fix(runtime): derive the tool permission mode from the live boundary (#3349)

The header carries the permission mode the backend was composed with, and a
backend generation outlives many turns. A permission change does not recompose
it, so `ctx.permissionMode` stayed at whatever the mode was when the backend
was built while the boundary the same dispatch reads for sandboxing had already
moved. The picker said Bypass, Bash stayed sandboxed, and approvals kept
prompting.

The boundary is the authority, so the mode is read off the boundary this
dispatch is about to run against. The header answers only for an externally
isolated boundary, which projects to no local mode at all.

Plan mode writes only the header, never the boundary, so the collaboration
overlay still has to apply on top; deriving purely from the boundary would turn
plan+managed from explore into ask and open the client-capability gate. That
rule now lives in @maka/core because both the composer and tool dispatch have
to reach the same answer, and packages/runtime cannot reach runtime-host.

Author: Astro-Han

packages/core/src/collaboration.ts

@@ -17,10 +17,28 @@
  * under the License.
  */
 
+import type { PermissionMode } from './permission.js';
+
 export const COLLABORATION_MODES = ['agent', 'plan'] as const;
 
 export type CollaborationMode = (typeof COLLABORATION_MODES)[number];
 
 export function isCollaborationMode(value: unknown): value is CollaborationMode {
   return typeof value === 'string' && (COLLABORATION_MODES as readonly string[]).includes(value);
 }
+
+/**
+ * The permission mode a session runs under once its collaboration mode is
+ * applied: Plan mode holds the session to read-only unless it is on Bypass.
+ *
+ * Lives here because both the model composer and tool dispatch have to reach
+ * the same answer; a second copy of the rule is a second authority.
+ */
+export function resolveCollaborationPermissionMode(input: {
+  readonly collaborationMode: CollaborationMode;
+  readonly permissionMode: PermissionMode;
+}): PermissionMode {
+  return input.collaborationMode === 'plan' && input.permissionMode !== 'bypass'
+    ? 'explore'
+    : input.permissionMode;
+}

packages/runtime-host/src/server/execution-model-composition.ts

@@ -24,6 +24,7 @@ import { relayModelProfile } from '@maka/core/model-thinking';
 import type { ModelCallAttempt } from '@maka/core/model-call-attempt';
 import type { ModelCallCommit } from '@maka/core/agent-run';
 import type { PermissionMode } from '@maka/core/permission';
+import { resolveCollaborationPermissionMode } from '@maka/core/collaboration';
 import { AiSdkBackend } from '@maka/runtime/ai-sdk-backend';
 import {
   buildDefaultContextBudgetPolicy,
@@ -535,11 +536,4 @@ class HostAiSdkBackend extends AiSdkBackend {
   }
 }
 
-export function resolveCollaborationPermissionMode(input: {
-  readonly collaborationMode: 'agent' | 'plan';
-  readonly permissionMode: PermissionMode;
-}): PermissionMode {
-  return input.collaborationMode === 'plan' && input.permissionMode !== 'bypass'
-    ? 'explore'
-    : input.permissionMode;
-}
+export { resolveCollaborationPermissionMode };

packages/runtime/src/__tests__/tool-runtime-sandbox-boundary.test.ts

@@ -103,6 +103,90 @@ describe('ToolRuntime session sandbox boundary', () => {
     );
   });
 
+  // #3349: the header carries the mode the backend was built with. A picker
+  // switch to Bypass between two turns widens the boundary without rebuilding
+  // that header, so a dispatch that trusts the header keeps sandboxing and
+  // keeps prompting while the picker already reads Bypass.
+  test('reads the permission mode off the live boundary, not the header it was built with', async () => {
+    let boundary: ExecutionBoundary = {
+      kind: 'managed',
+      profile: createWorkspaceWritePermissionProfile(),
+      revision: 0,
+    };
+    const observed: Array<{ kind: string; permissionMode: string | undefined }> = [];
+    const runtime = new ToolRuntime({
+      turnId: 'turn-1',
+      sessionId: 'session-1',
+      header: header(),
+      connection: { providerType: 'openai', slug: 'test' } as never,
+      modelId: 'test',
+      appendMessage: async () => {},
+      readExecutionBoundary: async () => boundary,
+      newId: nextId(),
+      now: () => 1,
+      getPermissionPauseTarget: () => null,
+    });
+    const tool: MakaTool = {
+      name: 'Bash',
+      description: 'test',
+      parameters: {},
+      impl: (_args, context) => {
+        assert.ok(context.executionBoundary);
+        observed.push({
+          kind: context.executionBoundary.kind,
+          permissionMode: context.permissionMode,
+        });
+        return { ok: true };
+      },
+    };
+
+    await settle(runtime, tool, 'tool-1');
+    boundary = { kind: 'bypass', revision: 1 };
+    await settle(runtime, tool, 'tool-2');
+
+    assert.equal(header().permissionMode, 'ask');
+    assert.deepEqual(observed, [
+      { kind: 'managed', permissionMode: 'ask' },
+      { kind: 'bypass', permissionMode: 'bypass' },
+    ]);
+  });
+
+  test('holds Plan mode to read-only even when the live boundary allows writes', async () => {
+    let observed: string | undefined;
+    const runtime = new ToolRuntime({
+      turnId: 'turn-1',
+      sessionId: 'session-1',
+      header: { ...header(), collaborationMode: 'plan' },
+      connection: { providerType: 'openai', slug: 'test' } as never,
+      modelId: 'test',
+      appendMessage: async () => {},
+      readExecutionBoundary: async () => ({
+        kind: 'managed',
+        profile: createWorkspaceWritePermissionProfile(),
+        revision: 0,
+      }),
+      newId: nextId(),
+      now: () => 1,
+      getPermissionPauseTarget: () => null,
+    });
+
+    await settle(
+      runtime,
+      {
+        name: 'Bash',
+        description: 'test',
+        parameters: {},
+        impl: (_args, context) => {
+          observed = context.permissionMode;
+          return { ok: true };
+        },
+      },
+      'tool-1',
+    );
+
+    assert.equal(observed, 'explore');
+  });
+
   test('parks the dedicated tool and admits only one boundary request at a time', async () => {
     const events: SessionEvent[] = [];
     const managed: ExecutionBoundary = {

packages/runtime/src/tool-runtime.ts

@@ -20,9 +20,11 @@
 import { decodeCanonicalToolResultContent } from '@maka/core/tool-result-record-schema';
 import { projectAgentSwarmResult } from '@maka/core/agent-swarm';
 import { projectToolActivityArgs } from '@maka/core/tool-activity-args';
+import { resolveCollaborationPermissionMode } from '@maka/core/collaboration';
 import {
   type CreateSandboxBoundaryRequest,
   type ExecutionBoundary,
+  executionBoundaryDisplayMode,
   type SandboxBoundaryDecision,
   type SandboxBoundaryExpansion,
   type SandboxBoundaryRequest,
@@ -599,6 +601,24 @@ export class ToolRuntime {
     this.readExecutionBoundary = input.readExecutionBoundary;
   }
 
+  /**
+   * The permission mode in force for this dispatch.
+   *
+   * The header carries the mode this backend was built with, which goes stale
+   * the moment the boundary widens under a live Session. The boundary is the
+   * authority, so read the mode off the boundary we are about to dispatch
+   * against; the header only answers for an externally isolated boundary,
+   * which projects to no local mode at all.
+   */
+  private livePermissionMode(boundary: ExecutionBoundary): PermissionMode {
+    const displayed = executionBoundaryDisplayMode(boundary);
+    if (displayed === undefined) return this.input.header.permissionMode;
+    return resolveCollaborationPermissionMode({
+      collaborationMode: this.input.header.collaborationMode ?? 'agent',
+      permissionMode: displayed,
+    });
+  }
+
   async endTurn(reason: 'completed' | 'aborted' = 'completed'): Promise<void> {
     const turnId = this.turnId;
     const boundaryRequests = this.sandboxBoundaryRequests.entries();
@@ -1434,7 +1454,8 @@ export class ToolRuntime {
       }
       const admissionFailure = !tool.prepareExecution
         ? CLIENT_CAPABILITY_PREPARATION_MESSAGE
-        : clientCapabilityBoundary.kind !== 'bypass' && this.input.header.permissionMode !== 'ask'
+        : clientCapabilityBoundary.kind !== 'bypass' &&
+            this.livePermissionMode(clientCapabilityBoundary) !== 'ask'
           ? CLIENT_CAPABILITY_BOUNDARY_MESSAGE
           : undefined;
       if (admissionFailure) {
@@ -1463,7 +1484,7 @@ export class ToolRuntime {
           ...(runId ? { runId } : {}),
           cwd: this.input.header.cwd,
           executionBoundary: clientCapabilityBoundary,
-          permissionMode: this.input.header.permissionMode,
+          permissionMode: this.livePermissionMode(clientCapabilityBoundary),
           toolCallId: toolUseId,
           abortSignal: ctx.abortSignal,
         });
@@ -1594,7 +1615,7 @@ export class ToolRuntime {
             : {}),
           cwd: this.input.header.cwd,
           executionBoundary,
-          permissionMode: this.input.header.permissionMode,
+          permissionMode: this.livePermissionMode(executionBoundary),
           toolCallId: toolUseId,
           // The id the call event actually carries, not the candidate: by here
           // `prepareDurableToolAttempt` has pushed it on the dispatch lane.