fix(permission): clear denials only on operator inbound

Mailbox, fleet-dry, and background-shell wakes are also
message.received and must not forget a deny the operator just made.

Author: TheGreatAxios

src/agent/director.ts

@@ -22,6 +22,7 @@ import {
   type CompactionGovernor,
 } from "./compaction.js";
 import { onTurnBoundary } from "./reactor-events.js";
+import { isOperatorOriginated } from "./message-provenance.js";
 import { type } from "arktype";
 import {
   applyManageTasks,
@@ -1019,7 +1020,15 @@ class ChatDirectorImpl extends DefaultDirector {
       this.toolOnlyStreak = 0;
       this.toolOnlyNudgeFired = false;
       this.pendingToolOnlyNudge = false;
-      this.clearDenials?.();
+      // Occupancy mailbox / fleet-dry / bg-shell inbounds are also
+      // message.received; only a human prompt may forget cached denies.
+      const inboundFlags =
+        "flags" in event.message && Array.isArray(event.message.flags)
+          ? event.message.flags.filter(
+              (flag): flag is string => typeof flag === "string",
+            )
+          : undefined;
+      if (isOperatorOriginated(inboundFlags)) this.clearDenials?.();
     }
     if (onTurnBoundary(event)) this.inferenceRecoveries = 0;
 

src/director.test.ts

@@ -740,7 +740,11 @@ describe("open-task termination guard", () => {
       await director.decide(
         {
           type: "message.received",
-          message: { role: "user", content: "just talk" },
+          message: {
+            role: "user",
+            content: "just talk",
+            flags: ["operator-originated"],
+          },
         } as unknown as ReactorInboundEvent,
         mockState,
         mockCapabilities,
@@ -757,6 +761,28 @@ describe("open-task termination guard", () => {
     expect(next.some((a) => a.type === "infer")).toBe(true);
     expect(cleared).toBe(1);
   });
+
+  test("mailbox inbound does not clear cached denies", async () => {
+    const director = createChatDirector("base", [], {});
+    let cleared = 0;
+    director.setClearDenials(() => {
+      cleared++;
+    });
+    await director.decide(
+      makeToolErrorEvent("c", declined),
+      mockState,
+      mockCapabilities,
+    );
+    await director.decide(
+      {
+        type: "message.received",
+        message: { role: "user", content: "worker report" },
+      } as unknown as ReactorInboundEvent,
+      mockState,
+      mockCapabilities,
+    );
+    expect(cleared).toBe(0);
+  });
 });
 
 describe("chatDirector compaction", () => {

tests/integration/harness.ts

@@ -32,6 +32,7 @@ import { type } from "arktype";
 
 import { createAgentWithLiveToolDispatch } from "../../src/agent/live-tool-dispatch.js";
 import { createChatDirector } from "../../src/agent/director.js";
+import { OPERATOR_ORIGINATED_FLAG } from "../../src/agent/message-provenance.js";
 import {
   readSourceCredentialMaterial,
   registerSourceCredential,
@@ -304,7 +305,19 @@ export async function runUntilDone(
 
   const collectTask = collect;
   const sendResult = await Promise.all([
-    session.agent.send(message).then((result) => {
+    session.agent.send({
+      ref: { uid: 1, mailbox: "INBOX" },
+      headers: {
+        from: "user@local",
+        to: ["agent@local"],
+        date: new Date().toISOString(),
+        messageId: `<${crypto.randomUUID()}@local>`,
+        interchangeType: "conversation.message",
+      },
+      flags: [OPERATOR_ORIGINATED_FLAG],
+      content: message,
+      signatureStatus: "missing",
+    }).then((result) => {
       turnComplete = true;
       return result;
     }),