@kodizm/acp 0.8.2 → 0.9.0

package/dist/index.js

@@ -46,6 +46,75 @@ var __esm = (fn, res, err) => () => {
 };
 var __require = import.meta.require;
 
+// package.json
+var package_default;
+var init_package = __esm(() => {
+  package_default = {
+    name: "@kodizm/acp",
+    version: "0.9.0",
+    description: "Custom ACP server bridging Claude Code and opencode CLIs through a single Kodizm-flavored protocol surface.",
+    type: "module",
+    bin: {
+      "kodizm-acp": "./dist/index.js"
+    },
+    main: "./dist/index.js",
+    files: [
+      "dist/",
+      "README.md",
+      "LICENSE"
+    ],
+    scripts: {
+      dev: "bun run src/index.ts",
+      build: "bun build src/index.ts --target=bun --outdir=dist",
+      test: "bun test test/unit test/e2e",
+      "test:unit": "bun test test/unit",
+      "test:e2e": "bun test test/e2e",
+      "test:integration": "./scripts/reap-opencode.sh bun test test/integration",
+      "test:watch": "bun test --watch",
+      lint: "biome check src test",
+      "lint:fix": "biome check --write src test",
+      format: "biome format --write src test",
+      typecheck: "tsc --noEmit",
+      "typecheck:src": "tsc --noEmit -p tsconfig.publish.json",
+      prepublishOnly: "bun run build && bun run typecheck:src"
+    },
+    engines: {
+      bun: ">=1.1.0"
+    },
+    publishConfig: {
+      access: "public"
+    },
+    config: {
+      claudeAgentSdk: "0.3.280"
+    },
+    devDependencies: {
+      "@anthropic-ai/claude-agent-sdk": "0.3.280",
+      "@anthropic-ai/sdk": ">=0.93.0",
+      "@biomejs/biome": "^1.9.0",
+      "@modelcontextprotocol/sdk": "^1.29.0",
+      "@opencode-ai/sdk": "^1.18.32",
+      "@types/bun": "latest",
+      typescript: "^5.6.0",
+      zod: "^4.0.0"
+    },
+    license: "Apache-2.0",
+    homepage: "https://github.com/kodizm/acp",
+    repository: {
+      type: "git",
+      url: "git+https://github.com/kodizm/acp.git"
+    },
+    keywords: [
+      "acp",
+      "agent-client-protocol",
+      "claude",
+      "opencode",
+      "ai",
+      "bridge",
+      "jsonrpc"
+    ]
+  };
+});
+
 // src/server/errors.ts
 var JsonRpcErrorCode, JsonRpcError, InvalidParamsError, SessionNotFoundError, MethodNotSupportedError, AcpTimeoutError, BackendNotConfiguredError, UnknownBackendError;
 var init_errors = __esm(() => {
@@ -5206,58 +5275,7 @@ var init_events = __esm(() => {
   ]);
 });
 
-// src/backends/claude/permission-bridge.ts
-function buildCanUseTool(deps) {
-  return async function canUseTool(toolName, input, options) {
-    const payload = {
-      sessionId: deps.sessionId,
-      toolCall: {
-        toolCallId: options.toolUseID,
-        rawInput: input,
-        title: options.title ?? toolName,
-        kind: "tool_use"
-      },
-      options: DEFAULT_OPTIONS
-    };
-    if (options.agentID !== undefined) {
-      payload.agentId = options.agentID;
-    }
-    const event = {
-      sessionId: deps.sessionId,
-      type: "permission_request",
-      toolUseId: options.toolUseID,
-      name: toolName,
-      options: DEFAULT_OPTIONS.map((o) => ({ optionId: o.optionId, label: o.name })),
-      ...options.agentID === undefined ? {} : { agentId: options.agentID, parentSessionId: deps.sessionId }
-    };
-    deps.emit.send(event);
-    const raceOptions = {
-      signal: composeSignals(deps.signal, options.signal)
-    };
-    if (deps.permissionTimeoutMs !== undefined) {
-      raceOptions.timeoutMs = deps.permissionTimeoutMs;
-    }
-    if (deps.deferTimeoutMs !== undefined && deps.onDefer !== undefined) {
-      raceOptions.deferTimeoutMs = deps.deferTimeoutMs;
-    }
-    let raced;
-    try {
-      raced = await awaitPermissionResponse(deps.server, "session/request_permission", payload, raceOptions);
-    } catch (error) {
-      if (error instanceof AcpTimeoutError) {
-        return { behavior: "deny", message: "Permission RPC timed out" };
-      }
-      throw error;
-    }
-    if (raced === DEFERRED_SENTINEL) {
-      if (deps.onDefer === undefined) {
-        return { behavior: "deny", message: "Permission deferred (no handler)" };
-      }
-      return await deps.onDefer({ toolName, input, options });
-    }
-    return mapPermissionOutcome(raced, input, options.suggestions);
-  };
-}
+// src/backends/permission-rpc.ts
 async function awaitPermissionResponse(server, method, params, options = {}) {
   const racers = [server.request(method, params)];
   let timeoutHandle;
@@ -5304,49 +5322,9 @@ async function awaitPermissionResponse(server, method, params, options = {}) {
     }
   }
 }
-function composeSignals(a, b) {
-  if (a.aborted)
-    return a;
-  if (b.aborted)
-    return b;
-  const controller = new AbortController;
-  const onAbort = () => controller.abort();
-  a.addEventListener("abort", onAbort, { once: true });
-  b.addEventListener("abort", onAbort, { once: true });
-  return controller.signal;
-}
-function mapPermissionOutcome(response, input, suggestions) {
-  const outcome = response.outcome;
-  if (outcome.outcome === "cancelled") {
-    throw new Error("Tool use aborted");
-  }
-  if (outcome.optionId === "allow") {
-    return { behavior: "allow", updatedInput: input };
-  }
-  if (outcome.optionId === "allow_always") {
-    return {
-      behavior: "allow",
-      updatedInput: input,
-      updatedPermissions: suggestions !== undefined && suggestions.length > 0 ? suggestions : [
-        {
-          type: "addRules",
-          rules: [{ toolName: "unknown" }],
-          behavior: "allow",
-          destination: "session"
-        }
-      ]
-    };
-  }
-  return { behavior: "deny", message: "User refused permission to run tool" };
-}
-var DEFAULT_OPTIONS, DEFERRED_SENTINEL;
-var init_permission_bridge = __esm(() => {
+var DEFERRED_SENTINEL;
+var init_permission_rpc = __esm(() => {
   init_errors();
-  DEFAULT_OPTIONS = [
-    { kind: "allow_always", name: "Always allow this tool", optionId: "allow_always" },
-    { kind: "allow_once", name: "Allow", optionId: "allow" },
-    { kind: "reject_once", name: "Reject", optionId: "reject" }
-  ];
   DEFERRED_SENTINEL = Symbol.for("kodizm.permission.deferred");
 });
 
@@ -5399,7 +5377,7 @@ var QuestionsArraySchema;
 var init_ask_user_question = __esm(() => {
   init_zod();
   init_events();
-  init_permission_bridge();
+  init_permission_rpc();
   QuestionsArraySchema = array(KodizmQuestionSchema).min(1).max(4);
 });
 
@@ -5784,6 +5762,104 @@ function buildSdkServer(server) {
   return sdkServer;
 }
 
+// src/backends/claude/permission-bridge.ts
+function buildCanUseTool(deps) {
+  return async function canUseTool(toolName, input, options) {
+    const payload = {
+      sessionId: deps.sessionId,
+      toolCall: {
+        toolCallId: options.toolUseID,
+        rawInput: input,
+        title: options.title ?? toolName,
+        kind: "tool_use"
+      },
+      options: DEFAULT_OPTIONS
+    };
+    if (options.agentID !== undefined) {
+      payload.agentId = options.agentID;
+    }
+    const event = {
+      sessionId: deps.sessionId,
+      type: "permission_request",
+      toolUseId: options.toolUseID,
+      name: toolName,
+      options: DEFAULT_OPTIONS.map((o) => ({ optionId: o.optionId, label: o.name })),
+      ...options.agentID === undefined ? {} : { agentId: options.agentID, parentSessionId: deps.sessionId }
+    };
+    deps.emit.send(event);
+    const raceOptions = {
+      signal: composeSignals(deps.signal, options.signal)
+    };
+    if (deps.permissionTimeoutMs !== undefined) {
+      raceOptions.timeoutMs = deps.permissionTimeoutMs;
+    }
+    if (deps.deferTimeoutMs !== undefined && deps.onDefer !== undefined) {
+      raceOptions.deferTimeoutMs = deps.deferTimeoutMs;
+    }
+    let raced;
+    try {
+      raced = await awaitPermissionResponse(deps.server, "session/request_permission", payload, raceOptions);
+    } catch (error) {
+      if (error instanceof AcpTimeoutError) {
+        return { behavior: "deny", message: "Permission RPC timed out" };
+      }
+      throw error;
+    }
+    if (raced === DEFERRED_SENTINEL) {
+      if (deps.onDefer === undefined) {
+        return { behavior: "deny", message: "Permission deferred (no handler)" };
+      }
+      return await deps.onDefer({ toolName, input, options });
+    }
+    return mapPermissionOutcome(raced, input, options.suggestions);
+  };
+}
+function composeSignals(a, b) {
+  if (a.aborted)
+    return a;
+  if (b.aborted)
+    return b;
+  const controller = new AbortController;
+  const onAbort = () => controller.abort();
+  a.addEventListener("abort", onAbort, { once: true });
+  b.addEventListener("abort", onAbort, { once: true });
+  return controller.signal;
+}
+function mapPermissionOutcome(response, input, suggestions) {
+  const outcome = response.outcome;
+  if (outcome.outcome === "cancelled") {
+    throw new Error("Tool use aborted");
+  }
+  if (outcome.optionId === "allow") {
+    return { behavior: "allow", updatedInput: input };
+  }
+  if (outcome.optionId === "allow_always") {
+    return {
+      behavior: "allow",
+      updatedInput: input,
+      updatedPermissions: suggestions !== undefined && suggestions.length > 0 ? suggestions : [
+        {
+          type: "addRules",
+          rules: [{ toolName: "unknown" }],
+          behavior: "allow",
+          destination: "session"
+        }
+      ]
+    };
+  }
+  return { behavior: "deny", message: "User refused permission to run tool" };
+}
+var DEFAULT_OPTIONS;
+var init_permission_bridge = __esm(() => {
+  init_errors();
+  init_permission_rpc();
+  DEFAULT_OPTIONS = [
+    { kind: "allow_always", name: "Always allow this tool", optionId: "allow_always" },
+    { kind: "allow_once", name: "Allow", optionId: "allow" },
+    { kind: "reject_once", name: "Reject", optionId: "reject" }
+  ];
+});
+
 // src/wire/policy.ts
 function parseCanonicalPattern(input) {
   if (input.length === 0) {
@@ -51522,7 +51598,7 @@ async function safeReply2(sdk, requestId, body) {
 }
 var CANONICAL_OPTIONS;
 var init_permission_bridge2 = __esm(() => {
-  init_permission_bridge();
+  init_permission_rpc();
   CANONICAL_OPTIONS = [
     { optionId: "allow", label: "Allow" },
     { optionId: "allow_always", label: "Always allow" },
@@ -52194,11 +52270,17 @@ function apiStopReason(reason) {
 function turnFailed(hook) {
   const error = text(hook.error) ?? "unknown";
   const details = text(hook.error_details);
+  return turnFailedWith(failureReason(error), details === undefined ? `StopFailure ${error}` : `StopFailure ${error}: ${details}`.slice(0, TITLE_MAX * 2));
+}
+function turnFailedWith(reason, detail) {
   return draft("turn_failed", {
-    reason: FAILURE_REASONS[error] ?? "api_error",
-    detail: details === undefined ? `StopFailure ${error}` : `StopFailure ${error}: ${details}`.slice(0, TITLE_MAX * 2)
+    reason,
+    detail
   });
 }
+function failureReason(error) {
+  return FAILURE_REASONS[error] ?? "api_error";
+}
 function sessionEnded(reason) {
   return draft("session_ended", { reason });
 }
@@ -52365,11 +52447,30 @@ async function buildPaneSettings(options) {
       }
     ]
   ]));
-  return {
+  const settings = {
     ...base,
     disableAllHooks: false,
+    autoContinueAtUsageLimit: false,
     hooks
   };
+  if (options.rules !== undefined) {
+    settings.permissions = mergePermissions(base.permissions, options.rules);
+  }
+  return settings;
+}
+function mergePermissions(base, rules) {
+  const permissions = isRecord2(base) ? base : {};
+  const merge = (list) => {
+    const own = permissions[list];
+    const entries = Array.isArray(own) ? own.filter((entry) => typeof entry === "string") : [];
+    return [...new Set([...entries, ...rules[list]])];
+  };
+  return {
+    ...permissions,
+    allow: merge("allow"),
+    deny: merge("deny"),
+    ask: merge("ask")
+  };
 }
 async function writePaneSettings(path, options) {
   const settings = await buildPaneSettings(options);
@@ -52558,8 +52659,9 @@ var init_input = __esm(() => {
 });
 
 // src/live/pane.ts
-import { mkdir as mkdir3, readFile as readFile3, realpath as realpath3, rename as rename4, writeFile as writeFile2 } from "fs/promises";
-import { join as join6 } from "path";
+import { randomUUID as randomUUID5 } from "crypto";
+import { mkdir as mkdir3, readFile as readFile3, realpath as realpath3, rename as rename4, stat as stat2, writeFile as writeFile2 } from "fs/promises";
+import { dirname as dirname4, join as join6, resolve as resolve5 } from "path";
 function supportsPasteBufferS(versionOutput) {
   const match = /^tmux (?:next-)?(\d+)\.(\d+)[a-z]?$/.exec(versionOutput.trim());
   if (match === null) {
@@ -52585,7 +52687,7 @@ async function createPane(options) {
   }
   const env = paneEnv(options);
   const cwd = await realpath3(options.cwd);
-  await seedTrust(env.CLAUDE_CONFIG_DIR === undefined ? [env.HOME] : [env.HOME, env.CLAUDE_CONFIG_DIR], cwd);
+  await seedTrust(env.CLAUDE_CONFIG_DIR === undefined ? [env.HOME] : [env.HOME, env.CLAUDE_CONFIG_DIR], await trustRoots(cwd), approvedKeySuffix(options.env?.ANTHROPIC_API_KEY));
   const { PATH: path, TERM: term, ...sessionEnv } = env;
   const created = await run(pane.socket, [
     "start-server",
@@ -52674,11 +52776,21 @@ function paneEnv(options) {
     ...env,
     HOME: options.home,
     CI: "1",
-    TERM: "xterm-256color"
+    TERM: "xterm-256color",
+    CLAUDE_CODE_DISABLE_BACKGROUND_TASKS: "1"
   };
 }
 function launchArgv(options) {
   const argv = [options.claudeBin ?? "claude", "--settings", options.settingsPath, "--setting-sources", ""];
+  if (options.permissionMode !== undefined) {
+    argv.push("--permission-mode", options.permissionMode);
+  }
+  if (options.mcpConfig !== undefined) {
+    argv.push("--mcp-config", options.mcpConfig, "--strict-mcp-config");
+  }
+  if (options.systemPromptFile !== undefined) {
+    argv.push("--append-system-prompt-file", options.systemPromptFile);
+  }
   if (options.model !== undefined) {
     argv.push("--model", options.model);
   }
@@ -52687,26 +52799,129 @@ function launchArgv(options) {
   }
   return argv;
 }
-async function seedTrust(dirs, cwd) {
+async function trustRoots(cwd) {
+  const roots = new Set([cwd]);
+  const repository = await findGitEntry(cwd);
+  if (repository === null) {
+    return [...roots];
+  }
+  roots.add(repository.root);
+  if (repository.isFile) {
+    const main = await worktreeMainRoot(repository.root);
+    if (main !== null) {
+      roots.add(main);
+    }
+  }
+  return [...roots];
+}
+async function findGitEntry(start) {
+  let dir = start;
+  while (true) {
+    const entry = await statIfPresent(join6(dir, ".git"));
+    if (entry !== null) {
+      return {
+        root: dir,
+        isFile: entry.isFile()
+      };
+    }
+    const parent = dirname4(dir);
+    if (parent === dir) {
+      return null;
+    }
+    dir = parent;
+  }
+}
+async function worktreeMainRoot(root) {
+  const gitfile = await readTextIfPresent(join6(root, ".git"));
+  const target = gitfile === null ? undefined : /^gitdir:\s*(.+?)\s*$/m.exec(gitfile)?.[1];
+  if (target === undefined) {
+    return null;
+  }
+  const gitdir = resolve5(root, target);
+  const commondir = await readTextIfPresent(join6(gitdir, "commondir"));
+  if (commondir === null) {
+    return null;
+  }
+  return realpathIfPresent(dirname4(resolve5(gitdir, commondir.trim())));
+}
+async function statIfPresent(path) {
+  try {
+    return await stat2(path);
+  } catch (error) {
+    if (isAbsent(error)) {
+      return null;
+    }
+    throw error;
+  }
+}
+async function readTextIfPresent(path) {
+  try {
+    return await readFile3(path, "utf8");
+  } catch (error) {
+    if (isAbsent(error)) {
+      return null;
+    }
+    throw error;
+  }
+}
+async function realpathIfPresent(path) {
+  try {
+    return await realpath3(path);
+  } catch (error) {
+    if (isAbsent(error)) {
+      return null;
+    }
+    throw error;
+  }
+}
+function isAbsent(error) {
+  return error instanceof Error && "code" in error && (error.code === "ENOENT" || error.code === "ENOTDIR");
+}
+function approvedKeySuffix(apiKey) {
+  return apiKey === undefined || apiKey === "" ? undefined : apiKey.slice(-20);
+}
+function approveKey(current, suffix) {
+  const responses = isRecord3(current) ? current : {};
+  const approved = stringList(responses.approved);
+  return {
+    ...responses,
+    approved: approved.includes(suffix) ? approved : [...approved, suffix],
+    rejected: stringList(responses.rejected)
+  };
+}
+function stringList(value) {
+  return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
+}
+function seedTrust(dirs, roots, keySuffix) {
+  const seeded = seeding.then(() => writeTrust(dirs, roots, keySuffix));
+  seeding = seeded.catch(() => {
+    return;
+  });
+  return seeded;
+}
+async function writeTrust(dirs, roots, keySuffix) {
   for (const dir of dirs) {
     const path = join6(dir, ".claude.json");
     const config = await readConfig(path);
     const projects = isRecord3(config.projects) ? config.projects : {};
-    const project = isRecord3(projects[cwd]) ? projects[cwd] : {};
-    projects[cwd] = {
-      allowedTools: [],
-      ...project,
-      hasTrustDialogAccepted: true,
-      hasCompletedProjectOnboarding: true
-    };
+    for (const root of roots) {
+      const project = isRecord3(projects[root]) ? projects[root] : {};
+      projects[root] = {
+        allowedTools: [],
+        ...project,
+        hasTrustDialogAccepted: true,
+        hasCompletedProjectOnboarding: true
+      };
+    }
     const seeded = {
       theme: "dark",
       ...config,
       hasCompletedOnboarding: true,
-      projects
+      projects,
+      ...keySuffix === undefined ? {} : { customApiKeyResponses: approveKey(config.customApiKeyResponses, keySuffix) }
     };
     await mkdir3(dir, { recursive: true });
-    const staging = `${path}.${process.pid}.tmp`;
+    const staging = `${path}.${randomUUID5()}.tmp`;
     await writeFile2(staging, JSON.stringify(seeded, null, 2), { mode: 384 });
     await rename4(staging, path);
   }
@@ -52791,7 +53006,7 @@ async function failOnPane(pane, stderr) {
   }
   throw new PaneError("tmux_failed", stderr);
 }
-var LIVE_SOCKET = "kodizm-live", PASTE_ENTER_DELAY_MS = 328, SUBMIT_WINDOWS_MS, SESSION_START_TIMEOUT_MS = 1e4, CANCEL_CLEAR_DELAY_MS = 414, PANE_ID, RESUME_ID, DROPPED_ENV, PASTE_S_SINCE, PaneError, bufferSequence = 0, pasteSFlags;
+var LIVE_SOCKET = "kodizm-live", PASTE_ENTER_DELAY_MS = 328, SUBMIT_WINDOWS_MS, SESSION_START_TIMEOUT_MS = 1e4, CANCEL_CLEAR_DELAY_MS = 414, PANE_ID, RESUME_ID, DROPPED_ENV, PASTE_S_SINCE, PaneError, bufferSequence = 0, seeding, pasteSFlags;
 var init_pane = __esm(() => {
   init_input();
   SUBMIT_WINDOWS_MS = [328, 656, 1312, 2624];
@@ -52807,11 +53022,197 @@ var init_pane = __esm(() => {
       this.reason = reason;
     }
   };
+  seeding = Promise.resolve();
   pasteSFlags = new Map;
 });
 
+// src/live/policy.ts
+function parseToolPolicy(text) {
+  const policy = parseJson2(text);
+  if (!isRecord4(policy) || !Object.keys(policy).every((key) => POLICY_KEYS.includes(key))) {
+    return null;
+  }
+  const rules = {
+    allow: [],
+    deny: [],
+    ask: []
+  };
+  for (const list of RULE_LISTS) {
+    const entries = policy[list] === undefined ? [] : policy[list];
+    if (!Array.isArray(entries) || !entries.every((entry) => typeof entry === "string")) {
+      return null;
+    }
+    for (const entry of entries) {
+      const rule = translatePattern(entry, list);
+      if (rule === null) {
+        return null;
+      }
+      if (!rules[list].includes(rule)) {
+        rules[list].push(rule);
+      }
+    }
+  }
+  return rules;
+}
+function translatePattern(pattern, list) {
+  let parsed;
+  try {
+    parsed = parseCanonicalPattern(pattern);
+  } catch (error) {
+    if (error instanceof InvalidPatternError) {
+      return null;
+    }
+    throw error;
+  }
+  if (parsed.mcpPath !== undefined) {
+    return mcpRule(parsed.mcpPath);
+  }
+  const { toolName, argPattern } = parsed;
+  if (!TOOL_NAME.test(toolName)) {
+    return null;
+  }
+  if (argPattern === undefined || argPattern === "*") {
+    return toolName;
+  }
+  const fileTool = FILE_TOOLS.get(toolName);
+  if (fileTool !== undefined && fileTool !== toolName && list === "allow") {
+    return null;
+  }
+  const tool = fileTool ?? toolName;
+  const content = ruleContent(tool, argPattern, list);
+  return isEnforceableContent(tool, content) ? `${tool}(${escapeRuleContent(content)})` : null;
+}
+function mcpRule(path) {
+  const wildcardMisplaced = path.some((segment, index) => segment.includes("*") && !(index === 1 && segment === "*"));
+  if (path.length > 2 || wildcardMisplaced || path.some((segment) => /[()]/.test(segment))) {
+    return null;
+  }
+  return `mcp__${path.join("__")}`;
+}
+function ruleContent(tool, argPattern, list) {
+  if (tool === "Read" || tool === "Edit") {
+    return anchorPath(argPattern);
+  }
+  return tool === "Bash" ? bashArg(argPattern, list) : argPattern;
+}
+function anchorPath(path) {
+  return path.startsWith("/") && !path.startsWith("//") ? `/${path}` : path;
+}
+function bashArg(argPattern, list) {
+  const prefix = argPattern.slice(0, -1);
+  if (list !== "allow" || !argPattern.endsWith("*") || prefix.includes("*") || /[:\s]$/.test(prefix)) {
+    return argPattern;
+  }
+  return `${prefix}:*`;
+}
+function escapeRuleContent(content) {
+  return content.replace(/\\/g, "\\\\").replace(/\(/g, "\\(").replace(/\)/g, "\\)");
+}
+function isEnforceableContent(tool, content) {
+  if (tool === "Bash") {
+    return (!content.includes(":*") || content.endsWith(":*")) && content !== ":*";
+  }
+  if (tool === "Read" || tool === "Edit") {
+    return !content.includes(":*") && (!content.includes("*") || /^\*|\*$|\*\*|\/\*|\*\.|\*\)/.test(content));
+  }
+  return true;
+}
+function parseJson2(text) {
+  try {
+    return JSON.parse(text);
+  } catch (error) {
+    if (error instanceof SyntaxError) {
+      return;
+    }
+    throw error;
+  }
+}
+function isRecord4(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+var RULE_LISTS, POLICY_KEYS, FILE_TOOLS, TOOL_NAME;
+var init_policy4 = __esm(() => {
+  init_policy();
+  RULE_LISTS = ["allow", "deny", "ask"];
+  POLICY_KEYS = [...RULE_LISTS, "defaultMode"];
+  FILE_TOOLS = new Map([
+    ["Read", "Read"],
+    ["Edit", "Edit"],
+    ["Write", "Edit"],
+    ["MultiEdit", "Edit"],
+    ["NotebookEdit", "Edit"],
+    ["Glob", "Read"],
+    ["Grep", "Read"]
+  ]);
+  TOOL_NAME = /^[A-Z][A-Za-z0-9_]*$/;
+});
+
+// src/live/start-flags.ts
+function parseStartExtras(args) {
+  for (const key of Object.keys(args)) {
+    if (!START_FLAGS.has(key)) {
+      return null;
+    }
+  }
+  const permissionMode = parsePermissionMode(args["permission-mode"]);
+  const oneShot = parseOneShot(args["one-shot"]);
+  const deadlineSeconds = parseSeconds(args["deadline-seconds"], 1);
+  const retainFailedSeconds = parseSeconds(args["retain-failed-seconds"], 0);
+  if (permissionMode === null || oneShot === null || deadlineSeconds === null || retainFailedSeconds === null) {
+    return null;
+  }
+  return {
+    permissionMode,
+    oneShot,
+    deadlineSeconds,
+    retainFailedSeconds: retainFailedSeconds ?? 0
+  };
+}
+function parsePermissionMode(value) {
+  if (value === undefined) {
+    return;
+  }
+  return value === "default" || value === "dontAsk" ? value : null;
+}
+function parseOneShot(value) {
+  if (value === undefined || value === "0") {
+    return false;
+  }
+  return value === "1" ? true : null;
+}
+function parseSeconds(value, min) {
+  if (value === undefined) {
+    return;
+  }
+  if (!DIGITS.test(value)) {
+    return null;
+  }
+  const seconds = Number(value);
+  return seconds >= min && seconds <= MAX_SECONDS ? seconds : null;
+}
+var START_FLAGS, START_FILE_FLAGS, MAX_SECONDS = 2147483, DIGITS;
+var init_start_flags = __esm(() => {
+  START_FLAGS = new Set([
+    "pane",
+    "cwd",
+    "settings-base",
+    "env-file",
+    "model",
+    "resume",
+    "mcp-config",
+    "tool-policy",
+    "system-prompt-file",
+    "permission-mode",
+    "one-shot",
+    "deadline-seconds",
+    "retain-failed-seconds"
+  ]);
+  START_FILE_FLAGS = ["env-file", "tool-policy", "system-prompt-file", "mcp-config"];
+  DIGITS = /^[0-9]+$/;
+});
+
 // src/live/transcript.ts
-import { stat as stat2 } from "fs/promises";
+import { stat as stat3 } from "fs/promises";
 
 class TranscriptTail {
   path;
@@ -52875,7 +53276,7 @@ function classifyInterrupt(record) {
     return null;
   }
   const [block] = content;
-  if (!isRecord4(block) || block.type !== "text") {
+  if (!isRecord5(block) || block.type !== "text") {
     return null;
   }
   if (block.text === INTERRUPT_MARKER) {
@@ -52886,6 +53287,29 @@ function classifyInterrupt(record) {
   }
   return null;
 }
+function classifyApiError(record) {
+  if (record.type !== "assistant" || !isMainChain(record) || record.isApiErrorMessage !== true) {
+    return null;
+  }
+  const error = typeof record.error === "string" ? record.error : "unknown";
+  const status = typeof record.apiErrorStatus === "number" ? record.apiErrorStatus : null;
+  const message = assistantBlocks(record).filter((block) => block.kind === "text").map((block) => block.text).join(`
+`);
+  return {
+    reason: apiErrorReason(error, status, message),
+    detail: `API error ${status ?? error}: ${message.slice(0, API_ERROR_DETAIL_MAX)}`
+  };
+}
+function apiErrorReason(error, status, message) {
+  if (error === "rate_limit" && USAGE_LIMIT_TEXT.test(message) && LIMIT_RESETS.test(message) && !NOT_A_USAGE_LIMIT.test(message)) {
+    return "usage_limit";
+  }
+  const reason = failureReason(error);
+  if (reason !== "api_error" || status === null) {
+    return reason;
+  }
+  return STATUS_REASONS[status] ?? reason;
+}
 
 class UsageLedger {
   counted = new Map;
@@ -52894,7 +53318,7 @@ class UsageLedger {
     if (record.type !== "assistant" || !isMainChain(record) || message === null) {
       return null;
     }
-    if (typeof message.id !== "string" || !isRecord4(message.usage)) {
+    if (typeof message.id !== "string" || !isRecord5(message.usage)) {
       return null;
     }
     const seen = this.counted.get(message.id) ?? emptyCounts();
@@ -52921,7 +53345,7 @@ function assistantBlocks(record) {
   }
   const blocks = [];
   for (const block of content) {
-    if (!isRecord4(block)) {
+    if (!isRecord5(block)) {
       continue;
     }
     if (block.type === "text" && typeof block.text === "string" && block.text !== "") {
@@ -52941,12 +53365,12 @@ function isMainChain(record) {
   return record.isSidechain !== true;
 }
 function messageOf(record) {
-  return isRecord4(record.message) ? record.message : null;
+  return isRecord5(record.message) ? record.message : null;
 }
 function parseLine(line) {
   try {
     const value = JSON.parse(line);
-    return isRecord4(value) ? value : null;
+    return isRecord5(value) ? value : null;
   } catch (error) {
     if (error instanceof SyntaxError) {
       return null;
@@ -52956,7 +53380,7 @@ function parseLine(line) {
 }
 async function fileSize(path) {
   try {
-    return (await stat2(path)).size;
+    return (await stat3(path)).size;
   } catch (error) {
     if (error.code === "ENOENT") {
       return null;
@@ -52984,17 +53408,27 @@ function emptyCounts() {
     cacheCreationTokens: 0
   };
 }
-function isRecord4(value) {
+function isRecord5(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-var INTERRUPT_MARKER = "[Request interrupted by user]", INTERRUPT_TOOL_MARKER = "[Request interrupted by user for tool use]", NEWLINE = 10;
-var init_transcript = () => {};
+var INTERRUPT_MARKER = "[Request interrupted by user]", INTERRUPT_TOOL_MARKER = "[Request interrupted by user for tool use]", NEWLINE = 10, USAGE_LIMIT_TEXT, LIMIT_RESETS, NOT_A_USAGE_LIMIT, STATUS_REASONS, API_ERROR_DETAIL_MAX = 200;
+var init_transcript = __esm(() => {
+  init_events2();
+  USAGE_LIMIT_TEXT = /\b(usage|session|weekly) limit\b|\bhit your\b[^.\n]*\blimit\b/i;
+  LIMIT_RESETS = /\bresets?\b/i;
+  NOT_A_USAGE_LIMIT = /\bnot your (usage )?limit\b/i;
+  STATUS_REASONS = {
+    429: "rate_limit",
+    401: "auth_error"
+  };
+});
 
 // src/live/daemon.ts
-import { randomUUID as randomUUID5 } from "crypto";
-import { chmod, mkdir as mkdir4, readFile as readFile4, stat as stat3, unlink as unlink2 } from "fs/promises";
+import { randomUUID as randomUUID6 } from "crypto";
+import { renameSync as renameSync2, rmSync as rmSync2, writeFileSync } from "fs";
+import { chmod, lstat as lstat2, mkdir as mkdir4, readFile as readFile4, realpath as realpath4, unlink as unlink2 } from "fs/promises";
 import { createServer } from "net";
-import { dirname as dirname4, isAbsolute as isAbsolute4, join as join7 } from "path";
+import { dirname as dirname5, isAbsolute as isAbsolute4, join as join7 } from "path";
 function exitCodeFor(code) {
   return EXIT_CODES[code];
 }
@@ -53157,6 +53591,9 @@ class LivePane {
   gen;
   ingestUrl;
   daemon;
+  extras;
+  mcpConfig;
+  paneDir;
   started = new Latch;
   submitted = new Latch;
   turnClosed = new Latch;
@@ -53179,17 +53616,29 @@ class LivePane {
   skippedLines = 0;
   lastAssistantText;
   lastStopReason = null;
+  apiError;
   settled = false;
   lastActivityAt = Date.now();
   sessionEndReason;
   timers = [];
+  heartbeatTimer;
+  deadlineTimer;
+  retentionTimer;
+  interruptTimer;
+  interrupt;
+  isRetaining = false;
+  ending = false;
+  teardown;
   monitoring = false;
   closed = false;
-  constructor(pane, gen, ingestUrl, token, authValues, daemon) {
+  constructor(pane, gen, ingestUrl, token, authValues, daemon, extras, mcpConfig, paneDir) {
     this.pane = pane;
     this.gen = gen;
     this.ingestUrl = ingestUrl;
     this.daemon = daemon;
+    this.extras = extras;
+    this.mcpConfig = mcpConfig;
+    this.paneDir = paneDir;
     this.token = token;
     this.secrets = [token, ...authValues.filter((value) => value.length >= MIN_SECRET_LENGTH)];
     this.queue = new EventQueue({
@@ -53198,7 +53647,11 @@ class LivePane {
       bearer: () => this.token,
       secrets: () => this.secrets,
       timings: () => daemon.timings,
-      onStaleGen: () => void this.abandon(),
+      onStaleGen: () => {
+        if (!this.isRetaining) {
+          this.abandon();
+        }
+      },
       logger: daemon.logger
     });
   }
@@ -53208,13 +53661,16 @@ class LivePane {
   get busy() {
     return this.turn !== undefined || this.compacting;
   }
+  get refusesInput() {
+    return this.ending || this.interrupt !== undefined;
+  }
   begin() {
     const timings = this.daemon.timings;
     this.timers = [
       setInterval(() => void this.guard("transcript", () => this.readTranscript()), timings.transcriptPollMs),
-      setInterval(() => void this.guard("monitor", () => this.monitor()), timings.monitorMs),
-      setInterval(() => void this.guard("heartbeat", () => this.beat()), timings.heartbeatMs)
+      setInterval(() => void this.guard("monitor", () => this.monitor()), timings.monitorMs)
     ];
+    this.heartbeatTimer = setInterval(() => void this.guard("heartbeat", () => this.beat()), timings.heartbeatMs);
   }
   rotate(token) {
     this.token = token;
@@ -53280,24 +53736,28 @@ class LivePane {
     }
     this.closeOpenTools();
     this.clearDialog();
+    const message = text(draft.payload.lastAssistantMessage);
+    if (draft.type === "turn_completed" && message !== undefined) {
+      this.persistLastAssistantMessage(message);
+    }
     this.queue.push(draft);
     this.turn = undefined;
+    clearTimeout(this.deadlineTimer);
+    this.deadlineTimer = undefined;
+    this.lastActivityAt = Date.now();
     this.lastCloseCause = cause;
     this.turnClosed.fire();
+    this.afterTurn(draft.type);
   }
   clearDialog() {
     this.dialog?.abort.abort();
     this.dialog = undefined;
   }
   interruptedTurn() {
-    return turnCompleted("interrupted", this.lastAssistantText);
+    return turnCompleted("interrupted", this.lastAssistantText ?? "");
   }
-  async stop() {
-    this.close();
-    await killPane(this.pane);
-    this.queue.push(sessionEnded("stopped"));
-    await this.queue.drain(STOP_DRAIN_MS);
-    this.queue.stop();
+  stop(reason = "stopped") {
+    return this.tearDown(() => this.finish(reason, () => killPane(this.pane)));
   }
   async dispose() {
     this.close();
@@ -53309,7 +53769,130 @@ class LivePane {
     for (const timer of this.timers.splice(0)) {
       clearInterval(timer);
     }
+    clearInterval(this.heartbeatTimer);
+    clearTimeout(this.deadlineTimer);
+    clearTimeout(this.retentionTimer);
+    clearTimeout(this.interruptTimer);
     this.clearDialog();
+    this.removeMcpConfig();
+  }
+  tearDown(run) {
+    this.teardown ??= run();
+    return this.teardown;
+  }
+  async finish(reason, kill) {
+    try {
+      this.close();
+      await kill();
+      this.queue.push(sessionEnded(reason));
+      await this.queue.drain(STOP_DRAIN_MS);
+      this.queue.stop();
+    } finally {
+      this.daemon.remove(this);
+    }
+  }
+  afterTurn(type) {
+    if (this.closed || this.ending) {
+      return;
+    }
+    const { oneShot, retainFailedSeconds } = this.extras;
+    if (type === "turn_completed" && oneShot) {
+      this.ending = true;
+      this.guard("end", () => this.endAfterDelivery(0));
+      return;
+    }
+    if (type !== "turn_failed" || !oneShot && retainFailedSeconds === 0) {
+      return;
+    }
+    this.ending = true;
+    if (retainFailedSeconds > 0) {
+      this.isRetaining = true;
+      clearInterval(this.heartbeatTimer);
+    }
+    this.guard("end", () => this.endAfterDelivery(retainFailedSeconds * this.daemon.timings.secondMs));
+  }
+  async endAfterDelivery(delayMs) {
+    await this.queue.drain(this.daemon.timings.deliveryDrainMs);
+    if (this.closed) {
+      return;
+    }
+    if (delayMs > 0) {
+      await new Promise((resolve) => {
+        this.retentionTimer = setTimeout(resolve, delayMs);
+      });
+      if (this.closed) {
+        return;
+      }
+    }
+    await this.end("stopped");
+  }
+  end(reason) {
+    return this.tearDown(() => this.finish(reason, () => this.killLogged()));
+  }
+  async onDeadline(promptId, seconds) {
+    if (this.closed || this.turn?.promptId !== promptId) {
+      return;
+    }
+    this.closeTurn(turnFailedWith("deadline", `The turn ran longer than ${seconds} seconds.`), "deadline");
+    const interrupt = {
+      sent: false,
+      marked: false
+    };
+    this.interrupt = interrupt;
+    this.interruptTimer = setTimeout(() => this.endInterrupt(), this.daemon.timings.cancelTimeoutMs);
+    try {
+      await cancelPane(this.pane);
+      interrupt.sent = true;
+      this.settleInterrupt();
+    } catch (error) {
+      if (!(error instanceof PaneError)) {
+        throw error;
+      }
+      this.daemon.logger.warn("tmuxd could not interrupt a turn past its deadline", {
+        pane: this.id,
+        reason: error.reason
+      });
+    }
+  }
+  settleInterrupt() {
+    if (this.interrupt?.sent === true && this.interrupt.marked) {
+      this.endInterrupt();
+    }
+  }
+  endInterrupt() {
+    clearTimeout(this.interruptTimer);
+    this.interruptTimer = undefined;
+    this.interrupt = undefined;
+  }
+  removeMcpConfig() {
+    if (this.mcpConfig === undefined) {
+      return;
+    }
+    try {
+      rmSync2(this.mcpConfig, { force: true });
+    } catch (error) {
+      if (!isErrno(error)) {
+        throw error;
+      }
+      this.daemon.logger.error("tmuxd could not remove the mcp-config", { pane: this.id, code: error.code });
+    }
+  }
+  persistLastAssistantMessage(message) {
+    const path = join7(this.paneDir, LAST_MESSAGE_FILE);
+    const temp = `${path}.${randomUUID6()}.tmp`;
+    try {
+      writeFileSync(temp, redactDeep(message, this.secrets), { mode: 384, flag: "wx" });
+      renameSync2(temp, path);
+    } catch (error) {
+      if (!isErrno(error)) {
+        throw error;
+      }
+      rmSync2(temp, { force: true });
+      this.daemon.logger.error("tmuxd could not persist the last assistant message", {
+        pane: this.id,
+        code: error.code
+      });
+    }
   }
   async onSessionStart(payload) {
     const source = text(payload.source);
@@ -53333,20 +53916,26 @@ class LivePane {
       return;
     }
     this.turn = {
-      promptId: this.pendingPromptId ?? text(payload.prompt_id) ?? randomUUID5()
+      promptId: this.pendingPromptId ?? text(payload.prompt_id) ?? randomUUID6()
     };
     this.pendingPromptId = undefined;
     this.settled = false;
     this.lastAssistantText = undefined;
     this.lastStopReason = null;
+    this.apiError = undefined;
     this.queue.push(turnStarted(this.turn.promptId));
     this.submitted.fire();
+    const seconds = this.extras.deadlineSeconds;
+    if (seconds !== undefined) {
+      const promptId = this.turn.promptId;
+      this.deadlineTimer = setTimeout(() => void this.guard("deadline", () => this.onDeadline(promptId, seconds)), seconds * this.daemon.timings.secondMs);
+    }
   }
   onPreToolUse(payload) {
     if (this.turn === undefined) {
       return;
     }
-    const toolCallId = text(payload.tool_use_id) ?? randomUUID5();
+    const toolCallId = text(payload.tool_use_id) ?? randomUUID6();
     this.openTools.set(toolCallId, {
       name: text(payload.tool_name),
       input: payload.tool_input
@@ -53355,9 +53944,22 @@ class LivePane {
     this.queue.push(toolCallBegin(payload, toolCallId));
   }
   async onPermissionRequest(payload, signal) {
+    if (this.extras.permissionMode === "dontAsk") {
+      this.daemon.logger.debug("tmuxd denied a permission request in dontAsk mode", {
+        pane: this.id,
+        tool: text(payload.tool_name)
+      });
+      return {
+        ok: true,
+        decision: {
+          behavior: "deny",
+          message: UNATTENDED_DENIAL
+        }
+      };
+    }
     const correlated = this.findOpenTool(payload);
     const dialog = {
-      toolCallId: correlated ?? randomUUID5(),
+      toolCallId: correlated ?? randomUUID6(),
       correlated: correlated !== undefined,
       toolName: text(payload.tool_name),
       input: payload.tool_input,
@@ -53481,7 +54083,10 @@ class LivePane {
       return;
     }
     await this.syncTranscript();
-    this.closeTurn(turnCompleted(apiStopReason(this.lastStopReason), text(payload.last_assistant_message) ?? this.lastAssistantText), "stop");
+    this.closeTurn(this.endOfTurn(turnCompleted(apiStopReason(this.lastStopReason), text(payload.last_assistant_message) ?? this.lastAssistantText ?? "")), "stop");
+  }
+  endOfTurn(completed) {
+    return this.apiError === undefined ? completed : turnFailedWith(this.apiError.reason, this.apiError.detail);
   }
   async onStopFailure(payload) {
     if (this.turn === undefined) {
@@ -53535,13 +54140,19 @@ class LivePane {
       }
       this.lastActivityAt = Date.now();
       if (classifyInterrupt(record) !== null) {
-        this.closeTurn(this.interruptedTurn(), "marker");
+        if (this.interrupt === undefined) {
+          this.closeTurn(this.interruptedTurn(), "marker");
+        } else {
+          this.interrupt.marked = true;
+          this.settleInterrupt();
+        }
         this.clearDialog();
         continue;
       }
+      const failure = classifyApiError(record);
       for (const block of assistantBlocks(record)) {
         this.queue.push(block.kind === "text" ? outputChunk(block.text) : thinkingChunk(block.text));
-        if (block.kind === "text") {
+        if (block.kind === "text" && failure === null) {
           this.lastAssistantText = block.text;
         }
       }
@@ -53555,6 +54166,14 @@ class LivePane {
       } else if (record.type === "user") {
         this.settled = false;
       }
+      if (failure !== null) {
+        this.apiError = failure;
+        if (failure.reason === "usage_limit") {
+          this.closeTurn(turnFailedWith(failure.reason, failure.detail), "api_error");
+        }
+      } else if (record.type === "assistant" || record.type === "user" && record.isMeta !== true) {
+        this.apiError = undefined;
+      }
     }
   }
   async monitor() {
@@ -53563,21 +54182,33 @@ class LivePane {
     }
     this.monitoring = true;
     try {
-      if (!await this.alive()) {
+      const alive = await this.alive();
+      if (this.closed) {
+        return;
+      }
+      if (!alive) {
         await this.onDeath();
         return;
       }
       const quiet = Date.now() - this.lastActivityAt >= this.daemon.timings.watchdogQuietMs;
       const idle = this.dialog === undefined && this.openTools.size === 0 && !this.compacting && this.settled;
       if (this.turn !== undefined && quiet && idle) {
-        this.closeTurn(turnCompleted("watchdog", this.lastAssistantText), "watchdog");
+        this.closeTurn(this.endOfTurn(turnCompleted("watchdog", this.lastAssistantText ?? "")), "watchdog");
+      }
+      const idleTimeoutMs = this.daemon.timings.idleTimeoutMs;
+      const unoccupied = this.turn === undefined && this.pendingPromptId === undefined && this.dialog === undefined && !this.compacting && !this.isRetaining;
+      if (idleTimeoutMs > 0 && unoccupied && Date.now() - this.lastActivityAt >= idleTimeoutMs) {
+        await this.end("idle_timeout");
       }
     } finally {
       this.monitoring = false;
     }
   }
   async beat() {
-    if (!this.closed && await this.alive()) {
+    if (this.closed || this.isRetaining || !await this.alive()) {
+      return;
+    }
+    if (!this.closed && !this.isRetaining) {
       this.queue.push(heartbeat());
     }
   }
@@ -53588,28 +54219,32 @@ class LivePane {
     if (this.closed) {
       return;
     }
-    const turnRunning = this.turn !== undefined;
-    this.close();
-    if (this.sessionEndReason !== undefined) {
-      this.queue.push(sessionEnded("stopped"));
-    } else {
-      this.queue.push(sessionEnded("crashed"));
-      this.queue.push(processDied());
-      if (turnRunning) {
-        this.queue.push(sessionFailed("process_died", "claude exited while a turn was running."));
+    await this.tearDown(async () => {
+      const turnRunning = this.turn !== undefined;
+      this.close();
+      if (this.sessionEndReason !== undefined) {
+        this.queue.push(sessionEnded("stopped"));
+      } else {
+        this.queue.push(sessionEnded("crashed"));
+        this.queue.push(processDied());
+        if (turnRunning) {
+          this.queue.push(sessionFailed("process_died", "claude exited while a turn was running."));
+        }
       }
-    }
-    await this.queue.drain(STOP_DRAIN_MS);
-    this.queue.stop();
-    this.daemon.remove(this);
+      await this.queue.drain(STOP_DRAIN_MS);
+      this.queue.stop();
+      this.daemon.remove(this);
+    });
   }
   async abandon() {
     if (this.closed) {
       return;
     }
-    this.close();
-    await this.killLogged();
-    this.daemon.remove(this);
+    await this.tearDown(async () => {
+      this.close();
+      await this.killLogged();
+      this.daemon.remove(this);
+    });
   }
   async killLogged() {
     try {
@@ -53639,6 +54274,7 @@ class LiveDaemon {
   logger;
   timings;
   panes = new Map;
+  starting = new Set;
   server;
   constructor(options) {
     this.options = options;
@@ -53656,7 +54292,7 @@ class LiveDaemon {
   }
   async listen() {
     const { socketPath } = this.options;
-    await mkdir4(dirname4(socketPath), { recursive: true, mode: 448 });
+    await mkdir4(dirname5(socketPath), { recursive: true, mode: 448 });
     if (await Bun.file(socketPath).exists()) {
       if (await this.answering(socketPath)) {
         throw new Error(`a tmuxd daemon already listens on ${socketPath}`);
@@ -53724,52 +54360,90 @@ class LiveDaemon {
     }
   }
   async start(args) {
-    const envFile = args["env-file"];
-    if (envFile === undefined || !isAbsolute4(envFile)) {
-      return refuse("usage_error");
-    }
+    let result;
     try {
-      return await this.launch(args, envFile);
+      result = await this.launch(args);
+      return result;
     } finally {
-      await removeFile(envFile);
+      await removeHandoff(args, result?.ok === true, this.logger);
     }
   }
-  async launch(args, envFile) {
+  async launch(args) {
     const { pane: id, cwd, model, resume } = args;
+    const envFile = args["env-file"];
     const settingsBase = args["settings-base"];
+    const policyFile = args["tool-policy"];
+    const systemPromptFile = args["system-prompt-file"];
+    const mcpConfig = args["mcp-config"];
     if (id === undefined || !PANE_ID2.test(id) || cwd === undefined || !isAbsolute4(cwd)) {
       return refuse("usage_error");
     }
-    if (settingsBase === undefined || !isAbsolute4(settingsBase)) {
+    if (envFile === undefined || !isAbsolute4(envFile) || settingsBase === undefined || !isAbsolute4(settingsBase)) {
       return refuse("usage_error");
     }
     if (model !== undefined && !MODEL_NAME.test(model)) {
       return refuse("usage_error");
     }
-    if (this.panes.has(id)) {
+    const extras = parseStartExtras(args);
+    if (extras === null || [policyFile, systemPromptFile, mcpConfig].some((path) => !optionalAbsolute(path))) {
+      return refuse("usage_error");
+    }
+    if (this.panes.has(id) || this.starting.has(id)) {
       return refuse("pane_exists");
     }
-    if (this.panes.size >= (this.options.maxPanes ?? DEFAULT_MAX_PANES)) {
+    if (this.panes.size + this.starting.size >= (this.options.maxPanes ?? DEFAULT_MAX_PANES)) {
       return refuse("pane_cap");
     }
+    this.starting.add(id);
+    try {
+      return await this.open({
+        id,
+        cwd,
+        model,
+        resume,
+        envFile,
+        settingsBase,
+        policyFile,
+        systemPromptFile,
+        mcpConfig,
+        extras
+      });
+    } finally {
+      this.starting.delete(id);
+    }
+  }
+  async open(request) {
+    const { id, cwd, model, resume, envFile, settingsBase, policyFile, systemPromptFile, mcpConfig, extras } = request;
     const content = await readSecretFile(envFile);
     const env = content === null ? null : parseStartEnv(content);
     if (env === null) {
       return refuse("usage_error");
     }
+    for (const path of [systemPromptFile, mcpConfig]) {
+      if (path !== undefined && !await isPrivateFile(path)) {
+        return refuse("usage_error");
+      }
+    }
+    const policy = policyFile === undefined ? undefined : await readToolPolicy(policyFile);
+    if (policy === null) {
+      return refuse("usage_error");
+    }
+    const mcpSpellings = mcpConfig === undefined ? [] : [...new Set([mcpConfig, await realpath4(mcpConfig)])];
     const settingsPath = join7(settingsBase, `${id}.settings.json`);
     await mkdir4(settingsBase, { recursive: true, mode: 448 });
     await writePaneSettings(settingsPath, {
       basePath: this.options.baseSettingsPath ?? DEFAULT_BASE_SETTINGS_PATH,
       helperArgv: this.options.helperArgv,
       socketPath: this.options.socketPath,
-      paneId: id
+      paneId: id,
+      rules: paneRules(policy, mcpSpellings, extras.permissionMode)
     });
     const pane = {
       id,
       socket: this.options.tmuxSocket ?? LIVE_SOCKET
     };
-    const live = new LivePane(pane, env.gen, env.ingestUrl, env.token, Object.values(env.authEnv), this);
+    const live = new LivePane(pane, env.gen, env.ingestUrl, env.token, Object.values(env.authEnv), this, extras, mcpConfig, settingsBase);
+    this.starting.delete(id);
     this.panes.set(id, live);
     try {
       await createPane({
@@ -53780,6 +54454,9 @@ class LiveDaemon {
         env: env.authEnv,
         model,
         resumeSessionId: resume,
+        mcpConfig,
+        systemPromptFile,
+        permissionMode: extras.permissionMode,
         claudeBin: this.options.claudeBin,
         socket: pane.socket,
         confirmStarted: (timeoutMs) => live.started.wait(timeoutMs)
@@ -53789,7 +54466,13 @@ class LiveDaemon {
       live.queue.stop();
       return refuse(launchFailure(error));
     }
-    live.pid = await panePid(pane);
+    try {
+      live.pid = await panePid(pane);
+    } catch (error) {
+      this.panes.delete(id);
+      await live.dispose();
+      return refuse(launchFailure(error));
+    }
     live.begin();
     return accept({
       pane: id,
@@ -53825,7 +54508,7 @@ class LiveDaemon {
       }
       throw error;
     }
-    const promptId = randomUUID5();
+    const promptId = randomUUID6();
     live.pendingPromptId = promptId;
     live.submitted.arm();
     let outcome;
@@ -53971,7 +54654,7 @@ class LiveDaemon {
     if (live.dialog !== undefined) {
       return refuse("dialog_open");
     }
-    if (live.busy || live.pendingPromptId !== undefined) {
+    if (live.busy || live.refusesInput || live.pendingPromptId !== undefined) {
       return refuse("busy");
     }
     return null;
@@ -54083,17 +54766,65 @@ function parseStartEnv(content) {
     authEnv: Object.fromEntries(Object.entries(values).filter(([key]) => !key.startsWith(LIVE_KEY_PREFIX)))
   };
 }
-async function readSecretFile(path) {
-  const info = await stat3(path).catch((error) => {
+function paneRules(policy, mcpPaths, mode) {
+  const deny = [...mcpPaths.map((path) => `Read(/${path})`), ...mode === "dontAsk" ? ["EnterPlanMode"] : []];
+  if (policy === undefined && deny.length === 0) {
+    return;
+  }
+  return {
+    allow: policy?.allow ?? [],
+    deny: [...policy?.deny ?? [], ...deny],
+    ask: policy?.ask ?? []
+  };
+}
+function optionalAbsolute(path) {
+  return path === undefined || isAbsolute4(path);
+}
+async function removeHandoff(args, keepMcp, logger) {
+  const files = START_FILE_FLAGS.flatMap((flag) => {
+    const path = args[flag];
+    return path === undefined || !isAbsolute4(path) || keepMcp && flag === "mcp-config" ? [] : [[flag, path]];
+  });
+  for (const failure of await removeHandoffFiles(files)) {
+    logger.error("tmuxd could not remove a hand-off file", { ...failure });
+  }
+}
+async function removeHandoffFiles(files) {
+  const ordered = [
+    ...files.filter(([flag]) => flag === "mcp-config"),
+    ...files.filter(([flag]) => flag !== "mcp-config")
+  ];
+  const failures = [];
+  for (const [flag, path] of ordered) {
+    try {
+      await removeFile(path);
+    } catch (error) {
+      if (!isErrno(error)) {
+        throw error;
+      }
+      failures.push({
+        flag,
+        code: error.code
+      });
+    }
+  }
+  return failures;
+}
+async function isPrivateFile(path) {
+  const info = await lstat2(path).catch((error) => {
     if (error.code === "ENOENT") {
       return null;
     }
     throw error;
   });
-  if (info === null || !info.isFile() || (info.mode & 511) !== 384) {
-    return null;
-  }
-  return readFile4(path, "utf8");
+  return info?.isFile() === true && (info.mode & 511) === 384;
+}
+async function readSecretFile(path) {
+  return await isPrivateFile(path) ? readFile4(path, "utf8") : null;
+}
+async function readToolPolicy(path) {
+  const content = await readSecretFile(path);
+  return content === null ? null : parseToolPolicy(content);
 }
 async function readFileOrNull(path) {
   return readFile4(path, "utf8").catch((error) => {
@@ -54255,11 +54986,18 @@ function accept(data) {
   return {
     ok: true,
     code: "ok",
-    data: Object.fromEntries(Object.entries(data).filter(([, value]) => value !== undefined))
+    data: stamped(data)
+  };
+}
+function refuse(code, data = {}) {
+  return {
+    ok: false,
+    code,
+    data: stamped(data)
   };
 }
-function refuse(code, data) {
-  return data === undefined ? { ok: false, code } : { ok: false, code, data };
+function stamped(data) {
+  return Object.fromEntries(Object.entries({ daemon_version: DAEMON_VERSION, ...data }).filter(([, value]) => value !== undefined));
 }
 function notRunning(id) {
   return refuse("pane_not_running", {
@@ -54267,14 +55005,18 @@ function notRunning(id) {
     running: false
   });
 }
-var HEARTBEAT_INTERVAL_MS = 20000, WATCHDOG_QUIET_MS = 30000, CANCEL_TIMEOUT_MS = 3000, PERMISSION_POLL_MS = 1500, INGEST_TIMEOUT_MS = 1e4, MAX_BATCH = 200, DEFAULT_MAX_PANES = 4, STOP_DRAIN_MS = 1e4, PERMISSION_WAIT_MS, PERMISSION_OPEN_RETRY_MS = 90000, MIN_SECRET_LENGTH = 8, MAX_REQUEST_BYTES, PANE_ID2, ENV_KEY, LIVE_KEY_PREFIX = "KODIZM_LIVE_", TOKEN_PREFIX = "kdz-int-jwt.", COMMAND_NAMES, REJECTION_RULES, EXIT_CODES, DEFAULT_TIMINGS;
+var DAEMON_VERSION, HEARTBEAT_INTERVAL_MS = 20000, WATCHDOG_QUIET_MS = 30000, CANCEL_TIMEOUT_MS = 3000, PERMISSION_POLL_MS = 1500, INGEST_TIMEOUT_MS = 1e4, MAX_BATCH = 200, DEFAULT_MAX_PANES = 4, STOP_DRAIN_MS = 1e4, PERMISSION_WAIT_MS, PERMISSION_OPEN_RETRY_MS = 90000, MIN_SECRET_LENGTH = 8, MAX_REQUEST_BYTES, PANE_ID2, ENV_KEY, LIVE_KEY_PREFIX = "KODIZM_LIVE_", TOKEN_PREFIX = "kdz-int-jwt.", LAST_MESSAGE_FILE = "last-assistant-message.txt", COMMAND_NAMES, UNATTENDED_DENIAL = "This session runs unattended and approves nothing, so the tool call is denied.", REJECTION_RULES, EXIT_CODES, DEFAULT_TIMINGS;
 var init_daemon = __esm(() => {
+  init_package();
   init_logger();
   init_events2();
   init_hooks();
   init_input();
   init_pane();
+  init_policy4();
+  init_start_flags();
   init_transcript();
+  DAEMON_VERSION = package_default.version;
   PERMISSION_WAIT_MS = PERMISSION_HOOK_TIMEOUT_S * 1000 - 1e4;
   MAX_REQUEST_BYTES = 8 * 1024 * 1024;
   PANE_ID2 = /^[A-Za-z0-9_-]{1,64}$/;
@@ -54308,14 +55050,17 @@ var init_daemon = __esm(() => {
     monitorMs: 2000,
     transcriptPollMs: 250,
     retryBaseMs: 250,
-    retryMaxMs: 1e4
+    retryMaxMs: 1e4,
+    secondMs: 1000,
+    idleTimeoutMs: 0,
+    deliveryDrainMs: 120000
   };
 });
 
 // src/live/ctl.ts
 import { spawn as spawn2 } from "child_process";
 import { homedir as homedir2, tmpdir } from "os";
-import { resolve as resolve5 } from "path";
+import { resolve as resolve6 } from "path";
 async function runTmuxd(args) {
   const [command, ...rest] = args;
   switch (command) {
@@ -54338,9 +55083,9 @@ async function runTmuxd(args) {
 async function runCtl(args) {
   const [verb, ...rest] = args;
   const flags = parseFlags(rest);
-  if (verb === undefined || !VERBS.has(verb) || flags === null) {
+  if (verb === undefined || !VERBS.has(verb) || flags === null || verb === "start" && parseStartExtras(flags) === null) {
     await discardHandoff(verb, rest);
-    return print({ ok: false, code: "usage_error" });
+    return print(ctlMade("usage_error"));
   }
   const socketPath = socketPathFromEnv();
   const message = {
@@ -54359,7 +55104,7 @@ async function runCtl(args) {
     if (error.reason === "unreachable") {
       await discardHandoff(verb, rest);
     }
-    return print(error.reason === "unreachable" ? { ok: false, code: "pane_not_running", data: { pane: flags.pane, running: false } } : { ok: false, code: "timeout" });
+    return print(error.reason === "unreachable" ? ctlMade("pane_not_running", { pane: flags.pane, running: false }) : ctlMade("timeout"));
   }
 }
 async function ask(socketPath, message, spawnIfMissing) {
@@ -54426,6 +55171,7 @@ async function runDaemon() {
     baseSettingsPath: env.KODIZM_LIVE_BASE_SETTINGS ?? DEFAULT_BASE_SETTINGS_PATH,
     maxPanes: Number.isInteger(maxPanes) && maxPanes > 0 ? maxPanes : DEFAULT_MAX_PANES,
     logger: createLogger({ env }),
+    timings: { idleTimeoutMs: idleTimeoutMs(env) },
     onIdle: () => void daemon.close().then(shutdown)
   });
   await daemon.listen();
@@ -54435,6 +55181,10 @@ async function runDaemon() {
   await stopped;
   return 0;
 }
+function idleTimeoutMs(env) {
+  const seconds = env.KODIZM_TMUXD_IDLE_TIMEOUT_SECONDS;
+  return seconds !== undefined && /^[1-9]\d*$/.test(seconds) ? Number(seconds) * 1000 : 0;
+}
 function spawnDaemon() {
   const child = spawn2(process.execPath, [process.argv[1] ?? "", "tmuxd", "daemon"], {
     detached: true,
@@ -54455,21 +55205,37 @@ function parseFlags(args) {
     if (!flag.startsWith("--") || name === "" || value === undefined || name in flags) {
       return null;
     }
-    flags[name] = PATH_FLAGS.has(name) ? resolve5(value) : value;
+    flags[name] = PATH_FLAGS.has(name) ? resolve6(value) : value;
   }
   return flags;
 }
 async function discardHandoff(verb, args) {
-  const flag = verb === undefined ? undefined : HANDOFF_FLAGS[verb];
-  if (flag === undefined) {
+  const flags = verb === undefined ? undefined : HANDOFF_FLAGS.get(verb);
+  if (flags === undefined) {
     return;
   }
+  const files = [];
   for (let index = 0;index < args.length - 1; index += 1) {
     const value = args[index + 1];
-    if (args[index] === `--${flag}` && value !== undefined) {
-      await removeFile(resolve5(value));
+    const flag = flags.find((name) => args[index] === `--${name}`);
+    if (value !== undefined && flag !== undefined) {
+      files.push([flag, resolve6(value)]);
     }
   }
+  for (const failure of await removeHandoffFiles(files)) {
+    process.stderr.write(`${JSON.stringify({ level: "error", message: "tmuxd ctl could not remove a hand-off file", ...failure })}
+`);
+  }
+}
+function ctlMade(code, data = {}) {
+  return {
+    ok: false,
+    code,
+    data: {
+      daemon_version: DAEMON_VERSION,
+      ...data
+    }
+  };
 }
 function toResult(response) {
   const code = typeof response === "object" && response !== null ? response.code : undefined;
@@ -54498,11 +55264,15 @@ var init_ctl = __esm(() => {
   init_daemon();
   init_hooks();
   init_pane();
+  init_start_flags();
   USAGE = `Usage: kodizm-acp tmuxd <command>
 
 Commands:
   ctl <verb> [flags]                         Drive a Live pane through the daemon; prints one JSON line.
                                              Verbs: start, prompt, command, cancel, stop, rotate-token, status.
+                                             start also takes --permission-mode default|dontAsk, --one-shot 0|1,
+                                             --deadline-seconds N, --retain-failed-seconds N and
+                                             --mcp-config/--tool-policy/--system-prompt-file PATH.
   hook <Event> --pane <id> --socket <path>   Hook helper the pane settings run; reads the payload on stdin.
   daemon                                     Run the daemon in the foreground; ctl start spawns it detached.
 
@@ -54510,82 +55280,30 @@ Environment:
   KODIZM_TMUXD_SOCKET        daemon socket (default: $XDG_RUNTIME_DIR or the temp dir, kodizm-live-<uid>/tmuxd.sock)
   KODIZM_TMUXD_TMUX_SOCKET   tmux socket name (default: ${LIVE_SOCKET})
   KODIZM_TMUXD_MAX_PANES     panes per daemon (default: ${DEFAULT_MAX_PANES})
+  KODIZM_TMUXD_IDLE_TIMEOUT_SECONDS
+                             end a pane with no turn, dialog or activity for N seconds (default: off)
   KODIZM_LIVE_BASE_SETTINGS  base settings with the deny list (default: ${DEFAULT_BASE_SETTINGS_PATH})
   CLAUDE_CODE_PATH           claude binary (default: claude on PATH)
 `;
   VERBS = new Set(["start", "prompt", "command", "cancel", "stop", "rotate-token", "status"]);
-  PATH_FLAGS = new Set(["settings-base", "env-file", "file", "token-file"]);
-  HANDOFF_FLAGS = {
-    start: "env-file",
-    prompt: "file",
-    "rotate-token": "token-file"
-  };
+  PATH_FLAGS = new Set([
+    "settings-base",
+    "env-file",
+    "file",
+    "token-file",
+    "mcp-config",
+    "tool-policy",
+    "system-prompt-file"
+  ]);
+  HANDOFF_FLAGS = new Map([
+    ["start", START_FILE_FLAGS],
+    ["prompt", ["file"]],
+    ["rotate-token", ["token-file"]]
+  ]);
 });
-// package.json
-var package_default = {
-  name: "@kodizm/acp",
-  version: "0.8.2",
-  description: "Custom ACP server bridging Claude Code and opencode CLIs through a single Kodizm-flavored protocol surface.",
-  type: "module",
-  bin: {
-    "kodizm-acp": "./dist/index.js"
-  },
-  main: "./dist/index.js",
-  files: [
-    "dist/",
-    "README.md",
-    "LICENSE"
-  ],
-  scripts: {
-    dev: "bun run src/index.ts",
-    build: "bun build src/index.ts --target=bun --outdir=dist",
-    test: "bun test test/unit test/e2e",
-    "test:unit": "bun test test/unit",
-    "test:e2e": "bun test test/e2e",
-    "test:integration": "./scripts/reap-opencode.sh bun test test/integration",
-    "test:watch": "bun test --watch",
-    lint: "biome check src test",
-    "lint:fix": "biome check --write src test",
-    format: "biome format --write src test",
-    typecheck: "tsc --noEmit",
-    "typecheck:src": "tsc --noEmit -p tsconfig.publish.json",
-    prepublishOnly: "bun run build && bun run typecheck:src"
-  },
-  engines: {
-    bun: ">=1.1.0"
-  },
-  publishConfig: {
-    access: "public"
-  },
-  config: {
-    claudeAgentSdk: "0.3.280"
-  },
-  devDependencies: {
-    "@anthropic-ai/claude-agent-sdk": "0.3.280",
-    "@anthropic-ai/sdk": ">=0.93.0",
-    "@biomejs/biome": "^1.9.0",
-    "@modelcontextprotocol/sdk": "^1.29.0",
-    "@opencode-ai/sdk": "^1.18.32",
-    "@types/bun": "latest",
-    typescript: "^5.6.0",
-    zod: "^4.0.0"
-  },
-  license: "Apache-2.0",
-  homepage: "https://github.com/kodizm/acp",
-  repository: {
-    type: "git",
-    url: "git+https://github.com/kodizm/acp.git"
-  },
-  keywords: [
-    "acp",
-    "agent-client-protocol",
-    "claude",
-    "opencode",
-    "ai",
-    "bridge",
-    "jsonrpc"
-  ]
-};
+
+// src/index.ts
+init_package();
 
 // src/backends/driver.ts
 init_errors();