fix(embed): preserve worker control reasons and additive permissions

crates/openhuman-core/src/agent/host_overrides.rs

@@ -17,6 +17,8 @@ pub use tinyagents_harness::cancel::CancellationToken;
 pub struct HostOverrides {
     /// Parent runtime adapters; local hook registration never edits this parent.
     pub parent: Option<Arc<HostOverrides>>,
+    /// Approval registration barrier owned by this agent instance.
+    pub approval_scope: Option<Arc<crate::security::approval::ApprovalScope>>,
     post_turn_hooks: RwLock<BTreeMap<String, Arc<dyn PostTurnHook>>>,
     tool_hooks: RwLock<BTreeMap<String, Arc<dyn ToolHook>>>,
     /// Native inference used by this agent instead of config-routed inference.
@@ -38,6 +40,13 @@ impl std::fmt::Debug for HostOverrides {
 }
 
 impl HostOverrides {
+    /// Resolve the instance barrier inherited by derived turn contexts.
+    pub fn approval_scope(&self) -> Option<Arc<crate::security::approval::ApprovalScope>> {
+        self.approval_scope
+            .clone()
+            .or_else(|| self.parent.as_ref().and_then(|p| p.approval_scope()))
+    }
+
     /// Add or replace an agent-local post-turn hook by name; `None` removes it.
     pub fn post_turn_hook(&self, name: &str, hook: Option<Arc<dyn PostTurnHook>>) {
         let mut hooks = self

crates/openhuman-core/src/hooks/bridge.rs

@@ -82,7 +82,10 @@ fn identity_from_tool(context: &ToolHookContext) -> TurnIdentity {
     TurnIdentity {
         session_id: context.session_id.clone(),
         agent_id: context.agent_id.clone(),
-        cwd: string_field(&context.arguments, "cwd"),
+        cwd: context
+            .cwd
+            .as_ref()
+            .map(|cwd| cwd.to_string_lossy().into_owned()),
         ..TurnIdentity::default()
     }
 }

crates/openhuman-core/src/hooks/bridge_tests.rs

@@ -113,3 +113,18 @@ fn timeout_text_classifies_as_a_timeout_failure() {
     );
     assert_eq!(classify_failure("something else"), "error");
 }
+
+#[test]
+fn configured_hook_identity_uses_the_resolved_working_directory() {
+    let mut ctx = context("shell", serde_json::json!({"command": "pwd"}));
+    ctx.cwd = Some(std::path::PathBuf::from("/resolved/workspace"));
+    assert_eq!(
+        identity_from_tool(&ctx).cwd.as_deref(),
+        Some("/resolved/workspace")
+    );
+    ctx.arguments["cwd"] = serde_json::json!("relative/argument");
+    assert_eq!(
+        identity_from_tool(&ctx).cwd.as_deref(),
+        Some("/resolved/workspace")
+    );
+}

crates/openhuman-core/src/security/approval/flow_surface.rs

@@ -0,0 +1,22 @@
+//! Orders request registration and its approval surfaces after workspace resolution.
+
+use super::ApprovalScope;
+
+/// Resolve the workspace before registering and publishing any approval surface.
+/// Removal during resolution refuses registration; accepted registration and
+/// publication finish together before removal. No barrier is held across the await.
+pub(super) async fn register_after_workspace<W, T>(
+    scope: Option<&ApprovalScope>,
+    workspace: impl std::future::Future<Output = W>,
+    register: impl FnOnce(W) -> T,
+) -> Result<T, String> {
+    let workspace = workspace.await;
+    match scope {
+        Some(scope) => scope.with_open(|| register(workspace)),
+        None => Ok(register(workspace)),
+    }
+}
+
+#[cfg(test)]
+#[path = "flow_surface_tests.rs"]
+mod tests;

crates/openhuman-core/src/security/approval/flow_surface_tests.rs

@@ -0,0 +1,83 @@
+use super::*;
+use std::cell::Cell;
+use std::future::Future;
+use std::sync::Arc;
+use std::task::{Context, Poll, Wake, Waker};
+
+struct Noop;
+impl Wake for Noop {
+    fn wake(self: Arc<Self>) {}
+}
+
+#[test]
+fn a_closed_instance_registers_nothing_and_publishes_neither_flow_surface() {
+    let scope = ApprovalScope::default();
+    scope.close("agent_removed");
+    let publications = Cell::new(0);
+    let mut publication = std::pin::pin!(register_after_workspace(
+        Some(&scope),
+        std::future::ready(17),
+        |_| publications.set(publications.get() + 1),
+    ));
+    let waker = Waker::from(Arc::new(Noop));
+    assert_eq!(
+        publication.as_mut().poll(&mut Context::from_waker(&waker)),
+        Poll::Ready(Err("agent_removed".to_owned()))
+    );
+    assert_eq!(publications.get(), 0);
+}
+
+#[test]
+fn removal_during_workspace_lookup_suppresses_registration_and_all_surfaces() {
+    let scope = ApprovalScope::default();
+    let ready = Cell::new(false);
+    let workspace = std::future::poll_fn(|_| {
+        if ready.get() {
+            Poll::Ready(17)
+        } else {
+            Poll::Pending
+        }
+    });
+    let publications = Cell::new(0);
+    let mut publication = std::pin::pin!(register_after_workspace(Some(&scope), workspace, |_| {
+        publications.set(publications.get() + 1)
+    },));
+    let waker = Waker::from(Arc::new(Noop));
+    let mut cx = Context::from_waker(&waker);
+    assert_eq!(publication.as_mut().poll(&mut cx), Poll::Pending);
+    assert_eq!(
+        publications.get(),
+        0,
+        "registration preceded workspace resolution"
+    );
+    scope.close("agent_removed");
+    ready.set(true);
+    assert_eq!(
+        publication.as_mut().poll(&mut cx),
+        Poll::Ready(Err("agent_removed".to_owned()))
+    );
+    assert_eq!(publications.get(), 0);
+}
+
+#[test]
+fn a_live_or_unscoped_flow_registers_once_with_its_resolved_workspace() {
+    let scope = ApprovalScope::default();
+    for scope in [Some(&scope), None] {
+        let publications = Cell::new(0);
+        let mut publication = std::pin::pin!(register_after_workspace(
+            scope,
+            std::future::ready(Some(("ws_test", 17))),
+            |workspace| {
+                assert_eq!(workspace, Some(("ws_test", 17)));
+                publications.set(publications.get() + 1);
+                42
+            },
+        ));
+        let waker = Waker::from(Arc::new(Noop));
+        assert_eq!(
+            publication.as_mut().poll(&mut Context::from_waker(&waker)),
+            Poll::Ready(Ok(42))
+        );
+        assert_eq!(publications.get(), 1);
+    }
+}

crates/openhuman-core/src/security/approval/gate.rs

@@ -268,6 +268,8 @@ pub(crate) struct RequestRoute {
     pub(crate) tool_call_id: Option<String>,
     pub(crate) forced: bool,
     pub(crate) agent_id: Option<String>,
+    /// Instance barrier captured at registration, independent of decision context.
+    pub(crate) approval_scope: Option<Arc<super::ApprovalScope>>,
     /// The [`thread_route_key`] the request was parked under, so a decision
     /// made outside the parking task's scope clears the right route.
     pub(crate) thread_key: Option<String>,