@alashi/cli 0.14.0 → 0.16.0

package/dist/{store-DoAGOynU.mjs → store-DvLX0Kft.mjs}

@@ -1,9 +1,9 @@
 import { createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { deleteCookie, getCookie, setCookie } from "hono/cookie";
-import { APP_NAME_PATTERN, AppSdkError, ConfigError, JsonFileStore, SDK_VERSION, evaluateAppConfig, interpolateConfig, manifestConfigDefaults, mergeConfig, parseAgentFile, parseManifestWithWarnings } from "@alashi/apps-sdk";
+import { APP_NAME_PATTERN, AppSdkError, ConfigError, JsonFileStore, SDK_VERSION, compilePolicy, describeRule, evaluateAppConfig, evaluatePolicy, interpolateConfig, manifestConfigDefaults, mergeConfig, parseAgentFile, parseManifestWithWarnings, permissionsPolicy } from "@alashi/apps-sdk";
 import semver from "semver";
 import { execFile } from "node:child_process";
-import { cp, lstat, mkdir, readFile, readdir, readlink, rename, rm, stat, symlink, writeFile } from "node:fs/promises";
+import { appendFile, cp, lstat, mkdir, readFile, readdir, readlink, rename, rm, stat, symlink, writeFile } from "node:fs/promises";
 import { basename, dirname, extname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { promisify } from "node:util";
 import { fileURLToPath, pathToFileURL } from "node:url";
@@ -368,6 +368,25 @@ function round(value) {
 function formatUsd(value) {
 	return `$${value.toFixed(value >= 1 ? 2 : 4)}`;
 }
+/**
+* The metering a turn actually contributes, or `undefined` when the engine
+* reported nothing usable.
+*
+* A turn counts when its cost is a finite, non-negative number **or** it
+* reported per-model tokens — an engine that omits both cannot corrupt the
+* totals. This is the single gate for both writes: the ledger line and the
+* usage.json fold must agree on what a turn is, or a rebuild from the ledger
+* would disagree with the live aggregate.
+*/
+function meteredTurn(turn) {
+	const costValid = typeof turn.costUsd === "number" && Number.isFinite(turn.costUsd) && turn.costUsd >= 0;
+	const modelUsage = turn.modelUsage !== void 0 && Object.keys(turn.modelUsage).length > 0 ? turn.modelUsage : void 0;
+	if (!costValid && modelUsage === void 0) return void 0;
+	return {
+		costUsd: costValid ? turn.costUsd : 0,
+		...modelUsage !== void 0 && { modelUsage }
+	};
+}
 /** Merges per-app summaries into the host-wide view. */
 function combineSummaries(summaries) {
 	const combined = {
@@ -453,38 +472,59 @@ function sanitizeModels(models) {
 }
 /**
 * Per-app AI spend and token usage, persisted as OS bookkeeping in the app
-* container (`apps/<name>/usage.json`, next to jobs.json and chat.json):
-* a per-UTC-day series trimmed to the retention window, plus per-month
-* rollups that are kept forever.
+* container next to jobs.json and chat.json, in two files:
+*
+* - `apps/<name>/turns.jsonl` — the ledger: one line per metered turn,
+*   append-only, oldest first, carrying the session attribution the
+*   aggregates throw away.
+* - `apps/<name>/usage.json` — a fold over that ledger: a per-UTC-day series
+*   trimmed to the retention window, plus per-month rollups kept forever.
+*
+* The two are written together inside one per-app queue, so a turn can never
+* land in one and not the other, and concurrent turns can neither lose an
+* update nor interleave a half-written line. Each app has its own queue, so a
+* slow write for one app never delays another.
 *
 * Cost and per-model tokens arrive from the `result` event, whose fields the
 * SDK contract marks optional: engines that report neither simply contribute
-* nothing. Writes are serialized per app so concurrent turns cannot lose an
-* update, and each app has its own queue so a slow write for one app never
-* delays another.
+* nothing.
 */
 var UsageRecorder = class {
 	store;
 	retentionDays;
-	/** Serializes usage.json read-modify-write per app. */
+	/** Serializes the usage.json read-modify-write and ledger append per app. */
 	queues = /* @__PURE__ */ new Map();
+	/** Apps whose ledger has already been compacted in this process. */
+	compacted = /* @__PURE__ */ new Set();
 	constructor(store, retentionDays = 90) {
 		this.store = store;
 		this.retentionDays = retentionDays;
 	}
 	/**
-	* Adds one turn's cost and token usage to the app's totals for the UTC day
-	* and month of `at`. A missing, non-finite, or negative `costUsd` is
-	* ignored; a turn that reports neither valid cost nor any model usage is
-	* not counted and nothing is written, so a provider that omits metering
-	* cannot corrupt the totals.
+	* Appends the turn to the app's ledger and adds its cost and token usage to
+	* the totals for the UTC day and month of `at`. A missing, non-finite, or
+	* negative `costUsd` is ignored; a turn that reports neither valid cost nor
+	* any model usage is not counted and nothing is written at all, so a
+	* provider that omits metering cannot corrupt the totals.
+	*
+	* Both writes happen in the same queued unit of work, ledger first: if the
+	* aggregate write then fails, the ledger is *ahead* of usage.json and
+	* `rebuild()` can recover the turn. The other order would lose it.
 	*/
 	record(appName, turn, at = /* @__PURE__ */ new Date()) {
-		const costValid = typeof turn.costUsd === "number" && Number.isFinite(turn.costUsd) && turn.costUsd >= 0;
-		const modelUsage = turn.modelUsage !== void 0 && Object.keys(turn.modelUsage).length > 0 ? turn.modelUsage : void 0;
-		if (!costValid && modelUsage === void 0) return Promise.resolve();
-		const costUsd = costValid ? turn.costUsd : 0;
+		const metered = meteredTurn(turn);
+		if (metered === void 0) return Promise.resolve();
+		const { costUsd, modelUsage } = metered;
+		const line = {
+			at: at.toISOString(),
+			...turn.sessionId !== void 0 && turn.sessionId !== "" && { sessionId: turn.sessionId },
+			...turn.model !== void 0 && turn.model !== "" && { model: turn.model },
+			costUsd,
+			...modelUsage !== void 0 && { modelUsage }
+		};
 		return this.enqueue(appName, async () => {
+			await this.compactOnce(appName, at);
+			await this.store.appendTurnRecord(appName, line);
 			const state = this.normalize(await this.store.readUsageState(appName));
 			const date = utcDay(at);
 			const day = state.days.find((entry) => entry.date === date);
@@ -539,6 +579,117 @@ var UsageRecorder = class {
 			months
 		};
 	}
+	/**
+	* The app's metered turns, oldest first, with expired lines excluded.
+	*
+	* `since` is an inclusive lower bound compared lexically against the ISO
+	* `at` (so a plain `YYYY-MM-DD` works as "from that day on"), `sessionId`
+	* narrows to one provider session, and both are ANDed. This is the one
+	* reader for the ledger: everything that needs per-turn detail goes through
+	* it rather than parsing the file itself.
+	*/
+	async turns(appName, query = {}, at = /* @__PURE__ */ new Date()) {
+		const cutoff = this.cutoff(at);
+		return (await this.store.readTurnRecords(appName)).filter((record) => this.inWindow(record, cutoff) && (query.since === void 0 || record.at >= query.since) && (query.sessionId === void 0 || record.sessionId === query.sessionId)).sort((a, b) => a.at.localeCompare(b.at));
+	}
+	/**
+	* Rewrites the app's ledger without the lines that have aged out of the
+	* retention window (the same window usage.json days use). Unparseable lines
+	* are dropped by the same rewrite, since only parsed records are written
+	* back.
+	*
+	* Runs inside the per-app queue, so it can never race a turn being
+	* appended. Pure bookkeeping: callers should treat a failure as noise, not
+	* as a reason to fail whatever they were doing.
+	*/
+	compact(appName, at = /* @__PURE__ */ new Date()) {
+		return this.enqueue(appName, async () => {
+			await this.compactNow(appName, at);
+			this.compacted.add(appName);
+		});
+	}
+	/**
+	* Rebuilds usage.json from turns.jsonl, for when the two have drifted apart
+	* (a lost write, a crash mid-fold, a hand edit). The result is exactly what
+	* the incremental fold in `record()` would have produced from the same
+	* lines: same day and month buckets, same turn counts, same per-model
+	* totals, same rounding.
+	*
+	* Caveat, by construction: the ledger is pruned at `retentionDays` but
+	* usage.json months are kept forever, so months the ledger no longer covers
+	* cannot be recomputed. Those keep their existing rollup and only the
+	* months the ledger does cover are replaced — a rebuild never silently
+	* erases older history. The one month that is *partially* covered (the one
+	* the retention cutoff falls in) is replaced by its in-window part, which is
+	* all the ledger can still account for.
+	*
+	* Returns the state it wrote.
+	*/
+	rebuild(appName, at = /* @__PURE__ */ new Date()) {
+		return this.enqueue(appName, async () => {
+			const cutoff = this.cutoff(at);
+			const [records, existing] = await Promise.all([this.store.readTurnRecords(appName), this.store.readUsageState(appName)]);
+			const previous = this.normalize(existing);
+			const days = /* @__PURE__ */ new Map();
+			const months = /* @__PURE__ */ new Map();
+			for (const record of records) {
+				if (!this.inWindow(record, cutoff)) continue;
+				const metered = meteredTurn(record);
+				if (metered === void 0) continue;
+				const date = record.at.slice(0, 10);
+				const monthKey = record.at.slice(0, 7);
+				const day = days.get(date) ?? {
+					date,
+					costUsd: 0,
+					turns: 0
+				};
+				this.apply(day, metered.costUsd, metered.modelUsage);
+				days.set(date, day);
+				const month = months.get(monthKey) ?? {
+					month: monthKey,
+					costUsd: 0,
+					turns: 0
+				};
+				this.apply(month, metered.costUsd, metered.modelUsage);
+				months.set(monthKey, month);
+			}
+			const kept = previous.months.filter((month) => !months.has(month.month));
+			const state = this.prune({
+				days: [...days.values()],
+				months: [...kept, ...months.values()]
+			}, at);
+			await this.store.writeUsageState(appName, state);
+			return state;
+		});
+	}
+	/** The oldest UTC day still inside the retention window at `at`. */
+	cutoff(at) {
+		return utcDay(/* @__PURE__ */ new Date(at.getTime() - (this.retentionDays - 1) * DAY_MS));
+	}
+	inWindow(record, cutoff) {
+		return record.at.slice(0, 10) >= cutoff;
+	}
+	/** The compaction body; assumes it is already inside the app's queue. */
+	async compactNow(appName, at) {
+		const cutoff = this.cutoff(at);
+		const records = await this.store.readTurnRecords(appName);
+		const kept = records.filter((record) => this.inWindow(record, cutoff));
+		if (kept.length === records.length) return;
+		await this.store.writeTurnRecords(appName, kept);
+	}
+	/**
+	* Trims the ledger on the app's first append of the process, so a host that
+	* is never restarted still sheds expired lines. Compaction is bookkeeping
+	* and must never break a turn, so a failure is swallowed — the next process
+	* tries again, and meanwhile `turns()` filters expired lines out anyway.
+	*/
+	async compactOnce(appName, at) {
+		if (this.compacted.has(appName)) return;
+		this.compacted.add(appName);
+		try {
+			await this.compactNow(appName, at);
+		} catch {}
+	}
 	apply(bucket, costUsd, modelUsage) {
 		bucket.costUsd = round(bucket.costUsd + costUsd);
 		bucket.turns += 1;
@@ -582,7 +733,7 @@ var UsageRecorder = class {
 	}
 	/** Drops days outside the retention window and normalizes ordering/values. Months are kept forever. */
 	prune(state, at) {
-		const cutoff = utcDay(/* @__PURE__ */ new Date(at.getTime() - (this.retentionDays - 1) * DAY_MS));
+		const cutoff = this.cutoff(at);
 		return {
 			days: state.days.filter((entry) => typeof entry?.date === "string" && entry.date >= cutoff && Number.isFinite(entry.costUsd) && entry.costUsd >= 0).map((entry) => {
 				const models = sanitizeModels(entry.models);
@@ -1355,8 +1506,14 @@ function createLogger(prefix) {
 * event reaches the caller. This sits under *every* session an app opens —
 * chat turns, cron job handlers, and app routes alike — so spend is recorded
 * no matter who opened the session.
+*
+* The session id and model come from the `session` event, which a provider
+* emits once and which then holds for every later turn — so they are
+* remembered in this closure, not per `send()` call.
 */
 function meterSession(session, recordUsage) {
+	let sessionId;
+	let model;
 	return {
 		get id() {
 			return session.id;
@@ -1365,16 +1522,81 @@ function meterSession(session, recordUsage) {
 			const events = session.send(input);
 			return (async function* metered() {
 				for await (const event of events) {
-					if (event.type === "result") await recordUsage({
-						costUsd: event.costUsd,
-						modelUsage: event.modelUsage
-					});
+					if (event.type === "session") {
+						if (event.sessionId !== "") sessionId = event.sessionId;
+						if (event.model !== void 0 && event.model !== "") model = event.model;
+					}
+					if (event.type === "result") {
+						const id = sessionId ?? (session.id === "" ? void 0 : session.id);
+						await recordUsage({
+							costUsd: event.costUsd,
+							modelUsage: event.modelUsage,
+							...id !== void 0 && { sessionId: id },
+							...model !== void 0 && { model }
+						});
+					}
 					yield event;
 				}
 			})();
 		},
 		interrupt: () => session.interrupt(),
-		close: () => session.close()
+		close: () => session.close(),
+		...session.respondToApproval !== void 0 && { respondToApproval: session.respondToApproval.bind(session) }
+	};
+}
+/**
+* Wraps a session so its approval traffic is mirrored into the host-wide
+* ApprovalRegistry. Layered like `meterSession` under every session an app
+* opens, which is what makes a cron job's approval visible in the host's
+* pending list instead of hanging silently until timeout.
+*
+* A stream that ends while approvals are still pending (crash, close) abandons
+* them, so the registry never carries a pending entry no session can answer.
+*/
+function superviseSession(session, app, registry) {
+	return {
+		get id() {
+			return session.id;
+		},
+		send(input) {
+			const events = session.send(input);
+			const open = /* @__PURE__ */ new Set();
+			return (async function* supervised() {
+				try {
+					for await (const event of events) {
+						if (event.type === "approval_required") {
+							open.add(event.approvalId);
+							registry.track(app, event, (decision) => session.respondToApproval ? session.respondToApproval(event.approvalId, decision) : Promise.resolve());
+						}
+						if (event.type === "approval_resolved") {
+							open.delete(event.approvalId);
+							registry.resolved(event);
+						}
+						yield event;
+					}
+				} finally {
+					for (const approvalId of open) registry.abandon(approvalId);
+				}
+			})();
+		},
+		interrupt: () => session.interrupt(),
+		close: () => session.close(),
+		...session.respondToApproval !== void 0 && { respondToApproval: session.respondToApproval.bind(session) }
+	};
+}
+/** Runs `onClose` once when the session closes (drops its gateway grants). */
+function endOnClose(session, onClose) {
+	return {
+		get id() {
+			return session.id;
+		},
+		send: (input) => session.send(input),
+		interrupt: () => session.interrupt(),
+		close: async () => {
+			onClose();
+			await session.close();
+		},
+		...session.respondToApproval !== void 0 && { respondToApproval: session.respondToApproval.bind(session) }
 	};
 }
 /**
@@ -1393,26 +1615,104 @@ function scopeProvider(provider, defaults) {
 				...defaults.mcpServers,
 				...options.mcpServers
 			};
-			const allowedTools = [.../* @__PURE__ */ new Set([...defaults.allowedTools, ...options.allowedTools ?? []])];
+			if (defaults.gateSession) {
+				const { allowedTools: callAllowed, askTools: callAsk, ...rest } = options;
+				const gate = defaults.gateSession({
+					...callAllowed !== void 0 && { allowedTools: callAllowed },
+					...callAsk !== void 0 && { askTools: callAsk }
+				});
+				const agents = {
+					...defaults.agents,
+					...rest.agents
+				};
+				const skillDirs = [.../* @__PURE__ */ new Set([...defaults.skillDirs, ...rest.skillDirs ?? []])];
+				let session = await provider.createSession({
+					cwd: defaults.cwd,
+					...defaults.instructions !== void 0 && { systemPrompt: defaults.instructions },
+					...rest,
+					...Object.keys(mcpServers).length > 0 && { mcpServers },
+					toolGate: gate.gate,
+					...Object.keys(agents).length > 0 && { agents },
+					...skillDirs.length > 0 && { skillDirs }
+				});
+				session = endOnClose(session, gate.end);
+				if (defaults.supervise) session = defaults.supervise(session);
+				return defaults.recordUsage ? meterSession(session, defaults.recordUsage) : session;
+			}
+			const granted = (defaults.readGrants ? await defaults.readGrants() : []).filter((tool) => defaults.askTools.includes(tool));
+			const allowedTools = [.../* @__PURE__ */ new Set([
+				...defaults.allowedTools,
+				...granted,
+				...options.allowedTools ?? []
+			])];
+			const askTools = [.../* @__PURE__ */ new Set([...defaults.askTools.filter((tool) => !granted.includes(tool)), ...options.askTools ?? []])];
 			const agents = {
 				...defaults.agents,
 				...options.agents
 			};
 			const skillDirs = [.../* @__PURE__ */ new Set([...defaults.skillDirs, ...options.skillDirs ?? []])];
-			const session = await provider.createSession({
+			let session = await provider.createSession({
 				cwd: defaults.cwd,
 				...defaults.instructions !== void 0 && { systemPrompt: defaults.instructions },
 				...options,
 				...Object.keys(mcpServers).length > 0 && { mcpServers },
 				...allowedTools.length > 0 && { allowedTools },
+				...askTools.length > 0 && { askTools },
 				...Object.keys(agents).length > 0 && { agents },
 				...skillDirs.length > 0 && { skillDirs }
 			});
+			if (defaults.supervise) session = defaults.supervise(session);
 			return defaults.recordUsage ? meterSession(session, defaults.recordUsage) : session;
 		}
 	};
 }
 /**
+* A summary that says "nothing has been metered", for a context built without
+* a recorder (tests, and callers that only need config and state).
+*
+* `recorded: false` is the whole point: every number here is an *absence of
+* data*, not a measured zero, and a reader that treats the difference
+* seriously must be able to tell them apart. Built fresh per call so a caller
+* that mutates `days` or `models` cannot poison the next reader.
+*/
+function unrecordedSummary() {
+	return {
+		date: utcDay(),
+		todayCostUsd: 0,
+		todayTurns: 0,
+		todayModels: {},
+		totalCostUsd: 0,
+		models: {},
+		retentionDays: 90,
+		recorded: false,
+		days: [],
+		months: []
+	};
+}
+/**
+* The app's read-only window onto its own spend, in-process like `ctx.state`.
+*
+* The app name is closed over here and never taken as an argument, so an app
+* can only ever read its own ledger: there is no parameter to point at another
+* app, no HTTP hop to spoof, and nothing on this surface that writes. The
+* recorder's own reads already filter to the retention window, so what an app
+* sees is exactly what the host kept.
+*
+* Without a recorder nothing is metered, so the honest answer is "no data":
+* `turns()` is empty and `summary()` reports `recorded: false` rather than a
+* fabricated zero.
+*/
+function appUsage(name, usage) {
+	if (usage === void 0) return {
+		turns: () => Promise.resolve([]),
+		summary: () => Promise.resolve(unrecordedSummary())
+	};
+	return {
+		turns: (query) => usage.turns(name, query),
+		summary: () => usage.summary(name)
+	};
+}
+/**
 * Reads and parses the manifest-declared agent files. The agent's name is
 * the filename without the `.md` extension.
 */
@@ -1450,10 +1750,13 @@ async function resolveAppConfig(store, manifest) {
 * while required keys are missing the scoped provider fails closed.
 *
 * When a `usage` recorder is supplied, every session opened through the
-* returned context reports its per-turn cost to it, and the app's host-set
-* daily spend cap (if any) is enforced on every createSession.
+* returned context reports its per-turn cost to it, the app's host-set daily
+* spend cap (if any) is enforced on every createSession, and `ctx.usage` reads
+* back the app's own ledger. Without one there is no metering, no cap, and
+* `ctx.usage` answers "nothing recorded" — the member is required by the
+* contract, so it is always present.
 */
-async function buildAppContext(store, manifest, provider, usage) {
+async function buildAppContext(store, manifest, provider, usage, approvals, gateway) {
 	const name = manifest.name;
 	const dataDir = store.appDataDir(name);
 	const repoDir = store.appRepoDir(name);
@@ -1470,6 +1773,39 @@ async function buildAppContext(store, manifest, provider, usage) {
 	const mcpServers = interpolate(Object.fromEntries(Object.entries(manifest.mcpServers).filter(([server]) => !excluded.includes(server)).map(([server, { optional: _optional, ...decl }]) => [server, decl])));
 	const allowedTools = manifest.permissions.allowedTools.filter((tool) => !excluded.some((server) => tool.startsWith(`mcp__${server}__`)));
 	const logger = createLogger(name);
+	let askTools = manifest.permissions.askTools.filter((tool) => !excluded.some((server) => tool.startsWith(`mcp__${server}__`)));
+	const agents = await loadAgents(repoDir, manifest.agents);
+	const gated = gateway !== void 0 && provider.supportsToolGate === true && provider.supportsApprovals === true;
+	const declaresPolicy = manifest.permissions.rules.length > 0 || manifest.permissions.default !== "deny";
+	let gateSession;
+	if (gated) {
+		const base = permissionsPolicy({
+			...manifest.permissions,
+			allowedTools,
+			askTools
+		});
+		const implicit = Object.keys(agents).length > 0 ? [{
+			id: "implicit.Agent",
+			tool: "Agent",
+			decision: "allow"
+		}] : [];
+		gateSession = (extra) => gateway.session(name, compilePolicy({
+			default: base.default,
+			rules: [
+				...base.rules,
+				...implicit,
+				...permissionsPolicy(extra).rules
+			]
+		}));
+	} else if (declaresPolicy) {
+		logger.warn(`AI engine "${provider.name}" cannot enforce policy rules; all tools are disabled for this app`);
+		allowedTools.length = 0;
+		askTools = [];
+	}
+	if (!gated && askTools.length > 0 && provider.supportsApprovals !== true) {
+		logger.warn(`AI engine "${provider.name}" does not support interactive approvals; ask-tier tools are disabled`, { askTools });
+		askTools = [];
+	}
 	const recordUsage = usage ? async (turn) => {
 		try {
 			await usage.record(name, turn);
@@ -1483,10 +1819,15 @@ async function buildAppContext(store, manifest, provider, usage) {
 		config,
 		logger,
 		state: new JsonFileStore(join(dataDir, "state.json")),
+		usage: appUsage(name, usage),
 		ai: scopeProvider(provider, {
 			mcpServers,
 			allowedTools,
-			agents: await loadAgents(repoDir, manifest.agents),
+			askTools,
+			...gateSession !== void 0 && { gateSession },
+			...(gated || askTools.length > 0) && approvals !== void 0 && { supervise: (session) => superviseSession(session, name, approvals) },
+			...!gated && askTools.length > 0 && { readGrants: async () => (await store.readGrants(name)).tools },
+			agents,
 			skillDirs: manifest.skills.map((dir) => resolve(repoDir, dir)),
 			...instructions !== void 0 && { instructions },
 			cwd: dataDir,
@@ -1496,6 +1837,255 @@ async function buildAppContext(store, manifest, provider, usage) {
 		})
 	};
 }
+const APPROVAL_LOG_CAP = 100;
+/** Settled records kept in memory so a late responder gets 409, not 404. */
+const SETTLED_CAP = 200;
+/**
+* Host-wide bookkeeping for interactive tool approvals. Sessions wrapped by
+* `superviseSession` register every `approval_required` here, so chat turns
+* and cron jobs alike show up in one pending list; decisions flow back through
+* `respond()` to the provider, and every outcome is appended to the app's
+* `approvals.json` log. The registry also arms the host's timeout policy:
+* a request nobody decides is denied after {@link DEFAULT_APPROVAL_TIMEOUT_MS}
+* (overridable via `approvalTimeoutSeconds` in the global config — host
+* policy, like budgets).
+*
+* Always-allow grants (`grants.json`) are written here too, so ask→allow
+* promotion stays inside manifest bounds in one place.
+*/
+var ApprovalRegistry = class {
+	#store;
+	#timeoutMs;
+	#pending = /* @__PURE__ */ new Map();
+	#settled = /* @__PURE__ */ new Map();
+	/** Serializes approvals.json read-modify-write across apps and timers. */
+	#logQueue = Promise.resolve();
+	constructor(store, options = {}) {
+		this.#store = store;
+		this.#timeoutMs = options.timeoutMs ?? 3e5;
+	}
+	/** Applies the host-config timeout override; safe to fire-and-forget at boot. */
+	async init() {
+		const seconds = (await this.#store.readGlobalConfig()).approvalTimeoutSeconds;
+		if (typeof seconds === "number" && Number.isFinite(seconds) && seconds > 0) this.#timeoutMs = seconds * 1e3;
+	}
+	/** Registers a provider-born approval request and arms the auto-deny timer. */
+	track(app, event, respond) {
+		if (this.#pending.has(event.approvalId)) return;
+		const now = Date.now();
+		const record = {
+			approvalId: event.approvalId,
+			app,
+			tool: event.tool,
+			input: event.input,
+			requestedAt: new Date(now).toISOString(),
+			expiresAt: new Date(now + this.#timeoutMs).toISOString(),
+			status: "pending",
+			...event.ruleId !== void 0 && { ruleId: event.ruleId },
+			...event.reason !== void 0 && { reason: event.reason }
+		};
+		const timer = setTimeout(() => this.#timeout(event.approvalId), this.#timeoutMs);
+		timer.unref?.();
+		this.#pending.set(event.approvalId, {
+			record,
+			respond,
+			timer
+		});
+		this.#mutateLog(app, (approvals) => approvals.push({ ...record }));
+	}
+	/** Attaches the conversation a chat-born approval belongs to (cron ones have none). */
+	annotate(approvalId, fields) {
+		const pending = this.#pending.get(approvalId);
+		if (!pending) return;
+		pending.record.conversationId = fields.conversationId;
+		this.#updateLog(pending.record);
+	}
+	/** The pending or settled record, for endpoint lookups. */
+	get(approvalId) {
+		return this.#pending.get(approvalId)?.record ?? this.#settled.get(approvalId);
+	}
+	/** Snapshots of pending records, optionally narrowed; newest last. */
+	pending(filter = {}) {
+		const records = [];
+		for (const { record } of this.#pending.values()) {
+			if (filter.app !== void 0 && record.app !== filter.app) continue;
+			if (filter.conversationId !== void 0 && record.conversationId !== filter.conversationId) continue;
+			records.push({ ...record });
+		}
+		return records;
+	}
+	/**
+	* Applies a user decision: settles the record, then forwards the decision to
+	* the session that is suspended on it. Returns 'unknown' for an id this host
+	* never saw and 'resolved' for one already decided, so the endpoint can tell
+	* 404 from 409.
+	*/
+	respond(approvalId, decision) {
+		const pending = this.#pending.get(approvalId);
+		if (!pending) return this.#settled.has(approvalId) ? "resolved" : "unknown";
+		this.#settle(pending, decision.behavior === "allow" ? "allowed" : "denied", decision.behavior === "allow" ? decision.scope : void 0);
+		pending.respond(decision).catch(() => void 0);
+		return "ok";
+	}
+	/**
+	* Observes a provider-side resolution (session closed, interrupt) arriving
+	* through the event stream. A registry-initiated decision already settled
+	* the record, so this is a no-op for it.
+	*/
+	resolved(event) {
+		const pending = this.#pending.get(event.approvalId);
+		if (!pending) return;
+		const status = event.behavior === "allow" ? "allowed" : event.reason === "timeout" ? "timeout" : "denied";
+		this.#settle(pending, status);
+	}
+	/**
+	* Marks an approval whose session's event stream ended without a resolution
+	* (crash, abrupt close) as denied, so nothing stays pending forever.
+	*/
+	abandon(approvalId) {
+		const pending = this.#pending.get(approvalId);
+		if (!pending) return;
+		this.#settle(pending, "denied");
+	}
+	/** Reads the app's always-allow grants. */
+	async grants(app) {
+		return (await this.#store.readGrants(app)).tools;
+	}
+	/**
+	* Persists an always-allow grant. Validated against the manifest's askTools:
+	* a grant can promote ask→allow but never allow a tool the manifest did not
+	* declare askable.
+	*/
+	async addGrant(app, tool, askTools) {
+		if (!askTools.includes(tool)) throw new AppSdkError(`Tool "${tool}" is not an ask-tier tool of app "${app}"`);
+		const state = await this.#store.readGrants(app);
+		if (state.tools.includes(tool)) return;
+		state.tools.push(tool);
+		await this.#store.writeGrants(app, state);
+	}
+	/** Clears timers and denies everything still pending (host shutdown). */
+	close() {
+		for (const approvalId of [...this.#pending.keys()]) this.abandon(approvalId);
+	}
+	#timeout(approvalId) {
+		const pending = this.#pending.get(approvalId);
+		if (!pending) return;
+		this.#settle(pending, "timeout");
+		pending.respond({
+			behavior: "deny",
+			message: "Approval timed out",
+			reason: "timeout"
+		}).catch(() => void 0);
+	}
+	#settle(pending, status, scope) {
+		clearTimeout(pending.timer);
+		this.#pending.delete(pending.record.approvalId);
+		pending.record.status = status;
+		pending.record.decidedAt = (/* @__PURE__ */ new Date()).toISOString();
+		if (scope !== void 0) pending.record.scope = scope;
+		this.#settled.set(pending.record.approvalId, pending.record);
+		if (this.#settled.size > SETTLED_CAP) {
+			const oldest = this.#settled.keys().next().value;
+			if (oldest !== void 0) this.#settled.delete(oldest);
+		}
+		this.#updateLog(pending.record);
+	}
+	#updateLog(record) {
+		this.#mutateLog(record.app, (approvals) => {
+			const index = approvals.findIndex((entry) => entry.approvalId === record.approvalId);
+			if (index === -1) approvals.push({ ...record });
+			else approvals[index] = { ...record };
+		});
+	}
+	#mutateLog(app, mutate) {
+		const update = this.#logQueue.then(async () => {
+			const log = await this.#store.readApprovalLog(app);
+			mutate(log.approvals);
+			if (log.approvals.length > APPROVAL_LOG_CAP) log.approvals.splice(0, log.approvals.length - APPROVAL_LOG_CAP);
+			await this.#store.writeApprovalLog(app, log);
+		});
+		this.#logQueue = update.catch(() => void 0);
+	}
+	/** Resolves when all queued approvals.json writes have landed (tests). */
+	flush() {
+		return this.#logQueue.then(() => void 0);
+	}
+};
+//#endregion
+//#region src/chat-bus.ts
+const RING_CAP = 200;
+/**
+* Per-conversation event bus: POST /chat enqueues a turn whose events are
+* published here, and any number of SSE subscribers replay then follow them.
+* Ids are monotonic per bus; the ring keeps the last {@link RING_CAP} entries
+* so a reconnecting subscriber can resume from its Last-Event-ID.
+*/
+var ConversationBus = class {
+	#nextId = 1;
+	#ring = [];
+	#wakers = [];
+	publish(event) {
+		const entry = {
+			id: this.#nextId++,
+			event
+		};
+		this.#ring.push(entry);
+		if (this.#ring.length > RING_CAP) this.#ring.shift();
+		for (const wake of this.#wakers.splice(0)) wake();
+		return entry.id;
+	}
+	/**
+	* Replay then live. With a `lastEventId` still covered by the ring, replay
+	* resumes right after it; one that scrolled out yields a `resync` first.
+	* Without one (a fresh subscriber), replay starts at the current turn — the
+	* entry after the newest `result` — because everything before it is already
+	* served by the history endpoint and would render twice.
+	*
+	* The iterator only ends via the signal (client disconnect); the bus itself
+	* never closes.
+	*/
+	async *subscribe(lastEventId, signal) {
+		let cursor;
+		if (lastEventId === void 0) cursor = this.#turnStart();
+		else {
+			const oldest = this.#ring[0]?.id;
+			if (oldest !== void 0 && lastEventId < oldest - 1) {
+				yield {
+					id: this.#nextId - 1,
+					event: { type: "resync" }
+				};
+				cursor = this.#turnStart();
+			} else cursor = lastEventId + 1;
+		}
+		while (!signal?.aborted) {
+			const next = this.#ring.find((entry) => entry.id >= cursor);
+			if (next) {
+				cursor = next.id + 1;
+				yield next;
+				continue;
+			}
+			await this.#nextPublish(signal);
+		}
+	}
+	/** The id right after the newest `result` in the ring — the in-flight turn's start. */
+	#turnStart() {
+		for (let i = this.#ring.length - 1; i >= 0; i--) {
+			const entry = this.#ring[i];
+			if (entry !== void 0 && entry.event.type === "result") return entry.id + 1;
+		}
+		return this.#ring[0]?.id ?? this.#nextId;
+	}
+	#nextPublish(signal) {
+		return new Promise((resolve) => {
+			const onAbort = () => resolve();
+			this.#wakers.push(() => {
+				signal?.removeEventListener("abort", onAbort);
+				resolve();
+			});
+			signal?.addEventListener("abort", onAbort, { once: true });
+		});
+	}
+};
 //#endregion
 //#region src/scheduler.ts
 const RUN_LOG_CAP = 50;
@@ -1955,6 +2545,45 @@ function roCard(title, children) {
   ]);
 }
 
+// Every tool call passes the host's tool gateway: user overrides first
+// (never past a manifest deny), then the manifest's rules, then the default.
+function ruleRow(r) {
+  return el('div', { class: 'ro-item' }, [
+    el('span', { class: 'chip ' + (r.decision === 'allow' ? 'on' : r.decision === 'deny' ? 'off' : ''),
+                 text: r.decision }),
+    document.createTextNode(' '),
+    el('code', { text: r.summary }),
+    el('div', { class: 'desc', text: (r.description && r.description !== r.summary ? r.description + ' · ' : '') + 'id: ' + r.id }),
+  ]);
+}
+
+function policyCard(p) {
+  const body = [];
+  if (!p.gated) {
+    body.push(el('div', { class: 'desc', text: 'This AI engine cannot gate individual tool calls; only name-level allow/ask lists apply.' }));
+  }
+  if (p.user.length > 0) {
+    body.push(el('h3', { text: 'Your overrides' }), ...p.user.map(ruleRow));
+  }
+  body.push(el('h3', { text: 'Declared by the app' }));
+  body.push(...(p.manifest.length > 0 ? p.manifest.map(ruleRow) : [el('div', { class: 'desc', text: 'No rules.' })]));
+  body.push(el('div', { class: 'desc', text: 'Anything else: ' + p.default + '.' }));
+  return roCard('Tool policy', body);
+}
+
+function toolCallsCard(calls) {
+  return roCard('Recent tool calls', [usageTable(
+    ['When', 'Tool', 'Decision', 'Why', 'Input'],
+    calls.slice().reverse().map((c) => [
+      new Date(c.at).toLocaleString(),
+      c.tool,
+      c.decision + ' (' + c.source + ')',
+      c.reason,
+      c.inputPreview.length > 80 ? c.inputPreview.slice(0, 80) + '…' : c.inputPreview,
+    ]),
+  )]);
+}
+
 function renderManifest(m) {
   const root = document.getElementById('manifest-cards');
   root.replaceChildren();
@@ -2000,10 +2629,8 @@ function renderManifest(m) {
     ]))));
   }
 
-  if (m.allowedTools.length > 0) {
-    cards.push(roCard('Allowed tools', m.allowedTools.map((t) =>
-      el('div', {}, [el('code', { text: t })]))));
-  }
+  if (m.policy) cards.push(policyCard(m.policy));
+  if (m.toolCalls && m.toolCalls.length > 0) cards.push(toolCallsCard(m.toolCalls));
 
   if (m.jobs.length > 0) {
     cards.push(roCard('Jobs', m.jobs.map((j) => el('div', { class: 'ro-item' }, [
@@ -2037,7 +2664,16 @@ async function load() {
     return;
   }
   render(await res.json());
-  if (manRes.ok) renderManifest(await manRes.json());
+  if (manRes.ok) {
+    const m = await manRes.json();
+    const [policyRes, callsRes] = await Promise.all([
+      fetch('/api/apps/' + APP + '/policy'),
+      fetch('/api/apps/' + APP + '/tool-calls?limit=20'),
+    ]);
+    if (policyRes.ok) m.policy = await policyRes.json();
+    if (callsRes.ok) m.toolCalls = (await callsRes.json()).calls;
+    renderManifest(m);
+  }
 }
 
 document.getElementById('save').addEventListener('click', async () => {
@@ -2065,6 +2701,193 @@ load();
 `;
 }
 //#endregion
+//#region src/tool-gateway.ts
+const INPUT_PREVIEW_CHARS = 1e3;
+/** Calls the gate answered `ask` and nobody has decided yet, bounded per host. */
+const PENDING_ASK_CAP = 500;
+/** The audit ledger is trimmed to this many newest lines... */
+const AUDIT_KEEP = 5e3;
+/** ...checked once every this many appends per app. */
+const AUDIT_TRIM_EVERY = 500;
+/**
+* The host's tool gateway: every tool call any app session makes — chat,
+* cron, app routes; built-in, MCP, subagent — is decided here (see
+* `SessionOptions.toolGate`). Layers, in order:
+*
+* 1. the manifest policy (rules, then `allowedTools`/`askTools` sugar);
+* 2. the user's overrides (`policy.json`, plus legacy `grants.json`) — which
+*    may tighten anything but never loosen past a manifest `deny`;
+* 3. session grants ("approve for session"), keyed by the rule that asked;
+*
+* and every decision is appended to the app's `tool-calls.jsonl` audit
+* ledger. `ask` verdicts go on to the provider's interactive approval flow;
+* `applyDecision` turns the user's answer into a session grant or a
+* persistent user rule.
+*/
+var ToolGateway = class {
+	#store;
+	#sessionGrants = /* @__PURE__ */ new Map();
+	#pendingAsks = /* @__PURE__ */ new Map();
+	#appendCounts = /* @__PURE__ */ new Map();
+	/** Serializes ledger appends/trims and policy.json writes. */
+	#queue = Promise.resolve();
+	constructor(store) {
+		this.#store = store;
+	}
+	/** Builds the gate for one new session of `app`. */
+	session(app, manifestPolicy) {
+		const sessionKey = randomUUID();
+		const gate = async (call) => this.#decide(app, sessionKey, manifestPolicy, call);
+		return {
+			gate,
+			end: () => this.#sessionGrants.delete(sessionKey)
+		};
+	}
+	/** The user override layer as stored: policy.json rules, then legacy grants. */
+	async userPolicy(app) {
+		const [policy, grants] = await Promise.all([this.#store.readUserPolicy(app), this.#store.readGrants(app)]);
+		return { rules: [...policy.rules, ...grants.tools.map((tool) => ({
+			id: `grants.${tool}`,
+			tool,
+			decision: "allow"
+		}))] };
+	}
+	/**
+	* Applies the scope of a user's answer to a call this gateway sent to
+	* `ask`: `session` grants the asking rule for the rest of the session,
+	* `always` appends an allow rule with the asking rule's scope to the app's
+	* policy.json. Returns false for approvals this gateway never saw (legacy
+	* name-level sessions), so the caller can fall back.
+	*/
+	async applyDecision(approvalId, decision) {
+		const pending = this.#pendingAsks.get(approvalId);
+		if (!pending) return false;
+		this.#pendingAsks.delete(approvalId);
+		if (decision.behavior !== "allow") return true;
+		if (decision.scope === "session" || decision.scope === "always") {
+			let grants = this.#sessionGrants.get(pending.sessionKey);
+			if (!grants) {
+				grants = /* @__PURE__ */ new Set();
+				this.#sessionGrants.set(pending.sessionKey, grants);
+			}
+			grants.add(pending.grantKey);
+		}
+		if (decision.scope === "always") await this.#persistAlways(pending);
+		return true;
+	}
+	/** The newest audit lines for an app, newest last. */
+	async recentCalls(app, limit = 100) {
+		await this.flush();
+		return (await this.#store.readToolCalls(app)).slice(-limit);
+	}
+	/** Resolves when queued ledger and policy writes have landed (tests). */
+	flush() {
+		return this.#queue.then(() => void 0);
+	}
+	async #decide(app, sessionKey, manifestPolicy, call) {
+		const manifest = evaluatePolicy(manifestPolicy, call);
+		let verdict = manifest;
+		let source = manifest.ruleId !== void 0 ? "manifest" : "default";
+		if (manifest.decision !== "deny") {
+			const user = evaluatePolicy(compilePolicy({
+				default: "deny",
+				...await this.userPolicy(app)
+			}), call);
+			if (user.ruleId !== void 0) {
+				verdict = user;
+				source = "user";
+			}
+		}
+		let result;
+		if (verdict.decision === "ask") {
+			const grantKey = verdict.ruleId ?? `default:${call.tool}`;
+			if (this.#sessionGrants.get(sessionKey)?.has(grantKey)) {
+				source = "session";
+				result = { decision: "allow" };
+			} else {
+				this.#trackAsk(call.toolUseId, {
+					app,
+					sessionKey,
+					grantKey,
+					tool: call.tool,
+					...verdict.rule !== void 0 && { rule: verdict.rule }
+				});
+				result = {
+					decision: "ask",
+					...verdict.ruleId !== void 0 && { ruleId: verdict.ruleId },
+					reason: verdict.reason
+				};
+			}
+		} else if (verdict.decision === "allow") result = { decision: "allow" };
+		else result = {
+			decision: "deny",
+			reason: `Denied by policy: ${verdict.reason}`
+		};
+		this.#audit(app, {
+			at: (/* @__PURE__ */ new Date()).toISOString(),
+			tool: call.tool,
+			toolUseId: call.toolUseId,
+			inputPreview: preview(call.input),
+			decision: result.decision,
+			source,
+			...verdict.ruleId !== void 0 && { ruleId: verdict.ruleId },
+			reason: source === "session" ? `session grant: ${verdict.reason}` : verdict.reason
+		});
+		return result;
+	}
+	#trackAsk(toolUseId, pending) {
+		this.#pendingAsks.set(toolUseId, pending);
+		if (this.#pendingAsks.size > PENDING_ASK_CAP) {
+			const oldest = this.#pendingAsks.keys().next().value;
+			if (oldest !== void 0) this.#pendingAsks.delete(oldest);
+		}
+	}
+	#persistAlways(pending) {
+		const scope = pending.rule ?? {
+			tool: pending.tool,
+			decision: "ask"
+		};
+		const rule = {
+			id: `always.${pending.grantKey}`,
+			tool: scope.tool,
+			...scope.input !== void 0 && { input: scope.input },
+			decision: "allow",
+			description: `Always allowed: ${describeRule(scope)}`
+		};
+		const write = this.#queue.then(async () => {
+			const policy = await this.#store.readUserPolicy(pending.app);
+			if (policy.rules.some((existing) => existing.id === rule.id)) return;
+			policy.rules.unshift(rule);
+			await this.#store.writeUserPolicy(pending.app, policy);
+		});
+		this.#queue = write.catch(() => void 0);
+		return write;
+	}
+	#audit(app, record) {
+		const write = this.#queue.then(async () => {
+			await this.#store.appendToolCall(app, record);
+			const count = (this.#appendCounts.get(app) ?? 0) + 1;
+			this.#appendCounts.set(app, count);
+			if (count % AUDIT_TRIM_EVERY === 0) {
+				const records = await this.#store.readToolCalls(app);
+				if (records.length > AUDIT_KEEP) await this.#store.writeToolCalls(app, records.slice(-5e3));
+			}
+		});
+		this.#queue = write.catch((err) => {
+			console.warn(`alashi: failed to write tool-call audit for "${app}": ${String(err)}`);
+		});
+	}
+};
+function preview(input) {
+	let json;
+	try {
+		json = JSON.stringify(input) ?? String(input);
+	} catch {
+		json = String(input);
+	}
+	return json.length > INPUT_PREVIEW_CHARS ? `${json.slice(0, INPUT_PREVIEW_CHARS)}…` : json;
+}
+//#endregion
 //#region src/server.ts
 const CONTENT_TYPES = {
 	".html": "text/html; charset=utf-8",
@@ -2136,21 +2959,42 @@ function appErrorPage(name, err) {
 *   GET  /api/apps/:name/usage  recorded AI spend: today's total, a daily series,
 *                               per-model token totals, monthly rollups,
 *                               `recorded`, and the budget status
+*   GET  /api/apps/:name/turns  the per-turn ledger that summary folds: `{ turns }`,
+*                               oldest first, each with `at`, `costUsd`, and the
+*                               session/model attribution the buckets drop.
+*                               ?since=<timestamp> (inclusive) and ?session=<id>
+*                               narrow it, ANDed; an unreadable `since` is a 400
 *   GET  /api/apps/:name/budget today's spend against the app's daily cap,
 *                               plus `recorded`
 *   PUT  /api/apps/:name/budget { dailyUsd: number | null } -> set or clear the cap
 *                               (a host setting; apps cannot set their own)
-*   POST /api/apps/:name/chat   { message, conversationId? } -> SSE stream of AgentEvents
-*                               (omit conversationId to start a new conversation; the
-*                                id is echoed in the x-conversation-id response header;
-*                                402 when the app is over its daily spend cap)
+*   POST /api/apps/:name/chat   { message, conversationId? } -> 202 { conversationId };
+*                               the turn runs detached and its AgentEvents are published
+*                               on the conversation's event bus (omit conversationId to
+*                               start a new conversation; the id is also echoed in the
+*                               x-conversation-id response header; 402 when the app is
+*                               over its daily spend cap)
+*   GET  /api/apps/:name/chat/:conversationId/events standing SSE from the conversation
+*                               bus: replay from Last-Event-ID (or ?lastEventId=), then
+*                               live; a scrolled-out id gets a `resync` event first
+*   GET  /api/apps/:name/chat/:conversationId/pending-approvals  reconnect snapshot of
+*                               undecided tool approvals for this conversation
+*   POST /api/apps/:name/chat/:conversationId/approvals/:approvalId
+*                               { behavior: "allow"|"deny", scope?, message? } -> decide a
+*                               pending approval (scope "always" persists a grant);
+*                               404 unknown/expired, 409 already decided
+*   GET  /api/approvals         host-wide pending tool approvals (chat and cron alike)
+*   POST /api/approvals/:approvalId  decide a pending approval regardless of source
 *   GET  /api/apps/:name/chat/conversations          conversations, most recent first
 *   POST /api/apps/:name/chat/conversations  { sessionId?, title? } -> create a conversation,
 *                               optionally adopting an existing provider session (e.g. an
 *                               app-run investigation) so chat continues where it left off
 *   GET  /api/apps/:name/chat/:conversationId/history  past turns from the provider transcript
+*                               plus the conversation's settled approval records
 *   GET  /api/apps/:name/jobs           manifest-declared jobs with schedule/status
 *   POST /api/apps/:name/jobs/:job/run  trigger a job now (409 while already running)
+*   GET  /api/apps/:name/policy         effective tool policy: user overrides + manifest rules
+*   GET  /api/apps/:name/tool-calls?limit=  newest gated tool calls (audit ledger)
 *   GET  /api/apps/:name/manifest       read-only app definition: instructions, agents,
 *                                       skills (with dir contents), allowed tools,
 *                                       MCP servers (with configured state), jobs, model
@@ -2168,9 +3012,19 @@ function createServer(store, provider, options = {}) {
 	const apps = /* @__PURE__ */ new Map();
 	const sessions = /* @__PURE__ */ new Map();
 	const usage = new UsageRecorder(store);
+	const approvals = new ApprovalRegistry(store);
+	const gateway = new ToolGateway(store);
+	approvals.init().catch((err) => {
+		console.warn(`alashi: failed to read approval timeout config: ${String(err)}`);
+	});
+	store.listInstalled().then((records) => Promise.all(records.map((record) => usage.compact(record.name).catch((err) => {
+		console.warn(`alashi: failed to compact turns.jsonl for "${record.name}": ${String(err)}`);
+	})))).catch((err) => {
+		console.warn(`alashi: failed to compact turn ledgers: ${String(err)}`);
+	});
 	async function startApp(name) {
 		const { definition, manifest } = await loadApp(store.appRepoDir(name));
-		const ctx = await buildAppContext(store, manifest, provider, usage);
+		const ctx = await buildAppContext(store, manifest, provider, usage, approvals, gateway);
 		return {
 			manifest,
 			ctx,
@@ -2215,6 +3069,28 @@ function createServer(store, provider, options = {}) {
 		}
 		return session;
 	}
+	/** One bus per conversation; created on first use, kept for reconnects. */
+	const buses = /* @__PURE__ */ new Map();
+	function getBus(name, conversationId) {
+		const key = `${name}/${conversationId}`;
+		let bus = buses.get(key);
+		if (!bus) {
+			bus = new ConversationBus();
+			buses.set(key, bus);
+		}
+		return bus;
+	}
+	/**
+	* Per-conversation turn FIFO: POST /chat enqueues and returns 202, the
+	* detached runner drains one send() at a time (providers reject concurrent
+	* turns on one session). Runners publish their own failures to the bus, so
+	* a queued promise never rejects into the void.
+	*/
+	const turnQueues = /* @__PURE__ */ new Map();
+	function enqueueTurn(key, run) {
+		const next = (turnQueues.get(key) ?? Promise.resolve()).then(run);
+		turnQueues.set(key, next.catch(() => void 0));
+	}
 	const scheduler = new Scheduler(store, getApp);
 	/** Rebuilds the request with `prefix` stripped and hands it to the app's handler. */
 	function dispatch(handler, raw, prefix) {
@@ -2329,6 +3205,22 @@ ${rows}
 </tbody>
 <tfoot><tr><td colspan="4" class="muted" title="${escapeHtml(TODAY_COLUMN_TITLE)}">AI spend today (UTC)</td><td class="muted" style="text-align:right">${totalToday}</td><td></td></tr></tfoot>
 </table>`;
+		const pendingApprovals = approvals.pending();
+		const approvalsSection = pendingApprovals.length === 0 ? "" : `<h2>Pending tool approvals</h2>
+<div class="panel">
+<table>
+<thead><tr><th>App</th><th>Tool</th><th>Requested</th><th>Expires</th><th>Where</th></tr></thead>
+<tbody>
+${pendingApprovals.map((approval) => `<tr>
+  <td><a href="/app/${escapeHtml(approval.app)}/">${escapeHtml(approval.app)}</a></td>
+  <td><code>${escapeHtml(approval.tool)}</code></td>
+  <td class="muted">${escapeHtml(approval.requestedAt)}</td>
+  <td class="muted">${escapeHtml(approval.expiresAt)}</td>
+  <td class="muted">${approval.conversationId ? "chat" : "background"}</td>
+</tr>`).join("\n")}
+</tbody>
+</table>
+</div>`;
 		return c.html(`<!doctype html>
 <html lang="en">
 <head>
@@ -2345,6 +3237,7 @@ ${rows}
 <div class="panel">
 ${body}
 </div>
+${approvalsSection}
 </main>
 </body>
 </html>
@@ -2390,6 +3283,33 @@ ${body}
 			budget: budgetStatusFor(summary, appBudget(config, name))
 		});
 	});
+	/**
+	* The per-turn ledger the usage summary is a fold over: one entry per metered
+	* turn, oldest first, carrying the session attribution the day/month buckets
+	* throw away. `?since=` and `?session=` are optional and ANDed.
+	*
+	* `since` is normalised to a canonical ISO instant before it reaches the
+	* recorder, whose bound is compared lexically against the stored `at`. That
+	* keeps a bare `2026-03-02` working as "from that day on" while making an
+	* offset-bearing timestamp (`...T12:00+05:30`) mean the instant it names
+	* rather than whatever its digits happen to sort next to.
+	*/
+	app.get("/api/apps/:name/turns", async (c) => {
+		const name = c.req.param("name");
+		if (!await installedApp(name)) return c.json({ error: `App "${name}" is not installed` }, 404);
+		const rawSince = c.req.query("since");
+		let since;
+		if (rawSince !== void 0) {
+			const parsed = Date.parse(rawSince);
+			if (Number.isNaN(parsed)) return c.json({ error: `"since" must be a timestamp, got "${rawSince}"` }, 400);
+			since = new Date(parsed).toISOString();
+		}
+		const sessionId = c.req.query("session");
+		return c.json({ turns: await usage.turns(name, {
+			...since !== void 0 && { since },
+			...sessionId !== void 0 && { sessionId }
+		}) });
+	});
 	app.get("/api/apps/:name/budget", async (c) => {
 		const name = c.req.param("name");
 		if (!await installedApp(name)) return c.json({ error: `App "${name}" is not installed` }, 404);
@@ -2458,7 +3378,12 @@ ${body}
 		const convo = conversations.find((conv) => conv.id === conversationId);
 		if (!convo) return c.json({ error: "Unknown conversation" }, 404);
 		const messages = convo.sessionId ? await provider.history?.(convo.sessionId) ?? [] : [];
-		return c.json({ messages });
+		await approvals.flush();
+		const settled = (await store.readApprovalLog(name)).approvals.filter((entry) => entry.conversationId === conversationId && entry.status !== "pending");
+		return c.json({
+			messages,
+			approvals: settled
+		});
 	});
 	/** Drops the cached app and its warm sessions so the next request rebuilds with fresh config. */
 	function restartApp(name) {
@@ -2469,6 +3394,33 @@ ${body}
 			session.then((s) => s.close()).catch(() => void 0);
 		}
 	}
+	app.get("/api/apps/:name/policy", async (c) => {
+		const name = c.req.param("name");
+		const running = await getApp(name);
+		if (!running) return c.json({ error: `App "${name}" is not installed` }, 404);
+		const manifestPolicy = permissionsPolicy(running.manifest.permissions);
+		const user = await gateway.userPolicy(name);
+		const describe = (rule) => ({
+			...rule,
+			summary: describeRule(rule)
+		});
+		return c.json({
+			gated: provider.supportsToolGate === true && provider.supportsApprovals === true,
+			default: manifestPolicy.default,
+			user: user.rules.map(describe),
+			manifest: manifestPolicy.rules.map((rule, index) => describe({
+				...rule,
+				id: rule.id ?? `rules.${index}`
+			}))
+		});
+	});
+	app.get("/api/apps/:name/tool-calls", async (c) => {
+		const name = c.req.param("name");
+		if (!await getApp(name)) return c.json({ error: `App "${name}" is not installed` }, 404);
+		const raw = Number(c.req.query("limit") ?? 100);
+		const limit = Number.isInteger(raw) && raw > 0 ? Math.min(raw, 1e3) : 100;
+		return c.json({ calls: await gateway.recentCalls(name, limit) });
+	});
 	app.get("/api/apps/:name/manifest", async (c) => {
 		const name = c.req.param("name");
 		const running = await getApp(name);
@@ -2611,8 +3563,12 @@ ${body}
 		} catch (err) {
 			return c.json({ error: `Failed to start AI session: ${String(err)}` }, 502);
 		}
-		c.header("x-conversation-id", conversation.id);
-		return streamSSE(c, async (stream) => {
+		const bus = getBus(name, conversation.id);
+		bus.publish({
+			type: "user_message",
+			text: message
+		});
+		enqueueTurn(`${name}/${conversation.id}`, async () => {
 			try {
 				for await (const event of session.send(message)) {
 					if (event.type === "session") {
@@ -2620,23 +3576,111 @@ ${body}
 						conversation.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
 						await store.writeChatState(name, state);
 					}
-					await stream.writeSSE({
-						event: event.type,
-						data: JSON.stringify(event)
-					});
+					if (event.type === "approval_required") approvals.annotate(event.approvalId, { conversationId: conversation.id });
+					bus.publish(event);
 				}
 			} catch (err) {
-				await stream.writeSSE({
-					event: "result",
-					data: JSON.stringify({
-						type: "result",
-						ok: false,
-						error: String(err)
-					})
+				bus.publish({
+					type: "result",
+					ok: false,
+					error: String(err)
 				});
 			}
 		});
+		c.header("x-conversation-id", conversation.id);
+		return c.json({ conversationId: conversation.id }, 202);
 	});
+	app.get("/api/apps/:name/chat/:conversationId/events", async (c) => {
+		const name = c.req.param("name");
+		if (!await getApp(name)) return c.json({ error: `App "${name}" is not installed` }, 404);
+		const conversationId = c.req.param("conversationId");
+		const { conversations } = await getChatState(name);
+		if (!conversations.some((conv) => conv.id === conversationId)) return c.json({ error: "Unknown conversation" }, 404);
+		const raw = c.req.header("last-event-id") ?? c.req.query("lastEventId");
+		const lastEventId = raw !== void 0 && /^\d+$/.test(raw) ? Number(raw) : void 0;
+		const bus = getBus(name, conversationId);
+		const signal = c.req.raw.signal;
+		return streamSSE(c, async (stream) => {
+			for await (const entry of bus.subscribe(lastEventId, signal)) await stream.writeSSE({
+				id: String(entry.id),
+				data: JSON.stringify(entry.event)
+			});
+		});
+	});
+	app.get("/api/apps/:name/chat/:conversationId/pending-approvals", async (c) => {
+		const name = c.req.param("name");
+		if (!await getApp(name)) return c.json({ error: `App "${name}" is not installed` }, 404);
+		return c.json({ approvals: approvals.pending({
+			app: name,
+			conversationId: c.req.param("conversationId")
+		}) });
+	});
+	/** Parses an approval decision body; returns undefined (with a 400 sent) when invalid. */
+	function parseDecision(body) {
+		if (typeof body !== "object" || body === null || Array.isArray(body)) return void 0;
+		const { behavior, scope, message } = body;
+		if (behavior === "allow") {
+			if (scope !== void 0 && scope !== "once" && scope !== "session" && scope !== "always") return;
+			return {
+				behavior: "allow",
+				...scope !== void 0 && { scope }
+			};
+		}
+		if (behavior === "deny") {
+			if (message !== void 0 && typeof message !== "string") return void 0;
+			return {
+				behavior: "deny",
+				...message !== void 0 && { message },
+				reason: "user"
+			};
+		}
+	}
+	/**
+	* Decides one pending approval. `expect` narrows which records this route
+	* may touch (the conversation-scoped route cannot decide another app's or
+	* conversation's approvals).
+	*/
+	async function decideApproval(c, approvalId, expect) {
+		let body;
+		try {
+			body = await c.req.json();
+		} catch {
+			return c.json({ error: "Body must be JSON" }, 400);
+		}
+		const decision = parseDecision(body);
+		if (!decision) return c.json({ error: "Body must be { \"behavior\": \"allow\"|\"deny\", \"scope\"?, \"message\"? }" }, 400);
+		const record = approvals.get(approvalId);
+		if (!record || expect !== void 0 && (record.app !== expect.app || expect.conversationId !== void 0 && record.conversationId !== expect.conversationId)) return c.json({ error: `Unknown approval "${approvalId}"` }, 404);
+		let gatewayHandled;
+		try {
+			gatewayHandled = record.status === "pending" && await gateway.applyDecision(approvalId, decision);
+		} catch (err) {
+			return c.json({ error: `Failed to persist grant: ${String(err)}` }, 500);
+		}
+		if (!gatewayHandled && decision.behavior === "allow" && decision.scope === "always") {
+			const running = await getApp(record.app);
+			if (running) try {
+				await approvals.addGrant(record.app, record.tool, running.manifest.permissions.askTools);
+			} catch (err) {
+				return c.json({ error: String(err) }, 400);
+			}
+		}
+		const outcome = approvals.respond(approvalId, decision);
+		if (outcome === "unknown") return c.json({ error: `Unknown approval "${approvalId}"` }, 404);
+		if (outcome === "resolved") return c.json({ error: `Approval "${approvalId}" is already decided` }, 409);
+		return c.json({ approval: approvals.get(approvalId) });
+	}
+	app.post("/api/apps/:name/chat/:conversationId/approvals/:approvalId", async (c) => {
+		const name = c.req.param("name");
+		if (!await getApp(name)) return c.json({ error: `App "${name}" is not installed` }, 404);
+		return decideApproval(c, c.req.param("approvalId"), {
+			app: name,
+			conversationId: c.req.param("conversationId")
+		});
+	});
+	/** Host-wide views: cron/app-route approvals have no conversation to scope by. */
+	app.get("/api/approvals", (c) => c.json({ approvals: approvals.pending() }));
+	app.post("/api/approvals/:approvalId", (c) => decideApproval(c, c.req.param("approvalId")));
 	app.all("/app/:name/api/*", async (c) => {
 		const name = c.req.param("name");
 		const running = await getApp(name);
@@ -2668,6 +3712,7 @@ ${body}
 		auth,
 		async close() {
 			scheduler.stop();
+			approvals.close();
 			const open = [...sessions.values()];
 			sessions.clear();
 			await Promise.all(open.map(async (p) => {
@@ -2739,9 +3784,24 @@ var Store = class {
 	appJobStatePath(name) {
 		return join(this.appDir(name), "jobs.json");
 	}
+	appApprovalLogPath(name) {
+		return join(this.appDir(name), "approvals.json");
+	}
+	appGrantsPath(name) {
+		return join(this.appDir(name), "grants.json");
+	}
+	appPolicyPath(name) {
+		return join(this.appDir(name), "policy.json");
+	}
+	appToolCallsPath(name) {
+		return join(this.appDir(name), "tool-calls.jsonl");
+	}
 	appUsagePath(name) {
 		return join(this.appDir(name), "usage.json");
 	}
+	appTurnsPath(name) {
+		return join(this.appDir(name), "turns.jsonl");
+	}
 	registryCachePath(name) {
 		if (!APP_NAME_PATTERN.test(name)) throw new AppSdkError(`Invalid registry name: ${JSON.stringify(name)}`);
 		return join(this.registriesDir, `${name}.json`);
@@ -2770,6 +3830,61 @@ var Store = class {
 	async writeChatState(name, state) {
 		await writeJson(this.appChatStatePath(name), state);
 	}
+	async readApprovalLog(name) {
+		return { approvals: (await readJson(this.appApprovalLogPath(name)))?.approvals ?? [] };
+	}
+	async writeApprovalLog(name, log) {
+		await writeJson(this.appApprovalLogPath(name), log);
+	}
+	async readGrants(name) {
+		return { tools: (await readJson(this.appGrantsPath(name)))?.tools ?? [] };
+	}
+	async writeGrants(name, state) {
+		await writeJson(this.appGrantsPath(name), state);
+	}
+	async readUserPolicy(name) {
+		const state = await readJson(this.appPolicyPath(name));
+		return { rules: Array.isArray(state?.rules) ? state.rules : [] };
+	}
+	async writeUserPolicy(name, policy) {
+		await writeJson(this.appPolicyPath(name), policy);
+	}
+	/** Appends one line to the app's tool-call audit ledger. */
+	async appendToolCall(name, record) {
+		const path = this.appToolCallsPath(name);
+		await mkdir(join(path, ".."), { recursive: true });
+		await appendFile(path, `${JSON.stringify(record)}\n`, "utf8");
+	}
+	/**
+	* Parseable lines of the tool-call ledger, oldest first. Like the turn
+	* ledger, a truncated or hand-mangled line costs only itself.
+	*/
+	async readToolCalls(name) {
+		let content;
+		try {
+			content = await readFile(this.appToolCallsPath(name), "utf8");
+		} catch (err) {
+			if (err.code === "ENOENT") return [];
+			throw err;
+		}
+		const records = [];
+		for (const line of content.split("\n")) {
+			if (line.trim() === "") continue;
+			try {
+				const record = JSON.parse(line);
+				if (typeof record?.at === "string" && typeof record.tool === "string") records.push(record);
+			} catch {}
+		}
+		return records;
+	}
+	/** Replaces the tool-call ledger atomically (tmp file + rename), for trimming. */
+	async writeToolCalls(name, records) {
+		const path = this.appToolCallsPath(name);
+		await mkdir(join(path, ".."), { recursive: true });
+		const tmp = `${path}.tmp`;
+		await writeFile(tmp, records.map((r) => `${JSON.stringify(r)}\n`).join(""), "utf8");
+		await rename(tmp, path);
+	}
 	async readJobState(name) {
 		const state = await readJson(this.appJobStatePath(name));
 		return {
@@ -2790,6 +3905,51 @@ var Store = class {
 	async writeUsageState(name, state) {
 		await writeJson(this.appUsagePath(name), state);
 	}
+	/** Appends one line to the app's turn ledger, creating the container if needed. */
+	async appendTurnRecord(name, record) {
+		const path = this.appTurnsPath(name);
+		await mkdir(join(path, ".."), { recursive: true });
+		await appendFile(path, `${JSON.stringify(record)}\n`, "utf8");
+	}
+	/**
+	* Every parseable line of the app's turn ledger, in file order (oldest
+	* first); an absent file reads as no turns.
+	*
+	* An append-only log written across crashes and hand edits will eventually
+	* contain a truncated or malformed line. One bad line must cost only itself,
+	* so unparseable lines — and lines without an `at` timestamp, which nothing
+	* downstream could place in time — are skipped rather than thrown on.
+	*/
+	async readTurnRecords(name) {
+		let content;
+		try {
+			content = await readFile(this.appTurnsPath(name), "utf8");
+		} catch (err) {
+			if (err.code === "ENOENT") return [];
+			throw err;
+		}
+		const records = [];
+		for (const line of content.split("\n")) {
+			if (line.trim() === "") continue;
+			let parsed;
+			try {
+				parsed = JSON.parse(line);
+			} catch {
+				continue;
+			}
+			const record = parsed;
+			if (typeof record?.at === "string") records.push(record);
+		}
+		return records;
+	}
+	/** Replaces the app's turn ledger atomically (tmp file + rename), for compaction. */
+	async writeTurnRecords(name, records) {
+		const path = this.appTurnsPath(name);
+		await mkdir(join(path, ".."), { recursive: true });
+		const tmp = `${path}.tmp`;
+		await writeFile(tmp, records.map((record) => `${JSON.stringify(record)}\n`).join(""), "utf8");
+		await rename(tmp, path);
+	}
 	get authStatePath() {
 		return join(this.root, "auth.json");
 	}
@@ -2823,4 +3983,4 @@ var Store = class {
 //#endregion
 export { UsageRecorder as A, BudgetExceededError as C, budgetStatusFor as D, budgetStatus as E, createAuthMiddleware as F, isConsoleRequest as I, registerAuthRoutes as L, utcDay as M, AuthService as N, setAppBudget as O, SESSION_COOKIE as P, requiredLevel as R, BUDGET_EXCEEDED_CODE as S, assertWithinBudget as T, fetchSource as _, EXPORT_FORMAT_VERSION as a, loadApp as b, installApp as c, updateApp as d, addRegistry as f, resolveApp as g, removeRegistry as h, resolveAppConfig as i, formatUsd as j, USAGE_RETENTION_DAYS as k, installDependencies as l, refreshRegistry as m, createServer as n, exportApp as o, readCachedIndex as p, buildAppContext as r, importApp as s, Store as t, removeApp as u, parseSourceArg as v, appBudget as w, checkSdkCompatibility as x, updateSource as y };
 
-//# sourceMappingURL=store-DoAGOynU.mjs.map
+//# sourceMappingURL=store-DvLX0Kft.mjs.map