDecision.reason);
+        if (finalDecision.kind === "deny")
+            throw new GuardError("PERMISSION_DENIED", finalDecision.reason);
         if (digest(finalDecision.delta) !== digest(policyDecision.delta))
-            throw new GuardError('STALE_APPROVAL', 'Resolved permissions changed after admission');
-        if (digest(finalDecision.authority ?? null) !== digest(policyDecision.authority ?? null))
-            throw new GuardError('STALE_APPROVAL', 'Execution authority changed after admission');
+            throw new GuardError("STALE_APPROVAL", "Resolved permissions changed after admission");
+        if (digest(finalDecision.authority ?? null) !==
+            digest(policyDecision.authority ?? null))
+            throw new GuardError("STALE_APPROVAL", "Execution authority changed after admission");
         try {
             const result = await this.options.executor.execute(job, this.policy.profile, admission.delta, {
-                ...options, signal, authority: admission.authority, timeoutSeconds: options.timeoutSeconds ?? this.options.settings.executionTimeoutSeconds,
+                ...options,
+                signal,
+                authority: admission.authority,
+                timeoutSeconds: options.timeoutSeconds ??
+                    this.options.settings.executionTimeoutSeconds,
             });
-            await this.options.audit.record(action, 'execution', 'settled');
+            await this.options.audit.record(action, "execution", "settled");
             return result;
         }
         catch (error) {
-            await this.options.audit.record(action, 'execution', 'failed');
+            await this.options.audit.record(action, "execution", "failed");
             throw error;
         }
         finally {
@@ -280,54 +459,186 @@ export class GuardController {
     wrapTool(definition, toolOptions) {
         const tool = definition.name;
         if (!TOOL_NAMES.includes(tool))
-            throw new GuardError('UNKNOWN_LOCAL_TOOL', 'Cannot delegate unknown local tool');
-        const parameters = tool === 'bash' ? { ...definition.parameters, properties: { ...definition.parameters.properties,
-                sandbox_permissions: { type: 'string', enum: ['use_default', 'require_escalated'], description: 'Compatibility field: request approval review for this exact command.' },
-                additional_permissions: { type: 'object', properties: { readPaths: { type: 'array', items: { type: 'string' } }, writePaths: { type: 'array', items: { type: 'string' } }, domains: { type: 'array', items: { type: 'string' } } }, additionalProperties: false, description: 'Describe the exact additional action scope for approval review.' },
-                justification: { type: 'string', description: 'Explain the boundary crossing for review.' },
-            } } : definition.parameters;
-        return { ...definition, parameters, execute: async (toolCallId, params, signal, onUpdate, context) => {
+            throw new GuardError("UNKNOWN_LOCAL_TOOL", "Cannot delegate unknown local tool");
+        const parameters = tool === "bash"
+            ? {
+                ...definition.parameters,
+                properties: {
+                    ...definition.parameters.properties,
+                    sandbox_permissions: {
+                        type: "string",
+                        enum: ["use_default", "require_escalated"],
+                        description: "Compatibility field: request approval review for this exact command.",
+                    },
+                    additional_permissions: {
+                        type: "object",
+                        properties: {
+                            readPaths: {
+                                type: "array",
+                                items: { type: "string" },
+                            },
+                            writePaths: {
+                                type: "array",
+                                items: { type: "string" },
+                            },
+                            domains: {
+                                type: "array",
+                                items: { type: "string" },
+                            },
+                        },
+                        additionalProperties: false,
+                        description: "Describe the exact additional action scope for approval review.",
+                    },
+                    justification: {
+                        type: "string",
+                        description: "Explain the boundary crossing for review.",
+                    },
+                },
+            }
+            : definition.parameters;
+        return {
+            ...definition,
+            parameters,
+            execute: async (toolCallId, params, signal, onUpdate, context) => {
                 this.assertReady();
                 const cwd = await canonicalPath(context.cwd, context.cwd);
-                if (tool === 'bash') {
+                if (tool === "bash") {
                     const input = params;
-                    const requested = JSON.parse(canonicalJson(Object.fromEntries(['sandbox_permissions', 'additional_permissions', 'justification'].filter(key => input[key] !== undefined).map(key => [key, input[key]]))));
-                    const delegate = createBashToolDefinition(cwd, { ...toolOptions, operations: { exec: async (command, finalCwd, options) => {
+                    const requested = JSON.parse(canonicalJson(Object.fromEntries([
+                        "sandbox_permissions",
+                        "additional_permissions",
+                        "justification",
+                    ]
+                        .filter((key) => input[key] !== undefined)
+                        .map((key) => [key, input[key]]))));
+                    const delegate = createBashToolDefinition(cwd, {
+                        ...toolOptions,
+                        operations: {
+                            exec: async (command, finalCwd, options) => {
                                 const env = options.env;
-                                const shellPath = toolOptions?.shellPath ?? '/bin/bash';
-                                const args = { command, shellPath, ...(options.timeout !== undefined ? { timeout: options.timeout } : {}), environment: reviewEnvironment(env), redactedEnvironmentVariables: redactedEnvironmentNames(env), ...requested };
+                                const shellPath = toolOptions
+                                    ?.shellPath ?? "/bin/bash";
+                                const args = {
+                                    command,
+                                    shellPath,
+                                    ...(options.timeout !== undefined
+                                        ? { timeout: options.timeout }
+                                        : {}),
+                                    environment: reviewEnvironment(env),
+                                    redactedEnvironmentVariables: redactedEnvironmentNames(env),
+                                    ...requested,
+                                };
                                 const resolvedCwd = await canonicalPath(finalCwd, finalCwd);
-                                const action = createAction({ toolCallId, tool, args: JSON.parse(canonicalJson(args)), cwd: resolvedCwd, source: this.sources.get(toolCallId) ?? 'model', sessionId: context.sessionManager.getSessionId(), policyRevision: this.policy.revision }, this.policy.profile);
-                                return await this.admitAndExecute(action, { kind: 'shell', command, shellPath, cwd: resolvedCwd }, { ...context, cwd: finalCwd }, { signal: options.signal, timeoutSeconds: options.timeout, env, onData: options.onData }, '', JSON.parse(canonicalJson(params)));
-                            } } });
+                                const action = createAction({
+                                    toolCallId,
+                                    tool,
+                                    args: JSON.parse(canonicalJson(args)),
+                                    cwd: resolvedCwd,
+                                    source: this.sources.get(toolCallId) ??
+                                        "model",
+                                    sessionId: context.sessionManager.getSessionId(),
+                                    policyRevision: this.policy.revision,
+                                }, this.policy.profile);
+                                return (await this.admitAndExecute(action, {
+                                    kind: "shell",
+                                    command,
+                                    shellPath,
+                                    cwd: resolvedCwd,
+                                }, { ...context, cwd: finalCwd }, {
+                                    signal: options.signal,
+                                    timeoutSeconds: options.timeout,
+                                    env,
+                                    onData: options.onData,
+                                }, "", JSON.parse(canonicalJson(params))));
+                            },
+                        },
+                    });
                     return delegate.execute(toolCallId, params, signal, onUpdate, context);
                 }
                 const boundParameters = JSON.parse(canonicalJson(params));
                 const args = { ...boundParameters };
-                const target = await resolveToolPath(typeof args.path === 'string' ? args.path : '.', cwd, tool === 'read');
+                const target = await resolveToolPath(typeof args.path === "string" ? args.path : ".", cwd, tool === "read");
                 args.path = pathToFileURL(target).href;
-                const action = createAction({ toolCallId, tool, args, cwd, source: this.sources.get(toolCallId) ?? 'model', sessionId: context.sessionManager.getSessionId(), policyRevision: this.policy.revision }, this.policy.profile);
-                const options = tool === 'read' ? { ...toolOptions, ...(context.model?.inputLimits?.images?.resize ? { resizeOptions: context.model.inputLimits.images.resize } : {}) } : undefined;
+                const action = createAction({
+                    toolCallId,
+                    tool,
+                    args,
+                    cwd,
+                    source: this.sources.get(toolCallId) ?? "model",
+                    sessionId: context.sessionManager.getSessionId(),
+                    policyRevision: this.policy.revision,
+                }, this.policy.profile);
+                const options = tool === "read"
+                    ? {
+                        ...toolOptions,
+                        ...(context.model?.inputLimits?.images?.resize
+                            ? {
+                                resizeOptions: context.model.inputLimits.images
+                                    .resize,
+                            }
+                            : {}),
+                    }
+                    : undefined;
                 const delegate = definition;
-                const execute = () => this.admitAndExecute(action, { kind: 'tool', tool, args: action.args, cwd, toolCallId, ...(options ? { options } : {}) }, context, {
-                    signal, onUpdate: onUpdate ? result => onUpdate(result) : undefined,
-                    delegate: async (admittedSignal) => await delegate.execute(toolCallId, boundParameters, admittedSignal, onUpdate, context),
-                }, '', JSON.parse(canonicalJson(params)));
-                const result = await (tool === 'write' || tool === 'edit' ? withApprovalMutationQueue(await canonicalPath(target, cwd), execute) : execute());
+                const execute = () => this.admitAndExecute(action, {
+                    kind: "tool",
+                    tool,
+                    args: action.args,
+                    cwd,
+                    toolCallId,
+                    ...(options ? { options } : {}),
+                }, context, {
+                    signal,
+                    onUpdate: onUpdate
+                        ? (result) => onUpdate(result)
+                        : undefined,
+                    delegate: async (admittedSignal) => (await delegate.execute(toolCallId, boundParameters, admittedSignal, onUpdate, context)),
+                }, "", JSON.parse(canonicalJson(params)));
+                const result = await (tool === "write" || tool === "edit"
+                    ? withApprovalMutationQueue(await canonicalPath(target, cwd), execute)
+                    : execute());
                 return result;
-            } };
+            },
+        };
     }
     userBashOperations(context, trustedCommand) {
-        const operations = { exec: async (command, cwd, options) => {
+        const operations = {
+            exec: async (command, cwd, options) => {
                 const resolvedCwd = await canonicalPath(cwd, cwd);
                 const env = options.env;
-                const shellPath = this.options.shellPath ?? '/bin/bash';
-                const action = createAction({ toolCallId: randomUUID(), tool: 'bash', source: 'user-bash', args: JSON.parse(canonicalJson({ command, shellPath, environment: reviewEnvironment(env), redactedEnvironmentVariables: redactedEnvironmentNames(env), ...(options.timeout !== undefined ? { timeout: options.timeout } : {}) })), cwd: resolvedCwd, sessionId: context.sessionManager.getSessionId(), policyRevision: this.policy.revision }, this.policy.profile);
-                return await this.admitAndExecute(action, { kind: 'shell', command, shellPath, cwd: resolvedCwd }, context, { signal: options.signal, timeoutSeconds: options.timeout, env: options.env, onData: options.onData }, trustedCommand === undefined ? '' : `The user directly requested this shell command: ${trustedCommand}`, { command: trustedCommand ?? command });
-            } };
+                const shellPath = this.options.shellPath ?? "/bin/bash";
+                const action = createAction({
+                    toolCallId: randomUUID(),
+                    tool: "bash",
+                    source: "user-bash",
+                    args: JSON.parse(canonicalJson({
+                        command,
+                        shellPath,
+                        environment: reviewEnvironment(env),
+                        redactedEnvironmentVariables: redactedEnvironmentNames(env),
+                        ...(options.timeout !== undefined
+                            ? { timeout: options.timeout }
+                            : {}),
+                    })),
+                    cwd: resolvedCwd,
+                    sessionId: context.sessionManager.getSessionId(),
+                    policyRevision: this.policy.revision,
+                }, this.policy.profile);
+                return (await this.admitAndExecute(action, { kind: "shell", command, shellPath, cwd: resolvedCwd }, context, {
+                    signal: options.signal,
+                    timeoutSeconds: options.timeout,
+                    env: options.env,
+                    onData: options.onData,
+                }, trustedCommand === undefined
+                    ? ""
+                    : `The user directly requested this shell command: ${trustedCommand}`, { command: trustedCommand ?? command }));
+            },
+        };
         this.ownedOperations.add(operations);
         return operations;
     }
-    isGuardedOperations(operations) { return this.ownedOperations.has(operations); }
+    isGuardedOperations(operations) {
+        return this.ownedOperations.has(operations);
+    }
 }
 //# sourceMappingURL=controller.js.map