ha-mcp-dev 8.5.0.dev2793__tar.gz → 8.5.0.dev2797__tar.gz

{ha_mcp_dev-8.5.0.dev2793/src/ha_mcp_dev.egg-info → ha_mcp_dev-8.5.0.dev2797}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ha-mcp-dev
-Version: 8.5.0.dev2793
+Version: 8.5.0.dev2797
 Summary: Home Assistant MCP Server - Complete control of Home Assistant through MCP
 Author-email: Julien <github@qc-h.net>
 License: MIT

{ha_mcp_dev-8.5.0.dev2793 → ha_mcp_dev-8.5.0.dev2797}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "ha-mcp-dev"
-version = "8.5.0.dev2793"
+version = "8.5.0.dev2797"
 description = "Home Assistant MCP Server - Complete control of Home Assistant through MCP"
 readme = "README.md"
 # Upper bound widened to <3.15 so the package installs on Home Assistant's

{ha_mcp_dev-8.5.0.dev2793 → ha_mcp_dev-8.5.0.dev2797}/src/ha_mcp/policy/editing.py

@@ -38,9 +38,9 @@ class PolicyCaller(NamedTuple):
 def _clear_remember_cache(server: Any | None) -> None:
     """Clear the approval remember-cache after a rule change.
 
-    Called only when the rules actually changed, so a missing queue is
-    worth a WARNING: the rules the operator just wrote are not what the
-    engine (wherever it runs) is still remembering.
+    Called only when the rules or ``rule_effect`` actually changed, so a
+    missing queue is worth a WARNING: the gates the operator just wrote are
+    not what the engine (wherever it runs) is still remembering.
     """
     queue = getattr(server, "approval_queue", None)
     if queue is None:
@@ -101,9 +101,8 @@ async def set_policy(
                 suggestions=[f"Call {caller.get_call} for the shape"],
             )
         )
-    # ``rules`` defaults to [] on the model and Policy ignores unknown keys,
-    # so an omitted (or misspelled) key would validate and silently delete
-    # every approval gate. Demand it explicitly instead.
+    # ``rules`` defaults to [] on the model, so an omitted key would validate
+    # and silently delete every approval gate. Demand it explicitly instead.
     if "rules" not in policy:
         raise_tool_error(
             create_error_response(
@@ -176,7 +175,29 @@ def _pre_save_warnings(
             '"event_decisions_enabled": true if that was not intended. The '
             "stored PIN is untouched either way."
         )
-    if not new_policy.rules:
+    if new_policy.rule_effect == "allow":
+        # In an allow list an added rule is the loosening direction.
+        added = [rule for rule in new_policy.rules if rule not in current.rules]
+        if added:
+            names = ", ".join(sorted({rule.tool_name for rule in added}))
+            warnings.append(
+                f"This write added {len(added)} approving rule(s), covering: "
+                f"{names}. Calls they match now run without approval."
+            )
+    if current.rule_effect != new_policy.rule_effect:
+        warnings.append(
+            f"This write switched rule_effect from '{current.rule_effect}' to "
+            f"'{new_policy.rule_effect}': every rule now "
+            + (
+                "approves the calls it matches, and every other call requires approval."
+                if new_policy.rule_effect == "allow"
+                else "requires approval for the calls it matches, and every "
+                "other call runs without approval."
+            )
+        )
+    # An empty require-approval list gates nothing, so its enforcement state
+    # is moot; an empty allow list gates every call and still needs it.
+    if not new_policy.rules and new_policy.rule_effect == "require_approval":
         return warnings
     policies_enabled = get_global_settings().enable_tool_security_policies
     if not policies_enabled:
@@ -214,6 +235,7 @@ def _commit_policy(
     """
     from ..utils.data_paths import get_data_dir
     from .decision_pin import is_pin_set
+    from .model import ALLOW_LIST_OMITTED_MESSAGE, drops_allow_list, gates_differ
     from .persistence import load_policy, save_policy
 
     data_dir = get_data_dir()
@@ -227,6 +249,14 @@ def _commit_policy(
                 suggestions=["Inspect or delete the file, then retry"],
             )
         )
+    if drops_allow_list(new_policy, current):
+        raise_tool_error(
+            create_error_response(
+                ErrorCode.VALIDATION_MISSING_PARAMETER,
+                ALLOW_LIST_OMITTED_MESSAGE,
+                suggestions=[f"Call {caller.get_call} and resend the edited document"],
+            )
+        )
     if new_policy.event_decisions_enabled and not is_pin_set(data_dir):
         # No MCP tool takes the PIN as a parameter, returns it, or writes
         # the file it lives in: the component's deny floor blocks that
@@ -262,7 +292,7 @@ def _commit_policy(
     warnings = _pre_save_warnings(new_policy, current, expected, server)
     # Rebase onto the on-disk version so save_policy bumps to current+1.
     save_policy(data_dir, new_policy.model_copy(update={"version": current.version}))
-    if rules_changed:
+    if gates_differ(current, new_policy):
         # The write has landed. Nothing after this point may turn a committed
         # save into a failure the caller would retry.
         try:

{ha_mcp_dev-8.5.0.dev2793 → ha_mcp_dev-8.5.0.dev2797}/src/ha_mcp/policy/evaluator.py

@@ -2,7 +2,7 @@
 
 import logging
 import re
-from collections.abc import Iterator
+from collections.abc import Iterable, Iterator
 from enum import StrEnum
 from typing import Any
 
@@ -93,7 +93,13 @@ def has_dynamic_selector_targets(name: str, args: dict[str, Any]) -> bool:
     return name == "ha_bulk_control" and args.get("selector") is not None
 
 
-def iter_path_values(args: dict[str, Any], path: str) -> Iterator[Any]:
+MISSING = object()
+"""What ``iter_path_values(..., report_missing=True)`` yields for a dead end."""
+
+
+def iter_path_values(
+    args: dict[str, Any], path: str, *, report_missing: bool = False
+) -> Iterator[Any]:
     """Yield every value the dotted path resolves to.
 
     The leading ``args`` segment is implicit and stripped. A ``*`` segment
@@ -101,6 +107,12 @@ def iter_path_values(args: dict[str, Any], path: str) -> Iterator[Any]:
     across items for lists — so ``args.*`` yields every top-level
     argument, ``args.config.*`` yields every leaf of the ``config``
     sub-dict, and so on. Empty iterator = no match.
+
+    A branch that cannot continue (a missing key, a named segment on a value
+    that is not a dict, or a ``*`` on a scalar) is skipped, unless
+    ``report_missing``, which yields ``MISSING`` for it instead and also for a
+    ``*`` over an empty container. Allow mode needs that: an operation without
+    the constrained field is a value the predicate never saw.
     """
     parts = path.split(".")
     if parts[0] == "args":
@@ -112,36 +124,56 @@ def iter_path_values(args: dict[str, Any], path: str) -> Iterator[Any]:
             return
         head, tail = rest[0], rest[1:]
         if head == "*":
-            if isinstance(cur, dict):
-                for v in cur.values():
-                    yield from walk(v, tail)
-            elif isinstance(cur, (list, tuple)):
-                for v in cur:
-                    yield from walk(v, tail)
+            children = _children(cur)
+            if report_missing and not children:
+                # An empty container is a dead end too: the branch holds no
+                # value the predicate could examine.
+                children = None
+        elif isinstance(cur, dict) and head in cur:
+            children = [cur[head]]
+        else:
+            children = None
+        if children is None:
+            if report_missing:
+                yield MISSING
             return
-        if isinstance(cur, dict) and head in cur:
-            yield from walk(cur[head], tail)
+        for child in children:
+            yield from walk(child, tail)
 
     yield from walk(args, parts)
 
 
-def _ci(x: Any) -> Any:
+def _children(node: Any) -> Iterable[Any] | None:
+    """What a ``*`` segment fans out over; None for a scalar."""
+    if isinstance(node, dict):
+        return node.values()
+    if isinstance(node, (list, tuple)):
+        return node
+    return None
+
+
+def _ci(x: Any, strict: bool = False) -> Any:
     """Lower-case strings for case-insensitive comparison; pass other
     types through unchanged so type semantics (int != "1") survive.
-    Used on both sides of every string op — security gates should fire
-    whether the caller wrote 'Lock' or 'LOCK' or 'lock'."""
-    return x.lower() if isinstance(x, str) else x
+    Used on both sides of the equality and membership ops — security gates
+    should fire whether the caller wrote 'Lock' or 'LOCK' or 'lock'.
 
+    ``strict`` keeps the case; ``match_predicate`` explains why allow mode
+    compares both ways."""
+    return x.lower() if isinstance(x, str) and not strict else x
 
-def _contains_matches(val: Any, pv: Any) -> bool:
+
+def _contains_matches(val: Any, pv: Any, strict: bool) -> bool:
     if isinstance(val, str) and isinstance(pv, str):
-        return pv.lower() in val.lower()
-    # Mirror the case-insensitive treatment that ``eq`` / ``in`` /
-    # ``not_in`` already apply: a rule listing ``["light.kitchen"]``
+        return _ci(pv, strict) in _ci(val, strict)
+    # Outside strict mode, mirror the case-insensitive treatment that ``eq``
+    # / ``in`` / ``not_in`` apply: a rule listing ``["light.kitchen"]``
     # must match an LLM passing ``"Light.Kitchen"``. Per-element
     # ``_ci`` guards non-string entries so mixed-type collections
     # (e.g. ``[1, "two"]``) keep their natural equality semantics.
-    return isinstance(val, (list, tuple, set)) and any(_ci(pv) == _ci(x) for x in val)
+    return isinstance(val, (list, tuple, set)) and any(
+        _ci(pv, strict) == _ci(x, strict) for x in val
+    )
 
 
 def _numeric_matches(val: Any, op: str, pv: Any) -> bool:
@@ -160,59 +192,118 @@ def _numeric_matches(val: Any, op: str, pv: Any) -> bool:
         return False
 
 
-def _op_matches(val: Any, op: str, pv: Any) -> bool:
+def _op_matches(val: Any, op: str, pv: Any, strict: bool = False) -> bool:
     """Apply one op to one concrete value. Predicate dispatches over
     the candidate values (which may be many for wildcard paths).
 
     String comparisons are case-insensitive (security gates shouldn't
-    care whether the LLM lowercased its args). Non-string types
-    preserve their natural comparison semantics.
+    care whether the LLM lowercased its args) unless ``strict`` (see
+    ``_ci``). Non-string types preserve their natural comparison semantics.
     """
     match op:
         case "eq":
-            return bool(_ci(val) == _ci(pv))
+            return bool(_ci(val, strict) == _ci(pv, strict))
         case "neq":
-            return bool(_ci(val) != _ci(pv))
+            return bool(_ci(val, strict) != _ci(pv, strict))
         case "in":
-            return _ci(val) in [_ci(x) for x in (pv or [])]
+            return _ci(val, strict) in [_ci(x, strict) for x in (pv or [])]
         case "not_in":
-            return _ci(val) not in [_ci(x) for x in (pv or [])]
+            return _ci(val, strict) not in [_ci(x, strict) for x in (pv or [])]
         case "regex":
             # `regex` is re.search (substring match). Anchor with ^...$
-            # for full-match. re.IGNORECASE so '^light\.' matches 'Light.x'.
+            # for full-match. re.IGNORECASE (unless strict) so '^light\.'
+            # matches 'Light.x'.
             return (
                 isinstance(val, str)
                 and isinstance(pv, str)
-                and re.search(pv, val, re.IGNORECASE) is not None
+                and re.search(pv, val, 0 if strict else re.IGNORECASE) is not None
             )
         case "contains":
-            return _contains_matches(val, pv)
+            return _contains_matches(val, pv, strict)
         case "gt" | "lt":
             return _numeric_matches(val, op, pv)
     return False
 
 
-def match_predicate(predicate: Predicate, args: dict[str, Any]) -> bool:
-    values = list(iter_path_values(args, predicate.path))
+def match_predicate(
+    predicate: Predicate, args: dict[str, Any], *, strict: bool = False
+) -> bool:
+    """Whether ``predicate`` holds for ``args``.
+
+    Outside allow mode a wildcard path matches when ANY value at the wildcard
+    satisfies the op; for a non-wildcard path there is at most one value.
+
+    ``strict`` is allow mode, where a match APPROVES the call, so every
+    ambiguity must resolve towards "no match":
+
+    - EVERY branch the path reaches must hold the field, ``exists``
+      included, so ``args.operations.*.parameters.brightness`` does not
+      approve a batch whose unlock operation carries no ``parameters`` (or
+      an empty one), and ``args.*.entity_id`` does not approve a ``target``
+      object that names only an area. A scalar argument lacks every field,
+      so ``args.*.<field>`` approves no call that also has one. The
+      remaining rules do not apply to ``exists``.
+    - EVERY value must satisfy the op, and a list found at the path counts
+      as its items, so an approval naming ``light.a`` covers neither an
+      ``operations`` list nor an ``entity_id`` list that also names a lock.
+    - A string with a comma or surrounding whitespace never matches: Home
+      Assistant splits ``"light.a, lock.x"`` into two entity IDs and strips
+      each, so the string would stand for values the op never saw.
+    - A dict value (an object argument) can only be matched exactly, by
+      ``eq`` or ``in``; ``neq "lock.x"`` says nothing about what the object
+      holds, so it must not approve it.
+    - The op must hold both case-sensitively and case-insensitively. A
+      positive op (``eq``, ``in``) then needs the exact case, so
+      ``home/bridge`` does not approve the different MQTT topic
+      ``Home/Bridge``; a negated op (``neq``, ``not_in``) cannot be
+      satisfied by a case variant, because Home Assistant lower-cases
+      domains, services and entity IDs and would run ``LOCK`` as ``lock``.
+    """
+    values = list(iter_path_values(args, predicate.path, report_missing=strict))
+    if not values or any(v is MISSING for v in values):
+        return False
     if predicate.op == "exists":
-        return bool(values)
+        return True
+    if not strict:
+        return any(_op_matches(v, predicate.op, predicate.value) for v in values)
+    values = list(_flatten_lists(values))
     if not values:
         return False
-    # Existential semantics: a wildcard path matches if ANY value at the
-    # wildcard satisfies the op. For non-wildcard paths there's at most
-    # one value so the any() collapses to a single check.
-    return any(_op_matches(v, predicate.op, predicate.value) for v in values)
+    return all(
+        not _splits_into_other_values(v)
+        and (not isinstance(v, dict) or predicate.op in ("eq", "in"))
+        and _op_matches(v, predicate.op, predicate.value, strict=True)
+        and _op_matches(v, predicate.op, predicate.value)
+        for v in values
+    )
+
 
+def _splits_into_other_values(value: Any) -> bool:
+    return isinstance(value, str) and ("," in value or value != value.strip())
 
-def match_rule(rule: Rule, tool_name: str, args: dict[str, Any]) -> bool:
+
+def _flatten_lists(values: Iterable[Any]) -> Iterator[Any]:
+    for value in values:
+        if isinstance(value, (list, tuple)):
+            yield from _flatten_lists(value)
+        else:
+            yield value
+
+
+def match_rule(
+    rule: Rule, tool_name: str, args: dict[str, Any], *, strict: bool = False
+) -> bool:
     if rule.tool_name not in ("*", tool_name):
         return False
-    return all(match_predicate(p, args) for p in rule.when)
+    return all(match_predicate(p, args, strict=strict) for p in rule.when)
 
 
 def find_matching_rule(
     tool_name: str, args: dict[str, Any], policy: Policy
 ) -> Rule | None:
+    """First rule gating this call under a require-approval list, else None."""
+    if policy.rule_effect != "require_approval":
+        return None
     for rule in policy.rules:
         if match_rule(rule, tool_name, args):
             return rule
@@ -231,8 +322,8 @@ def _predicate_reaches_operations(path: str) -> bool:
     literal segment right after that wildcard (e.g. ``domain`` in
     ``args.*.domain``) can only ever match a *dict* value at that level (like
     ``selector``) — ``walk()`` requires ``isinstance(cur, dict)`` for a
-    literal head, so it silently yields nothing against a list and can never
-    reach an operation row. Only a SECOND wildcard (``args.*.*...``, as in
+    literal head, so it yields no value against a list (only ``MISSING`` under
+    ``report_missing``) and can never reach an operation row. Only a SECOND wildcard (``args.*.*...``, as in
     ``args.*.*.entity_id``) or no further segment at all (bare ``args.*``,
     which yields the raw ``operations`` list value itself) can actually reach
     into the list. Any other concrete first segment (e.g. ``selector``) can
@@ -266,7 +357,38 @@ def _rule_needs_resolved_operations(rule: Rule) -> bool:
 
 
 def evaluate(tool_name: str, args: dict[str, Any], policy: Policy) -> Verdict:
-    """Decide whether one tool call requires approval under ``policy``.
+    """Decide whether one tool call requires approval under ``policy``."""
+    if policy.rule_effect == "require_approval":
+        return _evaluate_require_approval_list(tool_name, args, policy)
+    return _evaluate_allow_list(tool_name, args, policy)
+
+
+def _evaluate_allow_list(
+    tool_name: str, args: dict[str, Any], policy: Policy
+) -> Verdict:
+    """Allow mode: a call runs only when some rule approves it.
+
+    Unmatched calls, a ``ws_command`` call included, already require
+    approval here (a bare ``ha_call_service`` or ``*`` rule does approve
+    one), so the require-approval list's first fail-safe has
+    no counterpart. The selector one does: a rule that inspects
+    ``args.operations`` cannot see the targets a selector call resolves to
+    later, so it must not be what approves that call.
+    """
+    dynamic = has_dynamic_selector_targets(tool_name, args)
+    for rule in policy.rules:
+        if not match_rule(rule, tool_name, args, strict=True):
+            continue
+        if dynamic and _rule_needs_resolved_operations(rule):
+            continue
+        return Verdict.ALLOW
+    return Verdict.REQUIRE_APPROVAL
+
+
+def _evaluate_require_approval_list(
+    tool_name: str, args: dict[str, Any], policy: Policy
+) -> Verdict:
+    """Require-approval mode (the default): gate matching calls.
 
     A normal rule match (``find_matching_rule``) decides most calls. Two
     fail-safes broaden approval beyond an exact predicate match, each only

{ha_mcp_dev-8.5.0.dev2793 → ha_mcp_dev-8.5.0.dev2797}/src/ha_mcp/policy/events.py

@@ -84,9 +84,10 @@ def build_requested_payload(
     at ``ARG_VALUE_LIMIT``. The settings UI's pending list remains the place
     to read an argument in full.
 
-    ``matched_rule`` is present exactly when a rule matched this call. The
+    ``matched_rule`` is present exactly when a rule gated this call. The
     policy's two fail-safes (``evaluator.evaluate``) gate a call without a
-    matching rule, and then there is none to name.
+    matching rule, and under an allow list a call is gated because no rule
+    approved it; then there is none to name.
     """
     payload: dict[str, Any] = {
         "token": entry.token,

{ha_mcp_dev-8.5.0.dev2793 → ha_mcp_dev-8.5.0.dev2797}/src/ha_mcp/policy/handlers.py

@@ -15,7 +15,12 @@ from starlette.responses import JSONResponse
 from ..utils.config_write_lock import config_write_guard
 from .approval_queue import ApprovalQueue
 from .decision_pin import clear_pin, is_pin_set, pin_status, set_pin, validate_pin
-from .model import Policy
+from .model import (
+    ALLOW_LIST_OMITTED_MESSAGE,
+    Policy,
+    drops_allow_list,
+    gates_differ,
+)
 from .persistence import load_policy, save_policy
 from .value_sources import (
     all_value_sources_for,
@@ -66,17 +71,24 @@ def _extract_arg_paths(parameters: dict[str, Any]) -> list[dict[str, Any]]:
     return out
 
 
+def policy_file_corrupt_response(exc: ValueError) -> JSONResponse:
+    """The response for a corrupt or schema-invalid stored tool_policy.json.
+
+    Shared by GET and PUT here and in the sidecar: the body names the problem
+    and flags it (the page adds its repair hint on load), and the log records
+    it for whoever reads the server log rather than the page.
+    """
+    logger.warning("tool_policy.json could not be read: %s", exc)
+    return JSONResponse(
+        {"error": str(exc), "policy_file_corrupt": True}, status_code=500
+    )
+
+
 async def _get_config(data_dir: Path) -> JSONResponse:
     try:
         return JSONResponse(load_policy(data_dir).model_dump(mode="json"))
     except ValueError as e:
-        # Surface a corrupt or schema-invalid tool_policy.json to the
-        # UI so the user has a visible repair path; without this the
-        # tab would just spinner forever on an opaque 500.
-        return JSONResponse(
-            {"error": str(e), "policy_file_corrupt": True},
-            status_code=500,
-        )
+        return policy_file_corrupt_response(e)
 
 
 async def _put_config(
@@ -94,7 +106,13 @@ async def _put_config(
     # sidecar runs this same handler in its own process) so a concurrent
     # writer can't slip between the read and the write and lose an update.
     async with config_write_guard():
-        current = load_policy(data_dir)
+        try:
+            current = load_policy(data_dir)
+        except ValueError as e:
+            # No version to compare against, so the write is refused too.
+            return policy_file_corrupt_response(e)
+        if drops_allow_list(new_policy, current):
+            return JSONResponse({"error": ALLOW_LIST_OMITTED_MESSAGE}, status_code=400)
         # Inside the guard: DELETE /api/policy/decision-pin clears the PIN
         # under this same lock, and when the stored policy already has the
         # switch off it does so without bumping the version. Checked before
@@ -125,12 +143,12 @@ async def _put_config(
                 status_code=409,
             )
         save_policy(data_dir, new_policy)
-        # Drop the remember-cache only when rules actually changed.
+        # Drop the remember-cache only when the gates actually changed.
         # Editing just wait_seconds / approval_ttl_minutes shouldn't
-        # invalidate in-flight remembered approvals; only a rule change
-        # could make a previously-approved call now want a different
-        # outcome.
-        if current.rules != new_policy.rules:
+        # invalidate in-flight remembered approvals; only a rule or
+        # rule_effect change could make a previously-approved call now want
+        # a different outcome.
+        if gates_differ(current, new_policy):
             queue.clear_remember_cache()
     return JSONResponse({"saved": True, "version": new_policy.version + 1})
 

{ha_mcp_dev-8.5.0.dev2793 → ha_mcp_dev-8.5.0.dev2797}/src/ha_mcp/policy/middleware.py

@@ -119,8 +119,9 @@ class PolicyMiddleware(Middleware):
         # rewrites a retired name before it arrives. Resolving it again costs a
         # dict lookup and removes the ordering dependency, which here is the
         # difference between gated and ungated: rules are keyed on the current
-        # name, and ``evaluate`` returns ALLOW when nothing matches, so a gate
-        # reading a stale name lets the call through.
+        # name, and under a require-approval list ``evaluate`` returns ALLOW
+        # when nothing matches, so a gate reading a stale name lets the call
+        # through (under an allow list it would gate an approved call).
         name = current_tool_name(context.message.name)
         # Normalize stringified JSON containers (a client like Claude Desktop
         # stdio can send a nested parameter, e.g. `selector`, as a JSON
@@ -171,8 +172,17 @@ class PolicyMiddleware(Middleware):
         remember_minutes = (
             0 if dynamic_targets else rule.remember_minutes if rule else 0
         )
+        # An allow list has no remember window (find_matching_rule returns no
+        # rule for it, so remember_minutes is 0). A remembered entry is then
+        # left over from a require-approval list: a call left pending there
+        # and approved after the switch, or a switch saved from the sidecar or
+        # by a hand edit, neither of which clears this cache. It must not
+        # approve a call the allow list gates.
+        reads_remembered = (
+            not dynamic_targets and policy.rule_effect == "require_approval"
+        )
 
-        if not dynamic_targets and self._queue.is_remembered(name, args_hash):
+        if reads_remembered and self._queue.is_remembered(name, args_hash):
             return await call_next(context)
 
         # A dynamic selector call must never consume an entry it did not
@@ -201,6 +211,7 @@ class PolicyMiddleware(Middleware):
             name,
             args_hash,
             dynamic_targets=dynamic_targets,
+            reads_remembered=reads_remembered,
             remember_minutes=remember_minutes,
         ):
             return await call_next(context)
@@ -222,7 +233,7 @@ class PolicyMiddleware(Middleware):
                 pending,
                 name,
                 args_hash,
-                dynamic_targets=dynamic_targets,
+                reads_remembered=reads_remembered,
                 remember_minutes=remember_minutes,
             ):
                 return await call_next(context)
@@ -357,6 +368,7 @@ class PolicyMiddleware(Middleware):
         args_hash: str,
         *,
         dynamic_targets: bool,
+        reads_remembered: bool,
         remember_minutes: int,
     ) -> bool:
         """Act on an entry this call did not create. True means dispatch now.
@@ -383,7 +395,7 @@ class PolicyMiddleware(Middleware):
                 existing,
                 name,
                 args_hash,
-                dynamic_targets=dynamic_targets,
+                reads_remembered=reads_remembered,
                 remember_minutes=remember_minutes,
             )
         if existing.decision == "denied":
@@ -397,7 +409,7 @@ class PolicyMiddleware(Middleware):
         name: str,
         args_hash: str,
         *,
-        dynamic_targets: bool,
+        reads_remembered: bool,
         remember_minutes: int,
     ) -> bool:
         """Consume an approved entry for this invocation.
@@ -411,22 +423,23 @@ class PolicyMiddleware(Middleware):
         earlier in ``on_call_tool`` ran before the approval existed, which
         is why it has to be re-checked here rather than relied upon.
 
-        A dynamic selector call never reads the remember-cache -- that
-        same gate skips the lookup for it, and ``remember_minutes`` is
-        forced to 0 -- so it must not consult one here either. No
-        reachable case arms such a key today (``has_dynamic_selector_targets``
-        is a pure function of the name and args that also produce
-        ``args_hash``, so static and dynamic calls cannot collide on one
-        key), but the guard keeps this branch degrading the same
-        direction as the defensive claim check in
-        ``_resolve_already_decided``: toward an extra prompt, never
-        toward a dispatch the caller was not entitled to.
+        A call that skips that gate (``reads_remembered`` is false for a
+        dynamic selector call and for every call under an allow list) must
+        not consult the cache here either. Under an allow list an entry left
+        over from a require-approval list can be live. For a dynamic
+        selector call no reachable case arms one today
+        (``has_dynamic_selector_targets`` is a pure function of the name and
+        args that also produce ``args_hash``, so static and dynamic calls
+        cannot collide on one key), but the guard keeps this branch
+        degrading the same direction as the defensive claim check in
+        ``_resolve_already_decided``: toward an extra prompt, never toward a
+        dispatch the caller was not entitled to.
         """
         if self._queue.consume_and_maybe_remember(
             entry, remember_minutes=remember_minutes
         ):
             return True
-        if dynamic_targets:
+        if not reads_remembered:
             return False
         return self._queue.is_remembered(name, args_hash)