fix(approval): recover verified suspended calls from watchdog

Author: bwachman

src/session/approval-resume.test.ts

@@ -19,6 +19,7 @@ import {
   createApprovalResume,
   requestFromApprovalSnapshot,
   resolveParkedCallIdFromStore,
+  resolveSuspendedApprovalFromStore,
 } from "./approval-resume.js";
 import { createSessionOperationQueue } from "../tui/delivery-queue.js";
 import {
@@ -419,6 +420,12 @@ const operation: PendingOperation = {
     name: "run_shell",
     arguments: { command: "echo same" },
   },
+  approvalSnapshot: {
+    name: "run_shell",
+    description: "run shell",
+    inputSchema: {},
+    arguments: { command: "echo same" },
+  },
 };
 
 describe("persisted approval identity", () => {
@@ -451,6 +458,37 @@ describe("persisted approval identity", () => {
   });
 });
 
+describe("persisted suspended approval proof", () => {
+  test("requires an exact persisted snapshot and parked call", async () => {
+    const result = suspension("corr-A", "echo same");
+    expect(
+      await resolveSuspendedApprovalFromStore(storeWith([operation]), result),
+    ).toEqual({
+      ok: true,
+      parkedCallId: "call-A",
+    });
+
+    const mismatch: PendingOperation = {
+      ...operation,
+      approvalSnapshot: {
+        name: "run_shell",
+        description: "run shell",
+        inputSchema: {},
+        arguments: { command: "secret" },
+      },
+    };
+    expect(
+      await resolveSuspendedApprovalFromStore(storeWith([mismatch]), result),
+    ).toEqual({ ok: false, code: "snapshot-mismatch" });
+    expect(
+      await resolveSuspendedApprovalFromStore(
+        storeWith([operation, operation]),
+        result,
+      ),
+    ).toEqual({ ok: false, code: "ambiguous-pending" });
+  });
+});
+
 test("missing or ambiguous stored identity never falls back to an identical history call", async () => {
   for (const pending of [[], [operation, operation]]) {
     const deliver = mock((_message: InboundMessage): void => undefined);

src/session/approval-resume.ts

@@ -17,6 +17,7 @@ import type {
   ContextStore,
   InboundMessage,
 } from "@intx/types/runtime";
+import { isDeepStrictEqual } from "node:util";
 import { type } from "arktype";
 
 import { getLogger } from "@intx/log";
@@ -54,6 +55,60 @@ export interface ApprovalResume {
   handle: (result: SendResult) => Promise<boolean>;
 }
 
+export interface SuspendedApprovalRecovery {
+  capture: (
+    result: Extract<SendResult, { type: "suspended" }>,
+    stillCurrent: () => boolean,
+  ) => void;
+  clear: () => void;
+  tryResumeOnce: () => Promise<boolean>;
+}
+
+export function createSuspendedApprovalRecovery(args: {
+  storage: () => Pick<ContextStore, "load"> | undefined;
+  resume: ApprovalResume;
+}): SuspendedApprovalRecovery {
+  let candidate:
+    | {
+        readonly result: Extract<SendResult, { type: "suspended" }>;
+        readonly stillCurrent: () => boolean;
+        attempted: boolean;
+      }
+    | undefined;
+  return {
+    capture: (result, stillCurrent) => {
+      candidate = { result, stillCurrent, attempted: false };
+    },
+    clear: () => {
+      candidate = undefined;
+    },
+    tryResumeOnce: async () => {
+      const current = candidate;
+      if (
+        current === undefined ||
+        current.attempted ||
+        !current.stillCurrent()
+      ) {
+        candidate = undefined;
+        return false;
+      }
+      current.attempted = true;
+      const storage = args.storage();
+      if (storage === undefined) return false;
+      try {
+        const verified = await resolveSuspendedApprovalFromStore(
+          storage,
+          current.result,
+        );
+        if (!verified.ok || !current.stillCurrent()) return false;
+        return await args.resume.handle(current.result);
+      } catch {
+        return false;
+      }
+    },
+  };
+}
+
 // Rebuild the operator-facing request from the persisted snapshot. The parked
 // name is canonicalized first so resume matches live decide() (file scopes for
 // write_file, not a generic tool grant for default.write_file). Scopes come
@@ -103,6 +158,62 @@ export async function resolveParkedCallIdFromStore(
   return matches.length === 1 ? matches[0]?.suspendedCall?.id : undefined;
 }
 
+export type SuspendedApprovalResolution =
+  | { readonly ok: true; readonly parkedCallId: string }
+  | {
+      readonly ok: false;
+      readonly code:
+        | "not-pending"
+        | "ambiguous-pending"
+        | "snapshot-invalid"
+        | "snapshot-mismatch"
+        | "settled";
+    };
+
+/**
+ * Proves that the suspended result still identifies the one persisted call.
+ * Failure codes are intentionally content-free so watchdog diagnostics cannot
+ * disclose approval or tool payloads.
+ */
+export async function resolveSuspendedApprovalFromStore(
+  storage: Pick<ContextStore, "load">,
+  result: Extract<SendResult, { type: "suspended" }>,
+): Promise<SuspendedApprovalResolution> {
+  const { pendingOperations } = await storage.load();
+  const matches = pendingOperations.filter(
+    (operation) =>
+      operation.kind === "approval" &&
+      operation.correlationId === result.correlationId,
+  );
+  if (matches.length === 0) return { ok: false, code: "not-pending" };
+  if (matches.length !== 1) return { ok: false, code: "ambiguous-pending" };
+  const operation = matches[0];
+  if (operation === undefined) return { ok: false, code: "not-pending" };
+  if (operation.timeoutAt !== undefined && operation.timeoutAt <= Date.now())
+    return { ok: false, code: "settled" };
+  const parked = operation.suspendedCall;
+  const persisted = operation.approvalSnapshot;
+  const captured = result.approvalSnapshot;
+  const parsedPersisted = persisted && ApprovalSnapshotShape(persisted);
+  const parsedCaptured = ApprovalSnapshotShape(captured);
+  if (
+    parked === undefined ||
+    parked.id.length === 0 ||
+    !parsedPersisted ||
+    parsedPersisted instanceof type.errors ||
+    parsedCaptured instanceof type.errors
+  )
+    return { ok: false, code: "snapshot-invalid" };
+  if (
+    parked.name !== parsedPersisted.name ||
+    parked.name !== parsedCaptured.name ||
+    !isDeepStrictEqual(parked.arguments, parsedPersisted.arguments ?? {}) ||
+    !isDeepStrictEqual(parked.arguments, parsedCaptured.arguments ?? {})
+  )
+    return { ok: false, code: "snapshot-mismatch" };
+  return { ok: true, parkedCallId: parked.id };
+}
+
 function timeoutResult(
   turns: Awaited<ReturnType<Agent["history"]>>,
   parkedCallId: string,

src/tui/runner/session.ts

@@ -61,7 +61,9 @@ import type { CompactionArchive } from "../../session/compaction-archive.js";
 import { tryReadPriorHandoffFile } from "../../session/compaction-handoff.js";
 import {
   createApprovalResume,
+  createSuspendedApprovalRecovery,
   resolveParkedCallIdFromStore,
+  type SuspendedApprovalRecovery,
 } from "../../session/approval-resume.js";
 import { createReactorAuthorize } from "../../permission/reactor-authorize.js";
 import {
@@ -185,7 +187,9 @@ export async function assembleTUISession(
   const correlationAcceptance = createCorrelationAcceptance();
   const parkedApprovalCancel = { fn: undefined as (() => void) | undefined };
   const parkedOverlay = createParkedOverlayAbortBinding();
+  let suspendedApprovalRecovery: SuspendedApprovalRecovery | undefined;
   const deliveryGeneration = createDeliveryGeneration(() => {
+    suspendedApprovalRecovery?.clear();
     parkedApprovalCancel.fn?.();
     correlationAcceptance.settleAll();
   });
@@ -550,6 +554,10 @@ export async function assembleTUISession(
     cwd: config.cwd,
     extraDeniedPaths: [config.globalSettingsPath],
   });
+  suspendedApprovalRecovery = createSuspendedApprovalRecovery({
+    storage: () => state.currentStorage ?? undefined,
+    resume: approvalResume,
+  });
   state.enqueueAgentDeliver = (
     deliverToLiveAgent: () => void,
     onSettle?: (result: AgentDeliveryResult) => void,
@@ -788,6 +796,7 @@ export async function assembleTUISession(
     inferenceDeps: start.inferenceDeps,
     permissionGate,
     approvalResume,
+    suspendedApprovalRecovery,
     permissionsAdmin,
     liveSubAgent,
     subAgentSessions,

src/tui/runner/state.ts

@@ -118,6 +118,9 @@ export interface RunnerServices {
   approvalResume: ReturnType<
     typeof import("../../session/approval-resume.js").createApprovalResume
   >;
+  suspendedApprovalRecovery: ReturnType<
+    typeof import("../../session/approval-resume.js").createSuspendedApprovalRecovery
+  >;
   permissionsAdmin: ReturnType<
     typeof import("../../permission/admin.js").createPermissionsAdmin
   >;

src/tui/runner/submit.ts

@@ -366,6 +366,9 @@ export function createSubmitPath(
       live.agentProxy.send(next),
     presentFailureNotice = true,
   ): Promise<AgentDeliveryResult> => {
+    hostOf(state).bridge.setSuspendedApprovalRecovery(
+      services.suspendedApprovalRecovery.tryResumeOnce,
+    );
     const attempt = live.attemptIdentity();
     const providerFailure = services.providerFailureAttempts.begin(attempt);
     const recoveryAttempt = state.credentialRecovery.begin(
@@ -385,6 +388,12 @@ export function createSubmitPath(
         // send early; resolve the operator surface here and deliver the
         // decision on the correlationId signal channel so the parked run
         // resumes.
+        if (result.type === "suspended") {
+          services.suspendedApprovalRecovery.capture(
+            result,
+            services.deliveryGeneration.capture(),
+          );
+        }
         await services.approvalResume.handle(result);
       });
       return { status: "accepted" };

src/tui/runtime-bridge.ts

@@ -178,6 +178,12 @@ export interface TurnMonitorOptions {
   readonly stallNoticeMs?: number;
   /** Registers the periodic tick; returns an unsubscribe. */
   readonly schedule?: (tick: () => void, intervalMs: number) => () => void;
+  /**
+   * Attempts to re-present one already persisted approval suspension. This
+   * deliberately receives no agent, storage, grant, or tool capability: a
+   * true result means the correlated approval path owns the continuation.
+   */
+  readonly tryResumeSuspendedApproval?: () => boolean | Promise<boolean>;
 }
 
 const DEFAULT_TICK_MS = 250;
@@ -235,6 +241,9 @@ export interface SessionBridge {
   gateOpened: () => void;
   /** A previously raised gate resolved. */
   gateClosed: () => void;
+  setSuspendedApprovalRecovery: (
+    recovery: (() => boolean | Promise<boolean>) | undefined,
+  ) => void;
   dispose: () => void;
   /** Current derived turn phase (progress label, stall clock, quota window). */
   readonly turn: TurnState;
@@ -510,6 +519,7 @@ export interface BridgeBag {
   /** callId→name / delta bookkeeping for production-shaped events. */
   mapCtx: StreamMapContext;
   disposed: boolean;
+  suspendedApprovalRecovery: (() => boolean | Promise<boolean>) | undefined;
   turn: TurnState;
   /**
    * Live fleet-lane count from the last `fleet` event (idle-with-fleet).
@@ -1581,6 +1591,7 @@ export function attachSessionBridge(
     pendingPromptRecoveries: [],
     mapCtx: createStreamMapContext(),
     disposed: false,
+    suspendedApprovalRecovery: undefined,
     turn: initialTurnState(now()),
     liveFleet: 0,
     pendingAskWake: new Map(),
@@ -2201,17 +2212,32 @@ export function attachSessionBridge(
     const stallArgs = stallArgsFor(nowMs);
 
     if (shouldAbortForStall(stallArgs)) {
-      applyStallRecovery(
-        {
-          abort: () => {
-            if (abortStalledWakeTurn()) return;
-            doInterrupt();
+      const recover = (): void =>
+        applyStallRecovery(
+          {
+            abort: () => {
+              if (abortStalledWakeTurn()) return;
+              doInterrupt();
+            },
+            notify: (message) =>
+              setStatusFlash(shell, message, { ttlMs: RUNTIME_FLASH_MS }),
           },
-          notify: (message) =>
-            setStatusFlash(shell, message, { ttlMs: RUNTIME_FLASH_MS }),
-        },
-        STALL_RECOVERY_MESSAGE,
-      );
+          STALL_RECOVERY_MESSAGE,
+        );
+      const resumed =
+        bag.suspendedApprovalRecovery?.() ??
+        monitor?.tryResumeSuspendedApproval?.();
+      if (resumed instanceof Promise) {
+        void resumed.then(
+          (handled) => {
+            if (!handled) recover();
+          },
+          () => recover(),
+        );
+        return;
+      }
+      if (resumed) return;
+      recover();
       return;
     }
 
@@ -2258,6 +2284,9 @@ export function attachSessionBridge(
     submit,
     interrupt: doInterrupt,
     clearQueuedDelivery,
+    setSuspendedApprovalRecovery: (recovery) => {
+      bag.suspendedApprovalRecovery = recovery;
+    },
     get parentCycleLive() {
       return bag.liveSteerInject;
     },