fix(permissions): require explicit denied ask binding

Author: bwachman

src/permission/worker-grant.test.ts

@@ -286,19 +286,32 @@ describe("WorkerGrantStore lifecycle", () => {
     expect(store.invalidateSession("worker-1", "again")).toBe(0);
   });
 
-  test("attachToAsk stamps the questionId and keeps pending", () => {
+  test("attachToAsk binds only an explicit requestId and keeps it pending", () => {
     const store = new WorkerGrantStore();
     const envelope = store.register(createDeniedCallEnvelope(descriptor()));
     // Reads pin the clock: fixture now predates wall time, so an unpinned
     // read would sweep the envelope as expired.
-    expect(store.attachToAsk("worker-1", "ask-7", undefined, 1_000_001)).toBe(
-      envelope,
-    );
-    expect(envelope.questionId).toBe("ask-7");
+    expect(
+      store.attachToAsk("worker-1", "ask-generic", undefined, 1_000_001),
+    ).toBeUndefined();
+    expect(envelope.questionId).toBeUndefined();
     expect(envelope.status).toBe("pending");
     expect(store.peek(envelope.requestId)).toBe(envelope);
     expect(
-      store.attachToAsk("worker-9", "ask-8", undefined, 1_000_001),
+      store.attachToAsk("worker-1", "ask-7", envelope.requestId, 1_000_001),
+    ).toBe(envelope);
+    expect(envelope.questionId).toBe("ask-7");
+    expect(
+      store.attachToAsk(
+        "worker-1",
+        "ask-rebound",
+        envelope.requestId,
+        1_000_001,
+      ),
+    ).toBeUndefined();
+    expect(envelope.questionId).toBe("ask-7");
+    expect(
+      store.attachToAsk("worker-9", "ask-8", envelope.requestId, 1_000_001),
     ).toBeUndefined();
     expect(envelope.audit.map((event) => event.event)).toEqual([
       "denied",
@@ -332,12 +345,12 @@ describe("WorkerGrantStore lifecycle", () => {
       expect(store.peek(envelopeB.requestId)?.questionId).toBe("ask-B");
     });
 
-    test("unnamed ask keeps the legacy first-pending bind", () => {
+    test("unnamed ask does not bind a pending denial", () => {
       const { store, envelopeA, envelopeB } = twoDenies();
-      expect(store.attachToAsk("worker-1", "ask-x", undefined, 1_000_001)).toBe(
-        envelopeA,
-      );
-      expect(envelopeA.questionId).toBe("ask-x");
+      expect(
+        store.attachToAsk("worker-1", "ask-x", undefined, 1_000_001),
+      ).toBeUndefined();
+      expect(envelopeA.questionId).toBeUndefined();
       expect(envelopeB.questionId).toBeUndefined();
     });
 
@@ -373,7 +386,7 @@ describe("WorkerGrantStore lifecycle", () => {
   test("audit trail orders deny → ask → consume", () => {
     const store = new WorkerGrantStore();
     const envelope = store.register(createDeniedCallEnvelope(descriptor()));
-    store.attachToAsk("worker-1", "ask-1", undefined, 1_000_001);
+    store.attachToAsk("worker-1", "ask-1", envelope.requestId, 1_000_001);
     store.consumeOnAllow({
       sessionId: "worker-1",
       canonicalTool: "run_shell",

src/permission/worker-grant.ts

@@ -281,32 +281,27 @@ export class WorkerGrantStore {
     return undefined;
   }
 
-  /** Stamp the questionId the parent's retry references. A named requestId
-   * binds its exact denial (first-pending would join a question about B to
-   * call A); an unnamed ask keeps the legacy first-pending bind. Unresolvable
-   * ids fail closed; overdue envelopes sweep first. */
+  /** Stamp the questionId the parent's retry references. Only the exact
+   * requestId supplied by the worker can bind a denial: session-wide fallback
+   * would attach a stale denial to an unrelated ask. Unresolvable or already
+   * attached ids fail closed; overdue envelopes sweep first. */
   attachToAsk(
     sessionId: string,
     questionId: string,
     requestId?: string,
     now: number = Date.now(),
   ): WorkerDeniedCallEnvelope | undefined {
     this.sweepExpired(now);
-    const named = requestId?.trim() || undefined;
-    if (named !== undefined) {
-      const envelope = this.envelopes.get(named);
-      if (
-        envelope === undefined ||
-        envelope.workerSessionId !== sessionId ||
-        envelope.status !== "pending"
-      )
-        return undefined;
-      envelope.questionId = questionId;
-      audit(envelope, "asked", questionId);
-      return envelope;
-    }
-    const envelope = this.pendingForSession(sessionId, now);
-    if (envelope === undefined) return undefined;
+    const named = requestId?.trim();
+    if (named === undefined || named.length === 0) return undefined;
+    const envelope = this.envelopes.get(named);
+    if (
+      envelope === undefined ||
+      envelope.workerSessionId !== sessionId ||
+      envelope.status !== "pending" ||
+      envelope.questionId !== undefined
+    )
+      return undefined;
     envelope.questionId = questionId;
     audit(envelope, "asked", questionId);
     return envelope;

src/subagent/agent-fleet.test.ts

@@ -1942,6 +1942,7 @@ describe("list_agents", () => {
   });
 
   test("projects a bound grant_request_id without relying on ask prose", async () => {
+    getProcessWorkerGrantStore().clear();
     const sessions = createSubAgentSessionStore();
     const fleetRecords = createFleetMailbox(sessions);
     const id = "grant-projection";
@@ -1996,6 +1997,123 @@ describe("list_agents", () => {
     expect(waitedAgent.grant_request_id).toBe(envelope.requestId);
   });
 
+  test("does not rebind a resolved denial to a later generic ask", async () => {
+    getProcessWorkerGrantStore().clear();
+    const sessions = createSubAgentSessionStore();
+    const fleetRecords = createFleetMailbox(sessions);
+    const id = "grant-projection-no-rebind";
+    sessions.start({
+      id,
+      description: "need approval",
+      agentId: "a",
+      brief: "b",
+    });
+    sessions.markRunning(id);
+    fleetRecords.register(id);
+    const grantStore = getProcessWorkerGrantStore();
+    const envelopeA = grantStore.register(
+      createDeniedCallEnvelope({
+        callId: "denied-call-A",
+        tool: "run_shell",
+        action: "Run",
+        subject: "git status",
+        args: { command: "git status" },
+        cwd: process.cwd(),
+        workerSessionId: id,
+      }),
+    );
+    expect(
+      sessions.registerAsk(id, {
+        question: "Please decide how to proceed.",
+        questionId: "ask-1",
+        grantRequestId: envelopeA.requestId,
+        assessment: assessedAsk,
+        resolve: () => undefined,
+        reject: () => undefined,
+      }),
+    ).toBe(true);
+    expect(
+      sessions.resolveEscalationAsk(id, {
+        kind: "minimum_grant_available",
+        answer: "continue",
+        questionId: "ask-1",
+      }),
+    ).toBe(true);
+    expect(grantStore.peek(envelopeA.requestId)?.status).toBe("pending");
+
+    expect(
+      sessions.registerAsk(id, {
+        question: "What should I do next?",
+        questionId: "ask-2",
+        assessment: assessedAsk,
+        resolve: () => undefined,
+        reject: () => undefined,
+      }),
+    ).toBe(true);
+    expect(sessions.peekAsk(id)?.deniedCall).toBeUndefined();
+
+    const list = createListAgentsTool({ sessions, fleetRecords });
+    const listed = parseFleetJson(
+      (await callFleetToolRaw(list, {})).content,
+    ) as { agents: { grant_request_id?: string }[] };
+    expect(defined(listed.agents[0]).grant_request_id).toBeUndefined();
+
+    const wait = createWaitAgentsTool({ sessions, fleetRecords });
+    const waited = await callFleetTool(wait, {
+      targets: [id],
+      timeout_ms: 1,
+    });
+    expect(
+      defined((waited.results as { grant_request_id?: string }[])[0])
+        .grant_request_id,
+    ).toBeUndefined();
+
+    expect(sessions.resolveAsk(id, "continue")).toBe(true);
+    const envelopeB = grantStore.register(
+      createDeniedCallEnvelope({
+        callId: "denied-call-B",
+        tool: "run_shell",
+        action: "Run",
+        subject: "git diff",
+        args: { command: "git diff" },
+        cwd: process.cwd(),
+        workerSessionId: id,
+      }),
+    );
+    expect(
+      sessions.registerAsk(id, {
+        question: "May I retry git diff?",
+        questionId: "ask-3",
+        grantRequestId: envelopeB.requestId,
+        assessment: assessedAsk,
+        resolve: () => undefined,
+        reject: () => undefined,
+      }),
+    ).toBe(true);
+    expect(sessions.peekAsk(id)?.deniedCall?.requestId).toBe(
+      envelopeB.requestId,
+    );
+    expect(grantStore.peek(envelopeA.requestId)?.questionId).toBe("ask-1");
+
+    const listB = createListAgentsTool({ sessions, fleetRecords });
+    const listedB = parseFleetJson(
+      (await callFleetToolRaw(listB, {})).content,
+    ) as { agents: { grant_request_id?: string }[] };
+    expect(defined(listedB.agents[0]).grant_request_id).toBe(
+      envelopeB.requestId,
+    );
+
+    const waitB = createWaitAgentsTool({ sessions, fleetRecords });
+    const waitedB = await callFleetTool(waitB, {
+      targets: [id],
+      timeout_ms: 1,
+    });
+    expect(
+      defined((waitedB.results as { grant_request_id?: string }[])[0])
+        .grant_request_id,
+    ).toBe(envelopeB.requestId);
+  });
+
   test("errors after wait_agents surfaces awaiting_director with a question", async () => {
     const { gate, deps, list, id } = await spawnParkedAsk();
     const wait = waitTool(deps);

src/subagent/session-store.ts

@@ -2094,8 +2094,8 @@ export function createSubAgentSessionStore(
       if (pendingAsks.has(id)) return false;
       // Attach the harness-owned denied-call envelope (exact ToolCall + hash)
       // to the ask record, stamping its questionId for the parent's retry
-      // ref. A named grantRequestId binds that exact denial; an unnamed ask
-      // falls back to the session's first pending envelope.
+      // ref. Only a named grantRequestId binds its exact denial; generic asks
+      // must not inherit a pending envelope from an earlier question.
       let deniedCall: WorkerDeniedCallEnvelope | undefined;
       try {
         deniedCall =