jif 503ec190a8 Key request-permission grants by environment (#25850) ...

## Stack

1. This PR (#25850) - Key request-permission grants by environment:
stores and applies sticky permission grants per environment id.
2. #25858 - Add `environmentId` to `request_permissions`: lets the model
target a selected environment and resolves relative permission paths
against it.
3. #25862 - Propagate permission approval environment id: carries the
selected environment id through approval events, app-server requests,
TUI prompts, and delegate forwarding.
4. #25867 - Add remote request permissions integration coverage:
verifies the selected remote environment across request, approval, grant
reuse, and exec.

#25858, #25862, and #25867 are stacked on this PR and should be reviewed
after it.

## Why

Multi-environment CCA turns can attach both local and remote executors,
but request-permission grants were still effectively cwd-only. Pending
permission requests tracked a cwd, while stored turn/session grants had
no environment identity, so sticky grants could be reused through the
wrong executor context.

This makes the first permission-grant step environment-aware without
changing the external `request_permissions` payload shape: omitted
environment targeting remains bound to the primary turn environment.

## What Changed

- Store turn- and session-scoped request-permission grants by
`environment_id`.
- Keep the selected `TurnEnvironmentSelection` with pending
`request_permissions` calls so approval responses normalize and record
grants against the same environment.
- Resolve relative `request_permissions` file paths against the primary
turn environment cwd instead of deprecated `turn.cwd`.
- Apply sticky grants in `shell`, `exec_command`, and `apply_patch` by
selected environment id while still using the actual tool cwd for
cwd-relative permission materialization.
- Update Guardian and request-permissions coverage for the
environment-keyed grant behavior.

## Testing

Not run locally. Added or updated focused coverage for:

- `request_permission_grants_are_environment_keyed`
-
`request_permissions_tool_resolves_relative_paths_against_primary_environment`
- related Guardian/request-permissions sticky grant tests

503ec190a8 · 2026-06-02 20:16:57 +02:00

History

..

additional_context.rs

Add experimental turn additional context (#24154)

2026-05-26 13:02:34 -07:00

auto_compact_window.rs

Add body_after_prefix auto-compact token limit scope (#22870)

2026-05-19 10:19:46 +00:00

mod.rs

Add experimental turn additional context (#24154)

2026-05-26 13:02:34 -07:00

service.rs

core: refresh active permission profiles at runtime (#22931)

2026-05-20 21:55:21 +00:00

session_tests.rs

feat: show enterprise monthly credit limits in status (#24812)

2026-06-01 21:25:42 -07:00

session.rs

Key request-permission grants by environment (#25850)

2026-06-02 20:16:57 +02:00

turn.rs

Key request-permission grants by environment (#25850)

2026-06-02 20:16:57 +02:00