test(permissions): prove fleet carve-out under a restricted worktree

Name resume_agent and read_agent_trace in the agentId carve-out so all five single-target verbs are explicit, and build the CL-9362 gate on a registered worktree with a session-state control write that still asks.

Author: TheGreatAxios

src/permission/classify.ts

@@ -262,6 +262,8 @@ const AGENT_ID_TARGETED_FLEET_TOOLS = new Set([
   "close_agent",
   "interrupt_agent",
   "send_input",
+  "resume_agent",
+  "read_agent_trace",
 ]);
 
 export function callTargetsRestricted(
@@ -280,8 +282,10 @@ export function callTargetsRestricted(
   // here would duplicate that enforcement at a layer with no session access,
   // so these calls always report "not restricted", exactly like
   // spawn_agent/wait_agents. (The full fleet verb list lives in
-  // subagent/authority.ts as FLEET_VERBS; only the agentId-addressed
-  // continuation verbs need naming here.)
+  // subagent/authority.ts as FLEET_VERBS; the five single-`target`
+  // agentId-addressed verbs are named above — spawn_agent, wait_agents,
+  // list_agents, and search_agents take no single-agent `target` argument
+  // and already fall through to false below.)
   if (AGENT_ID_TARGETED_FLEET_TOOLS.has(name)) return false;
   if (name === "run_shell")
     return commandTargetsRestricted(stringArg(call, "command"), isRestricted);

src/permission/permission.test.ts

@@ -1607,6 +1607,11 @@ describe("createPermissionGate", () => {
   // auto-allows in auto mode, exactly like spawn_agent/wait_agents.
   test("auto mode auto-allows agentId-targeted fleet calls regardless of target worktree", async () => {
     let asked = 0;
+    // A registered worktree standing in for the restricted target worktree.
+    // Restriction is live in this gate — the session-state control write
+    // below still asks — so the fleet auto-allows prove worktree-independence
+    // instead of assuming it.
+    const worktree = mkdtempSync(join(tmpdir(), "corbits-restricted-wt-"));
     const gate = createPermissionGate({
       approvals: [],
       requestApproval: async () => {
@@ -1617,6 +1622,8 @@ describe("createPermissionGate", () => {
       skipPermissions: false,
       reactorGated: false,
       auto: true,
+      cwd: worktree,
+      rootsProvider: () => [realpathSync(worktree)],
     });
     const calls: ToolCall[] = [
       { id: "c", name: "close_agent", arguments: { target: "worker-1" } },
@@ -1626,12 +1633,31 @@ describe("createPermissionGate", () => {
         name: "send_input",
         arguments: { target: "worker-1", message: "continue" },
       },
+      {
+        id: "c",
+        name: "resume_agent",
+        arguments: { target: "worker-1", message: "continue" },
+      },
+      {
+        id: "c",
+        name: "read_agent_trace",
+        arguments: { target: "worker-1" },
+      },
     ];
     for (const call of calls) {
       const verdict = await gate.evaluate(call);
       expect(verdict.allowed).toBe(true);
     }
     expect(asked).toBe(0);
+    // Control: restriction is live in this gate — a session-state write
+    // through the same gate still asks (and is denied here).
+    const control = await gate.evaluate({
+      id: "c",
+      name: "write_file",
+      arguments: { path: ".agent-state/run.json" },
+    });
+    expect(control.allowed).toBe(false);
+    expect(asked).toBe(1);
     // The carve-out is intentional, not an oversight: even an isRestricted
     // that reports everything restricted (the target worktree is restricted)
     // does not flag these calls — they carry agent ids, not paths.