[Maximooch]

Change

Eligible single-file read/write prompts offer explicit exact-resource approval until close or remembered for the same saved session. Match tool, operation, agent, mode, request-policy context fingerprint, roots and file backend. Normal hard-deny checks still run before any reuse. Native ApprovalManager receives only ONCE approvals; no broad native SESSION/PATTERN/global grants are created. Process/network/delete operations remain one-shot. /permissions shows counts; /permissions reset revokes retained grants. Cancelled/denied requests never create grants.

Depends on #156 (real permission wire fix). No PRs merged.

Validation

10 focused grant/child-approval tests pass, including actual ToolManager writes, policy denial, exact literal-path/agent separation, close/reload/revocation, forged unsafe choices, cancellation/late reply, and real CLI persisted-choice roundtrip. Aggregate118 tests:117 pass; one fails in the independently reproduced native Windows atomic-save issue being fixed separately. Scoped Ruff/diff checks pass. Added to the ACP CI matrix.

Session metadata is the local persistence trust boundary; this is not protection from privileged local filesystem tampering.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
penguin	Ready	Preview	Oct 28, 2026 6:24am UTC

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Maximooch]

Integrated with preserved commit history through #161 (main commit abd8a66). Closing this stacked review after verifying its current head is an ancestor of main.