@agfpd/iapeer 0.4.3 → 0.4.4

package/README.md

@@ -76,6 +76,18 @@ Two ways to work with an agent locally in your terminal:
 
 Agents reach each other with `send_to_peer`; you can also message any peer over Telegram.
 
+## Bypass Permissions mode
+
+⚠️ **iapeer runs your Claude and Codex peers in bypass-permissions / no-sandbox mode — they execute tools (shell, file edits, network) without asking you to approve each action.** This is by design: a peer is a background, headless session with no human watching its terminal, so there is no one to answer a per-tool permission prompt. The launcher therefore starts Claude with `--dangerously-skip-permissions` and Codex with `--dangerously-bypass-approvals-and-sandbox`, and **auto-accepts the one-time "accept bypass mode" screen on your behalf** the first time a peer boots on a fresh machine.
+
+What this means for you, stated plainly:
+
+- A peer can run any command its runtime can run — read and write files across your home dir, install software, make network calls — with **no confirmation step**. There is no sandbox between an agent and your machine.
+- You are trusting the model's judgement (and the doctrine/instructions you give each peer) the same way you would trust a developer with a shell on your account.
+- iapeer does **not** silently weaken your own interactive `claude`/`codex` setup: the bypass acceptance is recorded per peer in the agent's own config, and the project-MCP pre-approval is written **project-locally** (under the peer's folder), never to your global user settings.
+
+Run iapeer on a host you control, give peers only the access they need, and treat a peer's instructions as security-relevant. `iapeer onboard` states this at setup; it is repeated here so the trade-off is explicit before you create your first agent. Details on every first-run dialog: [docs/07 — Install & update](docs/07-install-and-update.md#first-run-dialogs-on-a-clean-machine).
+
 ## What makes it different
 
 - **Real interactive CLI sessions, not headless one-shots.** Each AI peer is a full Claude Code or Codex CLI session, not a disposable `claude -p` / `codex exec` call (as of 2026-06-15, `claude -p` no longer counts against the subscription's main usage limits).

package/docs/07-install-and-update.md

@@ -47,6 +47,24 @@ You'll see the core version, the daemon's health, and the memory-slot state. The
 
 A breakdown of each onboard step is in [02 — Quick start](02-quickstart.md); runtimes and memory in detail — in [09](09-runtimes.md) and [11](11-extensions-and-memory.md).
 
+## First-run dialogs on a clean machine
+
+On a fresh macOS host the first install → onboard → peer launch surfaces a handful of dialogs. iapeer auto-clears the agent runtimes' own first-run modals when it brings a peer up; **three** items are yours to do.
+
+**Auto-cleared (iapeer answers them on peer boot — you do nothing):**
+
+- **Claude** — the theme picker ("Choose the text style"), folder-trust, external-CLAUDE.md-import, and dev-channels modals (the launcher accepts the default with Enter); the **bypass-permissions accept** screen ("WARNING: Claude Code running in Bypass Permissions mode") that a *virgin* config shows the first time `--dangerously-skip-permissions` runs — its default cursor is "No, exit", so the launcher **steps the cursor to "Yes, I accept"** and confirms (never a bare Enter, which would exit); and the **project MCP-server approval** ("N new MCP servers found in this project") when the peer's cwd carries a `.mcp.json` — pre-approved at `iapeer init` via a project-local `enableAllProjectMcpServers` flag and Enter-confirmed on boot as a backstop. Claude records each accept natively, so a re-launch on the same config is dialog-free.
+- **Codex** — folder-trust ("Do you trust the contents of this directory") is pre-trusted at peer creation and also auto-accepted on boot; the self-update offer is disabled (`check_for_update_on_startup = false`) and auto-declined; hooks-review is auto-trusted.
+- **Bypass / no-sandbox is the operating mode, not a one-time prompt.** The launcher runs Claude with `--dangerously-skip-permissions` and Codex with `--dangerously-bypass-approvals-and-sandbox`, so peers execute tools without per-action approval (a headless peer has no human to approve each call). The one-time *acceptance* screen above is the only interactive gate; the mode itself then stays on for every turn. See the security note in the [README](../README.md#bypass-permissions-mode) — this is a deliberate, disclosed trade-off.
+
+**Three things you do (these cannot be automated):**
+
+1. **Log in to the runtimes — before onboard.** Sign in to Claude Code and Codex first. Their login screen is a browser OAuth flow that no headless peer can drive, so iapeer deliberately does **not** auto-answer it; a runtime that is installed but not signed in makes a peer fail its first wake loudly. `iapeer onboard` warns when it finds an unauthenticated runtime.
+2. **Login keychain password — once, during install.** The install code-signs the binary with a stable local identity so Full Disk Access survives updates; macOS asks for your login keychain password the one time that identity is created. It is expected (the installer announces it). If declined, the binary still works — TCC prompts would just recur on updates.
+3. **Full Disk Access — a manual grant, no prompt.** macOS TCC cannot be set by any flag, env var, or script. Without it, a peer reading or writing a TCC-protected path (an iCloud Obsidian vault, Desktop, Documents, Downloads) silently fails with EPERM — no prompt, no hang. Grant it in **System Settings → Privacy & Security → Full Disk Access** (`~/.iapeer` itself is under `$HOME` and needs nothing); onboard prints the reminder.
+
+Gatekeeper does not gate the locally-built CLI run from a terminal (no quarantine attribute). Verified live on a truly-virgin Claude config (claude 2.1.183): the theme picker, folder-trust, the bypass-permissions accept (cursor stepped to "Yes"), and the project MCP-server approval all auto-clear in sequence, the peer reaches its input prompt, and a second launch on the same config is dialog-free; the Codex folder-trust / update auto-clearing likewise (an owner's clean-machine install + an isolated first-boot test).
+
 ## Updating
 
 ```bash

package/docs/10-messaging.md

@@ -55,7 +55,7 @@ iapeer compact assistant       # compact the conversation
 
 `interrupt` stops a turn that's gone off-track or hung, without losing context. `compact` compacts the conversation; if the peer is asleep after a clean sleep, the daemon resumes it first, then compacts, and for an empty session it honestly answers that there's nothing to compact.
 
-Separate are **aliases** — shortcuts like `/alias-new`, `/alias-compact`, defined in the peer profile. These aren't control but text templates: the runtime expands an alias into its full text and delivers it to the peer as an ordinary message. So with one short command the operator runs a pre-written scenario (e.g. "save state to memory and restart fresh").
+Separate are **aliases** — shortcuts like `/alias_new`, `/alias_compact`, defined in the peer profile. These aren't control but text templates: the runtime expands an alias into its full text and delivers it to the peer as an ordinary message. So with one short command the operator runs a pre-written scenario (e.g. "save state to memory and restart fresh").
 
 ## Ephemeral workers
 

package/docs/ru/07-/321/203/321/201/321/202/320/260/320/275/320/276/320/262/320/272/320/260-/320/270-/320/276/320/261/320/275/320/276/320/262/320/273/320/265/320/275/320/270/320/265.md

@@ -47,6 +47,24 @@ iapeer status
 
 Разбор каждого шага onboard — в [02 — Быстрый старт](02-быстрый-старт.md); рантаймы и память подробно — в [09](09-рантаймы.md) и [11](11-расширения-и-память.md).
 
+## Диалоги первого запуска на чистой машине
+
+На свежем macOS-хосте первый цикл install → onboard → запуск пира выводит несколько диалогов. Собственные first-run-модалки агент-рантаймов iapeer авто-снимает при поднятии пира; **три** пункта — на тебе.
+
+**Авто-снимается (iapeer отвечает на boot пира — от тебя ничего):**
+
+- **Claude** — theme-picker («Choose the text style»), folder-trust, импорт внешнего CLAUDE.md, dev-channels (лончер принимает дефолт через Enter); экран **принятия bypass-permissions** («WARNING: Claude Code running in Bypass Permissions mode»), который *виргин*-конфиг показывает при первом запуске `--dangerously-skip-permissions` — его курсор по умолчанию стоит на «No, exit», поэтому лончер **шагает курсором на «Yes, I accept»** и подтверждает (никогда не голый Enter — он бы вышел из сессии); и **аппрув проектных MCP-серверов** («N new MCP servers found in this project»), когда cwd пира несёт `.mcp.json` — пред-одобряется на `iapeer init` через проектно-локальный флаг `enableAllProjectMcpServers` и на boot подтверждается Enter'ом как страховка. Каждый accept claude записывает нативно, поэтому повторный запуск на том же конфиге уже без диалогов.
+- **Codex** — folder-trust («Do you trust the contents of this directory») пред-доверяется при создании пира и авто-принимается на boot; self-update-оффер отключён (`check_for_update_on_startup = false`) и авто-отклоняется; hooks-review авто-доверяется.
+- **Bypass / no-sandbox — это режим работы, а не разовый промпт.** Лончер запускает Claude с `--dangerously-skip-permissions`, а Codex с `--dangerously-bypass-approvals-and-sandbox`, поэтому пиры выполняют инструменты без поштучного аппрува (у headless-пира нет человека, который подтверждал бы каждый вызов). Разовый экран *принятия* выше — единственный интерактивный гейт; сам режим затем остаётся включённым на каждом ходу. См. security-заметку в [README](../../README.md#bypass-permissions-mode) — это намеренный, раскрытый компромисс.
+
+**Три пункта на тебе (автоматизировать нельзя):**
+
+1. **Залогинься в рантаймы — ДО onboard.** Войди в Claude Code и Codex заранее. Их экран логина — браузерный OAuth, который headless-пир не пройдёт, поэтому iapeer НАМЕРЕННО его не авто-отвечает; установленный, но не залогиненный рантайм роняет первый wake пира громко. `iapeer onboard` предупреждает, если найдёт неаутентифицированный рантайм.
+2. **Пароль логин-связки — один раз, при install.** Install подписывает бинарь стабильной локальной идентичностью, чтобы Full Disk Access пережил обновления; macOS один раз спросит пароль логин-связки при создании этой идентичности. Это ожидаемо (инсталлер анонсирует). При отказе бинарь всё равно работает — просто TCC-промпты будут повторяться на апдейтах.
+3. **Full Disk Access — ручной грант, без промпта.** macOS TCC нельзя выставить ни флагом, ни env, ни скриптом. Без него пир, читающий/пишущий TCC-защищённый путь (iCloud Obsidian vault, Desktop, Documents, Downloads), тихо падает с EPERM — без промпта, без зависания. Выдай в **System Settings → Privacy & Security → Full Disk Access** (`~/.iapeer` сам под `$HOME` и ничего не требует); onboard напомнит.
+
+Gatekeeper не гейтит локально собранный CLI, запускаемый из терминала (нет quarantine-атрибута). Проверено живьём на по-настоящему виргин-конфиге Claude (claude 2.1.183): theme-picker, folder-trust, принятие bypass-permissions (курсор шагнут на «Yes») и аппрув проектных MCP-серверов авто-снимаются по очереди, пир доходит до строки ввода, а повторный запуск на том же конфиге — уже без диалогов; codex folder-trust / update — аналогично (clean-install владельца + изолированный first-boot тест).
+
 ## Обновление
 
 ```bash

package/docs/ru/10-/320/276/320/261/320/274/320/265/320/275-/321/201/320/276/320/276/320/261/321/211/320/265/320/275/320/270/321/217/320/274/320/270.md

@@ -55,7 +55,7 @@ iapeer compact assistant       # сжать диалог
 
 `interrupt` останавливает зашедший не туда или зависший ход, не теряя контекст. `compact` сжимает диалог; если пир спит после чистого усыпления, демон сначала продолжит диалог, потом сожмёт, а для пустой сессии честно ответит, что сжимать нечего.
 
-Отдельно стоят **алиасы** — шорткаты вида `/alias-new`, `/alias-compact`, заданные в профиле пира. Это не контроль, а заготовки текста: рантайм разворачивает алиас в полный текст и доставляет его пиру как обычное сообщение. Так оператор одной короткой командой запускает заранее прописанный сценарий (например, «сохрани состояние в память и перезапустись свежим»).
+Отдельно стоят **алиасы** — шорткаты вида `/alias_new`, `/alias_compact`, заданные в профиле пира. Это не контроль, а заготовки текста: рантайм разворачивает алиас в полный текст и доставляет его пиру как обычное сообщение. Так оператор одной короткой командой запускает заранее прописанный сценарий (например, «сохрани состояние в память и перезапустись свежим»).
 
 ## Эфемерные воркеры
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agfpd/iapeer",
-  "version": "0.4.3",
+  "version": "0.4.4",
   "description": "Foundation core for the iapeer multi-agent ecosystem: identity, registry, storage, codec.",
   "license": "Apache-2.0",
   "author": "agfpd",
@@ -44,9 +44,9 @@
     "test": "IAPEER_TEST_SANDBOX=1 bun test",
     "typecheck": "tsc --noEmit",
     "preversion": "npm run test && npm run typecheck",
-    "release": "npm version patch && npm publish && git push --follow-tags",
-    "release:minor": "npm version minor && npm publish && git push --follow-tags",
-    "release:major": "npm version major && npm publish && git push --follow-tags",
+    "release": "npm version patch && npm publish && git push origin main --follow-tags",
+    "release:minor": "npm version minor && npm publish && git push origin main --follow-tags",
+    "release:major": "npm version major && npm publish && git push origin main --follow-tags",
     "prepublishOnly": "test -z \"$(git status --porcelain)\" || (echo 'release: working tree is dirty — commit or stash before release' >&2 && exit 1)"
   },
   "publishConfig": {

package/src/cli/index.ts

@@ -480,7 +480,7 @@ export interface NewPeerOutcome {
  * new <peer> [runtime] — the UNCONDITIONAL fresh-restart control command
  * (docs/Control-команды §new).
  *
- * The emergency lever for a HUNG or dead agent session: /alias-new covers only
+ * The emergency lever for a HUNG or dead agent session: /alias_new covers only
  * the COOPERATIVE path (a live peer reads the expanded prompt and runs
  * `iapeer self-fresh`); a stuck/raving/dead peer never reads a prompt — this
  * command restarts it MECHANICALLY, bypassing the peer entirely:

package/src/identity/profileStandard.ts

@@ -121,13 +121,13 @@ export function validateProfileStandard(raw: unknown, cwd: string): ProfileIssue
     issues.push({ severity: 'error', field: 'interfaces', message: 'must be a JSON object' })
   }
   // Legacy top-level aliases — contract relocates to the `expansion.aliases` plugin-
-  // config section with the /alias-* namespace (clean slash-keys are reserved for the
+  // config section with the /alias_* namespace (clean slash-keys are reserved for the
   // control layer). telegram-runtime owns that migration; flagged, not an error.
   if (obj.aliases !== undefined) {
     issues.push({
       severity: 'warn',
       field: 'aliases',
-      message: 'legacy top-level `aliases` — contract relocates to expansion.aliases (/alias-* namespace); owner migration pending',
+      message: 'legacy top-level `aliases` — contract relocates to expansion.aliases (/alias_* namespace); owner migration pending',
     })
   }
   // aliases misfiled in the PASSPORT (interfaces.telegram) — an interim home.

package/src/init/index.ts

@@ -6,16 +6,19 @@
 // THE BIG SIMPLIFICATION (install-gate, proven live): a peer gets send_to_peer
 // purely from a project-scope `.mcp.json` pointing at the host-wide HTTP-MCP daemon —
 // NO plugin install, NO /reload-plugins, NO GC version-snapshots (the whole legacy
-// persistent-peer install-gate class is gone). Verified: a cold-start claude session
-// (--dangerously-skip-permissions, as the launch primitive runs it) auto-enables the
-// `.mcp.json` http server and send_to_peer is callable on its FIRST turn, no approve.
+// persistent-peer install-gate class is gone). A cold-start claude session
+// (--dangerously-skip-permissions, as the launch primitive runs it) finds the
+// `.mcp.json` http server and send_to_peer is callable on its FIRST turn. The server's
+// project-approval is pre-granted by ensureClaudeProjectMcpEnabled (the
+// enableAllProjectMcpServers flag below); on a VIRGIN config without it the launch's
+// bootDialogKeys clears the one-time "new MCP servers found" dialog as a backstop.
 //
 // claude side here. codex side (`[mcp_servers.<name>]` in ~/.codex/config.toml +
 // default_tools_approval_mode="approve") lands with its own live codex check.
 
 import { copyFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs'
 import { homedir } from 'os'
-import { join } from 'path'
+import { dirname, join } from 'path'
 import { CODEX_BEARER_ENV_VAR, CODEX_DUMMY_BEARER, IAPEER_DIR, isInfraRuntime, type Runtime } from '../core/constants.ts'
 import { IapError } from '../core/errors.ts'
 import {
@@ -26,6 +29,7 @@ import {
   type StorageOptions,
 } from '../storage/index.ts'
 import { provisionPeer, type ProvisionResult } from '../provision/index.ts'
+import { claudeSettingsPath } from '../launch/nativeMemory.ts'
 import { launchctlBootstrap, launchdPlistPath, type BootstrapResult } from '../launch/launchd.ts'
 import { runtimeSelfConfig, type SelfConfigResult } from '../runtime/index.ts'
 import type { Intelligence } from '../core/constants.ts'
@@ -116,6 +120,46 @@ export function writeClaudeMcpConfig(cwd: string, personality: string, daemonUrl
   return path
 }
 
+/**
+ * Idempotently enable project-scope MCP servers for a claude peer by merging
+ * `"enableAllProjectMcpServers": true` into `<cwd>/.claude/settings.json`.
+ *
+ * Why: on a VIRGIN claude config, the FIRST launch in a cwd carrying a `.mcp.json`
+ * (writeClaudeMcpConfig above) shows a BLOCKING "N new MCP servers found in this
+ * project" approval dialog BEFORE the input prompt — a headless peer has no one to
+ * approve it, so the wake stalls. This project-LOCAL flag pre-approves the cwd's MCP
+ * servers so the dialog never appears (verified live, claude 2.1.183). It is
+ * PROJECT-scoped (this peer's cwd only) — it does NOT touch the user's GLOBAL
+ * ~/.claude/settings.json, so it never alters the user's own claude environment (the
+ * same constraint that forbids a global skipDangerousModePermissionPrompt). The launch
+ * adapter's bootDialogKeys also Enter-confirms this dialog as a belt-and-suspenders
+ * backstop, so a peer whose cwd predates this flag still boots.
+ *
+ * NO-CLOBBER merge (the file may carry foreign blocks — plugin enables, statusline
+ * wrappers, the native-memory lever): parse/patch + atomic write; a non-object
+ * settings.json is REFUSED rather than overwritten. Returns the written path, or null
+ * when already set / on a refusal / on any error (best-effort, never throws — the
+ * bootDialogKeys backstop covers the dialog regardless).
+ */
+export function ensureClaudeProjectMcpEnabled(cwd: string): string | null {
+  const path = claudeSettingsPath(cwd)
+  try {
+    let obj: Record<string, unknown> = {}
+    if (existsSync(path)) {
+      const raw = JSON.parse(readFileSync(path, 'utf8')) as unknown
+      if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return null // refuse to clobber a non-object
+      obj = raw as Record<string, unknown>
+    }
+    if (obj.enableAllProjectMcpServers === true) return path // already enabled
+    obj.enableAllProjectMcpServers = true
+    mkdirSync(dirname(path), { recursive: true })
+    writeFileAtomic(path, `${JSON.stringify(obj, null, 2)}\n`, 0o644)
+    return path
+  } catch {
+    return null // best-effort; the bootDialogKeys backstop still clears the dialog
+  }
+}
+
 // ─────────────────────────────────────────────────────────────────────────────
 // codex MCP config (~/.codex/config.toml — HOST-WIDE; the token-free recipe)
 // ─────────────────────────────────────────────────────────────────────────────
@@ -429,6 +473,10 @@ export async function initPeer(opts: InitPeerOptions): Promise<InitPeerResult> {
   // MCP client), so it gets no `.mcp.json`.
   if (provisioned.runtime === 'claude' || hasClaudeMarker(provisioned.cwd)) {
     mcpConfigPaths.push(writeClaudeMcpConfig(provisioned.cwd, provisioned.personality, daemonUrl))
+    // Pre-approve the cwd's project MCP servers so the FIRST virgin-config launch does
+    // not stall on the blocking "N new MCP servers found" dialog (project-local, never
+    // touches the user's global settings; bootDialogKeys is the backstop).
+    ensureClaudeProjectMcpEnabled(provisioned.cwd)
   }
   // codex: write the token-free host-wide config.toml block (dummy bearer flips codex's
   // auth gate; the OPEN daemon authenticates by the identity header). send_to_peer works

package/src/launch/adapters/claude.ts

@@ -50,11 +50,27 @@ const CLAUDE_BOOT_DIALOG_MARKERS = [
   'Resume from summary',
   'Resuming the full session',
   // First-run theme picker ("Let's get started. Choose the text style…") — appears
-  // on a CLEAN host (fresh config dir) BEFORE the input prompt, verified live on
-  // claude 2.1.181 in a pty. NOT removed by --dangerously-skip-permissions; if not
-  // cleared the peer never reaches ready. (There is NO separate "accept dangerous
-  // permissions" screen in 2.1.181 — verified absent.)
+  // on a CLEAN host (fresh config dir) BEFORE the input prompt. NOT removed by
+  // --dangerously-skip-permissions; if not cleared the peer never reaches ready.
   'Choose the text style',
+  // Bypass-permissions ACCEPT gate ("WARNING: Claude Code running in Bypass
+  // Permissions mode"; options "1. No, exit" / "2. Yes, I accept") — shown on a
+  // VIRGIN config the FIRST time --dangerously-skip-permissions runs, BEFORE the
+  // input prompt. (An earlier note here claimed this screen was "absent in 2.1.181";
+  // that was a NON-VIRGIN observation — the host had already accepted it once, so it
+  // was masked. On a truly virgin config it IS shown and BLOCKS the boot — verified
+  // live, claude 2.1.183 via tmux. bootDialogKeys steps the cursor to "2. Yes, I
+  // accept" and confirms; a bare Enter would hit the "1. No, exit" DEFAULT and kill
+  // the peer.) Once accepted, claude records it natively and the ready banner is the
+  // lowercase "bypass permissions on" (a DISTINCT string), so this marker vanishes —
+  // it never falsely traps isInputReady, and a re-launch is dialog-free (verified).
+  'Bypass Permissions mode',
+  // Project MCP-server approval ("N new MCP servers found in this project", servers
+  // pre-checked [✔]) — shown when cwd carries a .mcp.json the config has not yet
+  // approved. Suppressed at the source by enableAllProjectMcpServers in
+  // <cwd>/.claude/settings.json (init writes it); bootDialogKeys Enter-confirms it as
+  // a backstop. Substring matches both "1 new MCP server" and "N new MCP servers".
+  'new MCP server',
 ] as const
 
 function anyBootDialog(pane: string): boolean {
@@ -164,34 +180,43 @@ export const claudeAdapter: RuntimeAdapter = {
   /**
    * Map a visible startup dialog to the keys that clear it correctly:
    *
-   *   - RESUME COMPACT-PICKER ('Resume from summary …') → CURSOR-VERIFIED two-step.
-   *     This menu's cursor DEFAULTS to "1. Resume from summary (recommended)",
-   *     and selecting it COMPACTS the session (claude implements that choice as an
-   *     internal /compact) — but a resume must NOT trigger a compact. The original
-   *     blind ['Down','Enter'] burst (0e67e1f) put BOTH keys into one pty chunk;
-   *     under a heavy resume (a 313k-token session) the TUI dropped the Down and
-   *     the Enter confirmed the DEFAULT →
-   *     silent /compact (proven: pane log shows the picker frame with ❯ on
-   *     option 1 followed by "❯ /compact"; transcript compactMetadata
-   *     trigger=manual). Fix: ONE key per boot-iteration — Down while the cursor
-   *     is NOT yet seen on "2. Resume full session", Enter ONLY after the
-   *     captured pane PROVES it ("❯ 2."). A swallowed Down self-heals on the
-   *     next 2 s iteration; Enter can never hit the compacting default. If the
-   *     picker layout ever changes, the loop Downs until the boot deadline and
-   *     the wake fails LOUD — never a silent compact.
-   *   - OTHER MODALS (folder-trust / external-import / dev-channels) → ['Enter']:
-   *     their default-highlighted option IS the proceed path, so a bare Enter clears
-   *     each (claude-start.sh:341).
+   *   - CURSOR-VERIFIED two-step menus ('Resume from summary …' AND 'Bypass
+   *     Permissions mode') → step Down, confirm ONLY once the captured pane proves
+   *     the cursor sits on "2.". Both menus share one hazard: their DEFAULT cursor is
+   *     the WRONG option, so a blind Enter picks it.
+   *       · Resume: default "1. Resume from summary (recommended)" COMPACTS the
+   *         session (claude runs that choice as an internal /compact) — a resume must
+   *         not compact.
+   *       · Bypass: default "1. No, exit" makes the peer EXIT (die). "2. Yes, I
+   *         accept" is the proceed path. (Virgin-config gate the first time
+   *         --dangerously-skip-permissions runs; once accepted claude persists it.)
+   *     The original blind ['Down','Enter'] burst (0e67e1f) put BOTH keys in one pty
+   *     chunk; under load the TUI dropped the Down and the Enter confirmed the DEFAULT
+   *     (proven for resume: pane frame ❯ on option 1 → "❯ /compact"). Fix: ONE key
+   *     per boot-iteration — Down while the cursor is NOT yet on "2.", Enter ONLY
+   *     after the captured pane PROVES it ("❯ 2."). A swallowed Down self-heals next
+   *     iteration; Enter can never hit the bad default. If the layout ever changes the
+   *     loop Downs until the boot deadline and the wake fails LOUD.
+   *   - SINGLE-CONFIRM modals (folder-trust / external-import / dev-channels / theme /
+   *     project MCP-server approval) → ['Enter']: the default-highlighted option IS
+   *     the proceed path, so a bare Enter clears each. The MCP approval pre-checks the
+   *     servers [✔] (Enter enables them, Esc rejects all) — it is also suppressed at
+   *     the source by enableAllProjectMcpServers (init), so the Enter here is a
+   *     backstop. (claude-start.sh:341.)
    *   - anything else (incl. the post-select "Resuming…" load state) → null (wait).
    */
   bootDialogKeys(pane: string): string[] | null {
-    if (pane.includes('Resume from summary')) {
+    if (pane.includes('Resume from summary') || pane.includes('Bypass Permissions mode')) {
       return /❯\s*2\./.test(pane) ? ['Enter'] : ['Down']
     }
     if (
       pane.includes('trust this folder') ||
       pane.includes('Allow external CLAUDE.md file imports?') ||
       pane.includes('I am using this for local development') ||
+      // Project MCP-server approval (servers pre-checked [✔]; Enter confirms, Esc
+      // rejects all). enableAllProjectMcpServers normally suppresses it; this is the
+      // backstop. Matches both "1 new MCP server" and "N new MCP servers".
+      pane.includes('new MCP server') ||
       // First-run theme picker (clean host): the default-highlighted row is always a
       // valid theme (any choice is harmless for a headless peer), so a bare Enter
       // accepts it. Without this the picker blocks the boot forever on a fresh host.

package/src/transport/index.ts

@@ -936,7 +936,7 @@ export interface ControlResult {
  * acts on a running session — a non-live peer has nothing to interrupt) then
  * executeControlOnTarget. Without a runtime, resolves the single live runtime (2+ →
  * "specify runtime"). The clean-slash control namespace (interrupt/compact/…) is the
- * caller's; /alias-* expansions are message, not control (docs/Control §namespace).
+ * caller's; /alias_* expansions are message, not control (docs/Control §namespace).
  */
 export async function routeControl(personality: string, runtime: string | undefined, command: ControlCommand): Promise<Result<ControlResult>> {
   if (!isValidName(personality)) {