fusion

Files

gsxdsm 1db7adcdb0 FN-8809: preserve agent principals for secret approvals

Keep prompt-gated secret approvals bound to their calling chat-agent session.

- Resolve extension secret callers through async session identity context.
- Give anonymous engine sessions unique principals and preserve them across tool invocations.
- Surface actionable approval decision errors in the mailbox and cover approval flows.

Files changed:
 .changeset/fn-8809-secrets-chat-approval.md        |   7 +
 .../__tests__/extension-permission-gates.test.ts   | 257 ++++++++++++++++++++-
 packages/cli/src/extension.ts                      |  96 +++++---
 .../__tests__/session-identity-registry.test.ts    |  27 +++
 packages/core/src/index.ts                         |   4 +-
 packages/core/src/session-identity-registry.ts     |  47 +++-
 packages/dashboard/app/components/MailboxView.tsx  |  11 +-
 .../app/components/__tests__/MailboxView.test.tsx  |  49 ++++
 .../dashboard/src/__tests__/chat-manager.test.ts   |  28 ++-
 .../__tests__/register-approval-routes.test.ts     |  22 ++
 .../src/__tests__/pi-create-fn-agent.test.ts       | 210 ++++++++++++++++-
 packages/engine/src/pi.ts                          |  34 ++-
 12 files changed, 748 insertions(+), 44 deletions(-)

Fusion-Task-Id: FN-8809

Fusion-Task-Lineage: 2e070f78-7215-4401-bcf2-6fa25fa27066

Co-authored-by: Fusion (runfusion.ai) <noreply@runfusion.ai>

2026-08-05 16:46:53 -07:00