fix(session): reject swapped credentials in approval snapshot compare

Integrity compare no longer collapses every secret to one redaction token.
Redacted-at-rest snapshots still match the live call; raw re-dispatch
arguments must match exactly.

Author: TheGreatAxios

src/session/approval-resume.ts

@@ -16,7 +16,6 @@ import type {
   ContextStore,
   InboundMessage,
 } from "@intx/types/runtime";
-import { isDeepStrictEqual } from "node:util";
 import { type } from "arktype";
 
 import { getLogger } from "@intx/log";
@@ -37,7 +36,7 @@ import {
   LOCAL_APPROVAL_MAILBOX,
 } from "./approval-provenance.js";
 import { redactedCorrelationId } from "./redacted-correlation.js";
-import { canonicalSnapshotScrub } from "./pending-snapshot-scrub.js";
+import { snapshotArgumentsMatch } from "./pending-snapshot-scrub.js";
 
 const logger = getLogger([LOG_NAMESPACE_ROOT, "approval-resume"]);
 
@@ -289,17 +288,19 @@ export async function resolveSuspendedApprovalFromStore(
   if (
     parked.name !== parsedPersisted.name ||
     parked.name !== parsedCaptured.name ||
-    // Both sides of each comparison run through the same canonical scrub, so
-    // the persisted snapshot (scrubbed at the metadata write boundary) still
-    // matches the live raw snapshot: secret-shaped values are redacted
-    // identically on both sides; benign values are unchanged.
-    !isDeepStrictEqual(
-      canonicalSnapshotScrub(parked.arguments),
-      canonicalSnapshotScrub(parsedPersisted.arguments ?? {}),
+    // The persisted copy is redacted at rest, so its compare still accepts the
+    // canonical scrub when that copy is fully redacted. The re-dispatch
+    // snapshot is compared raw: different credential values are a mismatch
+    // even though both would scrub to the same token.
+    !snapshotArgumentsMatch(
+      parked.arguments,
+      parsedPersisted.arguments ?? {},
+      true,
     ) ||
-    !isDeepStrictEqual(
-      canonicalSnapshotScrub(parked.arguments),
-      canonicalSnapshotScrub(parsedCaptured.arguments ?? {}),
+    !snapshotArgumentsMatch(
+      parked.arguments,
+      parsedCaptured.arguments ?? {},
+      false,
     )
   )
     return { ok: false, code: "snapshot-mismatch" };

src/session/pending-snapshot-scrub.test.ts

@@ -143,4 +143,47 @@ describe("scrubPersistedPendingOperations", () => {
     );
     expect(drifted).toEqual({ ok: false, code: "snapshot-mismatch" });
   });
+
+  test("a swapped credential in the re-dispatch payload is a snapshot mismatch", async () => {
+    const keyA = "sk-proj-aaaaaaaaaaaaaaaaaaaa";
+    const keyB = "sk-proj-bbbbbbbbbbbbbbbbbbbb";
+    const parkedArgs = { api_key: keyA, mode: "fast" };
+    const swappedArgs = { api_key: keyB, mode: "fast" };
+    const op: PendingOperation = {
+      correlationId: "corr-9",
+      kind: "approval",
+      registeredAt: 1_700_000_000_000,
+      gateId: "gate-9",
+      timeoutAt: Date.now() + 60_000,
+      suspendedCall: { id: "call-9", name: "run_shell", arguments: parkedArgs },
+      approvalSnapshot: {
+        name: "run_shell",
+        description: "runs a shell command",
+        inputSchema: {},
+        arguments: swappedArgs,
+      },
+    };
+    const swapped = await resolveSuspendedApprovalFromStore(
+      {
+        load: async () => ({
+          turns: [],
+          pendingOperations: [op],
+          tokenUsage: {
+            input: 0,
+            output: 0,
+            cacheRead: 0,
+            cacheWrite: 0,
+            thinking: 0,
+          },
+          connectorState: null,
+        }),
+      },
+      {
+        type: "suspended",
+        correlationId: "corr-9",
+        approvalSnapshot: op.approvalSnapshot,
+      } as Extract<SendResult, { type: "suspended" }>,
+    );
+    expect(swapped).toEqual({ ok: false, code: "snapshot-mismatch" });
+  });
 });

src/session/pending-snapshot-scrub.ts

@@ -7,10 +7,15 @@
 // metadata write boundary; `suspendedCall` stays untouched because the
 // re-dispatch of an approved call must see the raw arguments.
 //
-// Snapshot equality checks (`resolveSuspendedApprovalFromStore`) run through
-// the same canonical transform on BOTH sides, so a scrubbed persisted snapshot
-// still matches the live raw snapshot exactly the way the unscrubbed copies
-// used to — one transform, symmetrically applied.
+// Snapshot equality checks (`resolveSuspendedApprovalFromStore`) must not
+// collapse every secret to one redaction token before comparing: that made
+// two different credentials compare equal. Persisted snapshots are redacted
+// at the metadata write, so a fully redacted copy still matches the live raw
+// snapshot through the canonical scrub. A copy that still carries raw secret
+// material — and the in-memory re-dispatch snapshot — compare without that
+// lossy collapse.
+
+import { isDeepStrictEqual } from "node:util";
 
 import type { PendingOperation } from "@intx/types/runtime";
 
@@ -38,6 +43,59 @@ export function canonicalSnapshotScrub(value: unknown): unknown {
   }
 }
 
+function jsonPlain(value: unknown): unknown {
+  return JSON.parse(JSON.stringify(value)) as unknown;
+}
+
+// True when `value` is already the redacted canonical form (the scrub is a
+// no-op). A snapshot that still holds a raw credential fails this check.
+function isRedactedCanonical(value: unknown): boolean {
+  try {
+    return isDeepStrictEqual(jsonPlain(value), canonicalSnapshotScrub(value));
+  } catch {
+    return false;
+  }
+}
+
+function rawArgumentsEqual(left: unknown, right: unknown): boolean {
+  try {
+    return isDeepStrictEqual(jsonPlain(left), jsonPlain(right));
+  } catch {
+    // Non-JSON-safe args cannot be compared raw. Fall back to the shared
+    // scrub stub so a parked call still lines up with its own snapshot;
+    // JSON-safe credentials never take this path.
+    return isDeepStrictEqual(
+      canonicalSnapshotScrub(left),
+      canonicalSnapshotScrub(right),
+    );
+  }
+}
+
+/**
+ * Integrity compare for approval arguments.
+ *
+ * `persisted` is the on-disk snapshot. When that copy was redacted at rest,
+ * secret fields are the stable redaction token and the canonical scrub still
+ * lines up with the live raw args. When it still contains a raw credential,
+ * compare the values themselves so a different secret is a mismatch.
+ *
+ * The in-memory re-dispatch snapshot (`persisted: false`) is never collapsed:
+ * two different credential values must not compare equal.
+ */
+export function snapshotArgumentsMatch(
+  parked: unknown,
+  other: unknown,
+  persisted: boolean,
+): boolean {
+  if (persisted && isRedactedCanonical(other)) {
+    return isDeepStrictEqual(
+      canonicalSnapshotScrub(parked),
+      canonicalSnapshotScrub(other),
+    );
+  }
+  return rawArgumentsEqual(parked, other);
+}
+
 export function scrubPersistedPendingOperations(
   pendingOperations: readonly PendingOperation[],
 ): PendingOperation[] {