pi-daddy 0.17.0 → 0.18.0

package/dist/workspace-lease.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-lease.js","sourceRoot":"","sources":["../src/workspace-lease.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EACL,cAAc,EACd,UAAU,EACV,YAAY,GAIb,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACnC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAG3D,MAAM,CAAC,MAAM,uBAAuB,GAAG,+BAA+B,CAAC;AAEvE,MAAM,UAAU,wBAAwB,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC3E,MAAM,QAAQ,GAAG,GAAG,CAAC,mBAAmB,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IAC5E,OAAO,GAAG,CAAC,uBAAuB,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,kBAAkB,CAAC,CAAC;AACxF,CAAC;AAED,MAAM,WAAW,GAAG,sBAAsB,CAAC;AAC3C,oGAAoG;AACpG,kGAAkG;AAClG,mGAAmG;AACnG,iGAAiG;AACjG,mGAAmG;AACnG,mGAAmG;AACnG,iGAAiG;AACjG,MAAM,aAAa,GAAG;;;;uBAIC,IAAI,CAAC,SAAS,CAAC,GAAG,WAAW,GAAG,CAAC;;;;wBAIhC,CAAC;AAEzB;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CACvC,OAAyC,EACzC,MAAc;IAEd,IAAI,OAAO,KAAK,UAAU;QAAE,OAAO,UAAU,CAAC;IAC9C,IAAI,OAAO,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC;IACtC,IAAI,OAAO,KAAK,qBAAqB;QAAE,OAAO,qBAAqB,CAAC;IACpE,IAAI,OAAO,KAAK,UAAU;QAAE,OAAO,aAAa,CAAC;IACjD,0GAA0G;IAC1G,4DAA4D;IAC5D,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;AACvD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAwB,EACxB,SAA8B;IAE9B,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,aAAa,CAAC;IAC5C,OAAO,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC;AACvD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAU3C;IACC,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC5B,OAAO;YACL,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,SAAS,EAAE,KAAK;YAChB,aAAa,EAAE,GAAG,EAAE,GAAE,CAAC;YACvB,cAAc,EAAE,GAAG,EAAE,GAAE,CAAC;YACxB,YAAY,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC;YAC5B,gBAAgB,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI;YAClC,IAAI,EAAE,IAAI,OAAO,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC;YAC3B,yFAAyF;YACzF,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,UAAU;SAChC,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;QAC1B,MAAM,IAAI,iBAAiB,CAAC,OAAO,CAAC,0BAA0B,EAAE,oBAAoB,KAAK,CAAC,SAAS,CAAC,WAAW,mCAAmC,CAAC,CAAC,CAAC;IACvJ,CAAC;IAED,MAAM,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/D,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,YAAY,IAAI,OAAO,EAAE;QAClD,aAAa,EAAE,YAAY,EAAE,sBAAsB,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI;QACrE,OAAO,CAAC,QAAQ,EAAE,qBAAqB,EAAE,IAAI,EAAE,aAAa;KAC7D,EAAE;QACD,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;QAC/B,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,qBAAqB,EAAE,KAAK,CAAC,MAAM,EAAE,6BAA6B,EAAE,MAAM,CAAC,KAAK,CAAC,kBAAkB,IAAI,EAAE,CAAC,EAAE;QACnI,oGAAoG;QACpG,iGAAiG;QACjG,mGAAmG;QACnG,iBAAiB;QACjB,QAAQ,EAAE,IAAI;KACf,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,KAAK,CAAC,oBAAoB,IAAI,IAAI,CAAC;IACrD,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,SAA6B,CAAC;IAClC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB;;;;;;;OAOG;IACH,MAAM,QAAQ,GAAG,GAAG,EAAE;QACpB,kGAAkG;QAClG,kGAAkG;QAClG,+FAA+F;QAC/F,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAI,CAAC;gBAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,gBAAgB,CAAC,CAAC;QAClF,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;YAChC,IAAI,CAAC;gBAAC,OAAO,CAAC,IAAI,CAAC,SAAU,EAAE,SAAS,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACzB,CAAC,CAAC;IACF,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,IAAI,CAAC;QACH,MAAM,IAAI,OAAO,CAAO,CAAC,YAAY,EAAE,WAAW,EAAE,EAAE;YACpD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,iBAAiB,CAAC,OAAO,CACtE,uBAAuB,EAAE,mDAAmD,SAAS,IAAI,CAC1F,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;YAChB,MAAM,OAAO,GAAG,GAAG,EAAE;gBACnB,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,KAAK,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACtD,CAAC,CAAC;YACF,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,iBAAiB,CAAC,OAAO,CAC7D,0BAA0B,EAAE,oBAAoB,KAAK,CAAC,SAAS,CAAC,WAAW,mCAAmC,CAC/G,CAAC,CAAC,CAAC;YACJ,KAAK,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACjE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBAC7B,OAAO,EAAE,CAAC;gBACV,WAAW,CAAC,IAAI,iBAAiB,CAAC,OAAO,CACvC,uBAAuB,EAAE,4DAA4D,MAAM,CAAC,KAAK,CAAC,GAAG,CACtG,CAAC,CAAC,CAAC;YACN,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBAC5B,IAAI,KAAK;oBAAE,OAAO;gBAClB,OAAO,EAAE,CAAC;gBACV,MAAM,QAAQ,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,uBAAuB,CAAC;gBACpF,WAAW,CAAC,IAAI,iBAAiB,CAAC,OAAO,CACvC,QAAQ,EACR,IAAI,KAAK,EAAE;oBACT,CAAC,CAAC,aAAa,KAAK,CAAC,SAAS,CAAC,WAAW,iDAAiD;oBAC3F,CAAC,CAAC,mDAAmD,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAC5F,EAAE,YAAY,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAC1E,CAAC,CAAC,CAAC;YACN,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;gBAClC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC7B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,KAAK;oBAAE,OAAO;gBACnD,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,GAAG,WAAW,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC3E,KAAK,GAAG,IAAI,CAAC;gBACb,OAAO,EAAE,CAAC;gBACV,YAAY,EAAE,CAAC;YACjB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,QAAQ,EAAE,CAAC;QACX,MAAM,KAAK,CAAC;IACd,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACpD,mGAAmG;IACnG,MAAM,SAAS,GAAwB,QAAQ,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,KAAK,KAAK,QAAQ,CAAC;IAC3G,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAkB;QAC9B,OAAO,EAAE,CAAC;QACV,KAAK,EAAE,QAAQ;QACf,KAAK;QACL,QAAQ,EAAE,KAAK,CAAC,OAAO;QACvB,YAAY,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW;QACzC,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,IAAI;QAC1B,GAAG,EAAE,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;QAC3E,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACtC,CAAC;IACF,IAAI,CAAC;QACH,MAAM,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC;QACpB,MAAM,IAAI,iBAAiB,CAAC,OAAO,CACjC,uBAAuB,EAAE,mEAAmE,MAAM,CAAC,KAAK,CAAC,GAAG,EAC5G,EAAE,YAAY,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAC1E,CAAC,CAAC;IACL,CAAC;IAED,qGAAqG;IACrG,wGAAwG;IACxG,uGAAuG;IACvG,+FAA+F;IAC/F,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,OAAwC,CAAC;IAC7C,IAAI,IAA6B,CAAC;IAClC,MAAM,IAAI,GAAG,IAAI,OAAO,CAAQ,CAAC,WAAW,EAAE,EAAE,GAAG,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1E,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,IAAI,KAAK,CAAC,4CAA4C,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;IAC7G,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS;QAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI;QAAE,cAAc,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IACpG,MAAM,MAAM,GAAG,CAAC,KAAsD,EAAE,EAAE;QACxE,IAAI,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC;YACnG,MAAM,IAAI,iBAAiB,CAAC,OAAO,CACjC,uBAAuB,EAAE,oBAAoB,KAAK,CAAC,SAAS,CAAC,WAAW,mCAAmC,CAC5G,CAAC,CAAC;QACL,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACnD,CAAC,CAAC;IACF,OAAO;QACL,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,OAAO;QACf,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS;QACT,aAAa,CAAC,GAAG,IAAI,MAAM,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QACpD,cAAc,CAAC,KAAK,IAAI,MAAM,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;QACvD,IAAI;QACJ,KAAK,CAAC,YAAY,CAAC,MAAM,GAAG,UAAU;YACpC,iGAAiG;YACjG,8CAA8C;YAC9C,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACnD,IAAI,OAAO,KAAK,WAAW,IAAI,OAAO,EAAE,KAAK,KAAK,KAAK,EAAE,CAAC;gBACxD,MAAM,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE;oBACnC,GAAG,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,cAAc,EAAE,YAAY,MAAM,EAAE;iBAC5G,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QACD,KAAK,CAAC,gBAAgB;YACpB,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAA2C,CAAC;YACpG,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,WAAW;YAChC,qGAAqG;YACrG,gGAAgG;YAChG,IAAI,OAAO;gBAAE,OAAO,OAAO,CAAC;YAC5B,SAAS,GAAG,IAAI,CAAC;YACjB,8FAA8F;YAC9F,mFAAmF;YACnF,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI;gBAAE,OAAO,CAAC,OAAO,GAAG,MAAM,CAAC,CAAC;YAEtF,kGAAkG;YAClG,mGAAmG;YACnG,mGAAmG;YACnG,mGAAmG;YACnG,wCAAwC;YACxC,4FAA4F;YAC5F,mGAAmG;YACnG,0CAA0C;YAC1C,IAAI,GAAG,GAAwB,qBAAqB,CAAC;YACrD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACnD,IAAI,OAAO,KAAK,WAAW,IAAI,OAAO,EAAE,KAAK,KAAK,KAAK,EAAE,CAAC;gBACxD,IAAI,CAAC;oBACH,MAAM,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE;wBACnC,GAAG,QAAQ;wBACX,KAAK,EAAE,UAAU;wBACjB,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;wBACrC,cAAc,EAAE,MAAM;qBACvB,CAAC,CAAC;oBACH,GAAG,GAAG,UAAU,CAAC;gBACnB,CAAC;gBAAC,MAAM,CAAC;oBACP,GAAG,GAAG,qBAAqB,CAAC;gBAC9B,CAAC;YACH,CAAC;iBAAM,IAAI,OAAO,KAAK,WAAW,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACvD,gGAAgG;gBAChG,GAAG,GAAG,qBAAqB,CAAC;YAC9B,CAAC;YAED,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;YAC9D,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC;YACpB,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;gBAC3D,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3G,CAAC;YACD,4FAA4F;YAC5F,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI;gBAAE,QAAQ,EAAE,CAAC;YACvE,OAAO,CAAC,OAAO,GAAG,GAAG,CAAC,CAAC;QACzB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/workspace.d.ts

@@ -0,0 +1,32 @@
+export declare const ENV_WORKSPACE_REGISTRY = "PI_GRANTS_WORKSPACE_REGISTRY";
+export type WorkspaceAccess = "read" | "write";
+export interface WorkspaceRegistryFile {
+    version: 1;
+    workspaces: Record<string, {
+        path: string;
+    }>;
+}
+export interface ValidatedWorkspace {
+    workspaceId: string;
+    /** Canonical Git worktree root and the child's validated initial CWD. Not a sandbox. */
+    root: string;
+    gitCommonDir: string;
+}
+export declare function loadWorkspaceRegistry(path: string): Promise<WorkspaceRegistryFile>;
+export declare function resolveWorkspace(registry: WorkspaceRegistryFile, workspaceId: string): Promise<ValidatedWorkspace>;
+/**
+ * Canonicalize and validate the initial workspace against Git's registered worktree list.
+ * This prevents accidental misrouting. It does not constrain any path a child accesses after spawn.
+ */
+export declare function validateRegisteredWorkspace(input: {
+    workspaceId: string;
+    registeredRoot: string;
+    suppliedRoot?: string;
+}): Promise<ValidatedWorkspace>;
+/**
+ * The governed-writer lease lives in `./workspace-lease.ts` and is re-exported here so that
+ * "the workspace module" remains one import for callers. Split only to stay under the 400-line
+ * module ceiling this project enforces mechanically.
+ */
+export { ENV_WORKSPACE_LEASE_DIR, acquireWorkspaceLease, defaultWorkspaceLeaseDir, leaseAcquisitionOutcome, leaseReleaseLedgerOutcome, type LeaseReleaseOutcome, type WorkspaceLease, } from "./workspace-lease.ts";
+//# sourceMappingURL=workspace.d.ts.map

package/dist/workspace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace.d.ts","sourceRoot":"","sources":["../src/workspace.ts"],"names":[],"mappings":"AAUA,eAAO,MAAM,sBAAsB,iCAAiC,CAAC;AAGrE,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,OAAO,CAAC;AAE/C,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,CAAC,CAAC;IACX,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC9C;AAED,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,wFAAwF;IACxF,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA6BxF;AAED,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAUxH;AAED;;;GAGG;AACH,wBAAsB,2BAA2B,CAAC,KAAK,EAAE;IACvD,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAyC9B;AAED;;;;GAIG;AACH,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EACrB,wBAAwB,EACxB,uBAAuB,EACvB,yBAAyB,EACzB,KAAK,mBAAmB,EACxB,KAAK,cAAc,GACpB,MAAM,sBAAsB,CAAC"}

package/dist/workspace.js

@@ -0,0 +1,79 @@
+import { createHash, randomUUID } from "node:crypto";
+import { execFile } from "node:child_process";
+import { once } from "node:events";
+import { mkdir, readFile, realpath, rename, stat, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { isAbsolute, join } from "node:path";
+import { promisify } from "node:util";
+import { GovernanceRefusal, refusal } from "./refusals.js";
+const execFileAsync = promisify(execFile);
+export const ENV_WORKSPACE_REGISTRY = "PI_GRANTS_WORKSPACE_REGISTRY";
+export async function loadWorkspaceRegistry(path) {
+    let parsed;
+    try {
+        parsed = JSON.parse(await readFile(path, "utf8"));
+    }
+    catch (error) {
+        throw new GovernanceRefusal(refusal("WORKSPACE_NOT_REGISTERED", `workspace registry ${path} could not be read (${String(error)})`, { registry_path: path }));
+    }
+    const file = parsed;
+    if (file?.version !== 1 || !file.workspaces || typeof file.workspaces !== "object" || Array.isArray(file.workspaces)) {
+        throw new GovernanceRefusal(refusal("WORKSPACE_NOT_REGISTERED", `workspace registry ${path} must contain {version:1, workspaces:{id:{path}}}`, { registry_path: path }));
+    }
+    for (const [id, value] of Object.entries(file.workspaces)) {
+        if (!id || !value || typeof value.path !== "string" || !isAbsolute(value.path)) {
+            throw new GovernanceRefusal(refusal("WORKSPACE_NOT_REGISTERED", `workspace registry entry ${JSON.stringify(id)} must name an absolute path`, { registry_path: path, workspace_id: id }));
+        }
+    }
+    return { version: 1, workspaces: structuredClone(file.workspaces) };
+}
+export async function resolveWorkspace(registry, workspaceId) {
+    const registered = Object.hasOwn(registry.workspaces, workspaceId) ? registry.workspaces[workspaceId] : undefined;
+    if (!registered) {
+        throw new GovernanceRefusal(refusal("WORKSPACE_NOT_REGISTERED", `workspace ${JSON.stringify(workspaceId)} is not present in the operator-owned registry`, { workspace_id: workspaceId }));
+    }
+    return validateRegisteredWorkspace({ workspaceId, registeredRoot: registered.path });
+}
+/**
+ * Canonicalize and validate the initial workspace against Git's registered worktree list.
+ * This prevents accidental misrouting. It does not constrain any path a child accesses after spawn.
+ */
+export async function validateRegisteredWorkspace(input) {
+    let registered;
+    let supplied;
+    try {
+        registered = await realpath(input.registeredRoot);
+        supplied = await realpath(input.suppliedRoot ?? input.registeredRoot);
+        if (!(await stat(registered)).isDirectory())
+            throw new Error("registered root is not a directory");
+    }
+    catch (error) {
+        throw new GovernanceRefusal(refusal("WORKSPACE_NOT_REGISTERED", `workspace ${input.workspaceId} root could not be canonicalized (${String(error)})`, { workspace_id: input.workspaceId }));
+    }
+    if (registered !== supplied) {
+        throw new GovernanceRefusal(refusal("WORKSPACE_NOT_REGISTERED", `workspace ${input.workspaceId} resolved to ${supplied}, not its registered worktree ${registered}`, { workspace_id: input.workspaceId, supplied_root: supplied, registered_root: registered }));
+    }
+    try {
+        const top = (await execFileAsync("git", ["-C", registered, "rev-parse", "--show-toplevel"], { encoding: "utf8" })).stdout.trim();
+        const canonicalTop = await realpath(top);
+        if (canonicalTop !== registered)
+            throw new Error(`path is inside worktree ${canonicalTop}, not its root`);
+        const commonRaw = (await execFileAsync("git", ["-C", registered, "rev-parse", "--path-format=absolute", "--git-common-dir"], { encoding: "utf8" })).stdout.trim();
+        const gitCommonDir = await realpath(commonRaw);
+        const list = (await execFileAsync("git", ["-C", registered, "worktree", "list", "--porcelain"], { encoding: "utf8" })).stdout;
+        const registeredWorktrees = await Promise.all(list.split("\n").filter((line) => line.startsWith("worktree ")).map((line) => realpath(line.slice(9))));
+        if (!registeredWorktrees.includes(registered))
+            throw new Error("Git does not list this path as a worktree");
+        return { workspaceId: input.workspaceId, root: registered, gitCommonDir };
+    }
+    catch (error) {
+        throw new GovernanceRefusal(refusal("WORKSPACE_NOT_REGISTERED", `workspace ${input.workspaceId} is not the registered Git worktree it claims to be (${String(error)})`, { workspace_id: input.workspaceId, registered_root: registered }));
+    }
+}
+/**
+ * The governed-writer lease lives in `./workspace-lease.ts` and is re-exported here so that
+ * "the workspace module" remains one import for callers. Split only to stay under the 400-line
+ * module ceiling this project enforces mechanically.
+ */
+export { ENV_WORKSPACE_LEASE_DIR, acquireWorkspaceLease, defaultWorkspaceLeaseDir, leaseAcquisitionOutcome, leaseReleaseLedgerOutcome, } from "./workspace-lease.js";
+//# sourceMappingURL=workspace.js.map

package/dist/workspace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace.js","sourceRoot":"","sources":["../src/workspace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACnC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACtF,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAE3D,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAC1C,MAAM,CAAC,MAAM,sBAAsB,GAAG,8BAA8B,CAAC;AAiBrE,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAAY;IACtD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,iBAAiB,CAAC,OAAO,CACjC,0BAA0B,EAC1B,sBAAsB,IAAI,uBAAuB,MAAM,CAAC,KAAK,CAAC,GAAG,EACjE,EAAE,aAAa,EAAE,IAAI,EAAE,CACxB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,IAAI,GAAG,MAAwC,CAAC;IACtD,IAAI,IAAI,EAAE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACrH,MAAM,IAAI,iBAAiB,CAAC,OAAO,CACjC,0BAA0B,EAC1B,sBAAsB,IAAI,mDAAmD,EAC7E,EAAE,aAAa,EAAE,IAAI,EAAE,CACxB,CAAC,CAAC;IACL,CAAC;IACD,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1D,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/E,MAAM,IAAI,iBAAiB,CAAC,OAAO,CACjC,0BAA0B,EAC1B,4BAA4B,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,6BAA6B,EAC3E,EAAE,aAAa,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,CAC1C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;AACtE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,QAA+B,EAAE,WAAmB;IACzF,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClH,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,iBAAiB,CAAC,OAAO,CACjC,0BAA0B,EAC1B,aAAa,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,gDAAgD,EACxF,EAAE,YAAY,EAAE,WAAW,EAAE,CAC9B,CAAC,CAAC;IACL,CAAC;IACD,OAAO,2BAA2B,CAAC,EAAE,WAAW,EAAE,cAAc,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;AACvF,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAIjD;IACC,IAAI,UAAkB,CAAC;IACvB,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAClD,QAAQ,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;QACtE,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACrG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,iBAAiB,CAAC,OAAO,CACjC,0BAA0B,EAC1B,aAAa,KAAK,CAAC,WAAW,qCAAqC,MAAM,CAAC,KAAK,CAAC,GAAG,EACnF,EAAE,YAAY,EAAE,KAAK,CAAC,WAAW,EAAE,CACpC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,iBAAiB,CAAC,OAAO,CACjC,0BAA0B,EAC1B,aAAa,KAAK,CAAC,WAAW,gBAAgB,QAAQ,iCAAiC,UAAU,EAAE,EACnG,EAAE,YAAY,EAAE,KAAK,CAAC,WAAW,EAAE,aAAa,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAE,CAC1F,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,CAAC,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,iBAAiB,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACjI,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,YAAY,KAAK,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,YAAY,gBAAgB,CAAC,CAAC;QAC1G,MAAM,SAAS,GAAG,CAAC,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,wBAAwB,EAAE,kBAAkB,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAClK,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC/C,MAAM,IAAI,GAAG,CAAC,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;QAC9H,MAAM,mBAAmB,GAAG,MAAM,OAAO,CAAC,GAAG,CAC3C,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CACvG,CAAC;QACF,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC5G,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC;IAC5E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,iBAAiB,CAAC,OAAO,CACjC,0BAA0B,EAC1B,aAAa,KAAK,CAAC,WAAW,wDAAwD,MAAM,CAAC,KAAK,CAAC,GAAG,EACtG,EAAE,YAAY,EAAE,KAAK,CAAC,WAAW,EAAE,eAAe,EAAE,UAAU,EAAE,CACjE,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EACrB,wBAAwB,EACxB,uBAAuB,EACvB,yBAAyB,GAG1B,MAAM,sBAAsB,CAAC"}

package/extensions/approval-banking.ts

@@ -0,0 +1,66 @@
+/**
+ * Taking back authority a gate banked for an operation that was then refused.
+ *
+ * Split out of `./approvals.ts` only to stay under the 400-line module ceiling this project enforces
+ * mechanically; `./approvals.ts` re-exports both names.
+ */
+import { revokeApproval } from "../src/approval-store.ts";
+import type { Capability } from "../src/resolve.ts";
+import { snapshotOf } from "./approvals.ts";
+import type { GrantsSession } from "./session.ts";
+
+/** One piece of authority a gate banked, and where it lives, so it can be undone. */
+export interface BankedApproval {
+  key: string;
+  capability: Capability;
+  subject: string;
+  /** True when a 30-day entry reached the on-disk store, which outlives the process. */
+  persisted: boolean;
+  /**
+   * False when this call did not CREATE the authority — it joined a dialog another delegation had already
+   * opened, or the key was already standing from an earlier grant.
+   *
+   * Load-bearing: unbanking revoked by `capability@subject` with no ownership check, so one refused
+   * delegation could destroy an approval a live sibling was running under. Two reachable shapes — a
+   * joined gate (one human answer shared by concurrent waiters, each recording it as its own) and a
+   * legacy-then-bound sequence, where a bound call re-prompts over a plain key that already exists and
+   * then deletes both on refusal. Only what this call actually created may be taken back.
+   */
+  owned: boolean;
+}
+
+/**
+ * Give back authority a gate banked for an operation that was then refused.
+ *
+ * Best-effort by necessity — the persisted store can be busy — but never silent: an approval that could
+ * not be revoked is exactly the one an operator needs to know is still standing (R-113).
+ */
+export async function unbankApprovals(
+  session: GrantsSession,
+  ctx: { ui: { notify: (message: string) => void } },
+  banked: BankedApproval[] | undefined,
+): Promise<void> {
+  if (!banked || banked.length === 0) return;
+  const stranded: string[] = [];
+  for (const entry of banked) {
+    // Never take back authority this call did not create — see `owned`.
+    if (!entry.owned) continue;
+    session.sessionApprovals.delete(entry.key);
+    session.sessionApprovalBindings.delete(entry.key);
+    if (!entry.persisted) continue;
+    const outcome = await revokeApproval(session.cwd, entry.key, (subject) => snapshotOf(session, subject), new Date());
+    // `"absent"` is NOT proof the entry is gone. `revokeApproval` reports it when the key is missing from
+    // the *valid* set, and `loadApprovals` excludes entries whose ceiling or body digest no longer
+    // matches — those are still physically in the file and revive the moment they validate again. So an
+    // entry that is merely stale reads as "nothing to revoke" and is silently left standing.
+    if (outcome !== "revoked") stranded.push(entry.key);
+  }
+  // Children inherit from the published set, so it must shrink with the session state, not after it.
+  session.publishChildEnv();
+  if (stranded.length > 0) {
+    ctx.ui.notify(
+      `grants: this delegation was refused, but a stored approval for ${stranded.join(", ")} could not be ` +
+      `revoked and still stands — remove it with \`/grants revoke\` if it was not intended.`,
+    );
+  }
+}

package/extensions/approvals.ts

@@ -28,7 +28,12 @@ import type { createApprovalGate } from "../src/approval-prompt.ts";
 import { timeoutMsFromEnv, type PromptOutcomeKind } from "../src/approval-prompt.ts";
 import { ceilingForDefinition, digestDefinition } from "../src/definitions.ts";
 import type { Capability } from "../src/resolve.ts";
+import { approvalBindingDigest, type ApprovalBinding } from "../src/correlation.ts";
+import type { RefusalCode } from "../src/refusals.ts";
 import type { GrantsSession } from "./session.ts";
+import type { BankedApproval } from "./approval-banking.ts";
+export { unbankApprovals } from "./approval-banking.ts";
+export type { BankedApproval } from "./approval-banking.ts";
 
 /**
  * What a subject looks like right now, for the confused-deputy check in the approval store.
@@ -102,6 +107,8 @@ export interface ApprovalOutcome {
    * and the behaviour that was already in place.
    */
   scopes: Record<Capability, ApprovalScope>;
+  /** Complete scope map for the ledger, including inherited, session, and persisted answers. */
+  recordedScopes: Record<Capability, ApprovalScope>;
   /**
    * Where EACH approved capability's yes came from (R-46).
    *
@@ -110,6 +117,10 @@ export interface ApprovalOutcome {
    * always computed this map; the bug was that it was thrown away.
    */
   sources: Record<Capability, ApprovalSource>;
+  /** Exact binding per approved capability when this is a correlated controller call. */
+  bindings: Record<Capability, ApprovalBinding>;
+  expiresAt: Record<Capability, string>;
+  uses: Record<Capability, { max: number; remaining: number }>;
   humanDenied: boolean;
   /**
    * Which of the five prompt outcomes ended the loop, when one did (ADR-0026's F5).
@@ -119,6 +130,18 @@ export interface ApprovalOutcome {
    * dismissal is a queue or a longer timeout, `no-ui` is an operator pre-approving, `error` is a defect.
    */
   gateOutcome?: PromptOutcomeKind;
+  /**
+   * Authority this gate LEFT BEHIND: session keys added, and 30-day entries written to disk.
+   *
+   * Recorded so a caller that refuses after the gate can take it back. `run-delegation.ts` already
+   * documents the rule at length — "a refused operation must not leave authority behind" — and moved the
+   * executor check before the gate to honour it. The adjacent path did not: an operator clicks *Always*,
+   * the load-bearing ledger append then fails (a lock timeout under fan-out is a documented condition),
+   * the delegation is refused, and a project-wide 30-day approval survives for a spawn that never
+   * happened (R-113).
+   */
+  banked?: BankedApproval[];
+  refusalCode?: RefusalCode;
   reason?: string;
 }
 
@@ -143,8 +166,9 @@ export async function storedApprovals(
   session: GrantsSession,
   gated: Capability[],
   subject: string,
+  expectedBinding?: ApprovalBinding,
 ): Promise<ResolveApprovalsResult> {
-  const { valid } = await loadApprovals({
+  const { valid, dropped } = await loadApprovals({
     cwd: session.cwd,
     now: new Date(),
     snapshotOf: (name) => snapshotOf(session, name),
@@ -153,7 +177,10 @@ export async function storedApprovals(
     gated,
     subject,
     sessionApprovals: session.sessionApprovals,
+    sessionApprovalBindings: session.sessionApprovalBindings,
     persisted: valid,
+    expectedBinding,
+    expiredKeys: new Set(dropped.filter((item) => item.verdict === "expired").map((item) => item.key)),
     // ADR-0022. Verified HERE rather than at parse time because it needs `session.definitions`, which
     // arrives at `session_start` — after the session object is built.
     inherited: verifyInherited(session.inheritedApprovals, (name) => snapshotOf(session, name)),
@@ -180,11 +207,23 @@ export async function obtainApprovals(
   ctx: ApprovalUIContext | null,
   task?: string,
   signal?: AbortSignal,
+  expectedBinding?: ApprovalBinding,
 ): Promise<ApprovalOutcome> {
   const snapshot = (name: string) => snapshotOf(session, name);
-  const pre = await storedApprovals(session, gatedBlocked, subject);
+  const pre = await storedApprovals(session, gatedBlocked, subject, expectedBinding);
+  const preBindings: Record<Capability, ApprovalBinding> = {};
+  if (expectedBinding) for (const capability of pre.approved) preBindings[capability] = expectedBinding;
   if (ctx === null || pre.needsPrompt.length === 0) {
-    return { approved: pre.approved, sources: pre.sources, scopes: {}, humanDenied: false };
+    return {
+      approved: pre.approved,
+      sources: pre.sources,
+      scopes: {},
+      recordedScopes: pre.scopes,
+      bindings: preBindings,
+      expiresAt: pre.expiresAt,
+      uses: {},
+      humanDenied: false,
+    };
   }
 
   // The gate PROVIDER lives on the session, not here: `obtainApprovals` runs once per `tool_call` and once
@@ -203,12 +242,21 @@ export async function obtainApprovals(
   // about — so a mixed set reports exactly which yes came from where.
   const sources: Record<Capability, ApprovalSource> = { ...pre.sources };
   const scopes: Record<Capability, ApprovalScope> = {};
+  const recordedScopes: Record<Capability, ApprovalScope> = { ...pre.scopes };
+  const bindings: Record<Capability, ApprovalBinding> = { ...preBindings };
+  const expiresAt: Record<Capability, string> = { ...pre.expiresAt };
+  const uses: Record<Capability, { max: number; remaining: number }> = {};
   let humanDenied = false;
+  const banked: BankedApproval[] = [];
   let gateOutcome: PromptOutcomeKind | undefined;
+  let refusalCode: RefusalCode | undefined;
   let reason: string | undefined;
 
   for (const capability of pre.needsPrompt) {
-    const outcome = await gate.request({ capability, subject, path, task, signal });
+    const outcome = await gate.request({
+      capability, subject, path, task, signal,
+      ...(expectedBinding ? { bindingKey: approvalBindingDigest(expectedBinding) } : {}),
+    });
     if (outcome.scope === null) {
       // Forward the gate's own discriminant rather than re-deriving it from `hasUI`: `hasUI` is true in
       // RPC mode too, so an automated client's timeout or dismissal there would misreport as "a human
@@ -219,6 +267,11 @@ export async function obtainApprovals(
       // so "was there an operator who timed out, or was there nobody?" had no answer, and the two want
       // different fixes. It was computed here all along and thrown away.
       gateOutcome = outcome.kind;
+      refusalCode = pre.expired.includes(capability)
+        ? "APPROVAL_EXPIRED"
+        : pre.scopeMismatched.includes(capability)
+          ? "APPROVAL_SCOPE_MISMATCH"
+          : "GATED_UNAPPROVED";
       reason = outcome.reason;
       break;
     }
@@ -230,9 +283,20 @@ export async function obtainApprovals(
     // were not.
     sources[capability] = outcome.joined ? "session" : "prompt";
     scopes[capability] = outcome.scope;
+    recordedScopes[capability] = outcome.scope;
+    if (expectedBinding) bindings[capability] = expectedBinding;
+    if (outcome.scope === "once") uses[capability] = { max: 1, remaining: 0 };
 
     if (outcome.scope === "session" || outcome.scope === "always") {
-      session.sessionApprovals.add(approvalKey(capability, subject));
+      const key = approvalKey(capability, subject);
+      // Whether THIS call created the authority, decided before we add it. `joined` means a human answer
+      // opened by another delegation was shared with us; an existing key means it was already standing.
+      // Either way it is not ours to take back if we are refused — see `BankedApproval.owned`.
+      const owned = !outcome.joined
+        && !(expectedBinding ? session.sessionApprovalBindings.has(key) : session.sessionApprovals.has(key));
+      if (expectedBinding) session.sessionApprovalBindings.set(key, expectedBinding);
+      else session.sessionApprovals.add(key);
+      banked.push({ key, capability, subject, persisted: false, owned });
     }
     if (outcome.scope === "always") {
       const now = new Date();
@@ -242,6 +306,8 @@ export async function obtainApprovals(
       // "type-missing" or "type-changed". Writing it is not unsafe (it fails closed), it is simply a
       // dead entry that silently accumulates in the file. Skip it and say so, taking the same
       // downgrade-to-session path as a failed write below: the human's yes still stands.
+      const expires = expiryFor(now);
+      expiresAt[capability] = expires;
       const written =
         current === null
           ? false
@@ -250,12 +316,13 @@ export async function obtainApprovals(
               approvalKey(capability, subject),
               {
                 approvedAt: now.toISOString(),
-                expiresAt: expiryFor(now),
+                expiresAt: expires,
                 cwd: session.cwd,
                 grantAtApproval: current.ceiling,
                 // ADR-0019: the tools AND the instructions the human actually saw. Pinning only the
                 // former would let a rewritten body inherit a yes that was given about different text.
                 bodyAtApproval: current.bodySha256,
+                ...(expectedBinding ? { binding: expectedBinding } : {}),
                 // The TASK is deliberately absent (ADR-0021). It is shown in the dialog, where a human
                 // needs it, and never written down, because the model assembles it from the parent's
                 // context and it can carry anything the parent could see.
@@ -263,6 +330,12 @@ export async function obtainApprovals(
               snapshot,
               now,
             );
+      if (written) {
+        // Mark the on-disk half so a later refusal knows there is a file entry to take back, not just a
+        // session key that dies with the process.
+        const persistedKey = approvalKey(capability, subject);
+        for (const entry of banked) if (entry.key === persistedKey) entry.persisted = true;
+      }
       if (!written) {
         // The human already said yes; the security decision stands. Only the convenience cache
         // failed, so this downgrades scope rather than refusing the delegation (see approval-store.ts).
@@ -276,10 +349,25 @@ export async function obtainApprovals(
         // The human's yes stands; only the cache failed. Downgrade THIS capability, not the set — under
         // the old scalar this also rewrote the scope of every other capability answered in the same call.
         scopes[capability] = "session";
+        recordedScopes[capability] = "session";
+        delete expiresAt[capability];
       }
     }
     session.publishChildEnv(); // a new session approval widens what children may inherit — republish now
   }
 
-  return { approved, sources, scopes, humanDenied, gateOutcome, reason };
+  return {
+    approved,
+    sources,
+    scopes,
+    recordedScopes,
+    bindings,
+    expiresAt,
+    uses,
+    humanDenied,
+    gateOutcome,
+    refusalCode,
+    reason,
+    banked,
+  };
 }

package/extensions/chain-approval-facts.ts

@@ -0,0 +1,51 @@
+import type { InheritableApproval } from "../src/approval.ts";
+import type { Capability } from "../src/resolve.ts";
+import type { ApprovalOutcome } from "./approvals.ts";
+
+export interface ChainApprovalAudit {
+  sources: Map<string, ApprovalOutcome["sources"][Capability]>;
+  scopes: Map<string, ApprovalOutcome["recordedScopes"][Capability]>;
+  expiresAt: Map<string, string>;
+  uses: Map<string, { max: number; remaining: number }>;
+}
+
+export function newChainApprovalAudit(): ChainApprovalAudit {
+  return { sources: new Map(), scopes: new Map(), expiresAt: new Map(), uses: new Map() };
+}
+
+export function rememberChainApproval(
+  audit: ChainApprovalAudit,
+  capability: Capability,
+  subject: string,
+  outcome: ApprovalOutcome,
+): void {
+  const key = `${capability}@${subject}`;
+  const source = outcome.sources[capability];
+  const scope = outcome.recordedScopes[capability];
+  if (source) audit.sources.set(key, source);
+  if (scope) audit.scopes.set(key, scope);
+  const expiresAt = outcome.expiresAt[capability];
+  if (expiresAt) audit.expiresAt.set(key, expiresAt);
+  const uses = outcome.uses[capability];
+  if (uses) audit.uses.set(key, uses);
+}
+
+export function chainApprovalFacts(
+  audit: ChainApprovalAudit,
+  available: InheritableApproval[],
+  subject: string,
+): Pick<ApprovalOutcome, "approved" | "sources" | "scopes" | "expiresAt" | "uses" | "humanDenied"> {
+  const entries = available.filter((approval) => approval.subject === subject);
+  const values = <T>(map: Map<string, T>) => Object.fromEntries(entries.flatMap((approval) => {
+    const value = map.get(`${approval.capability}@${approval.subject}`);
+    return value === undefined ? [] : [[approval.capability, value]];
+  }));
+  return {
+    approved: entries.map((approval) => approval.capability),
+    sources: values(audit.sources),
+    scopes: values(audit.scopes),
+    expiresAt: values(audit.expiresAt),
+    uses: values(audit.uses),
+    humanDenied: false,
+  };
+}

package/extensions/chain-ledger.ts

@@ -0,0 +1,48 @@
+import type { ApprovalOutcome } from "./approvals.ts";
+import type { Delegation } from "../src/delegate.ts";
+import { appendRecord, buildRecord } from "../src/ledger.ts";
+import type { StructuredRefusal } from "../src/refusals.ts";
+import { childSpawnId } from "../src/fanout.ts";
+import type { GrantsSession } from "./session.ts";
+
+/** Audit a chain preflight/gate refusal with the same trusted planner facts as a normal delegation. */
+export async function recordChainRefusal(input: {
+  session: GrantsSession;
+  plan: Delegation;
+  stepIndex: number;
+  agent?: string;
+  reason: string;
+  refusal?: StructuredRefusal;
+  approval?: ApprovalOutcome;
+}): Promise<void> {
+  if (!input.session.ledgerPath) return;
+  await appendRecord(
+    { path: input.session.ledgerPath, strict: true },
+    buildRecord({
+      parentId: input.session.ownSpawnId,
+      childId: childSpawnId(input.session.ownSpawnId, input.stepIndex),
+      depth: input.plan.childDepth,
+      agentType: input.agent ?? "delegate",
+      requested: input.plan.requested,
+      parentGrant: input.session.ownGrant,
+      result: input.plan.result,
+      blocked: true,
+      reason: input.reason,
+      approved: input.approval?.approved,
+      approvalSources: input.approval?.sources,
+      approvalScopes: input.approval?.recordedScopes,
+      approvalExpiresAt: input.approval?.expiresAt,
+      approvalUses: input.approval?.uses,
+      humanDenied: input.approval?.humanDenied,
+      gateOutcome: input.approval?.gateOutcome,
+      definitionDigest: input.plan.definitionDigest,
+      taskDigest: input.plan.taskDigest,
+      correlation: input.plan.correlation,
+      // An approval banked before a later chain decline is a yes that led to no spawn, not the stale
+      // GATED_UNAPPROVED refusal from the pre-approval plan.
+      refusal: input.refusal ?? (input.approval?.approved.length ? undefined : input.plan.refusal),
+      executor: input.session.executor.kind,
+      now: new Date(),
+    }),
+  );
+}