Preserve paused leases across engine auth resume

crates/ironclaw_engine/src/executor/orchestrator.rs

@@ -830,14 +830,15 @@ async fn handle_execute_code_step(
                 "had_error": result.failure.is_some(),
                 "pending_gate": result.need_approval.as_ref().map(|na| {
                     match na {
-                        ThreadOutcome::GatePaused { gate_name, action_name, call_id, parameters, resume_kind, resume_output } => serde_json::json!({
+                        ThreadOutcome::GatePaused { gate_name, action_name, call_id, parameters, resume_kind, resume_output, paused_lease } => serde_json::json!({
                             "gate_paused": true,
                             "gate_name": gate_name,
                             "action_name": action_name,
                             "call_id": call_id,
                             "parameters": parameters,
                             "resume_kind": serde_json::to_value(resume_kind).unwrap_or_default(),
                             "resume_output": resume_output,
+                            "paused_lease": paused_lease,
                         }),
                         _ => serde_json::Value::Null,
                     }
@@ -1117,6 +1118,7 @@ async fn handle_execute_action(
             parameters,
             resume_kind,
             resume_output,
+            paused_lease,
         }) => {
             let _ = leases.refund_use(lease.id).await;
             let output = serde_json::json!({"status": "gate_paused", "gate_name": gate_name});
@@ -1147,6 +1149,7 @@ async fn handle_execute_action(
                 "parameters": parameters,
                 "resume_kind": serde_json::to_value(&*resume_kind).unwrap_or_default(),
                 "resume_output": resume_output,
+                "paused_lease": paused_lease.as_deref().cloned(),
             });
             ExtFunctionResult::Return(json_to_monty(&result))
         }
@@ -1624,6 +1627,7 @@ async fn execute_single_action(
             parameters,
             resume_kind,
             resume_output,
+            paused_lease,
         }) => {
             let output = serde_json::json!({"status": "gate_paused", "gate_name": &gate_name});
             let event = EventKind::ApprovalRequested {
@@ -1646,6 +1650,7 @@ async fn execute_single_action(
                 "parameters": parameters,
                 "resume_kind": serde_json::to_value(&*resume_kind).unwrap_or_default(),
                 "resume_output": resume_output,
+                "paused_lease": paused_lease.as_deref().cloned(),
             });
             (result_json, event, output)
         }
@@ -2541,6 +2546,10 @@ fn parse_outcome(result: &serde_json::Value) -> ThreadOutcome {
                     .unwrap_or(serde_json::json!({})),
                 resume_kind,
                 resume_output: result.get("resume_output").cloned(),
+                paused_lease: result
+                    .get("paused_lease")
+                    .cloned()
+                    .and_then(|value| serde_json::from_value(value).ok()),
             }
         }
         _ => ThreadOutcome::Completed { response: None },
@@ -3112,6 +3121,7 @@ mod tests {
             parameters: serde_json::json!({"cmd":"ls"}),
             resume_kind: crate::gate::ResumeKind::Approval { allow_always: true },
             resume_output: None,
+            paused_lease: None,
         };
         normalize_pause_outcome(&mut thread, &outcome).unwrap();
         assert_eq!(thread.state, ThreadState::Waiting);
@@ -3133,18 +3143,38 @@ mod tests {
 
     #[test]
     fn parse_outcome_gate_paused() {
+        let lease = crate::types::capability::CapabilityLease {
+            id: crate::types::capability::LeaseId::new(),
+            thread_id: crate::types::thread::ThreadId::new(),
+            capability_name: "test-capability".into(),
+            granted_actions: crate::types::capability::GrantedActions::Specific(vec![
+                "shell".into(),
+            ]),
+            granted_at: chrono::Utc::now(),
+            expires_at: None,
+            max_uses: Some(1),
+            uses_remaining: Some(1),
+            revoked: false,
+            revoked_reason: None,
+        };
         let result = serde_json::json!({
             "outcome": "gate_paused",
             "gate_name": "approval",
             "action_name": "shell",
             "call_id": "abc",
             "parameters": {"cmd": "rm -rf /"},
-            "resume_kind": {"Approval": {"allow_always": true}}
+            "resume_kind": {"Approval": {"allow_always": true}},
+            "paused_lease": lease,
         });
         let outcome = parse_outcome(&result);
-        assert!(
-            matches!(outcome, ThreadOutcome::GatePaused { action_name, .. } if action_name == "shell")
-        );
+        assert!(matches!(
+            outcome,
+            ThreadOutcome::GatePaused {
+                action_name,
+                paused_lease: Some(_),
+                ..
+            } if action_name == "shell"
+        ));
     }
 
     #[test]

crates/ironclaw_engine/src/executor/scripting.rs

@@ -1186,6 +1186,7 @@ async fn preflight_action(
                         parameters: params.clone(),
                         resume_kind: crate::gate::ResumeKind::Approval { allow_always: true },
                         resume_output: None,
+                        paused_lease: None,
                     },
                 );
             }

crates/ironclaw_engine/src/executor/structured.rs

@@ -166,6 +166,7 @@ pub async fn execute_action_calls(
                             parameters: call.parameters.clone(),
                             resume_kind: crate::gate::ResumeKind::Approval { allow_always: true },
                             resume_output: None,
+                            paused_lease: None,
                         }),
                     });
                 }
@@ -319,6 +320,11 @@ pub async fn execute_action_calls(
                         allow_always: false,
                     }),
                     resume_output: result.output.get("resume_output").cloned(),
+                    paused_lease: result
+                        .output
+                        .get("paused_lease")
+                        .cloned()
+                        .and_then(|value| serde_json::from_value(value).ok()),
                 });
             }
             results.push(result);
@@ -387,6 +393,7 @@ fn classify_exec_result(
             parameters,
             resume_kind,
             resume_output,
+            paused_lease,
         }) => {
             let _error_msg = format!("gate paused: {gate_name}");
             let error_result = ActionResult {
@@ -397,6 +404,7 @@ fn classify_exec_result(
                     "gate": gate_name,
                     "resume_kind": serde_json::to_value(&*resume_kind).unwrap_or_default(),
                     "resume_output": resume_output.as_deref().cloned(),
+                    "paused_lease": paused_lease.as_deref().cloned(),
                 }),
                 is_error: true,
                 duration: std::time::Duration::ZERO,
@@ -893,6 +901,7 @@ mod tests {
                     auth_url: None,
                 }),
                 resume_output: None,
+                paused_lease: None,
             })],
         ));
         let leases = Arc::new(LeaseManager::new());
@@ -976,6 +985,7 @@ mod tests {
                         auth_url: None,
                     }),
                     resume_output: None,
+                    paused_lease: None,
                 }),
                 Ok(ActionResult {
                     call_id: String::new(),

crates/ironclaw_engine/src/runtime/messaging.rs

@@ -42,6 +42,11 @@ pub enum ThreadOutcome {
         /// Completed action output that should be injected on resume instead
         /// of re-running the action.
         resume_output: Option<serde_json::Value>,
+        /// Lease snapshot captured when the gate paused the action.
+        /// Boxed to keep `ThreadOutcome::GatePaused` under clippy's
+        /// `large_enum_variant` threshold — `CapabilityLease` is ~360
+        /// bytes and would otherwise dominate the whole enum's size.
+        paused_lease: Option<Box<crate::types::capability::CapabilityLease>>,
     },
 }
 

crates/ironclaw_engine/src/runtime/mission.rs

@@ -4151,6 +4151,7 @@ mod tests {
                         allow_always: false,
                     }),
                     resume_output: None,
+                    paused_lease: None,
                 });
             }
             Ok(ActionResult {

crates/ironclaw_engine/src/types/error.rs

@@ -79,6 +79,7 @@ pub enum EngineError {
         parameters: Box<serde_json::Value>,
         resume_kind: Box<crate::gate::ResumeKind>,
         resume_output: Option<Box<serde_json::Value>>,
+        paused_lease: Option<Box<crate::types::capability::CapabilityLease>>,
     },
 }
 

src/agent/agent_loop.rs

@@ -1595,6 +1595,7 @@ impl Agent {
             submission,
             Submission::ExecApproval { .. }
                 | Submission::ApprovalResponse { .. }
+                | Submission::ExternalCallback { .. }
                 | Submission::GateAuthResolution { .. }
         ) {
             message

src/bridge/effect_adapter.rs

@@ -169,6 +169,7 @@ impl EffectBridgeAdapter {
         parameters: serde_json::Value,
         resume_kind: ironclaw_engine::ResumeKind,
         resume_output: Option<serde_json::Value>,
+        paused_lease: Option<CapabilityLease>,
     ) -> EngineError {
         EngineError::GatePaused {
             gate_name: gate_name.to_string(),
@@ -177,6 +178,7 @@ impl EffectBridgeAdapter {
             parameters: Box::new(parameters),
             resume_kind: Box::new(resume_kind),
             resume_output: resume_output.map(Box::new),
+            paused_lease: paused_lease.map(Box::new),
         }
     }
 
@@ -185,6 +187,7 @@ impl EffectBridgeAdapter {
         parameters: serde_json::Value,
         context: &ThreadExecutionContext,
         output_value: &serde_json::Value,
+        lease: &CapabilityLease,
     ) -> Option<EngineError> {
         let status = output_value.get("status").and_then(|v| v.as_str())?;
         let name = output_value.get("name").and_then(|v| v.as_str())?;
@@ -221,6 +224,7 @@ impl EffectBridgeAdapter {
                     ),
                 },
                 None,
+                Some(lease.clone()),
             )),
             _ => None,
         }
@@ -726,7 +730,7 @@ impl EffectBridgeAdapter {
         &self,
         action_name: &str,
         parameters: serde_json::Value,
-        _lease: &CapabilityLease,
+        lease: &CapabilityLease,
         context: &ThreadExecutionContext,
         approval_already_granted: bool,
     ) -> Result<ActionResult, EngineError> {
@@ -826,6 +830,7 @@ impl EffectBridgeAdapter {
                             auth_url: sanitize_auth_url(auth_url.as_deref()),
                         },
                         None,
+                        Some(lease.clone()),
                     ));
                 }
                 Ok(crate::bridge::auth_manager::LatentActionExecution::NeedsSetup { message }) => {
@@ -898,6 +903,7 @@ impl EffectBridgeAdapter {
                             auth_url: sanitize_auth_url(cred.auth_url.as_deref()),
                         },
                         None,
+                        Some(lease.clone()),
                     ));
                 }
                 AuthCheckResult::Ready => {
@@ -939,6 +945,7 @@ impl EffectBridgeAdapter {
                             auth_url: sanitize_auth_url(auth_url.as_deref()),
                         },
                         None,
+                        Some(lease.clone()),
                     ));
                 }
                 ToolReadiness::NeedsSetup { message } => {
@@ -996,6 +1003,7 @@ impl EffectBridgeAdapter {
                                 allow_always: false,
                             },
                             None,
+                            Some(lease.clone()),
                         ));
                     }
                 }
@@ -1011,6 +1019,7 @@ impl EffectBridgeAdapter {
                             parameters,
                             ironclaw_engine::ResumeKind::Approval { allow_always: true },
                             None,
+                            Some(lease.clone()),
                         ));
                     }
                 }
@@ -1163,6 +1172,7 @@ impl EffectBridgeAdapter {
                         parameters.clone(),
                         context,
                         &output_value,
+                        lease,
                     )
                 {
                     return Err(err);
@@ -1204,6 +1214,7 @@ impl EffectBridgeAdapter {
                             auth_url: None,
                         },
                         None,
+                        Some(lease.clone()),
                     ));
                 }