fix(tui): auto-abandon resume overlay on reactor approval timeout

Author: TheGreatAxios

docs/ARCHITECTURE.md

@@ -408,7 +408,7 @@ tool call
 - **auto-shell-policy** — Constrains `run_shell` even when auto mode would otherwise rubber-stamp it. Before matching, `expandShellSubjects` peels `bash`/`sh`/`zsh -c`, `xargs` utility tails, and transparent prefixes (`env`, `nice`, `timeout`, …) so rules see the real payload; an unparseable wrapper (variable expansion or command substitution) sets an opaque flag that forces `ask`. Effects: `deny` blocks outright (file mutations through ad-hoc tooling — output redirection, `tee`, `sed -i`/`perl -i`, interpreter inline programs or heredocs — which must instead go through `write_file`/`edit_file`); `ask` declines to auto-allow and falls through to the operator prompt (recursive `rm`, dependency installs and remote runners: npm/yarn/pnpm/bun, pip, cargo, go, brew, npx/bunx, …, force or uncontained `git worktree` ops, shell that references a sensitive path such as `.env` or a private key, and opaque wrappers). Contained non-force `git worktree add`/`remove`/`prune` and read-only `list` auto-allow (sibling destinations like `../corbits-dispatch-wts/…` included; absolute outside, `~`, globs, and credential basenames still ask). Deny beats ask when multiple subjects match. Quoted spans are stripped before pattern matching so a quoted `>` or install word in an argument is not flagged, and program names are matched only in command position. Adding a table category is a one-line rule append in `AUTO_SHELL_RULES`.
 - **gate** — Evaluates a call: `skipPermissions` allows everything; `allow`-tier passes; for `ask`-tier, checks persisted approvals, otherwise requests operator approval. Shell security classifies each chain segment (`||` / `&&` / `|` / `;` / newlines), but the operator is prompted once for the full command block — any unapproved segment fails the whole block, and execution always runs the unsplit original. Safe pipeline tails and pure shell no-ops (`true` / `false` / `:` and bare control-flow keywords stranded by chain-splitting) skip without a prompt. In a non-interactive run an unresolved `ask` becomes a denial. In auto mode: non-shell built-ins in `AUTO_ALLOWED_TOOLS` (writes/edits/deletes, `manage_tasks`, `spawn_agent`, `wait_agents`, …) auto-allow when not path-restricted; for `run_shell` the gate consults the auto-shell policy — a `deny` rule fails the call, an `ask` rule skips the auto-allow shortcut and proceeds to the normal approval flow, and anything unmatched is auto-allowed. Paths outside the workspace on path-arg tools are denied at authorize time (the same sandbox path-escape enforces at execution, so the gate does not show an Accept overlay that cannot succeed). Writes under the in-workspace session state root (legacy `.agent-state`) still ask under auto mode. Under `--dangerously-skip-permissions` (forces this process) or `/yolo` (persists as the user-global default via `setSkipPermissions`), the gate auto-allows those same cases, and pre-gate sandboxes (path-escape, shell session cwd retention, `list_dir` / `delete_file` workspace bounds) honor `getSkipPermissions()` live so outside-workspace access is not hard-denied after the gate already allowed it — without rebuilding the plugin stack. Secret-guard path denies and authorization hard blocks still apply. Mutating MCP and unknown built-ins are not blanket-allowed outside skip. Newly granted scopes are appended in memory and persisted.
   - **Reactor-gated sessions (main session; `reactorGated: true`).** The gate's decision logic lives in one `decide()` used by both consumers: `evaluate()` (the middleware path below, still used by sub-agents) and `authorizeCall()`, which expresses the decision as the vendored reactor's before-tool authz effect (`src/permission/reactor-authorize.ts` bridges it into `env.authorize`). An `ask` there suspends the call as a reactor `PendingOperation` keyed by a correlationId (persisted through the context store's existing `pendingOperations`); `send()` settles as `suspended` and `src/session/approval-resume.ts` rebuilds the operator request from the approval snapshot, resolves it through the same `requestApproval` seam the TUI overlay uses, and delivers the decision to the reactor on the correlationId signal channel — an approved decision grants a one-shot bypass and the exact parked call re-dispatches; a rejected one answers it with an error result. `inFlight` occupancy owns idle rebuild: the TUI stays busy across the overlay and waits until the correlated resume is accepted (`message.received` / `message.correlated`) or a generation bump `settleAll`s the waiter. Delivery generation owns session identity: interrupt, `/clear`, and `/new` abort the outstanding overlay, skip minting a grant, drop the decision, and surface an operator notice rather than delivering into a rebuilt agent. Under reactor gating the middleware/MCP `gateToolCall` is an execution backstop, not a second copy of `env.authorize`: it consumes the `authorizeCall` verdict only when id, name, and arguments match, and does not re-decide. Deny still blocks and does not call `next`; an `ask` or `allow` skips the middleware prompt so an approved re-dispatch never re-asks. A reused `codex-proxy` id cannot apply an outer `shell` allow to an inner `run_shell` deny. Inner posix runs whose outer tool is not `run_shell` (Codex `apply_patch` proxy) never pass `env.authorize`, so `gateToolCall` decides on that cache miss and still blocks a deny. The headless denial and the stricter chained-command hard-deny are preserved as deny effects (upstream `block`s) decided inside the same `decide()`.
-  - **Approval resume identity.** Before opening the operator gate, resume captures the session generation and agent/store pair and resolves the correlation exactly once through `ContextStore.load().pendingOperations` to one approval operation's `suspendedCall.id`. Missing or duplicate mappings produce no gate or delivery; store errors propagate with registration cleanup. Every decision path first checks captured history for an exact-call approval timeout, and operator decisions check again after the gate. Identical tool names and arguments never establish identity. Cancellation during lookup cannot deliver a rejection. This suppresses observed exact timeouts, not all expired correlations: the reactor removes correlation state before the queued timeout result publishes, and expiration can also race the final history check or TUI delivery queue. Atomic stale-decision admission remains reactor-owned work tracked separately in CL-8000.
+  - **Approval resume identity.** Before opening the operator gate, resume captures the session generation and agent/store pair and resolves the correlation exactly once through `ContextStore.load().pendingOperations` to one approval operation's `suspendedCall.id`. Missing or duplicate mappings produce no gate or delivery; store errors propagate with registration cleanup. Every decision path first checks captured history for an exact-call approval timeout, and operator decisions check again after the gate. While the overlay is open, resume watches history for that exact-call timeout and aborts the overlay signal so the gate auto-denies, occupancy (`inFlight`) unsticks, and no late decision is delivered. Identical tool names and arguments never establish identity. Cancellation during lookup cannot deliver a rejection. This suppresses observed exact timeouts, not all expired correlations: the reactor removes correlation state before the queued timeout result publishes, and expiration can also race the final history check or TUI delivery queue. Atomic stale-decision admission remains reactor-owned work tracked separately in CL-8000.
   - **Worker reactor ownership.** `workerPermissionGate` is a reactor-gated view over the parent's live permission gate: grants and policy are shared, not copied or toggled. Worker posix plugins and inherited MCP tools are bound to that view at worker start, so they take the reactor-gated `gateToolCall` path because the view reports `isReactorGated()` — they do not close over the parent's middleware-gated `isReactorGated()`. Deny still blocks; ask/allow skip the middleware prompt. `authorizeCall` on the view never emits `ask` — unresolved approvals become denials that name the permission subject, without invoking an approval callback or suspending, even with an interactive parent; the parent can obtain a grant and retry. Worker control-plane tools (`submit_result`, `ask_director`, and nested fleet verbs other than `spawn_agent`) allow without a parent grant. Authorization and tool execution run under the same async-local worker identity and cwd. Fleet authority remains an independent restriction, not an alternative permission grant.
 
 - **matcher** — Approval pattern matching via `@intx/authz` `matchPattern` (`*` wildcards). Exact-command grants store a backslash before each metacharacter; those patterns match by equality after unescape (the package has no escape syntax).

src/session/approval-resume.ts

@@ -102,6 +102,35 @@ function timeoutResult(
   );
 }
 
+function sleep(ms: number, signal: AbortSignal): Promise<void> {
+  if (signal.aborted) return Promise.resolve();
+  return new Promise((resolve) => {
+    const timer = setTimeout(resolve, ms);
+    signal.addEventListener(
+      "abort",
+      () => {
+        clearTimeout(timer);
+        resolve();
+      },
+      { once: true },
+    );
+  });
+}
+
+async function watchParkedTimeout(
+  history: () => ReturnType<Agent["history"]>,
+  parkedCallId: string,
+  signal: AbortSignal,
+  pollMs: number,
+): Promise<boolean> {
+  while (!signal.aborted) {
+    await sleep(pollMs, signal);
+    if (signal.aborted) return false;
+    if (timeoutResult(await history(), parkedCallId)) return true;
+  }
+  return false;
+}
+
 function decisionMessage(
   correlationId: string,
   outcome: "approved" | "rejected",
@@ -137,6 +166,8 @@ export function createApprovalResume(args: {
   captureGeneration?: () => () => boolean;
   onDropped?: (text: string) => void;
   registerParkedCancel?: (cancel: (() => void) | undefined) => void;
+  registerOverlayAbort?: (controller: AbortController | undefined) => void;
+  parkedTimeoutPollMs?: number;
   resolveParkedCallId: (
     correlationId: string,
   ) => string | undefined | Promise<string | undefined>;
@@ -179,6 +210,7 @@ export function createApprovalResume(args: {
       cancelParked();
     };
     args.registerParkedCancel?.(cancelParked);
+    let overlayAbort: AbortController | undefined;
     try {
       // The resolver captures the paired store synchronously before its first await.
       const parkedCallId = await args.resolveParkedCallId(correlationId);
@@ -222,14 +254,38 @@ export function createApprovalResume(args: {
         );
         return true;
       }
+
+      overlayAbort = new AbortController();
+      args.registerOverlayAbort?.(overlayAbort);
+      const timeoutWatch = watchParkedTimeout(
+        () => parkedAgent.history(),
+        parkedCallId,
+        overlayAbort.signal,
+        args.parkedTimeoutPollMs ?? 250,
+      ).then((timedOut) => {
+        if (
+          timedOut &&
+          overlayAbort !== undefined &&
+          !overlayAbort.signal.aborted
+        ) {
+          overlayAbort.abort(APPROVAL_TIMEOUT_RESULT_TEXT);
+        }
+        return timedOut;
+      });
+
       const outcome = await args.gate.resolveSuspended(request, stillCurrent);
+      if (!overlayAbort.signal.aborted) overlayAbort.abort();
+      const timedOutDuringOverlay =
+        overlayAbort.signal.reason === APPROVAL_TIMEOUT_RESULT_TEXT ||
+        (await timeoutWatch);
       if (!stillCurrent()) {
         dropParked();
         return true;
       }
       args.registerParkedCancel?.(undefined);
       const history = await parkedAgent.history();
-      const timedOut = timeoutResult(history, parkedCallId);
+      const timedOut =
+        timedOutDuringOverlay || timeoutResult(history, parkedCallId);
       if (timedOut) canReject = false;
       if (!stillCurrent()) {
         dropParked();
@@ -248,6 +304,10 @@ export function createApprovalResume(args: {
       );
       return true;
     } finally {
+      if (overlayAbort !== undefined && !overlayAbort.signal.aborted) {
+        overlayAbort.abort();
+      }
+      args.registerOverlayAbort?.(undefined);
       args.registerParkedCancel?.(undefined);
     }
   };

src/tui/runner/session.ts

@@ -171,6 +171,9 @@ export async function assembleTUISession(
 
   const correlationAcceptance = createCorrelationAcceptance();
   const parkedApprovalCancel = { fn: undefined as (() => void) | undefined };
+  const parkedOverlayAbort = {
+    controller: undefined as AbortController | undefined,
+  };
   const deliveryGeneration = createDeliveryGeneration(() => {
     parkedApprovalCancel.fn?.();
     correlationAcceptance.settleAll();
@@ -185,7 +188,13 @@ export async function assembleTUISession(
     requestApproval: createGateRequestApproval({
       emitGate: (event) => emitter.emit("permission.gate", event),
       approvalTimeout,
-      identitySignal: () => deliveryGeneration.signal(),
+      identitySignal: () => {
+        const identity = deliveryGeneration.signal();
+        const parked = parkedOverlayAbort.controller?.signal;
+        return parked === undefined
+          ? identity
+          : AbortSignal.any([identity, parked]);
+      },
     }),
     getActiveProviderModel: () =>
       `${state.config.providerName}:${state.config.model}`,
@@ -526,6 +535,9 @@ export async function assembleTUISession(
     registerParkedCancel: (cancel) => {
       parkedApprovalCancel.fn = cancel;
     },
+    registerOverlayAbort: (controller) => {
+      parkedOverlayAbort.controller = controller;
+    },
     deliver: (message, stillCurrent) => {
       return sessionOps.enqueue(async () => {
         if (!stillCurrent()) return;

tests/unit/approval-resume.test.ts

@@ -3,6 +3,7 @@ import { describe, expect, test } from "bun:test";
 import { AgentClosedError, type SendResult } from "@intx/agent";
 import type { ConversationTurn, InboundMessage } from "@intx/types/runtime";
 
+import { APPROVAL_TIMEOUT_RESULT_TEXT } from "../../src/permission/decline-markers.js";
 import {
   createPermissionGate,
   type PermissionGate,
@@ -51,7 +52,7 @@ function approvalTimedOutTurn(): ConversationTurn {
       {
         type: "tool_result",
         callId: "call-ask",
-        content: [{ type: "text", text: "approval timed out" }],
+        content: [{ type: "text", text: APPROVAL_TIMEOUT_RESULT_TEXT }],
       },
     ],
     timestamp: 0,
@@ -752,3 +753,86 @@ describe("approval resume occupancy until correlation", () => {
     expect(state.inFlight).toBe(0);
   });
 });
+
+describe("approval resume overlay on reactor timeout", () => {
+  test("auto-abandons the overlay and unsticks occupancy when the parked call times out", async () => {
+    const parkedOverlayAbort = {
+      controller: undefined as AbortController | undefined,
+    };
+    const generation = createDeliveryGeneration();
+    const turns = [userTurn()];
+    let overlay: PermissionGateEvent | undefined;
+    let overlayReady: (() => void) | undefined;
+    const waitForOverlay = new Promise<void>((resolve) => {
+      overlayReady = resolve;
+    });
+    const requestApproval = createGateRequestApproval({
+      emitGate: (event) => {
+        overlay = event;
+        overlayReady?.();
+        event.signal?.addEventListener(
+          "abort",
+          () => {
+            event.resolve({
+              allow: false,
+              message:
+                typeof event.signal?.reason === "string"
+                  ? event.signal.reason
+                  : "aborted",
+            });
+          },
+          { once: true },
+        );
+        return true;
+      },
+      approvalTimeout: () => undefined,
+      identitySignal: () => {
+        const identity = generation.signal();
+        const parked = parkedOverlayAbort.controller?.signal;
+        if (parked === undefined) return identity;
+        return AbortSignal.any([identity, parked]);
+      },
+    });
+    const gate = createPermissionGate({
+      approvals: [],
+      interactive: true,
+      skipPermissions: false,
+      reactorGated: true,
+      requestApproval,
+    });
+    const delivered: unknown[] = [];
+    const resume = createApprovalResume({
+      resolveParkedCallId: () => "call-ask",
+      getAgent: () => ({
+        deliver: (message: unknown) => delivered.push(message),
+        history: async () => turns,
+      }),
+      captureGeneration: generation.capture,
+      registerOverlayAbort: (controller) => {
+        parkedOverlayAbort.controller = controller;
+      },
+      parkedTimeoutPollMs: 5,
+      gate,
+    });
+    const state = {
+      inFlight: 0,
+      pendingReload: false,
+      reloadIfIdle: () => undefined,
+    };
+
+    const running = runWhileAgentBusy(state, async () => {
+      await resume.handle(SUSPENDED);
+    });
+    await waitForOverlay;
+    expect(state.inFlight).toBe(1);
+    expect(overlay?.signal?.aborted).toBe(false);
+
+    turns.push(approvalTimedOutTurn());
+    await running;
+
+    expect(overlay?.signal?.aborted).toBe(true);
+    expect(overlay?.signal?.reason).toBe(APPROVAL_TIMEOUT_RESULT_TEXT);
+    expect(delivered).toEqual([]);
+    expect(state.inFlight).toBe(0);
+  });
+});