Pre-existing (predates #507, surfaced during its review cycle): the session-allow store keys write-tool grants by file path alone, so one "allow for session" on a path covers different operations on that path for the rest of the session. The identical broadening was rejected by review for the new persistent (AllowAlways) grants, which now key on the full operation (input digest, flags, policy fingerprint, cwd digest) — the session store should adopt the same keying (persistent_grant_key in crates/lib/src/tools/executor.rs is reusable).
Risk is bounded (session-lifetime, user-watched) but inconsistent with the stricter standard now applied to durable grants.
Pre-existing (predates #507, surfaced during its review cycle): the session-allow store keys write-tool grants by file path alone, so one "allow for session" on a path covers different operations on that path for the rest of the session. The identical broadening was rejected by review for the new persistent (
AllowAlways) grants, which now key on the full operation (input digest, flags, policy fingerprint, cwd digest) — the session store should adopt the same keying (persistent_grant_keyin crates/lib/src/tools/executor.rs is reusable).Risk is bounded (session-lifetime, user-watched) but inconsistent with the stricter standard now applied to durable grants.