@ganglion/xacpx 0.24.4-beta.0 → 0.24.5

package/dist/bots/bot-types.d.ts

@@ -0,0 +1,35 @@
+export type BotRuntimeScope = "bot-direct" | "group-member" | "group-controller";
+export interface BotProfile {
+    id: string;
+    name: string;
+    avatar?: string;
+    role?: string;
+    instructions?: string;
+    agent: string;
+    workspace: string;
+    cwd?: string;
+    model?: string;
+    effort?: string;
+    enabled: boolean;
+    createdAt: string;
+    updatedAt: string;
+}
+interface BotRuntimeBindingBase {
+    id: string;
+    conversationId: string;
+    topicId: string;
+    logicalSessionId: string;
+    sessionAlias: string;
+    createdAt: string;
+    updatedAt: string;
+}
+export type BotRuntimeBinding = (BotRuntimeBindingBase & {
+    scope: "bot-direct";
+    botId: string;
+}) | (BotRuntimeBindingBase & {
+    scope: "group-member";
+    botId: string;
+}) | (BotRuntimeBindingBase & {
+    scope: "group-controller";
+});
+export {};

package/dist/bridge/bridge-main.js

@@ -9911,6 +9911,45 @@ var init_session_effort = __esm(() => {
   ]);
 });
 
+// src/util/async.ts
+function settleWithinTimeout(work, timeoutMs) {
+  return new Promise((resolve3) => {
+    let settled = false;
+    const finish = () => {
+      if (!settled) {
+        settled = true;
+        resolve3();
+      }
+    };
+    const timer = setTimeout(finish, timeoutMs);
+    if (typeof timer.unref === "function") {
+      timer.unref();
+    }
+    work.then(() => {
+      clearTimeout(timer);
+      finish();
+    }, () => {
+      clearTimeout(timer);
+      finish();
+    });
+  });
+}
+function raceWithTimeout(work, timeoutMs, onTimeout) {
+  return new Promise((resolve3, reject) => {
+    const timer = setTimeout(() => reject(onTimeout()), timeoutMs);
+    if (typeof timer.unref === "function") {
+      timer.unref();
+    }
+    work.then((value) => {
+      clearTimeout(timer);
+      resolve3(value);
+    }, (error) => {
+      clearTimeout(timer);
+      reject(error);
+    });
+  });
+}
+
 // src/bridge/engine/runtime/physical-session-identity.ts
 import { createHash as createHash6 } from "node:crypto";
 import { resolve as resolvePath } from "node:path";
@@ -10266,7 +10305,7 @@ function isEligibleForRuntime(policy, nonInteractivePermissions, interactiveAvai
   }
   return true;
 }
-function assertEligibleForRuntimePermissionChange(hasPersistedRuntimeBindings, transport) {
+function assertEligibleForRuntimePermissionChange(hasPersistedRuntimeBindings, transport, options) {
   if (!hasPersistedRuntimeBindings)
     return;
   let parsedPolicy;
@@ -10274,7 +10313,7 @@ function assertEligibleForRuntimePermissionChange(hasPersistedRuntimeBindings, t
     parsedPolicy = typeof transport.permissionPolicy === "object" && transport.permissionPolicy !== null ? transport.permissionPolicy : parseXacpxPermissionPolicy(transport.permissionPolicy);
   }
   const nonInteractive = typeof transport.nonInteractivePermissions === "string" ? transport.nonInteractivePermissions : undefined;
-  if (!isEligibleForRuntime(parsedPolicy, nonInteractive, false)) {
+  if (!isEligibleForRuntime(parsedPolicy, nonInteractive, options?.interactionAvailable ?? false)) {
     throw new Error('cannot apply permission policy: runtime-ineligible policy (nonInteractive="fail" or escalate without interactive) with persisted runtime bindings');
   }
 }
@@ -10286,6 +10325,7 @@ var init_runtime_permission_policy = __esm(() => {
 // src/bridge/engine/runtime/runtime-permission-resolver.ts
 var exports_runtime_permission_resolver = {};
 __export(exports_runtime_permission_resolver, {
+  readToolInputFromReq: () => readToolInputFromReq,
   configFromRaw: () => configFromRaw,
   RuntimePermissionResolver: () => RuntimePermissionResolver
 });
@@ -10344,6 +10384,49 @@ function readRawKindFromReq(req) {
   }
   return;
 }
+function readToolInputFromReq(req) {
+  const raw = getRawObject(req);
+  if (!raw)
+    return;
+  const toolCall = raw.toolCall ?? raw.tool;
+  if (toolCall && typeof toolCall === "object" && !Array.isArray(toolCall)) {
+    const rec = toolCall;
+    if (rec.rawInput !== undefined)
+      return rec.rawInput;
+    if (rec.input !== undefined)
+      return rec.input;
+    const contentText = readTextFromToolContent(rec.content);
+    if (contentText !== undefined)
+      return contentText;
+  }
+  if (raw.rawInput !== undefined)
+    return raw.rawInput;
+  if (raw.input !== undefined)
+    return raw.input;
+  if (raw.subject !== undefined && raw.subject !== null)
+    return raw.subject;
+  if (typeof raw.description === "string" && raw.description.trim().length > 0) {
+    return raw.description;
+  }
+  return;
+}
+function readTextFromToolContent(content) {
+  if (!Array.isArray(content))
+    return;
+  const parts = [];
+  for (const block of content.slice(0, 8)) {
+    if (block && typeof block === "object" && !Array.isArray(block)) {
+      const rec = block;
+      if (rec.type === "text" && typeof rec.text === "string" && rec.text.trim().length > 0) {
+        parts.push(rec.text);
+      }
+    }
+  }
+  if (parts.length === 0)
+    return;
+  return parts.join(`
+`);
+}
 function inferToolKindForReq(req) {
   if (req.inferredKind && typeof req.inferredKind === "string" && req.inferredKind.trim().length > 0) {
     return normalizeMatcher(req.inferredKind);
@@ -12284,10 +12367,8 @@ class RuntimeWorkerClient {
       if (!handler) {
         decision = { outcome: "reject_once" };
       } else {
-        const withTimeout = await Promise.race([
-          handler(payload),
-          new Promise((_, reject) => setTimeout(() => reject(new Error("permission UI timeout")), 8000).unref?.())
-        ]);
+        const timeoutMs = this.deps?.permissionTimeoutMs ?? 125000;
+        const withTimeout = await raceWithTimeout(handler(payload), timeoutMs, () => new Error("permission UI timeout"));
         const outcome = withTimeout?.outcome;
         if (outcome !== "allow_once" && outcome !== "allow_always" && outcome !== "reject_once" && outcome !== "reject_always" && outcome !== "cancel") {
           decision = { outcome: "reject_once" };
@@ -14343,6 +14424,7 @@ class RuntimeEngine {
       const fenceDir = this.options.fenceDir ?? (() => join22(this.durableRoot(), "worker-fences"));
       const permissionDeps = {
         ...options.workerClientDeps ?? {},
+        ...options.permissionRequestTimeoutMs !== undefined ? options.workerClientDeps?.permissionTimeoutMs === undefined ? { permissionTimeoutMs: options.permissionRequestTimeoutMs } : {} : {},
         spawnEnv: {
           ...resolveAcpxHostPolicyEnv({
             acpxMaxIncomingMessageBytes: options.acpxMaxIncomingMessageBytes,
@@ -14437,7 +14519,7 @@ class RuntimeEngine {
       await this.ensureSessionHandle(input, client, agentProcessEnv);
       try {
         const attachments = await buildRuntimeAttachments(options.media);
-        const outcome = await client.request("prompt", { text, ...attachments.length > 0 ? { attachments } : {} }, {
+        const outcome = await client.request("prompt", { text, ...attachments.length > 0 ? { attachments } : {}, ...options.interactionId ? { interactionId: options.interactionId } : {} }, {
           onEvent: (payload) => {
             const event = payload;
             const sink = options.onEvent;
@@ -14684,7 +14766,7 @@ class RuntimeEngine {
   isRuntimeEligible() {
     try {
       const policy = this.options.permissionPolicy !== undefined ? parseXacpxPermissionPolicy(this.options.permissionPolicy) : undefined;
-      const interactiveAvailable = this.options.permissionInteractionAvailable === true;
+      const interactiveAvailable = this.options.permissionInteractionCapable === true;
       return isEligibleForRuntime(policy, this.options.nonInteractivePermissions, interactiveAvailable);
     } catch {
       return false;
@@ -14703,10 +14785,8 @@ class RuntimeEngine {
       return { outcome: "reject_once" };
     if (this.options.onPermissionRequest) {
       try {
-        const res = await Promise.race([
-          this.options.onPermissionRequest(payload),
-          new Promise((_, reject) => setTimeout(() => reject(new Error("permission UI timeout")), 8000).unref?.())
-        ]);
+        const timeoutMs = this.options.permissionRequestTimeoutMs ?? 125000;
+        const res = await raceWithTimeout(this.options.onPermissionRequest(payload), timeoutMs, () => new Error("permission UI timeout"));
         if (this.deleting.has(key) || this.shuttingDown)
           return { outcome: "reject_once" };
         if (payload.policyGeneration !== this.permissionGeneration)
@@ -15287,7 +15367,7 @@ class RuntimeEngine {
       throw new RuntimeError("RUNTIME_INIT_FAILED", `session "${key}" is being deleted`);
     }
     try {
-      const result = await this.executeRuntimeTurn(input, input.text, { onEvent, media: input.media, toolEventMode: input.toolEventMode, toolEvents: input.toolEvents });
+      const result = await this.executeRuntimeTurn(input, input.text, { onEvent, media: input.media, toolEventMode: input.toolEventMode, toolEvents: input.toolEvents, ...input.interactionId ? { interactionId: input.interactionId } : {} });
       return result;
     } finally {
       try {
@@ -16726,6 +16806,7 @@ class BridgeServer {
       case "prompt":
         const media = asOptionalPromptMediaInput(params.media);
         const resolvedToolEventMode = asOptionalToolEventMode(params.toolEventMode);
+        const promptInteractionId = asOptionalString(params.interactionId);
         return await this.engines.prompt({
           agent: requireString(params, "agent"),
           ...agentExecutionSettings(params),
@@ -16742,7 +16823,8 @@ class BridgeServer {
           replyMode: asOptionalReplyMode(params.replyMode),
           toolEvents: params.toolEvents === true,
           ...resolvedToolEventMode ? { toolEventMode: resolvedToolEventMode } : {},
-          media
+          media,
+          ...promptInteractionId ? { interactionId: promptInteractionId } : {}
         }, (event) => {
           if (event.type === "prompt.segment") {
             writeLine?.(encodeBridgePromptSegmentEvent({
@@ -17249,9 +17331,10 @@ async function runBridgeMain() {
         durableRootDir: durableRoot,
         queueDir,
         fenceDir,
+        permissionInteractionCapable: coreEnv("BRIDGE_PERMISSION_INTERACTION_CAPABLE") === "1",
         onPermissionRequest: async (payload) => {
           try {
-            const result = await server.requestDaemon("resolvePermissionRequest", payload, { timeoutMs: 8000 });
+            const result = await server.requestDaemon("resolvePermissionRequest", payload, { timeoutMs: 125000 });
             const outcome = result?.outcome;
             if (outcome === "allow_once" || outcome === "allow_always" || outcome === "reject_once" || outcome === "reject_always" || outcome === "cancel") {
               return { outcome };

package/dist/bridge/engine/bridge-engine.d.ts

@@ -129,6 +129,7 @@ export interface EnginePromptInput extends EngineSessionInput {
     toolEvents?: boolean;
     toolEventMode?: ToolEventMode;
     media?: PromptMediaInput;
+    interactionId?: string;
 }
 export interface EngineInjectInput extends EngineSessionInput {
     text: string;

package/dist/bridge/engine/runtime/runtime-permission-policy.d.ts

@@ -10,7 +10,7 @@ export declare function isEligibleForRuntime(policy: XacpxPermissionPolicy | und
  * Shared fail-closed gate for permission changes while persisted Runtime
  * bindings exist (watcher reload in main.ts, `/config set` + `/pm` handlers).
  * Pure: takes the already-loaded transport snapshot and the bindings flag, so
- * the two call sites cannot drift on `permissionInteractionAvailable` or the
+ * the two call sites cannot drift on `permissionInteractionCapable` or the
  * error contract. Throws with the canonical message when the change must not
  * apply; returns without effect otherwise (including when no Runtime bindings
  * exist — any permission tuple is then appliable).
@@ -18,4 +18,6 @@ export declare function isEligibleForRuntime(policy: XacpxPermissionPolicy | und
 export declare function assertEligibleForRuntimePermissionChange(hasPersistedRuntimeBindings: boolean, transport: {
     permissionPolicy?: unknown;
     nonInteractivePermissions?: unknown;
+}, options?: {
+    interactionAvailable?: boolean;
 }): void;

package/dist/bridge/engine/runtime/runtime-worker-main.js

@@ -46,6 +46,45 @@ var __export = (target, all) => {
 var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
+// src/util/async.ts
+function settleWithinTimeout(work, timeoutMs) {
+  return new Promise((resolve) => {
+    let settled = false;
+    const finish = () => {
+      if (!settled) {
+        settled = true;
+        resolve();
+      }
+    };
+    const timer = setTimeout(finish, timeoutMs);
+    if (typeof timer.unref === "function") {
+      timer.unref();
+    }
+    work.then(() => {
+      clearTimeout(timer);
+      finish();
+    }, () => {
+      clearTimeout(timer);
+      finish();
+    });
+  });
+}
+function raceWithTimeout(work, timeoutMs, onTimeout) {
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => reject(onTimeout()), timeoutMs);
+    if (typeof timer.unref === "function") {
+      timer.unref();
+    }
+    work.then((value) => {
+      clearTimeout(timer);
+      resolve(value);
+    }, (error) => {
+      clearTimeout(timer);
+      reject(error);
+    });
+  });
+}
+
 // src/runtime/core-env.ts
 function coreEnv(suffix, env = process.env) {
   return env[`${PRIMARY_PREFIX}${suffix}`] ?? env[`${LEGACY_PREFIX}${suffix}`];
@@ -2799,7 +2838,7 @@ function isEligibleForRuntime(policy, nonInteractivePermissions, interactiveAvai
   }
   return true;
 }
-function assertEligibleForRuntimePermissionChange(hasPersistedRuntimeBindings, transport) {
+function assertEligibleForRuntimePermissionChange(hasPersistedRuntimeBindings, transport, options) {
   if (!hasPersistedRuntimeBindings)
     return;
   let parsedPolicy;
@@ -2807,7 +2846,7 @@ function assertEligibleForRuntimePermissionChange(hasPersistedRuntimeBindings, t
     parsedPolicy = typeof transport.permissionPolicy === "object" && transport.permissionPolicy !== null ? transport.permissionPolicy : parseXacpxPermissionPolicy(transport.permissionPolicy);
   }
   const nonInteractive = typeof transport.nonInteractivePermissions === "string" ? transport.nonInteractivePermissions : undefined;
-  if (!isEligibleForRuntime(parsedPolicy, nonInteractive, false)) {
+  if (!isEligibleForRuntime(parsedPolicy, nonInteractive, options?.interactionAvailable ?? false)) {
     throw new Error('cannot apply permission policy: runtime-ineligible policy (nonInteractive="fail" or escalate without interactive) with persisted runtime bindings');
   }
 }
@@ -2819,6 +2858,7 @@ var init_runtime_permission_policy = __esm(() => {
 // src/bridge/engine/runtime/runtime-permission-resolver.ts
 var exports_runtime_permission_resolver = {};
 __export(exports_runtime_permission_resolver, {
+  readToolInputFromReq: () => readToolInputFromReq,
   configFromRaw: () => configFromRaw,
   RuntimePermissionResolver: () => RuntimePermissionResolver
 });
@@ -2877,6 +2917,49 @@ function readRawKindFromReq(req) {
   }
   return;
 }
+function readToolInputFromReq(req) {
+  const raw = getRawObject(req);
+  if (!raw)
+    return;
+  const toolCall = raw.toolCall ?? raw.tool;
+  if (toolCall && typeof toolCall === "object" && !Array.isArray(toolCall)) {
+    const rec = toolCall;
+    if (rec.rawInput !== undefined)
+      return rec.rawInput;
+    if (rec.input !== undefined)
+      return rec.input;
+    const contentText = readTextFromToolContent(rec.content);
+    if (contentText !== undefined)
+      return contentText;
+  }
+  if (raw.rawInput !== undefined)
+    return raw.rawInput;
+  if (raw.input !== undefined)
+    return raw.input;
+  if (raw.subject !== undefined && raw.subject !== null)
+    return raw.subject;
+  if (typeof raw.description === "string" && raw.description.trim().length > 0) {
+    return raw.description;
+  }
+  return;
+}
+function readTextFromToolContent(content) {
+  if (!Array.isArray(content))
+    return;
+  const parts = [];
+  for (const block of content.slice(0, 8)) {
+    if (block && typeof block === "object" && !Array.isArray(block)) {
+      const rec = block;
+      if (rec.type === "text" && typeof rec.text === "string" && rec.text.trim().length > 0) {
+        parts.push(rec.text);
+      }
+    }
+  }
+  if (parts.length === 0)
+    return;
+  return parts.join(`
+`);
+}
 function inferToolKindForReq(req) {
   if (req.inferredKind && typeof req.inferredKind === "string" && req.inferredKind.trim().length > 0) {
     return normalizeMatcher(req.inferredKind);
@@ -6251,6 +6334,7 @@ var init_runtime_mcp = __esm(() => {
 });
 
 // src/bridge/engine/runtime/runtime-worker-main.ts
+import { randomUUID as randomUUID5 } from "node:crypto";
 import { createInterface } from "node:readline";
 
 // src/bridge/engine/runtime/worker-eof.ts
@@ -7467,23 +7551,42 @@ async function initializeRuntime(params) {
         return { outcome: "reject_once" };
       if (ctx.signal.aborted)
         return { outcome: "reject_once" };
-      const requestId = `perm-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 6)}`;
-      const toolCallId = (() => {
-        const raw = req.raw;
-        const id = typeof raw?.toolCall?.toolCallId === "string" && raw.toolCall.toolCallId.length > 0 ? raw.toolCall.toolCallId : typeof raw?.toolCall?.id === "string" && raw.toolCall.id.length > 0 ? raw.toolCall.id : requestId;
-        return id;
-      })();
-      const title = (() => {
-        const raw = req.raw;
-        const t2 = raw?.toolCall?.title;
-        return typeof t2 === "string" ? t2 : undefined;
-      })();
-      const kind = (() => {
-        const raw = req.raw;
-        const k = raw?.toolCall?.kind;
-        return typeof k === "string" ? k : undefined;
+      const activeInteractionId = state.activeInteractionId;
+      if (!activeInteractionId)
+        return { outcome: "reject_once" };
+      const requestId = randomUUID5();
+      const asRecord = (value) => {
+        if (!value || typeof value !== "object" || Array.isArray(value))
+          return;
+        return value;
+      };
+      const rawValue = "raw" in req ? asRecord(req.raw) : undefined;
+      const toolValue = rawValue?.toolCall ?? rawValue?.tool;
+      const toolRecord = asRecord(toolValue);
+      const readField = (holder, key) => {
+        if (!holder)
+          return;
+        const value = holder[key];
+        return typeof value === "string" && value.length > 0 ? value : undefined;
+      };
+      const toolCallId = readField(toolRecord, "toolCallId") ?? readField(toolRecord, "id") ?? requestId;
+      const title = readField(rawValue, "title") ?? readField(toolRecord, "title");
+      const inferredKind = "inferredKind" in req && typeof req.inferredKind === "string" && req.inferredKind ? req.inferredKind : undefined;
+      const kind = inferredKind ?? readField(rawValue, "kind") ?? readField(toolRecord, "kind");
+      const rawInput = readToolInputFromReq(req);
+      const availableOutcomes = (() => {
+        const options = rawValue?.options;
+        if (!Array.isArray(options))
+          return;
+        const kinds = new Set;
+        for (const option of options) {
+          const record = asRecord(option);
+          if (record && typeof record.kind === "string")
+            kinds.add(record.kind);
+        }
+        const valid = ["allow_once", "allow_always", "reject_once", "reject_always", "cancel"].filter((k) => kinds.has(k));
+        return valid.length > 0 ? valid : undefined;
       })();
-      const rawInput = req.raw;
       const payload = {
         logicalSessionId: state.ensureParams?.logicalSessionId ?? params.logicalSessionId ?? state.ensureParams?.sessionKey ?? params.sessionKey,
         sessionKey: state.ensureParams?.sessionKey ?? params.sessionKey,
@@ -7493,7 +7596,9 @@ async function initializeRuntime(params) {
         ...kind ? { kind } : {},
         ...rawInput !== undefined ? { rawInput } : {},
         policyGeneration: state.permissionGeneration,
-        workerGeneration: state.workerGeneration
+        workerGeneration: state.workerGeneration,
+        interactionId: activeInteractionId,
+        ...availableOutcomes ? { availableOutcomes } : {}
       };
       const pending = new Promise((resolve, reject) => {
         state.pendingPermissions.set(requestId, { resolve, reject, generation: state.permissionGeneration, workerGeneration: state.workerGeneration });
@@ -7510,10 +7615,7 @@ async function initializeRuntime(params) {
       });
       process.stdout.write(encodeWorkerMessage({ id: requestId, event: "permission.request", payload }));
       try {
-        const decision = await Promise.race([
-          pending,
-          new Promise((_, reject) => setTimeout(() => reject(new Error("host permission timeout")), 9000).unref?.())
-        ]);
+        const decision = await raceWithTimeout(pending, 125000, () => new Error("host permission timeout"));
         const outcome = decision.outcome;
         if (outcome !== "allow_once" && outcome !== "allow_always" && outcome !== "reject_once" && outcome !== "reject_always" && outcome !== "cancel") {
           return { outcome: "reject_once" };
@@ -7601,6 +7703,9 @@ async function runPrompt(requestId, params) {
     onElicitation
   });
   state.activeTurn = turn;
+  const promptInteractionId = params.interactionId;
+  if (promptInteractionId)
+    state.activeInteractionId = promptInteractionId;
   try {
     await turn.promptStarted;
     let finalText = "";
@@ -7615,6 +7720,9 @@ async function runPrompt(requestId, params) {
   } finally {
     if (state.activeTurn === turn)
       state.activeTurn = undefined;
+    if (promptInteractionId && state.activeInteractionId === promptInteractionId) {
+      state.activeInteractionId = undefined;
+    }
   }
 }
 async function dispatch(request) {

package/dist/channels/types.d.ts

@@ -10,6 +10,36 @@ import type { ActiveTurnRegistry } from "../sessions/active-turn-registry.js";
 import type { Locale } from "../i18n/index.js";
 import type { ControlService } from "../control/control-service.js";
 export type { ChatAgent };
+export type PermissionOutcome = "allow_once" | "allow_always" | "reject_once" | "reject_always" | "cancel";
+export interface ChannelPermissionRequest {
+    requestId: string;
+    chatKey: string;
+    accountId?: string;
+    replyContextToken?: string;
+    requester: {
+        senderId: string;
+        senderName?: string;
+        isOwner?: boolean;
+    };
+    toolCallId: string;
+    title?: string;
+    kind?: string;
+    summary?: string;
+    availableOutcomes: PermissionOutcome[];
+    expiresAt: number;
+    signal: AbortSignal;
+}
+export interface ChannelPermissionDecision {
+    outcome: PermissionOutcome;
+    /**
+     * Platform user id that activated the approval control. REQUIRED: every
+     * `requestPermission()` implementation must return an authenticated
+     * responder; the broker re-verifies it against the bound initiator (I3).
+     * A platform that cannot prove responder identity must not implement
+     * `requestPermission()` at all.
+     */
+    responderId: string;
+}
 export interface OutboundQuota {
     onInbound(chatKey: string): void;
     reserveMidSegment(chatKey: string): boolean;
@@ -151,6 +181,14 @@ export interface MessageChannelRuntime {
     notifyTaskProgress(task: OrchestrationTaskRecord, text: string): Promise<void>;
     sendCoordinatorMessage(input: CoordinatorMessageInput): Promise<void>;
     sendScheduledMessage?(input: ScheduledChannelMessageInput): Promise<void>;
+    /**
+     * Interactive permission UI (plan channel-permission-interaction).
+     * Optional so already-published plugins stay compatible; absent means
+     * interactive permission is unavailable and the broker fails closed.
+     * Implementations MUST verify the responder equals request.requester.senderId
+     * and MUST settle exactly once (first terminal decision wins).
+     */
+    requestPermission?(request: ChannelPermissionRequest): Promise<ChannelPermissionDecision>;
     /**
      * Preferred render format for `/ssn` native session lists. weixin renders
      * markdown tables poorly and declares "cards"; channels that omit this are