@getmarrow/mcp 3.9.98 → 3.9.100

package/dist/cli.js

@@ -10,10 +10,12 @@
  *   MARROW_API_KEY=mrw_abc123 npx @getmarrow/mcp
  */
 Object.defineProperty(exports, "__esModule", { value: true });
+const node_crypto_1 = require("node:crypto");
 const model_usage_1 = require("./model-usage");
 const index_1 = require("./index");
 const control_state_1 = require("./control-state");
 const hook_1 = require("./hook");
+const host_approval_1 = require("./host-approval");
 const hook_contract_1 = require("./hook-contract");
 const hook_context_1 = require("./hook-context");
 const hook_session_1 = require("./hook-session");
@@ -32,7 +34,6 @@ const status_cache_1 = require("./status-cache");
 const habit_loop_copy_1 = require("./habit-loop-copy");
 const host_capability_1 = require("./host-capability");
 const session_loop_guard_1 = require("./session-loop-guard");
-// Parse CLI args
 function parseArgs() {
     const args = process.argv.slice(2);
     const result = {};
@@ -47,7 +48,10 @@ function parseArgs() {
         if (['hook', '--hook', 'claude-hook', 'cline-hook', 'codex-hook', 'cursor-hook', 'gemini-hook', 'grok-hook', 'windsurf-hook'].includes(args[i])) {
             result.hook = true;
         }
-        if (['context-hook', '--context-hook', 'claude-context-hook', 'codex-context-hook', 'grok-context-hook'].includes(args[i])) {
+        if (['permission-request-hook', 'claude-permission-request-hook'].includes(args[i])) {
+            result.permissionRequestHook = true;
+        }
+        if (['context-hook', '--context-hook', 'claude-context-hook', 'codex-context-hook', 'grok-context-hook', 'cursor-context-hook', 'gemini-context-hook'].includes(args[i])) {
             result.contextHook = true;
         }
         if (['pre-action-hook', '--pre-action-hook', 'claude-pre-action-hook', 'cline-pre-action-hook', 'codex-pre-action-hook', 'cursor-pre-action-hook', 'gemini-pre-action-hook', 'grok-pre-action-hook', 'windsurf-pre-action-hook'].includes(args[i])) {
@@ -306,6 +310,13 @@ ${MARROW_BLOCK_END}`;
     else {
         process.stdout.write('PreToolUse hook configuration is present. Activity is client-self-reported and does not certify pre-action control.\n');
     }
+    const permissionHookInstall = (0, hook_1.installPermissionRequestHook)(process.cwd());
+    if (permissionHookInstall.installed) {
+        process.stdout.write('Configured the pass-through PermissionRequest hook and the PostToolBatch hook (both async). They record when Claude Code shows its own permission dialog for a held action and whether the operator declined it; they never answer the dialog. Activity is client-self-reported.\n');
+    }
+    else {
+        process.stdout.write('PermissionRequest and PostToolBatch hook configuration is present. Activity is client-self-reported.\n');
+    }
     const sessionHookInstall = (0, hook_session_1.installSessionEndHook)(process.cwd());
     if (sessionHookInstall.installed) {
         process.stdout.write('Configured Stop hook. Activity is client-self-reported and does not certify session-end coverage.\n');
@@ -430,12 +441,16 @@ if (process.argv[2] !== 'keys') {
     else if (cliArgs.backgroundNudge) {
         void runBackgroundNudge();
     }
+    else if (cliArgs.permissionRequestHook) {
+        // Pass-through: exits 0 with no output, so it never answers the dialog.
+        void (0, hook_1.runPermissionRequestHookCommand)().finally(() => process.exit(0));
+    }
     else if (cliArgs.contextHook) {
         void (0, hook_context_1.runContextHookCommand)();
     }
     else if (cliArgs.preActionHook) {
         void (0, hook_pre_action_1.runPreActionHookCommand)().catch(() => {
-            process.stderr.write('Marrow pre-action governance failed closed. Retry after restoring the trusted configuration.\n');
+            process.stderr.write('Marrow\'s pre-action check stopped on an internal error, so this action was held. Run `npx -y @getmarrow/install@latest doctor` in this terminal, then retry.\n');
             process.exitCode = 2;
         });
     }
@@ -486,6 +501,92 @@ if (process.argv[2] !== 'keys') {
         let thinkCallCount = 0;
         let orientCallCount = 0;
         let initialized = false;
+        // ---------------------------------------------------------------------------
+        // MCP elicitation: where the client can ask its user mid-task, a held
+        // marrow_auto action is approved in the client's own dialog (one click). The
+        // request goes to the client UI, never to the model; the answer is reported to
+        // Marrow as client-attested.
+        // ---------------------------------------------------------------------------
+        const ELICITATION_PROTOCOL_VERSIONS = ['2025-06-18', '2025-11-25'];
+        const ELICITATION_TIMEOUT_MS = 120_000;
+        let clientElicitation = false;
+        let clientHost = 'other';
+        let serverRequestSeq = 0;
+        const pendingClientRequests = new Map();
+        function noteClientCapabilities(params) {
+            const record = params && typeof params === 'object' ? params : {};
+            const capabilities = record.capabilities && typeof record.capabilities === 'object' ? record.capabilities : {};
+            const requested = typeof record.protocolVersion === 'string' ? record.protocolVersion : '';
+            const info = record.clientInfo && typeof record.clientInfo === 'object' ? record.clientInfo : {};
+            const name = typeof info.name === 'string' ? info.name.toLowerCase() : '';
+            clientHost = /claude/.test(name) ? 'claude-code' : /cursor/.test(name) ? 'cursor' : /hermes/.test(name) ? 'hermes'
+                : /codex/.test(name) ? 'codex' : /gemini/.test(name) ? 'gemini' : 'other';
+            clientElicitation = Boolean(capabilities.elicitation && typeof capabilities.elicitation === 'object')
+                && ELICITATION_PROTOCOL_VERSIONS.includes(requested);
+            // Elicitation needs the protocol version that defines it; otherwise keep the version this server always spoke.
+            return clientElicitation ? requested : '2024-11-05';
+        }
+        function requestClient(method, params, timeoutMs) {
+            serverRequestSeq += 1;
+            const id = `marrow-server-${serverRequestSeq}`;
+            return new Promise((resolve) => {
+                const timer = setTimeout(() => {
+                    pendingClientRequests.delete(id);
+                    resolve({ error: { code: 'timeout' } });
+                }, timeoutMs);
+                timer.unref?.();
+                pendingClientRequests.set(id, { resolve, timer });
+                send({ jsonrpc: '2.0', id, method, params });
+            });
+        }
+        /** A response from the client to one of this server's requests (elicitation). */
+        function settleClientResponse(message) {
+            if (typeof message.id !== 'string' || message.method !== undefined)
+                return false;
+            const pending = pendingClientRequests.get(message.id);
+            if (!pending)
+                return false;
+            pendingClientRequests.delete(message.id);
+            clearTimeout(pending.timer);
+            pending.resolve({ result: message.result, error: message.error });
+            return true;
+        }
+        /** Asks the user in the client's own dialog; approved, declined, or null (cancelled, timed out, unsupported). */
+        async function elicitApproval(request) {
+            if (!clientElicitation)
+                return null;
+            const answer = await requestClient('elicitation/create', {
+                message: request.message,
+                requestedSchema: {
+                    type: 'object',
+                    properties: {
+                        decision: {
+                            type: 'string',
+                            title: 'Your answer',
+                            description: 'Approve only if you authorize this exact action.',
+                            enum: ['approve', 'decline'],
+                            enumNames: ['Approve this action', 'Decline it'],
+                        },
+                    },
+                    required: ['decision'],
+                },
+            }, ELICITATION_TIMEOUT_MS);
+            const result = answer.result && typeof answer.result === 'object' ? answer.result : null;
+            if (!result)
+                return null;
+            if (result.action === 'decline')
+                return 'declined';
+            if (result.action !== 'accept')
+                return null;
+            const content = result.content && typeof result.content === 'object' ? result.content : {};
+            return content.decision === 'approve' ? 'approved' : content.decision === 'decline' ? 'declined' : null;
+        }
+        function autoElicitationOptions() {
+            if (!clientElicitation)
+                return undefined;
+            const hostSessionId = typeof SESSION_ID === 'string' && /^[A-Za-z0-9][A-Za-z0-9._:-]{0,199}$/.test(SESSION_ID) ? SESSION_ID : `mcp-${process.pid}`;
+            return { elicitApproval, elicitHost: clientHost, elicitHostSessionId: hostSessionId };
+        }
         function formatWarningActionably(w) {
             const pct = Math.round(w.failureRate * 100);
             return `⚠️ ${w.type} has ${pct}% failure rate — check what went wrong last time before proceeding`;
@@ -544,6 +645,37 @@ if (process.argv[2] !== 'keys') {
                 ...(isError ? { isError: true } : {}),
             });
         }
+        /** Proof fields Marrow reported missing per decision or gate receipt, for a plain answer on a retry conflict. */
+        const commitProofMissing = new Map();
+        function proofFieldsGiven(proof) {
+            if (!proof || typeof proof !== 'object' || Array.isArray(proof))
+                return [];
+            return Object.entries(proof)
+                .filter(([, value]) => value !== null && value !== undefined && value !== ''
+                && !(Array.isArray(value) && value.length === 0)
+                && !(typeof value === 'object' && !Array.isArray(value) && Object.keys(value).length === 0))
+                .map(([key]) => key);
+        }
+        /**
+         * A retry of marrow_commit that added proof, refused as a conflict with the
+         * outcome Marrow already holds (409 MARROW_OUTCOME_OBSERVATION_CONFLICT):
+         * say plainly which proof fields are still missing.
+         */
+        function proofRetryConflict(keys, proof, requiredFromHold) {
+            const required = [...new Set([...keys.flatMap((key) => commitProofMissing.get(key) || []), ...requiredFromHold])];
+            const given = proofFieldsGiven(proof);
+            const stillMissing = required.filter((field) => !given.includes(field));
+            return {
+                committed: false,
+                code: 'MARROW_OUTCOME_OBSERVATION_CONFLICT',
+                proof_required: true,
+                failure_kind: 'validation',
+                still_missing: stillMissing,
+                exact_next_action: stillMissing.length
+                    ? `Still missing: ${stillMissing.join(', ')}. Call marrow_commit again with the same decision_id and gate_receipt_id, and a proof that has every field you sent plus these. Fill them from what really happened; do not invent values.`
+                    : 'Marrow already holds an outcome for this action with different proof. Call marrow_commit again with the same decision_id and gate_receipt_id and the complete proof in one call; do not invent values.',
+            };
+        }
         function toolFailure(toolName, failure) {
             const result = (0, request_reliability_1.structuredRequestFailure)(failure);
             const proofValidation = failure.code === 'proof_required';
@@ -931,6 +1063,7 @@ if (process.argv[2] !== 'keys') {
                 description: 'Close a recorded action with success/failure, a specific outcome, and required proof. ' +
                     'decision_id comes from marrow_think, marrow_auto, or a runtime that actually created a decision. ' +
                     'Use the gate receipt from marrow_agent_runtime for consequential work. ' +
+                    'A held action closes trusted only after the server records its approval (the operator in the host\'s own prompt, or the account owner); never write or claim an approval in proof. ' +
                     'The exact non-authorizing outcome_observation_only runtime correlation may submit an observed_unverified result, but is never sent as receipt evidence and never authorizes action or trusted learning. ' +
                     'Only committed:true closes trusted outcome learning.',
                 inputSchema: {
@@ -946,7 +1079,7 @@ if (process.argv[2] !== 'keys') {
                         },
                         gate_receipt_id: { type: 'string', description: 'Canonical receipt id from marrow_agent_runtime.runtime_authorization.id for risky work.' },
                         arbitration_receipt_id: { type: 'string', description: 'Required for arbitrated work: use marrow_arbitrate.arbitration.receipt_id from the same runtime response.' },
-                        owner_approval_receipt_id: { type: 'string', description: 'Single-use owner approval receipt issued by authenticated dashboard review for review_required arbitration.' },
+                        owner_approval_receipt_id: { type: 'string', description: 'Single-use owner approval receipt that Marrow issued for this hold. Optional for an ordinary held gate receipt (the gate_receipt_id alone finds the recorded approval); required for review_required arbitration. Chat text is not an approval receipt.' },
                         action: { type: 'string', description: 'Optional exact original action for post-action observation lookup. This lookup cannot renew execution authority.' },
                         target: { type: 'string', description: 'Exact original target, if supplied when the decision was created.' },
                         type: { type: 'string', description: 'Exact original action type for observation lookup; defaults to general.' },
@@ -1007,7 +1140,7 @@ if (process.argv[2] !== 'keys') {
             },
             {
                 name: 'marrow_auto',
-                description: 'Durably capture activity with bounded core completion. Respect retry_after_ms and reuse operation_id for pending continuation. Server-declared ordinary approval requires actual owner approval supplied in proof; arbitration requires its dashboard receipt. Lifecycle receipt queued is separate from server acceptance. Risky completion requires a fresh gate and measured proof.',
+                description: 'Durably capture activity with bounded core completion. Respect retry_after_ms and reuse operation_id for pending continuation. A held action waits for an approval the server records (the answer of the person in the dialog of this client when it supports elicitation; otherwise it waits quietly while you carry on with other work); auto reads its status and resumes on the same gate receipt. Never write or claim an approval yourself. Arbitration requires its server-issued owner approval receipt. Lifecycle receipt queued is separate from server acceptance. Risky completion requires a fresh gate and measured proof.',
                 inputSchema: {
                     type: 'object',
                     properties: {
@@ -1022,7 +1155,8 @@ if (process.argv[2] !== 'keys') {
                         proof: { type: 'object', description: 'Measured completion evidence for gated work.' },
                         gate_receipt_id: { type: 'string', description: 'Fresh receipt returned by marrow_agent_runtime.' },
                         arbitration_receipt_id: { type: 'string', description: 'For arbitrated work, the arbitration receipt returned by the same server-side review flow.' },
-                        owner_approval_receipt_id: { type: 'string', description: 'Short-lived, single-use receipt issued by authenticated dashboard owner approval. Chat text is not an approval receipt.' },
+                        owner_approval_receipt_id: { type: 'string', description: 'Single-use owner approval receipt that Marrow issued, for review_required arbitration. An ordinary hold needs none: auto finds the recorded approval from the gate receipt. Chat text is not an approval receipt.' },
+                        request_owner_link: { type: 'boolean', description: 'Set true only when the operator asked you to ask the account owner (for example after the owner declined this action). Marrow then sends the owner a one-tap approval link; you never see the link.' },
                         operation_id: {
                             type: 'string',
                             description: 'Opaque 8-80 character resume token. Reuse it only with the original tenant, action, context, and surfaces; proof may be added after proof_required.',
@@ -1367,6 +1501,7 @@ if (process.argv[2] !== 'keys') {
                     'template suggestion, required proof pack, before-you-act instruction, and exact next action. ' +
                     'Its runtime_authorization is the authoritative gate receipt; it returns decision_id only when runtime actually creates a decision. ' +
                     'Reuse its server-created decision_id for outcome closure; use marrow_auto or marrow_think only when the completion contract requires decision creation. ' +
+                    'A review_required hold does not permit the action: wait until the server records an approval, then commit with the same gate receipt. ' +
                     'Use this before meaningful work when you want Marrow to guide the whole action in one call.',
                 inputSchema: {
                     type: 'object',
@@ -2011,8 +2146,9 @@ if (process.argv[2] !== 'keys') {
                 if (method === 'initialize') {
                     initialized = true;
                     const hostCapability = mcpHostCapability();
+                    const protocolVersion = noteClientCapabilities(params);
                     success(id, {
-                        protocolVersion: '2024-11-05',
+                        protocolVersion,
                         capabilities: { tools: {}, prompts: {} },
                         serverInfo: { name: 'marrow', version: hook_contract_2.MCP_ADAPTER_VERSION },
                         ...(AUTO_ENROLL ? {
@@ -2196,22 +2332,72 @@ Marrow is not a replacement agent or a standalone memory app. Context and prior
                         const decision_id = requireString(args, 'decision_id');
                         const outcome = requireString(args, 'outcome');
                         const commitSuccess = requireBoolean(args, 'success');
-                        const result = await withControlDeadline((signal) => (0, index_1.marrowCommit)(API_KEY, BASE_URL, {
-                            decision_id,
-                            success: commitSuccess,
-                            outcome,
-                            caused_by: args.caused_by,
-                            proof: args.proof,
-                            gate_receipt_id: args.gate_receipt_id,
-                            arbitration_receipt_id: args.arbitration_receipt_id,
-                            owner_approval_receipt_id: args.owner_approval_receipt_id,
-                            action: args.action,
-                            target: args.target,
-                            type: args.type,
-                            surfaces: args.surfaces,
-                            auto_gate: args.auto_gate,
-                            model_usage: args.model_usage,
-                        }, SESSION_ID, FLEET_AGENT_ID, signal), { highRisk: true, cacheAware: false, toolName: 'marrow_commit' });
+                        // A receipt a host hook held: commit in the session it was issued to,
+                        // and send the operator's queued answer first so the commit closes
+                        // with that approval.
+                        let commitSessionId = SESSION_ID;
+                        if (typeof args.gate_receipt_id === 'string' && args.gate_receipt_id) {
+                            const holdContext = {
+                                apiKey: API_KEY,
+                                baseUrl: BASE_URL,
+                                sessionId: SESSION_ID || 'mcp-server',
+                                agentId: FLEET_AGENT_ID,
+                                harness: 'mcp-client',
+                                host: 'other',
+                                hostSessionId: SESSION_ID || 'mcp-server',
+                            };
+                            commitSessionId = (0, host_approval_1.holdSessionForReceipt)(holdContext, args.gate_receipt_id) || SESSION_ID;
+                            await (0, host_approval_1.deliverQueuedForReceipt)(holdContext, args.gate_receipt_id).catch(() => undefined);
+                        }
+                        const proofKeys = [`decision:${decision_id}`, ...(typeof args.gate_receipt_id === 'string' && args.gate_receipt_id ? [`receipt:${args.gate_receipt_id}`] : [])];
+                        let result;
+                        try {
+                            result = await withControlDeadline((signal) => (0, index_1.marrowCommit)(API_KEY, BASE_URL, {
+                                decision_id,
+                                success: commitSuccess,
+                                outcome,
+                                caused_by: args.caused_by,
+                                proof: args.proof,
+                                gate_receipt_id: args.gate_receipt_id,
+                                arbitration_receipt_id: args.arbitration_receipt_id,
+                                owner_approval_receipt_id: args.owner_approval_receipt_id,
+                                action: args.action,
+                                target: args.target,
+                                type: args.type,
+                                surfaces: args.surfaces,
+                                auto_gate: args.auto_gate,
+                                model_usage: args.model_usage,
+                            }, commitSessionId, FLEET_AGENT_ID, signal), { highRisk: true, cacheAware: false, toolName: 'marrow_commit' });
+                        }
+                        catch (err) {
+                            if (err instanceof request_reliability_1.MarrowRequestError && err.code === 'proof_required' && err.missingFields.length) {
+                                for (const key of proofKeys)
+                                    commitProofMissing.set(key, [...err.missingFields]);
+                            }
+                            if (err instanceof request_reliability_1.MarrowRequestError && err.status === 409 && err.backendCode === 'MARROW_OUTCOME_OBSERVATION_CONFLICT') {
+                                const fromHold = typeof args.gate_receipt_id === 'string' && args.gate_receipt_id
+                                    ? (0, host_approval_1.proofFieldsForReceipt)({ apiKey: API_KEY, baseUrl: BASE_URL, sessionId: SESSION_ID || 'mcp-server', agentId: FLEET_AGENT_ID, harness: 'mcp-client', host: 'other', hostSessionId: SESSION_ID || 'mcp-server' }, args.gate_receipt_id)
+                                    : [];
+                                toolSuccess(id, proofRetryConflict(proofKeys, args.proof, fromHold), true);
+                                return;
+                            }
+                            throw err;
+                        }
+                        if (result.committed) {
+                            for (const key of proofKeys)
+                                commitProofMissing.delete(key);
+                        }
+                        else {
+                            // A short close is accepted unverified with the missing proof named ("Retry only after proof includes: a, b.").
+                            const unverified = result;
+                            const listed = unverified.governance_validation?.code === 'MARROW_PROOF_PACK_INCOMPLETE'
+                                ? /proof includes: ([A-Za-z0-9_, ]{1,600})\.?\s*$/.exec(String(unverified.exact_next_action || ''))?.[1]
+                                : undefined;
+                            const missing = listed ? listed.split(',').map((field) => field.trim()).filter(Boolean) : [];
+                            if (missing.length)
+                                for (const key of proofKeys)
+                                    commitProofMissing.set(key, missing);
+                        }
                         const commitResult = { ...result, narrative: result.narrative ?? null };
                         lastCommitted = result.committed;
                         lastDecisionId = result.committed ? null : decision_id;
@@ -2314,7 +2500,8 @@ Marrow is not a replacement agent or a standalone memory app. Context and prior
                             // work obtains exactly one canonical runtime authorization inside auto.
                             auto_gate: highRisk,
                             operation_id: typeof args.operation_id === 'string' ? args.operation_id : undefined,
-                        }, SESSION_ID, FLEET_AGENT_ID, 8_000);
+                            ...(args.request_owner_link === true ? { request_owner_link: true } : {}),
+                        }, SESSION_ID, FLEET_AGENT_ID, 8_000, autoElicitationOptions());
                         let delivered = null;
                         let deliveryFailure = null;
                         let failedHttpAttemptTrace = null;
@@ -2337,7 +2524,10 @@ Marrow is not a replacement agent or a standalone memory app. Context and prior
                             deferDelivery: true,
                             event: {
                                 ...(delivered?.operation_id ? {
-                                    event_id: `auto_${delivered.committed ? 'closed' : 'pending'}_${delivered.operation_id}`,
+                                    // A closed operation has one record; each pending call is its own attempt.
+                                    event_id: delivered.committed
+                                        ? `auto_closed_${delivered.operation_id}`
+                                        : `auto_pending_${delivered.operation_id}_${(0, node_crypto_1.randomUUID)().replace(/-/g, '').slice(0, 12)}`,
                                 } : {}),
                                 event_type: delivered?.committed
                                     ? 'outcome_committed'
@@ -2369,17 +2559,23 @@ Marrow is not a replacement agent or a standalone memory app. Context and prior
                                         ? 'intent_confirmed'
                                         : 'durably_queued',
                             receipt,
-                            completion_state: delivered?.committed
-                                ? 'closed_with_proof'
-                                : delivered?.phase === 'review_required'
-                                    ? 'review_required_terminal'
-                                    : delivered?.phase === 'owner_approval_required'
-                                        ? 'pending_owner_approval'
-                                        : delivered?.phase === 'proof_required'
-                                            ? 'pending_required_proof'
-                                            : delivered?.phase === 'decision_created' || outcomeSuccess === undefined
-                                                ? 'pending_evidence'
-                                                : 'delivery_pending',
+                            completion_state: delivered?.committed && delivered.closure === 'gate_denial'
+                                ? 'closed_as_denial'
+                                : delivered?.closure === 'already_closed_denial'
+                                    ? 'closed_earlier_as_denial'
+                                    : delivered?.closure === 'already_closed'
+                                        ? 'closed_earlier'
+                                        : delivered?.committed
+                                            ? 'closed_with_proof'
+                                            : delivered?.phase === 'review_required'
+                                                ? 'review_required_terminal'
+                                                : delivered?.phase === 'owner_approval_required'
+                                                    ? 'pending_owner_approval'
+                                                    : delivered?.phase === 'proof_required'
+                                                        ? 'pending_required_proof'
+                                                        : delivered?.phase === 'decision_created' || outcomeSuccess === undefined
+                                                            ? 'pending_evidence'
+                                                            : 'delivery_pending',
                             decision_id: delivered?.decision_id || null,
                             operation_id: delivered?.operation_id || (typeof args.operation_id === 'string' ? args.operation_id : null),
                             phase: delivered?.phase || null,
@@ -2390,17 +2586,19 @@ Marrow is not a replacement agent or a standalone memory app. Context and prior
                                 attempts: [],
                                 dropped_count: 0,
                             },
-                            exact_next_action: delivered?.committed
-                                ? 'The governed outcome is closed. Reuse this decision_id only for read-only trace inspection.'
-                                : delivered?.exact_next_action
-                                    ? delivered.exact_next_action
-                                    : delivered?.phase === 'owner_approval_required'
-                                        ? 'Approve this exact arbitration decision in the authenticated Marrow dashboard, then call marrow_auto once with this same operation_id, arbitration_receipt_id, and the server-issued owner_approval_receipt_id. Do not retry proof or use chat approval text.'
-                                        : delivered?.phase === 'proof_required'
-                                            ? 'Attach the required measured proof and retry marrow_auto with this same operation_id and unchanged action, context, and surfaces.'
-                                            : delivered?.resumable
-                                                ? 'Retry marrow_auto with this same operation_id. Do not start a new auto operation.'
-                                                : 'Close this decision after the real outcome is known.',
+                            exact_next_action: delivered?.committed && delivered.closure === 'gate_denial' && delivered.exact_next_action
+                                ? delivered.exact_next_action
+                                : delivered?.committed
+                                    ? 'The governed outcome is closed. Reuse this decision_id only for read-only trace inspection.'
+                                    : delivered?.exact_next_action
+                                        ? delivered.exact_next_action
+                                        : delivered?.phase === 'owner_approval_required'
+                                            ? 'The account owner must approve one proposal of this arbitration before it runs; Marrow then issues an owner_approval_receipt_id. Do not run any proposal or write an approval yourself. Once Marrow issues the receipt, call marrow_auto once with this same operation_id, arbitration_receipt_id and owner_approval_receipt_id.'
+                                            : delivered?.phase === 'proof_required'
+                                                ? 'Attach the required measured proof and retry marrow_auto with this same operation_id and unchanged action, context, and surfaces.'
+                                                : delivered?.resumable
+                                                    ? 'Retry marrow_auto with this same operation_id. Do not start a new auto operation.'
+                                                    : 'Close this decision after the real outcome is known.',
                             live_delivery: {
                                 accepted: Boolean(delivered?.decision_id),
                                 committed: Boolean(delivered?.committed),
@@ -2408,6 +2606,7 @@ Marrow is not a replacement agent or a standalone memory app. Context and prior
                             },
                             host_capability: mcpHostCapability(),
                             client_update: (0, request_reliability_1.localClientUpdate)(),
+                            ...(delivered?.approval ? { approval: delivered.approval } : {}),
                             ...(runtimeGate ? { runtime_gate: runtimeGate } : {}),
                         };
                         // Measure through response construction; stdout/host consumption occurs
@@ -2982,6 +3181,9 @@ Marrow is not a replacement agent or a standalone memory app. Context and prior
                 // MCP notifications (no id) must be silently ignored per spec
                 if (msg.id === undefined || msg.id === null)
                     continue;
+                // The client's answer to this server's own request (elicitation).
+                if (settleClientResponse(msg))
+                    continue;
                 pendingRequests++;
                 handleRequest(msg)
                     .catch((err) => {