@inetafrica/open-claudia 2.8.0 → 2.9.0

package/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## v2.9.0
+- **Hybrid async approvals — a destructive run no longer burns the turn or dead-ends on a late press.** v2.8.0's chat approval blocked the CLI for 5 minutes and treated timeout as denial, which had two UX failures: an undecided window wasted minutes of live turn, and a button pressed after the window hit a dead-end (terse auto-ack, no agent reaction — the record was already denied). The flow is now two-phase. **Fast path**: the CLI waits ~90s; an inline Approve runs immediately, Deny refuses — unchanged semantics, just a tighter window. **Async path**: if undecided at 90s, the CLI marks the record `detached` and exits code 5 with instructions to end the turn ("pending your Approve/Deny — do NOT retry"); the record stays open for 24h. When the button is eventually pressed, the `apr:` handler sees the detached record and **schedules an immediate wakeup** in the originating channel carrying the decision and the exact command, so the agent reacts either way (runs it, or acknowledges the denial).
+- **One-shot approval tokens, fail-closed on every branch.** The woken agent redeems the decision with `tool run <name> <args> --approval <apr_id>`. `approvals.consume()` requires ALL of: status `approved`, never consumed before (single use — a replay is refused), within 24h of request, and a command line **byte-identical** to what the user saw on the buttons (a mismatch refuses without burning the token). `--approval` is honored on top-level runs only — a nested/composed tool can't smuggle a token — and redemption stamps `approvedVia: "chat-approval"` + exports `OPEN_CLAUDIA_APPROVED_TIER=destructive` exactly like an inline approve, so composition inheritance is unchanged. Undecided, denied, expired, unknown, or mismatched never runs.
+- Approval prompt and system-prompt docs updated for the two-phase flow; new `test-approval-async.js` covers the full lifecycle (detach semantics, pending/denied/unknown refusals, exact-match redemption, replay refusal, token not burned on mismatch, 24h expiry, 1000-char command cap, 90s default window).
+
 ## v2.8.0
 - **Per-verb manifests — the gate now knows each verb's blast radius (Phase 5).** A tool may declare its verbs in the header (`verb: <name> [args] | <tier> | <doc>` — one line per verb); `tool run` then resolves the risk tier **per invoked verb** instead of whole-tool: `spaces unread` runs freely while `spaces upload` demands `--yes`, and `prod-k8s cert-status` is read-only while `cert-renew` stays write-gated. An **undeclared verb on a manifest tool is refused outright** regardless of flags (declare it before using it), `help`/no-verb is always read-only, and manifest-less tools keep the old whole-tool gate unchanged (fully backward compatible — older runners ignore `verb:` lines). `tool scaffold --verbs "list:read-only:doc,create:write:doc"` generates the manifest lines, a dispatcher entry per verb, and a TOOL.md verbs block; `tool show` lists the declared manifest. Migrated all 8 live verb-CLIs (clickhouse, inet-central-cli, inet-ops, kazee-chat, kticket, metabase, prod-k8s, spaces — 41 declared verbs) in the tools repo.
 - **Chat approval with the EXACT payload — destructive runs escalate to inline Approve/Deny.** `--yes-destructive` acknowledged the agent's *paraphrase* of a destructive action; now an unflagged destructive top-level `tool run` inside a bot task POSTs the literal resolved command line to the requesting channel via a new loopback `approval-request` kind — the user sees `open-claudia tool run <name> <args>` verbatim with ✅ Approve / ⛔ Deny buttons (owner-only, idempotent: a second press can't overturn the first). The CLI polls the file-backed record (`core/approvals.js`) and **fails closed**: timeout (5 min) or deny = refusal at exit 3; only an explicit approve proceeds, stamped `approvedVia: "chat-approval"` with `OPEN_CLAUDIA_APPROVED_TIER=destructive` exported for composition. Every run's history entry now records the acknowledged tier — auditable forever.

package/bin/tool.js

@@ -353,7 +353,17 @@ async function run(args) {
       if (!name) { console.error("Usage: tool run <name> [args...]"); process.exitCode = 1; return; }
       const t = tools.findTool(name);
       if (!t) { console.error(`No tool named "${name}". Run: open-claudia tool list`); process.exitCode = 1; return; }
-      const toolArgs = rest.slice(1);
+      let toolArgs = rest.slice(1);
+
+      // Async-approval token (--approval apr_x): redeemed one-shot against the
+      // exact command line WITHOUT the token flag, so what's checked is what
+      // was shown to the user. Stripped before spawn — tools never see it.
+      let approvalId = "";
+      const aprIdx = toolArgs.indexOf("--approval");
+      if (aprIdx >= 0) {
+        approvalId = toolArgs[aprIdx + 1] || "";
+        toolArgs = [...toolArgs.slice(0, aprIdx), ...toolArgs.slice(aprIdx + 2)];
+      }
 
       // Risk-tier gate, resolved per verb when the tool declares a manifest:
       // write needs --yes, destructive needs --yes-destructive. Undeclared
@@ -361,24 +371,50 @@ async function run(args) {
       // calling this tool) gate on the tier the OUTERMOST invocation approved
       // instead — argv flags can't fabricate approval.
       const gate = tools.runGate(t, toolArgs, process.env);
+      const commandLine = ["open-claudia tool run", t.name, ...toolArgs].join(" ");
       let approvedVia = "";
-      if (!gate.ok) {
+
+      if (approvalId) {
+        const approvals = require("../core/approvals");
+        if (String(process.env.OPEN_CLAUDIA_TOOL_STACK || "").trim()) {
+          console.error("⛔ --approval tokens are only honored on top-level runs, not nested tool calls.");
+          process.exitCode = 3; return;
+        }
+        const redeemed = approvals.consume(approvalId, commandLine);
+        if (!redeemed.ok) {
+          console.error(`⛔ Approval ${approvalId} rejected: ${redeemed.reason}. The run stays blocked.`);
+          process.exitCode = 3; return;
+        }
+        approvedVia = "chat-approval";
+        console.error(`✅ Approval ${approvalId} redeemed (single use) — running.`);
+      } else if (!gate.ok) {
         // Chat-approval fallback: an unflagged destructive top-level run inside
         // a bot task escalates to the requesting channel with the EXACT command
-        // and inline Approve/Deny. Anything but an explicit approve = refusal.
+        // and inline Approve/Deny. Fast path: block ~90s for an inline decision.
+        // No decision in time → detach and exit; the button press later fires a
+        // wakeup carrying a one-shot --approval token. Anything but an explicit
+        // approve = the command never runs.
         const canAsk = gate.tier === "destructive" && !gate.nested && !gate.undeclared
           && process.env.OC_SEND_URL && process.env.OC_SEND_TOKEN && process.env.OC_CHANNEL_ID && process.env.OC_CHANNEL_ADAPTER;
         if (!canAsk) { console.error(gate.message); process.exitCode = 3; return; }
-        const commandLine = ["open-claudia tool run", t.name, ...toolArgs].join(" ");
         console.error(`Destructive run without --yes-destructive — asking for chat approval of the exact command...`);
         let decision = "denied";
+        let reqId = "";
         try {
           const { postJson } = require("./loopback-client");
           const res = await postJson("approval-request", {
             tool: t.name, verb: tools.invokedVerb(toolArgs), tier: gate.tier, command: commandLine,
           });
+          reqId = res.id;
           const approvals = require("../core/approvals");
           decision = await approvals.waitForDecision(res.id);
+          if (decision === "timeout") {
+            approvals.detach(res.id);
+            console.error(`⏳ No decision yet — approval ${res.id} stays open for 24h (detached).`);
+            console.error(`End the turn and tell the user the run is pending their Approve/Deny. When they press a button, ` +
+              `a wakeup will fire with the outcome — do NOT retry or re-request this command in the meantime.`);
+            process.exitCode = 5; return;
+          }
         } catch (e) {
           console.error(`Chat approval unavailable (${e.message}).`);
         }

package/core/actions.js

@@ -305,12 +305,43 @@ async function handleAction(envelope) {
     const id = parts[1];
     const choice = parts[2] === "ok" ? "approved" : "denied";
     const approvals = require("./approvals");
+    const wasPending = approvals.read(id)?.status === "pending";
     const rec = approvals.decide(id, choice, String(envelope.channelId));
     if (!rec) return send("That approval request has expired or was cleaned up — the run stays blocked.");
     // If a second press disagreed, rec.status still holds the FIRST decision.
+    const label = `${rec.tool}${rec.verb ? " " + rec.verb : ""}`;
+    if (rec.detached && wasPending) {
+      // The CLI gave up its fast-path wait and exited — no live turn is
+      // listening. Wake the agent so it can redeem (or acknowledge) the
+      // decision. The one-shot token in consume() keeps this fail-closed.
+      const prompt = rec.status === "approved"
+        ? `[Tool approval ${rec.id}] The user APPROVED the pending destructive run:\n${rec.command}\n` +
+          `Run it now EXACTLY as:\n${rec.command} --approval ${rec.id}\n` +
+          `The token is single-use and bound to that exact command — do not alter it. Report the result to the user.`
+        : `[Tool approval ${rec.id}] The user DENIED the pending destructive run:\n${rec.command}\n` +
+          `Do NOT run it. Acknowledge the denial to the user and adjust course.`;
+      try {
+        scheduler.addJob({
+          kind: "wakeup",
+          adapter: rec.adapter || (adapter && adapter.id) || "",
+          adapterType: adapter && adapter.type,
+          channelId: String(rec.channelId || envelope.channelId),
+          prompt,
+          label: `Tool approval ${rec.status}: ${label}`.slice(0, 60),
+          source: "approval",
+          fireAt: Date.now() + 2000,
+        });
+      } catch (e) {
+        return send(`Decision recorded (${rec.status}) but I couldn't wake the agent: ${e.message}`);
+      }
+      await send(rec.status === "approved"
+        ? `✅ Approved — waking the agent to run ${label} now.`
+        : `⛔ Denied — ${label} stays blocked; letting the agent know.`);
+      return;
+    }
     await send(rec.status === "approved"
-      ? `✅ Approved — ${rec.tool}${rec.verb ? " " + rec.verb : ""} will run now.`
-      : `⛔ Denied — ${rec.tool}${rec.verb ? " " + rec.verb : ""} will not run.`);
+      ? `✅ Approved — ${label} will run now.`
+      : `⛔ Denied — ${label} will not run.`);
     return;
   }
   if (d.startsWith("tt:")) {

package/core/approvals.js

@@ -4,12 +4,15 @@
 // --yes-destructive flag acknowledges a summary — here the user approves the
 // literal command that will execute, not the agent's paraphrase of it.
 //
-// Mechanics: file-backed records under CONFIG_DIR/approvals. The CLI (a bot
-// subprocess) POSTs approval-request to the bot's loopback server, which sends
-// the button message and creates the pending record; the CLI then polls the
-// record file until the actions.js "apr:" callback flips its status, or the
-// timeout lapses (timeout = denied — fail-closed, unlike the guard's
-// fail-open, because this path only exists for destructive actions).
+// Mechanics (hybrid async): file-backed records under CONFIG_DIR/approvals.
+// The CLI (a bot subprocess) POSTs approval-request to the bot's loopback
+// server, which sends the button message and creates the pending record. The
+// CLI then polls the record for a short fast-path window; if the user decides
+// in time the run proceeds (or refuses) inline. Otherwise the CLI marks the
+// record "detached" and exits — the agent's turn ends cleanly, and when the
+// button is eventually pressed, actions.js schedules a wakeup so the agent can
+// consume the approval as a ONE-SHOT token bound to the exact command string
+// (single use, 24h TTL, fail-closed: undecided or mismatched never runs).
 
 const fs = require("fs");
 const path = require("path");
@@ -71,8 +74,9 @@ function decide(id, status, by = "") {
 }
 
 // Poll until decided or timeout. Timeout resolves as "timeout" — the caller
-// must treat anything other than "approved" as a refusal.
-async function waitForDecision(id, { timeoutMs = 300000, pollMs = 1500 } = {}) {
+// must treat anything other than "approved" as a refusal (or detach and go
+// async).
+async function waitForDecision(id, { timeoutMs = 90000, pollMs = 1500 } = {}) {
   const deadline = Date.now() + timeoutMs;
   for (;;) {
     const rec = read(id);
@@ -82,4 +86,33 @@ async function waitForDecision(id, { timeoutMs = 300000, pollMs = 1500 } = {}) {
   }
 }
 
-module.exports = { APPROVALS_DIR, create, read, decide, waitForDecision };
+// The CLI gave up its fast-path wait and exited; the record stays pending.
+// actions.js uses this flag to know a later button press must wake the agent
+// (an attached waiter reacts by itself, a detached one cannot).
+function detach(id) {
+  const rec = read(id);
+  if (!rec || rec.status !== "pending") return rec;
+  rec.detached = true;
+  rec.detachedAt = new Date().toISOString();
+  fs.writeFileSync(fileOf(id), JSON.stringify(rec, null, 2), { mode: 0o600 });
+  return rec;
+}
+
+// One-shot token redemption for the async path. Fail-closed on every branch:
+// only an approved, un-consumed, un-expired record whose stored command is
+// byte-identical to what is about to run can be consumed — and only once.
+function consume(id, commandLine) {
+  const rec = read(id);
+  if (!rec) return { ok: false, reason: "unknown or expired approval id" };
+  if (rec.status !== "approved") return { ok: false, reason: `approval is ${rec.status}, not approved` };
+  if (rec.consumedAt) return { ok: false, reason: "approval already consumed (single use)" };
+  if (Date.now() - Date.parse(rec.requestedAt) > MAX_AGE_MS) return { ok: false, reason: "approval expired (24h)" };
+  if (String(commandLine || "").slice(0, 1000) !== rec.command) {
+    return { ok: false, reason: "command does not match the approved payload" };
+  }
+  rec.consumedAt = new Date().toISOString();
+  fs.writeFileSync(fileOf(id), JSON.stringify(rec, null, 2), { mode: 0o600 });
+  return { ok: true, record: rec };
+}
+
+module.exports = { APPROVALS_DIR, create, read, decide, waitForDecision, detach, consume };

package/core/loopback.js

@@ -477,7 +477,7 @@ async function handleJson(req, res, url, kind) {
         `<pre>${String(payload.command).slice(0, 800).replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;")}</pre>`,
         ``,
         `Tool: ${payload.tool}${payload.verb ? ` · verb: ${payload.verb}` : ""} · tier: ${rec.tier}`,
-        `This is the literal command that will execute. Times out (denied) in 5 minutes.`,
+        `This is the literal command that will execute. Decide within ~90s to run it inline; after that the agent moves on, but your Approve/Deny stays valid for 24h and wakes it back up.`,
       ].join("\n");
       const keyboard = { inline_keyboard: [[
         { text: "✅ Approve", callback_data: `apr:${rec.id}:ok` },

package/core/system-prompt.js

@@ -110,7 +110,7 @@ Operational work — hitting an API, mutating a live system, driving an interfac
 Raw shell one-liners and heredocs are for probing and diagnosis only — never the operational action itself. If a tool is broken, fix it or journal the defect (\`tool note <name> --issue "..."\`); do not route around it with a script.
 
 - Risk gate: read-only tools run freely; write-tier needs \`--yes\`; destructive needs \`--yes-destructive\`. The flag is your mechanical acknowledgment AFTER the user approves the action — it never replaces asking first.
-- Per-verb manifest: a tool that declares \`verb:\` header lines is gated verb-by-verb — each verb runs at its own declared tier, and an undeclared verb is refused outright (declare it in the header before using it). An unflagged destructive run inside a bot task escalates to chat with the EXACT command and Approve/Deny buttons; anything but an explicit approve is a refusal.
+- Per-verb manifest: a tool that declares \`verb:\` header lines is gated verb-by-verb — each verb runs at its own declared tier, and an undeclared verb is refused outright (declare it in the header before using it). An unflagged destructive run inside a bot task escalates to chat with the EXACT command and Approve/Deny buttons and waits ~90s: an inline Approve runs it, Deny refuses. If the window lapses (exit code 5, "pending"), the approval detaches but stays valid 24h — END the turn telling the user the run awaits their button press; do NOT retry or re-request it. When they later press a button you're woken with the outcome: if approved, run the EXACT command with \`--approval <id>\` appended (one-shot token, top-level runs only, bound byte-for-byte to the approved command — never alter or reuse it); if denied, acknowledge and move on.
 - Tools carry their own memory: TOOL.md (Interface · Known issues · State · Journal) is the manual, state.json records every run (per-verb health), and every change is a git commit. Keep TOOL.md truthful as you work; update the tool in place when behaviour changes.
 - Preauth, least-privilege: keyring creds are injected ONLY into \`tool run\` subprocesses, and only the keys a tool declares via \`--requires\` (\`open-claudia keyring list\` shows names) — your own shell and sub-agents hold NO creds. Reference creds as \`$inet_central_user\` etc. inside tool sources and declare every one; never write a secret into a tool file (saves are refused).
 - Deny-gate: raw shell commands that act on known production surfaces (platform APIs, prod hosts, in-cluster mongo, GitLab host shell) are blocked mid-flight with a redirect to the covering tool — that block is the system working, not an obstacle to route around. Genuine one-off no tool covers yet? \`open-claudia keyring exec --reason "<why>" -- <cmd>\` runs with full creds and logs the bypass for audit; scaffold the tool if you'd ever run it twice.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inetafrica/open-claudia",
-  "version": "2.8.0",
+  "version": "2.9.0",
   "description": "Your always-on AI coding assistant — Claude Code, Cursor Agent, and OpenAI Codex via Telegram or Kazee Chat",
   "main": "bot.js",
   "bin": {
@@ -9,7 +9,7 @@
   "scripts": {
     "setup": "node setup.js",
     "start": "node bot.js",
-    "test": "OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node -e \"require('./vault'); console.log('OK')\" && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-runner-watchdog-static.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-usage-accounting.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-recall-engine.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-recall-graph.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-recall-discoverer.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-project-transcripts-smoke.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-abilities.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-ability-extraction.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-ability-couse.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-ability-transfer.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-ability-tiers.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-ability-merge-guard.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-learning-e2e.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-pack-nesting.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-journal-dedupe.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-read-signal.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-tools.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-tool-graph.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-tool-guard.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-tooling-mode.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-tool-manifest.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-recall-evolution.js"
+    "test": "OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node -e \"require('./vault'); console.log('OK')\" && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-runner-watchdog-static.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-usage-accounting.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-recall-engine.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-recall-graph.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-recall-discoverer.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-project-transcripts-smoke.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-abilities.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-ability-extraction.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-ability-couse.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-ability-transfer.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-ability-tiers.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-ability-merge-guard.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-learning-e2e.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-pack-nesting.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-journal-dedupe.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-read-signal.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-tools.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-tool-graph.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-tool-guard.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-tooling-mode.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-tool-manifest.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-recall-evolution.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-approval-async.js"
   },
   "files": [
     "bot.js",
@@ -49,7 +49,8 @@
     "test-tool-graph.js",
     "test-tool-guard.js",
     "test-tooling-mode.js",
-    "test-tool-manifest.js"
+    "test-tool-manifest.js",
+    "test-approval-async.js"
   ],
   "keywords": [
     "claude",

package/test-approval-async.js

@@ -0,0 +1,76 @@
+// Hybrid async approvals: when the CLI's fast-path wait lapses it detaches
+// and exits, and a later button press is redeemed as a ONE-SHOT token bound
+// to the exact command string. Every branch here is fail-closed — only an
+// approved, un-consumed, un-expired, byte-identical command runs, and only
+// once.
+const assert = require("assert");
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+
+const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "approval-async-test-"));
+process.env.APPROVALS_DIR = path.join(tmp, "approvals");
+
+const approvals = require("./core/approvals");
+
+(async () => {
+  const CMD = "open-claudia tool run fleet purge n1";
+
+  // ── detach: pending record gains the flag; decided records are untouched ──
+  const rec = approvals.create({ tool: "fleet", verb: "purge", tier: "destructive", command: CMD, channelId: "c1", adapter: "tg" });
+  const det = approvals.detach(rec.id);
+  assert.strictEqual(det.detached, true, "pending record detaches");
+  assert.ok(det.detachedAt, "detach is timestamped");
+  assert.strictEqual(approvals.read(rec.id).status, "pending", "detach does not decide");
+
+  const decided = approvals.create({ tool: "fleet", verb: "purge", tier: "destructive", command: CMD, channelId: "c1", adapter: "tg" });
+  approvals.decide(decided.id, "denied", "c1");
+  const det2 = approvals.detach(decided.id);
+  assert.notStrictEqual(det2.detached, true, "decided record cannot be detached");
+
+  // ── consume: only approved records redeem ──
+  assert.strictEqual(approvals.consume(rec.id, CMD).ok, false, "pending record cannot be consumed");
+  assert.ok(/pending/.test(approvals.consume(rec.id, CMD).reason));
+  assert.strictEqual(approvals.consume(decided.id, CMD).ok, false, "denied record cannot be consumed");
+
+  // ── late decide on a detached record still works, then redeems exactly once ──
+  approvals.decide(rec.id, "approved", "c1");
+  const bad = approvals.consume(rec.id, CMD + " --extra");
+  assert.strictEqual(bad.ok, false, "command mismatch refused");
+  assert.ok(/does not match/.test(bad.reason));
+  assert.strictEqual(approvals.read(rec.id).consumedAt, undefined, "failed consume does not burn the token");
+
+  const good = approvals.consume(rec.id, CMD);
+  assert.strictEqual(good.ok, true, "exact command redeems");
+  assert.ok(good.record.consumedAt, "redemption is stamped");
+
+  const replay = approvals.consume(rec.id, CMD);
+  assert.strictEqual(replay.ok, false, "second consume refused (single use)");
+  assert.ok(/already consumed/.test(replay.reason));
+
+  // ── unknown id fails closed ──
+  assert.strictEqual(approvals.consume("apr_nope", CMD).ok, false, "unknown id refused");
+
+  // ── expiry: an approved token older than 24h cannot redeem ──
+  const old = approvals.create({ tool: "fleet", verb: "purge", tier: "destructive", command: CMD, channelId: "c1", adapter: "tg" });
+  approvals.decide(old.id, "approved", "c1");
+  const f = path.join(approvals.APPROVALS_DIR, `${old.id}.json`);
+  const j = JSON.parse(fs.readFileSync(f, "utf-8"));
+  j.requestedAt = new Date(Date.now() - 25 * 60 * 60 * 1000).toISOString();
+  fs.writeFileSync(f, JSON.stringify(j));
+  const expired = approvals.consume(old.id, CMD);
+  assert.strictEqual(expired.ok, false, "expired token refused");
+  assert.ok(/expired/.test(expired.reason));
+
+  // ── long commands: stored payload is capped at 1000 chars and matching respects the cap ──
+  const longCmd = "open-claudia tool run fleet purge " + "x".repeat(1200);
+  const lrec = approvals.create({ tool: "fleet", verb: "purge", tier: "destructive", command: longCmd, channelId: "c1", adapter: "tg" });
+  approvals.decide(lrec.id, "approved", "c1");
+  assert.strictEqual(approvals.consume(lrec.id, longCmd).ok, true, "capped command still matches its own approval");
+
+  // ── waitForDecision default fast-path window is 90s (not the old 5 min) ──
+  const src = fs.readFileSync(path.join(__dirname, "core", "approvals.js"), "utf-8");
+  assert.ok(/timeoutMs = 90000/.test(src), "fast-path default is 90s");
+
+  console.log("approval async OK");
+})().catch((e) => { console.error(e); process.exit(1); });