Re-evaluate the pending approval queue when a grant widens

A scope-widening grant (session, project, or global) now drains any
already-queued permission requests it covers instead of leaving them to
re-prompt one at a time. Project-scoped grants carry the minting repo's
cwd so they only drain requests from that repo; cross-repo requests still
prompt. Provider-model grants only drain requests matching the active
model, matching evaluate()'s own matching rules.

Author: TheGreatAxios

src/permission/gate.ts

@@ -1,5 +1,5 @@
 import type { ToolCall } from "@intx/types/runtime";
-import type { Approval, ApprovalOutcome, GrantScope, RequestApproval } from "./types.js";
+import type { Approval, ApprovalOutcome, GrantScope, PermissionRequest, RequestApproval } from "./types.js";
 import {
   classifyTool,
   buildRequests,
@@ -12,7 +12,7 @@ import {
 import { autoShellRuleForCall } from "./auto-shell-policy.js";
 import { commandReferencesSensitivePath } from "../plugins/secret-guard-plugin.js";
 import { runShellAuthzBlockReason } from "../shell/run-shell-authz.js";
-import { isApproved, escapeGlobLiteral } from "./matcher.js";
+import { isApproved, matchesPattern, escapeGlobLiteral } from "./matcher.js";
 import { splitChainedCommand, tokenize, isShellCommentOnly, stripCommentLines } from "./command.js";
 import { createPathRestriction } from "./path-restriction.js";
 import { createWorktreeRootsProvider, type RootsProvider } from "./worktrees.js";
@@ -45,6 +45,7 @@ function hasExactFullCommandGrant(
   fullCommand: string,
   approvals: readonly Approval[],
   activeProviderModel: string | undefined,
+  requestCwd: string | undefined,
 ): boolean {
   // Comment-insensitive: a model-authored "# why" line prepended to an
   // otherwise-identical command must still replay against a grant minted
@@ -55,10 +56,40 @@ function hasExactFullCommandGrant(
     (a) =>
       a.tool === tool &&
       a.pattern === normalized &&
-      (a.providerModel === undefined || a.providerModel === activeProviderModel),
+      (a.providerModel === undefined || a.providerModel === activeProviderModel) &&
+      (a.cwd === undefined || a.cwd === requestCwd),
   );
 }
 
+// Pure reconciliation check used to re-evaluate the TUI's pending approval
+// queue against a single newly-minted grant (see PermissionGateOptions.onGrant).
+// A queued request is covered only when this one grant, by itself, would have
+// let it skip the prompt — mirrors the matching evaluate() itself applies, so
+// reconciliation never auto-approves something evaluate() would still ask for.
+export function isRequestCoveredByGrant(
+  request: PermissionRequest,
+  approval: Approval,
+  activeProviderModel: string | undefined,
+): boolean {
+  if (request.tool !== approval.tool) return false;
+  if (approval.cwd !== undefined && approval.cwd !== request.cwd) return false;
+  if (
+    approval.providerModel !== undefined &&
+    approval.providerModel !== activeProviderModel
+  ) {
+    return false;
+  }
+  if (request.tool !== "run_shell") {
+    return matchesPattern(request.subject, approval.pattern);
+  }
+  const segments = splitChainedCommand(request.subject).filter((s) => !isShellCommentOnly(s));
+  if (segments.length === 0) return false;
+  if (segments.length > 1) {
+    return approval.pattern === stripCommentLines(request.subject).trim();
+  }
+  return matchesPattern(segments[0]!, approval.pattern);
+}
+
 // In auto mode these non-shell built-in tools auto-allow without an operator
 // prompt: file mutations plus the benign built-ins that a hands-off run should
 // not stop for. Reads auto-allow via their own path and run_shell via the shell
@@ -117,6 +148,12 @@ export type PermissionGateOptions = {
   // Tiers learned from connected MCP servers (tools/list annotations). Tests may
   // inject a shared registry; production gates create one when omitted.
   mcpTiers?: McpToolPermissionRegistry;
+  // Fires synchronously right after a grant is minted (in-memory list already
+  // updated), before evaluate() moves on to the next request. Callers use this
+  // to re-evaluate any requests already queued behind the one just answered —
+  // see isRequestCoveredByGrant — so a scope-widening grant drains the rest of
+  // the queue instead of re-prompting for coverage it already grants.
+  onGrant?: (approval: Approval) => void;
 };
 
 export type PermissionGate = {
@@ -185,13 +222,16 @@ export function createPermissionGate(options: PermissionGateOptions): Permission
     const approval: Approval =
       grant === "provider-model" && activeProviderModel !== undefined
         ? { tool, pattern, providerModel: activeProviderModel }
-        : { tool, pattern };
+        : grant === "project"
+          ? { tool, pattern, cwd: resolvedCwd }
+          : { tool, pattern };
     approvals.push(approval);
     if (grant === "session") {
       sessionGrants.push(approval);
     } else {
       persist?.(approval, grant);
     }
+    options.onGrant?.(approval);
   };
 
   const evaluate = async (call: ToolCall): Promise<GateVerdict> => {
@@ -233,7 +273,8 @@ export function createPermissionGate(options: PermissionGateOptions): Permission
       // blanket-allowed; fall through to the operator prompt below.
     }
 
-    for (const request of buildRequests(call)) {
+    for (const rawRequest of buildRequests(call)) {
+      const request: typeof rawRequest = { ...rawRequest, cwd: resolvedCwd };
       // Shell: security still splits the chain, but the operator sees (and
       // accepts/rejects) the full command once. Any unapproved segment fails the
       // whole block. Execution always runs the full string the model asked for.
@@ -256,7 +297,7 @@ export function createPermissionGate(options: PermissionGateOptions): Permission
           !fullReferencesSecret &&
           !commandTargetsRestricted(fullCommand, isRestricted) &&
           segments.length > 1 &&
-          hasExactFullCommandGrant(request.tool, fullCommand, approvals, activeProviderModel)
+          hasExactFullCommandGrant(request.tool, fullCommand, approvals, activeProviderModel, resolvedCwd)
         ) {
           continue;
         }
@@ -290,7 +331,7 @@ export function createPermissionGate(options: PermissionGateOptions): Permission
             needsOperator = true;
             continue;
           }
-          if (isApproved(request.tool, segment, approvals, activeProviderModel)) {
+          if (isApproved(request.tool, segment, approvals, activeProviderModel, resolvedCwd)) {
             continue;
           }
           // Safe pipeline tails (`| sort`) and pure no-ops (`|| true`) skip.
@@ -338,7 +379,7 @@ export function createPermissionGate(options: PermissionGateOptions): Permission
       const alreadyApproved =
         // Path-arg tools already drop to ask via callTargetsRestricted; grants
         // match on the path subject the same as before.
-        isApproved(request.tool, request.subject, approvals, activeProviderModel);
+        isApproved(request.tool, request.subject, approvals, activeProviderModel, resolvedCwd);
       if (alreadyApproved) {
         continue;
       }

src/permission/matcher.ts

@@ -38,17 +38,21 @@ export function matchesPattern(subject: string, pattern: string): boolean {
 // True when any stored approval for this tool matches the subject. The subject
 // is the shell command segment (run_shell) or the file path (write/edit). An
 // approval bound to a `providerModel` only matches when `activeProviderModel`
-// equals it, so a grant scoped to one model never leaks to another.
+// equals it, so a grant scoped to one model never leaks to another. An
+// approval bound to a `cwd` (project-scoped) only matches when `requestCwd`
+// equals it, so a project grant from one repo never leaks into another.
 export function isApproved(
   tool: string,
   subject: string,
   approvals: readonly Approval[],
   activeProviderModel?: string,
+  requestCwd?: string,
 ): boolean {
   return approvals.some(
     (a) =>
       a.tool === tool &&
       matchesPattern(subject, a.pattern) &&
-      (a.providerModel === undefined || a.providerModel === activeProviderModel),
+      (a.providerModel === undefined || a.providerModel === activeProviderModel) &&
+      (a.cwd === undefined || a.cwd === requestCwd),
   );
 }

src/permission/permission.test.ts

@@ -779,7 +779,7 @@ describe("createPermissionGate", () => {
     expect((await gate.evaluate(shellCall("npm test"))).allowed).toBe(true);
     expect((await gate.evaluate(shellCall("npm run build"))).allowed).toBe(true);
     expect(asked).toBe(1);
-    expect(persisted).toEqual([{ tool: "run_shell", pattern: "npm *" }]);
+    expect(persisted).toEqual([{ tool: "run_shell", pattern: "npm *", cwd: process.cwd() }]);
   });
 
   test("a declined request blocks the call", async () => {
@@ -1484,7 +1484,7 @@ describe("createPermissionGate", () => {
     // Evaluate same command again — now pre-approved, persist should not fire again.
     await gate.evaluate(shellCall("curl x"));
     expect(persisted).toHaveLength(1);
-    expect(persisted[0]).toEqual({ tool: "run_shell", pattern: "curl x" });
+    expect(persisted[0]).toEqual({ tool: "run_shell", pattern: "curl x", cwd: process.cwd() });
   });
 
   test("persist never fires when pattern is null (one-time approval)", async () => {
@@ -1626,7 +1626,7 @@ describe("createPermissionGate", () => {
     });
     expect((await gate.evaluate(shellCall(full))).allowed).toBe(true);
     expect(asked).toBe(1);
-    expect(persisted).toEqual([{ tool: "run_shell", pattern: full }]);
+    expect(persisted).toEqual([{ tool: "run_shell", pattern: full, cwd: process.cwd() }]);
     // Same full block is covered by the exact grant.
     expect((await gate.evaluate(shellCall(full))).allowed).toBe(true);
     expect(asked).toBe(1);
@@ -1769,7 +1769,7 @@ describe("scoped grants", () => {
       model: "gpt-5",
     });
     await gate.evaluate(shellCall("npm test"));
-    expect(routed[0]).toEqual({ tool: "run_shell", pattern: "npm *" });
+    expect(routed[0]).toEqual({ tool: "run_shell", pattern: "npm *", cwd: process.cwd() });
   });
 });
 

src/permission/types.ts

@@ -10,8 +10,11 @@ export type GrantScope = "session" | "project" | "global" | "provider-model";
 // A single persistable approval: a tool name plus a glob pattern that, when it
 // matches a future call's subject (a shell command or a file path), auto-allows
 // it without asking again. `providerModel`, when set, restricts the approval to
-// the matching active providerName+model.
-export type Approval = { tool: string; pattern: string; providerModel?: string };
+// the matching active providerName+model. `cwd`, when set (project-scoped
+// grants only), restricts the approval to requests originating from that
+// workspace root — a project grant minted in one repo must never auto-allow a
+// queued request from a different repo.
+export type Approval = { tool: string; pattern: string; providerModel?: string; cwd?: string };
 
 // One option offered to the operator at approval time. `pattern` is the glob
 // that gets persisted if the operator picks this scope; `null` means "just this
@@ -37,6 +40,9 @@ export type PermissionRequest = {
   subject: string;
   arguments?: Record<string, unknown>;
   scopes: ApprovalScope[];
+  // The workspace root this request was raised from. Used to confine
+  // project-scoped grant reconciliation to the repo the grant was minted in.
+  cwd?: string;
   // A single muted-line explanation shown to the operator when scopes were
   // withheld for a reason beyond the ordinary "no persistent option exists
   // yet" case (e.g. a mega-chain that only offers accept-once). Plain literal

src/tui/app.tsx

@@ -459,6 +459,10 @@ export function App({
     eventEmitter,
     setGatePending: state.setGatePending,
     activationBlocked: approvalActivationBlocked,
+    // Mirrors the permission gate's own activeProviderModel (fixed at gate
+    // creation from initialProvider/initialModel), so queue reconciliation
+    // honors provider-model-scoped grants the same way evaluate() does.
+    activeProviderModel: `${initialProvider}:${initialModel}`,
   });
 
   useEffect(() => {