Restore permission-gate auto-deny and fix Esc leaving gate promises unresolved

gate-wire.ts redeclared a local PermissionGateEvent missing timeoutMs,
timeoutMessage and signal, so goal-mode timeouts and watchdog aborts were
silently dropped and an unattended run could hang on the modal forever.
Import the shared type instead, and wire a timer/abort listener into
onPermission that auto-denies and tears itself down cleanly.

Esc on a permission or operator overlay called closeInsetOverlay without
ever invoking the awaited resolve, deadlocking the session until the
process was killed. Add an onCancel hook to the overlay opts, thread it
through openListOverlay/closeInsetOverlay for the promise-backed overlay
kinds only, and have gate-wire resolve deny/cancel from it.

Author: TheGreatAxios

src/tui-opentui/gate-wire.test.ts

@@ -9,6 +9,7 @@ import { withTestRenderer, type Harness } from "./harness.js"
 import { OVERLAY_MAX_FRACTION } from "./geometry/index.js"
 import {
   acceptOverlaySelection,
+  closeInsetOverlay,
   createAppShell,
   exitOverlayAnswerMode,
   handleOverlayAnswerKey,
@@ -423,6 +424,171 @@ describe("wireGates", () => {
   })
 })
 
+describe("permission.gate auto-deny", () => {
+  test("timeoutMs elapsing auto-denies with the timeout message and closes the overlay", async () => {
+    await withTestRenderer(async (h) => {
+      const shell = createAppShell(h.renderer, {
+        terminal: { columns: 80, rows: 24 },
+        run: "idle",
+      })
+      const emitter = new EventEmitter()
+      let resolved: unknown
+      try {
+        wireGates(emitter, shell)
+        emitter.emit("permission.gate", {
+          request: baseRequest(),
+          resolve: (outcome: unknown) => {
+            resolved = outcome
+          },
+          timeoutMs: 5,
+          timeoutMessage: "goal mode: no answer in time",
+        })
+        expect(shell.overlayKind).toBe("permissions")
+
+        await new Promise((r) => setTimeout(r, 20))
+
+        expect(resolved).toEqual({
+          allow: false,
+          message: "goal mode: no answer in time",
+        })
+        expect(shell.overlayList).toBeNull()
+      } finally {
+        shell.dispose()
+      }
+    })
+  })
+
+  test("aborting the signal while the overlay is open auto-denies and closes it", async () => {
+    await withTestRenderer(async (h) => {
+      const shell = createAppShell(h.renderer, {
+        terminal: { columns: 80, rows: 24 },
+        run: "idle",
+      })
+      const emitter = new EventEmitter()
+      const controller = new AbortController()
+      let resolved: unknown
+      try {
+        wireGates(emitter, shell)
+        emitter.emit("permission.gate", {
+          request: baseRequest(),
+          resolve: (outcome: unknown) => {
+            resolved = outcome
+          },
+          signal: controller.signal,
+        })
+        expect(shell.overlayKind).toBe("permissions")
+
+        controller.abort()
+
+        expect(resolved).toEqual({
+          allow: false,
+          message: "tool no longer running; permission request denied",
+        })
+        expect(shell.overlayList).toBeNull()
+      } finally {
+        shell.dispose()
+      }
+    })
+  })
+
+  test("resolving normally clears the timer instead of firing it later", async () => {
+    await withTestRenderer(async (h) => {
+      const shell = createAppShell(h.renderer, {
+        terminal: { columns: 80, rows: 24 },
+        run: "idle",
+      })
+      const emitter = new EventEmitter()
+      let resolveCount = 0
+      let lastOutcome: unknown
+      try {
+        wireGates(emitter, shell)
+        emitter.emit("permission.gate", {
+          request: baseRequest(),
+          resolve: (outcome: unknown) => {
+            resolveCount += 1
+            lastOutcome = outcome
+          },
+          timeoutMs: 10,
+        })
+
+        acceptOverlaySelection(shell)
+        expect(resolveCount).toBe(1)
+        expect(lastOutcome).toEqual({ allow: false })
+
+        await new Promise((r) => setTimeout(r, 25))
+        expect(resolveCount).toBe(1)
+      } finally {
+        shell.dispose()
+      }
+    })
+  })
+})
+
+describe("Esc on a gate overlay settles the awaited promise", () => {
+  test("permission.gate: Esc denies instead of abandoning the promise", async () => {
+    await withTestRenderer(async (h) => {
+      const shell = createAppShell(h.renderer, {
+        terminal: { columns: 80, rows: 24 },
+        run: "idle",
+      })
+      const emitter = new EventEmitter()
+      let resolved: unknown
+      let resolveCount = 0
+      try {
+        wireGates(emitter, shell)
+        emitter.emit("permission.gate", {
+          request: baseRequest(),
+          resolve: (outcome: unknown) => {
+            resolveCount += 1
+            resolved = outcome
+          },
+        })
+        expect(shell.overlayKind).toBe("permissions")
+
+        closeInsetOverlay(shell)
+
+        expect(shell.overlayList).toBeNull()
+        expect(resolveCount).toBe(1)
+        expect(resolved).toEqual({ allow: false })
+      } finally {
+        shell.dispose()
+      }
+    })
+  })
+
+  test("operator.gate: Esc cancels instead of abandoning the promise", async () => {
+    await withTestRenderer(async (h) => {
+      const shell = createAppShell(h.renderer, {
+        terminal: { columns: 80, rows: 24 },
+        run: "idle",
+      })
+      const emitter = new EventEmitter()
+      let resolved: unknown
+      let resolveCount = 0
+      try {
+        wireGates(emitter, shell)
+        emitter.emit("operator.gate", {
+          question: "Proceed?",
+          options: ["Cancel", "Continue"],
+          resolve: (result: unknown) => {
+            resolveCount += 1
+            resolved = result
+          },
+        })
+        expect(shell.overlayKind).toBe("operator")
+
+        closeInsetOverlay(shell)
+
+        expect(shell.overlayList).toBeNull()
+        expect(resolveCount).toBe(1)
+        expect(resolved).toEqual({ kind: "cancel" })
+      } finally {
+        shell.dispose()
+      }
+    })
+  })
+})
+
 describe("permission overlay height", () => {
   const openGate = (shell: AppShell, scopeCount: number): void => {
     const emitter = new EventEmitter()

src/tui-opentui/gate-wire.ts

@@ -14,8 +14,17 @@ import type {
   PermissionRequest,
 } from "../permission/types.js"
 import type { AppShell, OverlaySelection } from "./shell.js"
-import { appendStreamRow, onOverlayClosed, setOverlayBody } from "./shell.js"
+import {
+  appendStreamRow,
+  closeInsetOverlay,
+  onOverlayClosed,
+  setOverlayBody,
+} from "./shell.js"
 import { EXPAND_KEY } from "./stream.js"
+import type {
+  OperatorGateEvent,
+  PermissionGateEvent,
+} from "../tui/gate-events.js"
 
 /** Stable sentinel ids for the always-present deny / once rows. */
 export const PERMISSION_DENY_ID = "__deny__" as const
@@ -218,17 +227,6 @@ function recordDecision(
   appendStreamRow(shell, { role: "system", text, meta: "permission" })
 }
 
-type PermissionGateEvent = {
-  request: PermissionRequest
-  resolve: (outcome: ApprovalOutcome) => void
-}
-
-type OperatorGateEvent = {
-  question: string
-  options: string[]
-  resolve: (result: OperatorResult) => void
-}
-
 /**
  * Subscribe the permission/operator gate events to the shell's overlays.
  * Returns a dispose function that removes exactly the listeners this call added.
@@ -264,6 +262,8 @@ export function wireGates(
     const collapsedAnything =
       formatCommandForApproval(ev.request.subject).payloadCount > 0
     let expanded = false
+    let settled = false
+    let isOpen = false
 
     const onToggleExpand = (): void => {
       expanded = !expanded
@@ -283,20 +283,77 @@ export function wireGates(
       })
     }
 
-    openOrQueue(() => openPermissionsOverlay(shell, {
-      items: choices.items,
-      itemIds: choices.itemIds,
-      body: collapsedBody,
-      ...(collapsedAnything ? { onToggleExpand } : {}),
-      onAccept: (sel: OverlaySelection) => {
-        const gateSelection = {
-          index: sel.index,
-          ...(sel.id !== undefined ? { id: sel.id } : {}),
-        }
-        recordDecision(shell, ev.request, choices, gateSelection)
-        ev.resolve(approvalOutcomeFromSelection(choices, gateSelection))
-      },
-    }))
+    const open = (): void => {
+      isOpen = true
+      openPermissionsOverlay(shell, {
+        items: choices.items,
+        itemIds: choices.itemIds,
+        body: collapsedBody,
+        ...(collapsedAnything ? { onToggleExpand } : {}),
+        onAccept: (sel: OverlaySelection) => {
+          settled = true
+          clearTimers()
+          const gateSelection = {
+            index: sel.index,
+            ...(sel.id !== undefined ? { id: sel.id } : {}),
+          }
+          recordDecision(shell, ev.request, choices, gateSelection)
+          ev.resolve(approvalOutcomeFromSelection(choices, gateSelection))
+        },
+        // Esc must settle the awaited promise (as a deny), not abandon it —
+        // an unresolved gate hangs the run until the process is killed.
+        onCancel: () => {
+          if (settled) return
+          settled = true
+          clearTimers()
+          ev.resolve(
+            approvalOutcomeFromSelection(choices, {
+              index: 0,
+              id: PERMISSION_DENY_ID,
+            }),
+          )
+        },
+      })
+    }
+
+    // Watchdog abort (tool budget expired / parent run cancelled) and the
+    // goal-mode timeout both race an operator who may never answer — each
+    // must resolve the gate itself rather than leave the overlay (or the
+    // queued open) parked forever. autoDeny wins the race exactly once:
+    // whichever fires first tears down the other and, if the overlay is
+    // already on screen for this gate, closes it so nothing stale lingers.
+    let timer: ReturnType<typeof setTimeout> | undefined
+    const clearTimers = (): void => {
+      if (timer !== undefined) clearTimeout(timer)
+      ev.signal?.removeEventListener("abort", onAbort)
+    }
+    const autoDeny = (message: string): void => {
+      if (settled) return
+      settled = true
+      clearTimers()
+      if (isOpen) {
+        closeInsetOverlay(shell)
+      } else {
+        const idx = pending.indexOf(open)
+        if (idx >= 0) pending.splice(idx, 1)
+      }
+      ev.resolve({ allow: false, message })
+    }
+    function onAbort(): void {
+      autoDeny("tool no longer running; permission request denied")
+    }
+    if (ev.timeoutMs !== undefined) {
+      timer = setTimeout(() => {
+        autoDeny(ev.timeoutMessage ?? "approval timed out; request denied")
+      }, ev.timeoutMs)
+    }
+    if (ev.signal?.aborted === true) {
+      autoDeny("tool no longer running; permission request denied")
+      return
+    }
+    ev.signal?.addEventListener("abort", onAbort, { once: true })
+
+    openOrQueue(open)
   }
 
   function onOperator(ev: OperatorGateEvent): void {
@@ -316,6 +373,9 @@ export function wireGates(
       // The ask_operator contract offers a free-form answer, so the overlay
       // must be able to send one back rather than only an option index.
       onTextAnswer: (text: string) => ev.resolve(operatorCustomResult(text)),
+      // Esc must settle the awaited promise (as a cancel), not abandon it —
+      // an unresolved gate hangs the run until the process is killed.
+      onCancel: () => ev.resolve(operatorCancelResult()),
     }))
   }
 

src/tui-opentui/overlays.ts

@@ -89,6 +89,8 @@ export type OpenPermissionsOpts = {
   readonly onAccept?: (selection: OverlaySelection) => void
   /** Per-open expand/collapse of collapsed command payloads. */
   readonly onToggleExpand?: () => void
+  /** Per-open Esc/dismiss; host binds resolve(ApprovalOutcome) so Esc denies instead of hanging. */
+  readonly onCancel?: () => void
 }
 
 export function openPermissionsOverlay(
@@ -108,6 +110,7 @@ export function openPermissionsOverlay(
       ? { onToggleExpand: opts.onToggleExpand }
       : {}),
     ...(opts?.onAccept !== undefined ? { onAccept: opts.onAccept } : {}),
+    ...(opts?.onCancel !== undefined ? { onCancel: opts.onCancel } : {}),
   })
 }
 
@@ -120,6 +123,8 @@ export type OpenOperatorOpts = {
   readonly onAccept?: (selection: OverlaySelection) => void
   /** Per-open free-text answer; host binds the custom OperatorResult. */
   readonly onTextAnswer?: (text: string) => void
+  /** Per-open Esc/dismiss; host binds resolve(cancel) so Esc cancels instead of hanging. */
+  readonly onCancel?: () => void
 }
 
 /**
@@ -128,7 +133,7 @@ export type OpenOperatorOpts = {
  * offering "Enter choose" against an empty list.
  */
 const NO_WAY_TO_ANSWER =
-  "No options were offered and this question takes no typed answer. Press Esc to dismiss it."
+  "No options were offered and this question takes no typed answer. Press Esc to cancel it."
 
 export function openOperatorOverlay(
   shell: AppShell,
@@ -150,6 +155,7 @@ export function openOperatorOverlay(
     ...(opts?.onTextAnswer !== undefined
       ? { onTextAnswer: opts.onTextAnswer }
       : {}),
+    ...(opts?.onCancel !== undefined ? { onCancel: opts.onCancel } : {}),
   })
 }