@linzumi/cli 0.0.86-beta → 0.0.88-beta

package/README.md

@@ -58,7 +58,7 @@ Install the CLI or run it with `npx`:
 ```bash
 npm install -g @linzumi/cli@latest
 npx -y @linzumi/cli@latest signup
-npx -y @linzumi/cli@0.0.86-beta --version
+npx -y @linzumi/cli@0.0.88-beta --version
 linzumi --version
 ```
 

package/dist/index.js

@@ -11541,7 +11541,7 @@ function createClaudeCodeSessionPipeline(host) {
     const toolName2 = pending?.toolName ?? event.toolName ?? "tool";
     const input = pending?.input ?? {};
     const itemId = `tool:${event.itemKey}`;
-    if (!event.isError && isFileChangeTool(toolName2)) {
+    if (isFileChangeTool(toolName2)) {
       const patchText = claudeFileChangePatchText(toolName2, input, {
         targetExistedAtCall: pending?.targetExistedAtCall
       });
@@ -11549,7 +11549,7 @@ function createClaudeCodeSessionPipeline(host) {
         const item2 = {
           type: "fileChange",
           id: itemId,
-          status: "completed",
+          status: event.isError ? "failed" : "completed",
           patchText
         };
         recordItem(turn, item2);
@@ -11569,12 +11569,13 @@ function createClaudeCodeSessionPipeline(host) {
       submit("item/completed", { turnId: turn.turnId, item: item2 });
       return;
     }
-    if (!event.isError && toolName2 === "TodoWrite") {
+    if (!event.isError && isClaudePlanTool(toolName2)) {
       host.onTodoWriteCompleted?.(input);
       const plan = claudePlanItem(itemId, input);
       if (plan !== void 0) {
-        recordItem(turn, plan);
-        submit("item/completed", { turnId: turn.turnId, item: plan });
+        const planRow = { ...plan, id: itemId };
+        recordItem(turn, planRow);
+        submit("item/completed", { turnId: turn.turnId, item: planRow });
         return;
       }
     }
@@ -11605,7 +11606,7 @@ function createClaudeCodeSessionPipeline(host) {
       }
       case "reasoning_delta": {
         const turn = ensureTurn();
-        const itemId = claudeAssistantPipelineItemId(event.itemKey);
+        const itemId = claudeReasoningPipelineItemId(event.itemKey);
         appendRawText(turn, itemId, "reasoning", event.delta);
         submit("item/reasoning/textDelta", {
           turnId: turn.turnId,
@@ -11626,7 +11627,7 @@ function createClaudeCodeSessionPipeline(host) {
       }
       case "reasoning_message": {
         const turn = ensureTurn();
-        const itemId = claudeAssistantPipelineItemId(event.itemKey);
+        const itemId = claudeReasoningPipelineItemId(event.itemKey);
         setRawText(turn, itemId, "reasoning", event.content);
         submit("item/completed", {
           turnId: turn.turnId,
@@ -11636,14 +11637,15 @@ function createClaudeCodeSessionPipeline(host) {
       }
       case "tool_call": {
         const turn = ensureTurn();
+        const targetExistedAtCall = fileChangeTargetExists(
+          event.toolName,
+          event.input,
+          host.cwd
+        );
         turn.pendingTools.set(event.itemKey, {
           toolName: event.toolName,
           input: event.input,
-          targetExistedAtCall: fileChangeTargetExists(
-            event.toolName,
-            event.input,
-            host.cwd
-          )
+          targetExistedAtCall
         });
         if (isWebSearchTool(event.toolName)) {
           const query = stringValue(event.input.query) ?? stringValue(event.input.url) ?? event.toolName;
@@ -11655,7 +11657,34 @@ function createClaudeCodeSessionPipeline(host) {
               query
             }
           });
+          return;
         }
+        if (isClaudePlanTool(event.toolName)) {
+          return;
+        }
+        const itemId = `tool:${event.itemKey}`;
+        if (isFileChangeTool(event.toolName)) {
+          const patchText = claudeFileChangePatchText(
+            event.toolName,
+            event.input,
+            { targetExistedAtCall }
+          );
+          if (patchText !== void 0 && patchText.trim() !== "") {
+            submit("item/fileChange/outputDelta", {
+              turnId: turn.turnId,
+              itemId,
+              delta: patchText
+            });
+          }
+          return;
+        }
+        submit("item/commandExecution/outputDelta", {
+          turnId: turn.turnId,
+          itemId,
+          command: claudeToolCommandLabel(event.toolName, event.input),
+          stream: "stdout",
+          delta: "\n"
+        });
         return;
       }
       case "tool_result": {
@@ -11809,6 +11838,9 @@ function claudeAssistantPipelineItemId(itemKey) {
   const streamIndex = itemKey.match(/^assistant-stream-(\d+)$/)?.[1];
   return streamIndex === void 0 ? itemKey : `content-block-${streamIndex}`;
 }
+function claudeReasoningPipelineItemId(itemKey) {
+  return `reasoning-${claudeAssistantPipelineItemId(itemKey)}`;
+}
 function isFileChangeTool(toolName2) {
   switch (toolName2) {
     case "Edit":
@@ -11823,6 +11855,9 @@ function isFileChangeTool(toolName2) {
 function isWebSearchTool(toolName2) {
   return toolName2 === "WebSearch" || toolName2 === "WebFetch";
 }
+function isClaudePlanTool(toolName2) {
+  return toolName2 === "TodoWrite" || toolName2 === "TaskCreate" || toolName2 === "TaskUpdate";
+}
 function fileChangeTargetExists(toolName2, input, sessionCwd) {
   if (!isFileChangeTool(toolName2)) {
     return void 0;
@@ -11895,9 +11930,18 @@ ${body}
 *** End Patch
 `;
 }
+function claudePlanInputItems(input) {
+  if (Array.isArray(input.todos)) {
+    return input.todos;
+  }
+  if (Array.isArray(input.tasks)) {
+    return input.tasks;
+  }
+  return [];
+}
 function claudePlanItem(itemId, input) {
-  const todos = Array.isArray(input.todos) ? input.todos : [];
-  const lines = todos.flatMap((todo) => {
+  const items = claudePlanInputItems(input);
+  const lines = items.flatMap((todo) => {
     const value = objectValue(todo);
     if (value === void 0) {
       return [];
@@ -11971,7 +12015,7 @@ function objectValue2(value) {
   return isJsonObject(value) ? value : void 0;
 }
 function claudeTodoWritePlanSteps(input) {
-  const todos = Array.isArray(input.todos) ? input.todos : [];
+  const todos = Array.isArray(input.todos) ? input.todos : Array.isArray(input.tasks) ? input.tasks : [];
   const steps = todos.flatMap((todo) => {
     const value = objectValue2(todo);
     if (value === void 0) {
@@ -12042,6 +12086,29 @@ function createClaudeCodePlanMirror(args) {
     settle: () => flight
   };
 }
+async function seedClaudeCodingJobGoal(args) {
+  const goal = args.goal.trim().slice(0, 2e3);
+  if (goal === "") {
+    return false;
+  }
+  try {
+    await args.upsertCodingJobPlan(
+      { thread_id: args.threadId, goal },
+      { signal: args.signal }
+    );
+    args.log("claude_code.goal_seeded", {
+      thread_id: args.threadId,
+      goal_length: goal.length
+    });
+    return true;
+  } catch (error) {
+    args.log("claude_code.goal_seed_failed", {
+      thread_id: args.threadId,
+      message: error instanceof Error ? error.message : String(error)
+    });
+    return false;
+  }
+}
 var todoStatusToPlanStepStatus, planStepTitleMaxLength, planStepDescriptionMaxLength, planStepsMaxCount;
 var init_claudeCodePlanMirror = __esm({
   "src/claudeCodePlanMirror.ts"() {
@@ -12597,6 +12664,87 @@ var init_claudeCodeLiveBashOutput = __esm({
   }
 });
 
+// src/claudeCodeTurnStallWatchdog.ts
+function createClaudeCodeTurnStallWatchdog(options) {
+  if (!(options.thresholdMs > 0)) {
+    throw new Error("Claude turn-stall threshold must be > 0");
+  }
+  const now = options.now ?? (() => Date.now());
+  const setTimer = options.setTimer ?? ((callback, delayMs) => {
+    const handle2 = setTimeout(callback, delayMs);
+    handle2.unref?.();
+    return handle2;
+  });
+  const clearTimer = options.clearTimer ?? ((handle2) => clearTimeout(handle2));
+  const isTurnActive = options.isTurnActive ?? (() => true);
+  let handle;
+  let lastKickMs = now();
+  let stopped = false;
+  let fired = false;
+  let wasActive = isTurnActive();
+  const disarm = () => {
+    if (handle !== void 0) {
+      clearTimer(handle);
+      handle = void 0;
+    }
+  };
+  const onTimeout = () => {
+    handle = void 0;
+    if (stopped || fired) {
+      return;
+    }
+    const active = isTurnActive();
+    if (!active) {
+      wasActive = false;
+      arm();
+      return;
+    }
+    if (!wasActive) {
+      wasActive = true;
+      lastKickMs = now();
+      arm();
+      return;
+    }
+    const silentMs = now() - lastKickMs;
+    if (silentMs < options.thresholdMs) {
+      arm();
+      return;
+    }
+    fired = true;
+    options.onStall({ silentMs });
+  };
+  function arm() {
+    if (stopped || fired) {
+      return;
+    }
+    disarm();
+    const delay = isTurnActive() ? Math.max(0, options.thresholdMs - (now() - lastKickMs)) : options.thresholdMs;
+    handle = setTimer(onTimeout, delay);
+  }
+  arm();
+  return {
+    kick: () => {
+      if (stopped || fired) {
+        return;
+      }
+      wasActive = true;
+      lastKickMs = now();
+      arm();
+    },
+    stop: () => {
+      stopped = true;
+      disarm();
+    }
+  };
+}
+var defaultClaudeCodeTurnStallThresholdMs;
+var init_claudeCodeTurnStallWatchdog = __esm({
+  "src/claudeCodeTurnStallWatchdog.ts"() {
+    "use strict";
+    defaultClaudeCodeTurnStallThresholdMs = 10 * 6e4;
+  }
+});
+
 // src/claudeCodeSession.ts
 import { existsSync as existsSync4, readFileSync as readFileSync5 } from "node:fs";
 import { homedir as homedir6 } from "node:os";
@@ -12864,8 +13012,49 @@ async function startClaudeCodeSession(options) {
     lastCompletedTurnBody: void 0
   };
   const streamUsageTracker = createClaudeCodeStreamUsageTracker();
+  let stallReason;
+  let signalStall;
+  const stallSignal = new Promise((resolve12) => {
+    signalStall = resolve12;
+  });
+  const stallWatchdog = options.turnStallThresholdMs !== void 0 && options.turnStallThresholdMs > 0 ? createClaudeCodeTurnStallWatchdog({
+    thresholdMs: options.turnStallThresholdMs,
+    isTurnActive: options.turnStallIsActive,
+    onStall: ({ silentMs }) => {
+      stallReason = `Claude Code turn stalled: no SDK output for ${Math.round(
+        silentMs / 1e3
+      )}s (threshold ${Math.round(
+        (options.turnStallThresholdMs ?? 0) / 1e3
+      )}s)`;
+      options.abortController?.abort();
+      signalStall?.();
+    }
+  }) : void 0;
   try {
-    for await (const message of runner(options)) {
+    const iterator = runner(options)[Symbol.asyncIterator]();
+    for (; ; ) {
+      let nextStep;
+      if (stallWatchdog) {
+        const nextPromise = iterator.next().then((result) => ({ kind: "next", result }));
+        nextPromise.catch(() => void 0);
+        const raced = await Promise.race([
+          nextPromise,
+          stallSignal.then(() => ({ kind: "stall" }))
+        ]);
+        if (raced.kind === "stall") {
+          void Promise.resolve(iterator.return?.()).catch(() => void 0);
+          break;
+        }
+        nextStep = raced;
+      } else {
+        nextStep = { kind: "next", result: await iterator.next() };
+      }
+      const step = nextStep;
+      if (step.result.done === true) {
+        break;
+      }
+      const message = step.result.value;
+      stallWatchdog?.kick();
       state.sessionId = state.sessionId ?? extractClaudeSessionId(message);
       const sessionId = extractClaudeSessionId(message) ?? state.sessionId;
       if (sessionId !== void 0 && !state.startedSessionIds.has(sessionId)) {
@@ -12931,8 +13120,12 @@ async function startClaudeCodeSession(options) {
       }
     }
   } finally {
+    stallWatchdog?.stop();
     options.streamingInput?.close();
   }
+  if (stallReason !== void 0) {
+    return await failClaudeCodeSession(options, state.sessionId, stallReason);
+  }
   return completeClaudeCodeSession(options, state);
 }
 async function emitClaudeCodeTurnCompleted(options, state) {
@@ -13073,7 +13266,16 @@ async function* defaultClaudeCodeRunner(options) {
           options.wrapApprovedToolInput
         )
       },
-      ...options.model === void 0 ? {} : { model: options.model }
+      ...options.model === void 0 ? {} : { model: options.model },
+      ...options.permissionMode === void 0 ? {} : {
+        permissionMode: options.permissionMode,
+        // The SDK requires this safety acknowledgement when a session is
+        // constructed in 'bypassPermissions' (sdk.d.ts Options:
+        // "Must be set to true when using permissionMode:
+        // 'bypassPermissions'"). It is the intentional-bypass flag, only
+        // meaningful for that mode; harmless for the others.
+        ...options.permissionMode === "bypassPermissions" ? { allowDangerouslySkipPermissions: true } : {}
+      }
       // exactOptionalPropertyTypes: the conditional spreads build a union the
       // SDK's Options cannot absorb verbatim; the shape is correct field-wise.
     }
@@ -13316,13 +13518,16 @@ function assistantTranscriptEvents(message, sessionId) {
       contentBlockItemKey(block, index)
     )
   );
-  const directText = nonEmptyText(stringValue(message?.text));
+  const hasTextContentBlock = content.some(
+    (block) => stringValue(objectValue(block)?.type) === "text"
+  );
+  const directText = hasTextContentBlock ? void 0 : nonEmptyText(stringValue(message?.text));
   return directText === void 0 ? contentEvents : [
     ...contentEvents,
     {
       type: "assistant_message",
       sessionId,
-      itemKey: stringValue(message?.uuid) ?? "assistant-message",
+      itemKey: `content-block-${content.length}`,
       content: directText,
       streamState: "completed"
     }
@@ -13343,7 +13548,7 @@ function userTranscriptEvents(message, sessionId) {
       {
         type: "tool_result",
         sessionId,
-        itemKey: contentBlockItemKey(block, index),
+        itemKey: stringValue(value?.tool_use_id) ?? stringValue(value?.id) ?? `content-block-${index}`,
         toolName: void 0,
         content: visibleToolResultContent(value),
         isError: value?.is_error === true
@@ -13429,12 +13634,14 @@ function unknownTranscriptEvent(message, sessionId) {
 }
 function streamItemKey(event, _message) {
   const index = integerValue(event?.index);
-  const contentBlock = objectValue(event?.content_block);
-  return stringValue(event?.content_block_id) ?? stringValue(contentBlock?.id) ?? stringValue(contentBlock?.tool_use_id) ?? stringValue(contentBlock?.uuid) ?? (index === void 0 ? "assistant-stream" : `assistant-stream-${index}`);
+  return index === void 0 ? "assistant-stream" : `content-block-${index}`;
 }
 function contentBlockItemKey(block, index) {
   const value = objectValue(block);
-  return stringValue(value?.id) ?? stringValue(value?.tool_use_id) ?? stringValue(value?.uuid) ?? `content-block-${index}`;
+  if (stringValue(value?.type) === "tool_use") {
+    return stringValue(value?.id) ?? stringValue(value?.tool_use_id) ?? `content-block-${index}`;
+  }
+  return `content-block-${index}`;
 }
 function visibleToolResultContent(block) {
   const content = block?.content;
@@ -13482,6 +13689,7 @@ var init_claudeCodeSession = __esm({
     "use strict";
     init_json();
     init_claudeCodeLiveBashOutput();
+    init_claudeCodeTurnStallWatchdog();
     claudeRateLimitWindowLabels = {
       five_hour: "5h window",
       seven_day: "7d window",
@@ -14992,8 +15200,8 @@ function startCallbackServer(args) {
         }
         resolveCallback?.({ code, state });
         writeOauthResult(response, {
-          title: "Connected",
-          body: "You can close this tab. Your terminal will finish the setup.",
+          title: "Computer authorized",
+          body: "This computer has been authorized for agentic use in Linzumi. Feel free to close this tab and let the terminal finish setup.",
           status: 200
         });
       } catch (error) {
@@ -15036,29 +15244,108 @@ function writeOauthResult(response, args) {
   response.end(oauthResultHtml(args));
 }
 function oauthResultHtml(args) {
+  const success = args.status >= 200 && args.status < 300;
+  const badgeClass = success ? "badge badge--success" : "badge badge--notice";
+  const badgeMark = success ? '<svg viewBox="0 0 24 24" aria-hidden="true" focusable="false" class="mark"><path fill="none" stroke="currentColor" stroke-width="2.4" stroke-linecap="round" stroke-linejoin="round" d="M5 12.5l4.2 4.2L19 7"/></svg>' : '<svg viewBox="0 0 24 24" aria-hidden="true" focusable="false" class="mark"><path fill="none" stroke="currentColor" stroke-width="2.4" stroke-linecap="round" stroke-linejoin="round" d="M12 7v6M12 17h.01"/></svg>';
   return `<!doctype html>
-<html>
+<html lang="en">
   <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1" />
     <title>${escapeHtml(args.title)}</title>
     <style>
-      :root { color-scheme: light dark; font-family: Inter, ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif; }
-      body { margin: 0; min-height: 100vh; display: grid; place-items: center; background: #f6f7f9; color: #13161c; }
-      main { width: min(520px, calc(100vw - 32px)); border: 1px solid #d9dde5; border-radius: 12px; background: #fff; padding: 30px; box-shadow: 0 24px 70px rgba(18, 25, 38, 0.12); }
-      h1 { margin: 0 0 10px; font-size: 24px; line-height: 1.2; }
-      p { margin: 0; color: #465160; line-height: 1.55; }
+      :root {
+        color-scheme: light dark;
+        /* Linzumi brand tokens (light) \u2014 kandan/server_v2/web/src/ui/theme/tokens.css */
+        --page-bg: #f5f2ee;
+        --surface: #fcfaf7;
+        --foreground: #1e1b18;
+        --muted: #5c5550;
+        --divider: rgba(138, 148, 144, 0.16);
+        --accent: #c4897a;
+        --success: #5a9a6a;
+        --success-soft: rgba(90, 154, 106, 0.1);
+        --notice-soft: rgba(196, 137, 122, 0.1);
+        --shadow: 0 12px 40px rgba(106, 138, 122, 0.12), 0 4px 12px rgba(106, 138, 122, 0.06);
+      }
       @media (prefers-color-scheme: dark) {
-        body { background: #0f131a; color: #f3f5f8; }
-        main { background: #171c25; border-color: #2b3442; box-shadow: 0 24px 70px rgba(0, 0, 0, 0.4); }
-        p { color: #aab4c2; }
+        :root {
+          /* Linzumi brand tokens (dark) */
+          --page-bg: #171b19;
+          --surface: #202522;
+          --foreground: rgba(245, 241, 232, 0.95);
+          --muted: rgba(245, 241, 232, 0.68);
+          --divider: rgba(245, 241, 232, 0.1);
+          --accent: #c8a0b0;
+          --success: #72c488;
+          --success-soft: rgba(114, 196, 136, 0.14);
+          --notice-soft: rgba(200, 160, 176, 0.14);
+          --shadow: 0 18px 50px rgba(0, 0, 0, 0.5), 0 4px 12px rgba(0, 0, 0, 0.35);
+        }
+      }
+      * { box-sizing: border-box; }
+      body {
+        margin: 0;
+        min-height: 100vh;
+        display: grid;
+        place-items: center;
+        padding: 24px;
+        background:
+          radial-gradient(1200px 600px at 50% -10%, var(--notice-soft), transparent 60%),
+          var(--page-bg);
+        color: var(--foreground);
+        font-family: Inter, ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
+        -webkit-font-smoothing: antialiased;
+      }
+      main {
+        width: min(520px, 100%);
+        border: 1px solid var(--divider);
+        border-radius: 16px;
+        background: var(--surface);
+        padding: 40px 36px;
+        box-shadow: var(--shadow);
+        text-align: center;
+      }
+      .logo {
+        width: 44px;
+        height: 44px;
+        margin: 28px auto 0;
+        color: var(--accent);
+      }
+      .logo svg { display: block; width: 100%; height: 100%; }
+      .badge {
+        width: 64px;
+        height: 64px;
+        margin: 0 auto 22px;
+        display: grid;
+        place-items: center;
+        border-radius: 999px;
+      }
+      .badge--success { background: var(--success-soft); color: var(--success); }
+      .badge--notice { background: var(--notice-soft); color: var(--accent); }
+      .mark { width: 32px; height: 32px; }
+      h1 {
+        margin: 0 0 12px;
+        font-size: 23px;
+        font-weight: 600;
+        line-height: 1.3;
+        letter-spacing: -0.01em;
+        color: var(--foreground);
+      }
+      p {
+        margin: 0;
+        color: var(--muted);
+        font-size: 15px;
+        line-height: 1.6;
       }
     </style>
   </head>
   <body>
     <main>
+      <div class="${badgeClass}">${badgeMark}</div>
       <h1>${escapeHtml(args.title)}</h1>
       <p>${escapeHtml(args.body)}</p>
+      <div class="logo">${LINZUMI_LOGO_SVG}</div>
     </main>
   </body>
 </html>`;
@@ -15089,10 +15376,12 @@ function openBrowser(url) {
     });
   });
 }
+var LINZUMI_LOGO_SVG;
 var init_oauth = __esm({
   "src/oauth.ts"() {
     "use strict";
     init_runnerLogger();
+    LINZUMI_LOGO_SVG = '<svg viewBox="0 0 512 512" xmlns="http://www.w3.org/2000/svg" aria-hidden="true" focusable="false"><path fill="currentColor" d="M206.7,82.37l2.55-6.45,2.01-3.63c.67-1.21,1.07-1.88,2.55-3.63,1.34-1.61,3.36-4.43,5.64-6.58,2.42-2.24,5.06-4.3,7.93-6.18,3.92-2.53,8.17-4.52,12.63-5.91,1.79-.63,4.03-1.16,6.72-1.61,6.1-.88,12.29-.92,18.4-.13,2.69.45,5.06,1.03,7.12,1.75,2.15.67,3.49,1.07,5.64,2.15,4.55,2.16,8.87,4.77,12.9,7.79,1.61,1.34,2.42,2.15,4.16,4.16l5.91,7.66c1.34,2.01,1.34,2.28,2.15,4.03l2.55,6.58c.67,1.34-.13,1.34,1.07.94,1.21-.27,4.3-2.01,6.45-2.82,4.7-1.83,9.62-3,14.64-3.49,2.42-.27,3.76-.54,7.12-.27s9.27,1.21,12.76,2.15c3.63.94,6.58,2.55,8.73,3.49,2.15,1.07,2.55,1.48,4.16,2.55,3.49,2.51,6.77,5.29,9.81,8.33,1.52,1.7,3.04,3.58,4.57,5.64,2.74,4.49,4.86,9.32,6.31,14.37.67,2.28,1.07,3.49,1.34,6.72.27,3.22,0,10.48.4,12.76.27,2.28.27.67,1.61.94,1.48.27,4.3,0,6.72.4,2.42.27,4.97.85,7.66,1.75,6.76,2.32,13.01,5.92,18.4,10.61,2.28,1.75,2.96,2.69,4.3,4.3,3.51,3.93,6.32,8.43,8.33,13.3,1.07,2.15,1.21,2.28,1.88,5.1.54,2.96,1.61,8.19,1.61,12.36s-.81,9.67-1.34,12.76c-.67,3.22-1.07,4.03-2.15,6.18-2.16,4.54-4.81,8.82-7.93,12.76-1.25,1.61-2.6,3-4.03,4.16-1.48,1.34-2.69,2.42-4.7,3.76-3.79,2.34-7.74,4.4-11.82,6.18l-6.58,2.15c-2.06.45-4.12.72-6.18.81l-7.25.13c-2.28,0-2.82.27-6.58-.4-3.76-.81-11.69-2.82-15.99-4.3-4.16-1.34-6.31-2.69-9.67-4.43-3.49-1.75-10.48-6.18-12.9-7.39-8.26-4.54-16.78-8.58-25.52-12.09-4.3-1.75-9.27-3.22-11.82-4.03-2.55-.81-5.24-1.61-7.66-2.15-8.39-2.25-16.99-3.6-25.66-4.03-3.9-.27-4.84-.27-8.19-.13-3.67-.09-7.79.04-12.36.4-7.9.79-15.75,2.04-23.51,3.76-8.37,2.26-16.62,4.95-24.72,8.06-3.22,1.34-2.82.81-9.13,4.16-6.31,3.36-22.03,12.22-28.75,15.58-6.72,3.36-8.73,3.49-11.82,4.43-3.09,1.07-4.3,1.21-6.58,1.61-7.3,1.09-14.71,1.18-22.03.27-2.55-.54-5.78-1.61-7.79-2.28-2.01-.54-2.15-.67-4.03-1.75-2.02-1.07-5.64-3.22-7.79-4.7-3.24-2.15-6.14-4.77-8.6-7.79-1.34-1.52-2.69-3.36-4.03-5.51-1.52-2.51-2.96-5.24-4.3-8.19-2.03-5.46-3.03-11.24-2.96-17.06,0-2.96.13-6.72.67-9.67.54-2.87,1.34-5.6,2.42-8.19,4.24-10.52,12.04-19.22,22.03-24.58,5.19-2.98,10.88-4.98,16.79-5.91,2.55-.4,5.37-.13,6.72-.4,1.34-.27,1.34,1.34,1.61-.94.4-2.28,0-9.4.4-12.76.27-3.36.81-4.97,1.48-7.25,1.87-6.19,4.88-11.97,8.87-17.06,3.47-3.98,7.39-7.54,11.69-10.61,4.43-2.61,9.11-4.77,13.97-6.45,2.55-.67,6.99-1.34,9.13-1.75,2.15-.27,1.88-.13,3.63-.13,1.79-.09,4.03,0,6.72.27,2.69.18,5.73.72,9.13,1.61,3.49,1.07,9.27,4.03,11.28,4.7s.4.27,1.07-.94ZM512.27,255.7c0,141.39-114.62,256-256,256S.27,397.09.27,255.7,114.89-.3,256.27-.3s256,114.62,256,256ZM449.33,352.66c14.67-29.16,22.94-62.09,22.94-96.95,0-119.29-96.71-216-216-216S40.27,136.41,40.27,255.7c0,41.89,11.94,80.98,32.57,114.09,1.7,1.79,2.94.65,3.05-.57.27-1.61,2.75-20.85,4.43-27.27,1.87-7.6,4.52-14.98,7.93-22.03,1.75-3.49,3.76-7.93,6.18-11.82,8.77-13.95,19.75-26.38,32.51-36.81,7.24-5.32,14.87-10.08,22.84-14.24,9.74-4.78,20.09-8.22,30.76-10.21,4.03-.99,7.61-1.66,10.75-2.02,3.36-.54,5.78-.54,9.27-.94,3.49-.54,9.32-1.16,11.82-2.01,6.65-2.27,5.64-6.72,3.09-7.52-2.55-.81-9.67-1.88-13.84-2.96-4.16-1.21-8.73-2.82-11.28-3.76-2.55-.94-2.28-.94-3.9-2.02l-5.91-4.03c-.94-.94-1.34-.94.54-2.02l10.21-5.51c2.01-1.07,1.75-.67,3.09-.13,1.34.67,4.3,2.42,6.72,3.36,7.2,2.69,14.96,3.52,22.57,2.42,1.34-.27,1.34-.54,1.61-1.21.27-.67.81-.94-.13-2.69-.94-1.88-4.43-6.58-5.64-8.46l-1.21-2.28c-.27-.45-1.07-1.07,1.21-1.75,2.42-.54,10.48-2.58,12.9-2.82.86-.09.67,0,1.75,1.07,1.07,1.07,3.09,3.63,4.84,5.24,1.88,1.61,4.43,3.22,6.18,4.3,2.8,1.71,5.99,2.68,9.27,2.82,1.88,0,4.97-.13,7.12-.67,2.15-.4,3.63-.94,5.64-2.02,2.01-1.07,4.7-2.69,6.72-4.43,2.01-1.75,3.49-5.1,5.64-6.04,2.15-.81,4.97.54,7.12.94,2.28.4,4.97,1.21,6.18,1.61,1.21.4,2.01.4.67,2.28l-8.06,10.34c-1.34,1.88.13,5.51,1.21,5.64l5.64.27c2.28-.13,4.43.13,7.66-.67,3.36-.81,9.27-2.96,11.82-3.9,2.69-.94,3.22-1.34,4.16-2.01.81-.54,1.39-1.03,1.75-1.48.45-.27.67-1.07,2.82,0s9.4,4.97,11.28,6.18c2.01,1.21,1.07.94,0,1.75l-5.51,3.9c-1.48.94-1.07.94-3.22,1.88-2.15,1.07-6.58,2.96-9.67,4.03s-4.03,1.75-8.73,2.69c-4.7.81-14.51,1.75-19.48,2.55-4.97.81-7.93,1.34-10.34,2.01-2.28.67-2.15.94-3.49,1.88-1.48,1.07-2.69,1.61-4.97,3.9-2.28,2.28-5.91,6.85-8.73,9.81-2.82,2.96-6.45,6.04-8.33,7.79-2.02,1.61-1.61,1.34-3.36,2.42l-6.99,4.03-4.03,2.02-6.72,2.15c-2.42.67-3.9,1.21-7.66,2.01l-14.91,2.82c-3.63.81-4.3,1.07-7.12,2.01-2.96,1.07-6.22,2.46-9.81,4.16-3.22,1.43-6.81,3.45-10.75,6.04-13.6,9.14-24.61,21.63-31.97,36.27-2.01,3.76-2.96,6.58-3.9,9.27-1.07,2.69-1.61,4.03-2.28,6.58-.67,2.69-1.48,5.24-2.15,9.27-.54,4.16-1.48,11.15-1.75,15.45-.27,4.16-.27,6.04,0,10.21l1.88,14.91c.67,3.76,1.48,5.91,2.15,8.19l1.88,5.64c.99,2.6,2.42,5.78,4.3,9.54,2.15,3.76,5.37,9.13,8.06,13.03,10.08,14.51,23.81,26.36,40.17,33.05,22.55,9.22,43.32,10.46,61.89,10.46,3.25,0,6.49-.09,9.71-.23,3.07-.42,2.74-6.09,10.48-9.42,5.26-2.26,13.7-2.42,14.91-2.55,1.07-.13-5.24-4.57-7.79-6.45-2.55-1.88-4.97-4.3-6.72-5.91-1.75-1.75-2.42-2.28-3.9-4.16-1.61-1.88-3.9-5.51-5.24-7.12-1.34-1.61-1.48-2.28-2.55-2.55-.98-.27-2.37-.09-4.16.54-1.88.4-5.37,1.21-7.12,1.88-1.75.67-2.02.81-3.09,2.01-1.07,1.07-2.69,3.76-3.63,4.7-.81.94-.67.67-1.48.94-.81.27-2.42.67-3.63.54-1.34-.18-2.55-.58-3.63-1.21-.81-.81-1.48-2.42-1.88-3.22-.4-.94-.54-1.21-.54-2.15l.4-3.49c.18-1.52.72-3.27,1.61-5.24.94-1.75,1.88-3.49,4.16-5.64,2.15-2.02,7.52-5.51,9.13-6.85,1.61-1.34,1.21-2.15.54-3.63-2.69-5.16-6.33-9.77-10.75-13.57-2.42-1.88-5.51-3.22-7.79-4.3-2.15-1.21-2.01-1.21-5.78-2.42-3.76-1.07-13.16-3.63-16.79-4.84-3.63-1.07-2.82-.94-5.1-2.01l-8.19-4.3c-1.75-.94-1.34-.54-2.69-1.61l-5.51-4.57c-2.18-1.93-3.77-4.45-4.57-7.25-.45-1.52-.45-2.87,0-4.03.4-1.34,0-1.21,2.01-3.63,2.15-2.42,7.25-7.93,10.21-10.75,3.09-2.82,4.97-4.03,7.79-6.04,5.43-3.82,11.09-7.32,16.93-10.48,2.42-1.21,5.37-2.02,7.12-2.69,1.61-.81,2.64-1.43,3.09-1.88.54-.4.67.54.4-.94-.4-1.48-1.88-4.97-2.28-7.66-.4-2.82-.4-6.18,0-8.73.36-2.42,1.03-4.66,2.01-6.72,1.16-2.24,2.46-4.3,3.9-6.18,1.34-1.7,2.91-3.04,4.7-4.03,1.75-1.07,4.3-2.01,6.18-2.42,1.61-.45,3.13-.58,4.57-.4l4.57.27c1.34.18,2.55.49,3.63.94,1.07.54,2.55,1.48,3.09,2.01.4.67.67.13-.27,1.61-1.07,1.48-4.16,4.57-5.78,7.12-1.61,2.69-2.96,5.6-4.03,8.73-.94,3.22-1.88,8.73-2.01,10.75-.27,2.15,4.7,1.75,5.1.54.54-1.07.27-2.55,1.07-5.1.81-2.42,2.42-7.25,3.9-9.81,1.34-2.55,2.82-3.76,4.57-5.51,1.79-1.88,3.67-3.45,5.64-4.7,1.88-1.21,3.22-1.75,5.64-2.28,2.42-.4,6.18-.67,8.73-.67,2.42,0,3.9.13,6.18.94,2.15.81,5.24,2.69,7.12,4.03,1.79,1.52,3.22,3.09,4.3,4.7,1.21,1.61,1.88,2.96,2.55,5.1.67,2.15,1.34,5.1,1.34,7.66,0,2.69-.54,6.04-1.21,8.19-.63,2.24-1.43,4.03-2.42,5.37-.67,1.34-.94,1.61-2.15,2.82-1.21,1.34-3.22,3.22-4.97,4.57-1.75,1.21-4.43,2.28-5.51,3.22-.94.81-.4,2.51.4,2.42.94.13,1.75.4,4.57-.13,2.82-.4,8.33-2.15,12.22-2.82,11.99-2.63,24.41-2.63,36.4,0,3.22.54,4.16,1.07,6.31,1.75l6.04,2.28c2.42,1.07,5.51,2.42,8.19,4.16,8.15,5.36,15.14,12.3,20.55,20.42,1.61,2.42,2.87,4.66,3.76,6.72,1.85,4.51,3.42,9.13,4.7,13.84.67,2.82,1.21,4.43,1.61,8.19.4,3.76.4,11.82.54,14.37.27,2.55-.13,2.28,1.75,1.34,1.75-.94,20.09-7.74,30.63-31.57,9.16-20.71,1.9-47.26-2.28-55.34-1.75-3.22-4.16-6.99-6.31-9.81-4.44-5.14-9.6-9.62-15.31-13.3-2.96-1.7-5.55-3.09-7.79-4.16-4.33-1.6-8.77-2.86-13.3-3.76l-6.18-.4h-14.37c-2.69-.27-3.1-3.18-.54-4.3,3.64-1.58,9.88-2.63,18.54-2.42,8.78.21,14.91,1.88,17.33,2.55,13.98,3.94,30.19,16.65,38.55,30.76,6.61,11.16,9.81,29.96,9.81,29.96.37,1.75,2.18,1.66,3.08.35ZM232.78,345.3c-3.91,0-7.08,3.17-7.08,7.08s3.17,7.08,7.08,7.08,7.08-3.17,7.08-7.08-3.17-7.08-7.08-7.08Z"/></svg>';
   }
 });
 
@@ -15805,7 +16094,7 @@ var init_remoteCodexExecutionContext = __esm({
       "SHELL",
       "TMPDIR"
     ]);
-    ignoredEnvOverrideKeys = /* @__PURE__ */ new Set(["PATH"]);
+    ignoredEnvOverrideKeys = /* @__PURE__ */ new Set(["PATH", "GIT_PAGER"]);
     deniedEnvKeys = /* @__PURE__ */ new Set([
       "BASH_ENV",
       "ENV",
@@ -18430,7 +18719,7 @@ var linzumiCliVersion, linzumiCliVersionText;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    linzumiCliVersion = "0.0.86-beta";
+    linzumiCliVersion = "0.0.88-beta";
     linzumiCliVersionText = `linzumi ${linzumiCliVersion}`;
   }
 });
@@ -20819,7 +21108,7 @@ function createLinzumiMcpApiClient(options) {
   const baseUrl = kandanHttpBaseUrl(options.kandanUrl);
   const apiPrefix = options.authMode === "personal-agent-delegation" ? "/api/v2/personal-agent-mcp" : "/api/v2/local-runner-mcp";
   const operatingMode = options.operatingMode ?? "text";
-  const request = async (method, path2, params) => {
+  const request = async (method, path2, params, requestOptions = {}) => {
     const url = new URL(path2, baseUrl);
     const paramsWithMode = {
       ...params,
@@ -20827,7 +21116,11 @@ function createLinzumiMcpApiClient(options) {
     };
     const requestInit = {
       method,
-      headers: { authorization: `Bearer ${options.accessToken}` }
+      headers: { authorization: `Bearer ${options.accessToken}` },
+      // An aborted signal cancels the in-flight fetch so a caller that has
+      // already given up (e.g. a timed-out goal seed) cannot land a LATE POST
+      // and clobber state written after it gave up (#1864 finding 2).
+      ...requestOptions.signal === void 0 ? {} : { signal: requestOptions.signal }
     };
     if (method === "GET") {
       for (const [key, value] of Object.entries(paramsWithMode)) {
@@ -20860,9 +21153,11 @@ function createLinzumiMcpApiClient(options) {
     getMessage: (params) => request("GET", `${apiPrefix}/message`, params),
     getThread: (params) => request("GET", `${apiPrefix}/thread`, params),
     getChannel: (params) => request("GET", `${apiPrefix}/channel`, params),
+    searchWorkspace: (params) => request("GET", `${apiPrefix}/search`, params),
+    askWorkspace: (params) => request("POST", `${apiPrefix}/ask`, params),
     getCodingJobMetadata: (params) => request("GET", `${apiPrefix}/coding-job-metadata`, params),
     renameCodingJob: (params) => request("POST", `${apiPrefix}/coding-job-title`, params),
-    upsertCodingJobPlan: (params) => request("POST", `${apiPrefix}/coding-job-plan`, params),
+    upsertCodingJobPlan: (params, requestOptions) => request("POST", `${apiPrefix}/coding-job-plan`, params, requestOptions),
     replaceCodingJobPlanSteps: (params) => request("POST", `${apiPrefix}/coding-job-plan/steps`, params),
     updateCodingJobPlanStep: (params) => request("POST", `${apiPrefix}/coding-job-plan/step`, params),
     linkCodingJobPullRequest: (params) => request("POST", `${apiPrefix}/coding-job-primary-pr`, params),
@@ -25649,29 +25944,18 @@ async function applyControl(codex, kandan, topic, instanceId, options, agentProv
         approvalPolicy: stringValue(control.approvalPolicy) ?? void 0
       });
       if (applied.approval_policy === "never") {
-        const pendingForSession = [
-          ...pendingClaudeCodeApprovals.entries()
-        ].filter(
-          ([, pending]) => pending.sessionId === void 0 || pending.sessionId === control.threadId
-        );
-        for (const [requestId, pending] of pendingForSession) {
-          pending.resolve({ type: "allow" });
-          await publishClaudeCodeMessageState(kandan, topic, {
-            workspace: pending.workspace,
-            channel: pending.channel,
-            threadId: pending.threadId,
-            sourceSeq: pending.sourceSeq,
-            status: "processing",
-            reason: "Claude Code tool approved",
-            sessionId: pending.sessionId ?? control.threadId
-          });
-          log2("claude_code.approval_request_auto_approved", {
-            request_id: requestId,
-            source_seq: pending.sourceSeq,
-            session_id: pending.sessionId ?? control.threadId,
-            reason: "full_access_enabled"
-          });
-        }
+        await settleClaudeCodeApprovalsForSession({
+          kandan,
+          topic,
+          pendingClaudeCodeApprovals,
+          // activeClaudeCodeSessions is keyed by the SDK session id, so
+          // control.threadId here is the SDK session id, NOT the linzumi thread
+          // id. The drain matches pending approvals by their linzumi threadId,
+          // so pass the session's stored linzumi threadId (Codex PR #1846 P1).
+          sessionThreadId: claudeSession.threadId,
+          log: log2,
+          reason: "full_access_enabled"
+        });
       }
       return {
         instanceId,
@@ -25800,12 +26084,18 @@ function truncateFailureDetail(message) {
 }
 function commanderDeveloperInstructions(args) {
   const agentLabel = args.agentLabel ?? "Codex";
-  const planStepsInstruction = args.planTool === "todo-write" ? `For coding-job threads, start by setting the current goal with
-linzumi_upsert_coding_job_plan, then record the plan steps with the TodoWrite
-tool. Linzumi mirrors your TodoWrite list into the coding-job plan steps
-automatically, one TodoWrite item per plan step.` : `For coding-job threads, start by setting the current goal with
-linzumi_upsert_coding_job_plan, then replace the plan steps with
-linzumi_replace_coding_job_plan_steps.`;
+  const planOpener = `Before you begin ANY work - and again whenever the job
+changes - call linzumi_upsert_coding_job_plan to set or refresh the current
+goal and the high-level plan. Always record the plan up front, before starting
+work, so the user can see a high-level view of what you are doing at all times
+and trust your work. Keep it accurate as you go: whenever you discover steps to
+add, steps that are no longer needed, or the nature of the job changes, update
+it with linzumi_upsert_coding_job_plan.`;
+  const planStepsInstruction = args.planTool === "todo-write" ? `${planOpener}
+Record and maintain the plan STEPS with the TodoWrite tool. Linzumi mirrors
+your TodoWrite list into the coding-job plan steps automatically, one TodoWrite
+item per plan step.` : `${planOpener}
+Replace the plan STEPS with linzumi_replace_coding_job_plan_steps.`;
   const planUpdateInstruction = args.planTool === "todo-write" ? `As work proceeds, update each step's status with TodoWrite. Do not call
 linzumi_replace_coding_job_plan_steps or linzumi_update_coding_job_plan_step
 directly; TodoWrite is the source of truth for the plan steps.` : `As work proceeds, update each step with linzumi_update_coding_job_plan_step.`;
@@ -26194,6 +26484,14 @@ async function startCodexProviderInstance(args) {
     }
   };
 }
+function claudeCodeTurnStallThresholdMs(env) {
+  const raw = env.LINZUMI_CLAUDE_TURN_STALL_MS?.trim();
+  if (raw === void 0 || raw === "") {
+    return defaultClaudeCodeTurnStallThresholdMs;
+  }
+  const parsed = Number.parseInt(raw, 10);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : defaultClaudeCodeTurnStallThresholdMs;
+}
 function createClaudeCodeInputQueue(input) {
   const pendingMessages = [
     claudeCodeUserInputMessage(input.content)
@@ -26521,6 +26819,7 @@ async function startClaudeCodeProviderInstance(args) {
     args.options,
     args.control
   );
+  const initialPermissionMode = runtimeSettings.approvalPolicy === void 0 ? void 0 : claudePermissionModeForApprovalPolicy(runtimeSettings.approvalPolicy);
   if (args.resumeSessionId !== void 0) {
     try {
       await validateClaudeCodeResumeSession({
@@ -26557,18 +26856,54 @@ async function startClaudeCodeProviderInstance(args) {
   let startControlResponded = false;
   let activeSessionId;
   let sessionControls;
+  let startupApprovalDrain;
   const planMirrorClient = createLinzumiMcpApiClient({
     kandanUrl: args.options.kandanUrl,
     accessToken: args.options.token,
     fetchImpl: args.options.fetch,
     operatingMode: "text"
   });
+  const seededGoal = workDescription.trim().slice(0, 2e3);
   const planMirror = createClaudeCodePlanMirror({
     replacePlanSteps: planMirrorClient.replaceCodingJobPlanSteps,
     threadId,
-    goal: workDescription.trim().slice(0, 2e3),
+    goal: seededGoal,
     log: args.log
   });
+  const seedCodingJobGoalBeforeTurn = async () => {
+    if (args.resumeSessionId !== void 0) {
+      return;
+    }
+    const seedTimeoutMs = 5e3;
+    const seedAbort = new AbortController();
+    let timeoutHandle;
+    const timedOut = new Promise((resolve12) => {
+      timeoutHandle = setTimeout(() => {
+        seedAbort.abort(new Error("claude goal seed timed out"));
+        args.log("claude_code.goal_seed_timeout", {
+          thread_id: threadId,
+          timeout_ms: seedTimeoutMs
+        });
+        resolve12();
+      }, seedTimeoutMs);
+    });
+    try {
+      await Promise.race([
+        seedClaudeCodingJobGoal({
+          upsertCodingJobPlan: planMirrorClient.upsertCodingJobPlan,
+          threadId,
+          goal: seededGoal,
+          log: args.log,
+          signal: seedAbort.signal
+        }),
+        timedOut
+      ]);
+    } finally {
+      if (timeoutHandle !== void 0) {
+        clearTimeout(timeoutHandle);
+      }
+    }
+  };
   const adapter = createClaudeCodeSessionPipeline({
     instanceId: args.instanceId,
     cwd: args.cwd,
@@ -26874,6 +27209,7 @@ async function startClaudeCodeProviderInstance(args) {
   });
   const runSession = async () => {
     let result2;
+    await seedCodingJobGoalBeforeTurn();
     try {
       try {
         result2 = await startClaudeCodeSession({
@@ -26887,9 +27223,35 @@ async function startClaudeCodeProviderInstance(args) {
             linzumiContext
           }),
           model: claudeCodeModelForRuntimeModel(runtimeSettings.model),
+          // Apply the user's initial access level at session START, mirroring
+          // codex (which seeds approvalPolicy / sandbox via
+          // codexThreadRuntimeOverrides at start). Without this every Claude
+          // Code session started in the SDK's 'default' mode and the no-prompt
+          // ("never" -> bypassPermissions) level only took effect once an
+          // update_session_settings control arrived post-start - so WebFetch
+          // (no built-in allowlist) still raised an approval card on turn 1.
+          // The mode is derived from runtimeSettings.approvalPolicy, which the
+          // server already gates so only "never" (paired with a full-access
+          // sandbox) survives to map to bypassPermissions; lesser levels keep
+          // their 'default' / 'acceptEdits' modes.
+          ...initialPermissionMode === void 0 ? {} : { permissionMode: initialPermissionMode },
           resumeSessionId: args.resumeSessionId,
           abortController,
           streamingInput: inputQueue,
+          // PROD-RESILIENCE turn-stall watchdog (real-SDK sessions only; mock
+          // runners drive their own timing). A turn that stays in flight with
+          // no SDK output past the threshold is a wedged SILENT subprocess: the
+          // watchdog aborts it and fails the turn so the thread reconnects,
+          // instead of sitting "processing" forever (the ~28-min-hang incident).
+          // The in-flight predicate (currentSourceSeq() is defined only while a
+          // turn is queued/active) keeps a keep-alive session idling between
+          // turns from being a false positive.
+          ...args.options.claudeCodeRunner === void 0 ? {
+            turnStallThresholdMs: claudeCodeTurnStallThresholdMs(
+              process.env
+            ),
+            turnStallIsActive: () => inputQueue.currentSourceSeq() !== void 0
+          } : {},
           runner: args.options.claudeCodeRunner,
           canUseTool,
           ...mcpServers === void 0 ? {} : { mcpServers },
@@ -26904,6 +27266,22 @@ async function startClaudeCodeProviderInstance(args) {
           allowedTools: ["mcp__linzumi__*"],
           onSessionControls: (controls) => {
             sessionControls = controls;
+            if (initialPermissionMode === "bypassPermissions") {
+              startupApprovalDrain = settleClaudeCodeApprovalsForSession({
+                kandan: args.kandan,
+                topic: args.topic,
+                pendingClaudeCodeApprovals: args.pendingClaudeCodeApprovals,
+                sessionThreadId: threadId,
+                log: args.log,
+                reason: "full_access_started"
+              }).catch((error) => {
+                args.log("claude_code.startup_approval_drain_failed", {
+                  linzumi_thread_id: threadId,
+                  claude_session_id: activeSessionId ?? null,
+                  message: error instanceof Error ? error.message : String(error)
+                });
+              });
+            }
           },
           onTurnCompleted: () => {
             inputQueue.completeTurn();
@@ -26996,6 +27374,9 @@ async function startClaudeCodeProviderInstance(args) {
       message: error instanceof Error ? error.message : String(error)
     });
   }
+  if (startupApprovalDrain !== void 0) {
+    await startupApprovalDrain;
+  }
   void sessionWork.then(
     () => {
       args.log("claude_code.session_loop_ended", {
@@ -27031,6 +27412,35 @@ function claudePermissionModeForApprovalPolicy(approvalPolicy) {
       return void 0;
   }
 }
+function claudeCodeApprovalsForSessionThread(pendingClaudeCodeApprovals, sessionThreadId) {
+  return [...pendingClaudeCodeApprovals.entries()].filter(
+    ([, pending]) => pending.threadId === sessionThreadId
+  );
+}
+async function settleClaudeCodeApprovalsForSession(args) {
+  const pendingForSession = claudeCodeApprovalsForSessionThread(
+    args.pendingClaudeCodeApprovals,
+    args.sessionThreadId
+  );
+  for (const [requestId, pending] of pendingForSession) {
+    pending.resolve({ type: "allow" });
+    await publishClaudeCodeMessageState(args.kandan, args.topic, {
+      workspace: pending.workspace,
+      channel: pending.channel,
+      threadId: pending.threadId,
+      sourceSeq: pending.sourceSeq,
+      status: "processing",
+      reason: "Claude Code tool approved",
+      sessionId: pending.sessionId ?? args.sessionThreadId
+    });
+    args.log("claude_code.approval_request_auto_approved", {
+      request_id: requestId,
+      source_seq: pending.sourceSeq,
+      session_id: pending.sessionId ?? args.sessionThreadId,
+      reason: args.reason
+    });
+  }
+}
 function claudeSteerInputText(input) {
   const items = arrayValue(input) ?? [];
   const text2 = items.flatMap((item) => {
@@ -29202,6 +29612,7 @@ var init_runner = __esm({
     init_engineChildReaper();
     init_claudeCodeLiveBashOutput();
     init_claudeCodeSession();
+    init_claudeCodeTurnStallWatchdog();
     init_codexAppServer();
     init_codexProjectTrust();
     init_codexRuntimeOptions();
@@ -65955,6 +66366,60 @@ async function runMcpServer(args) {
       },
       async (params) => mcpJsonResult(await client.getChannel(params))
     );
+    server.tool(
+      "linzumi_search_workspace",
+      "Search the Linzumi workspace with hybrid lexical+semantic retrieval, scoped to what the authorizing user can access. Returns scored content chunks with provenance (channel, thread, authored time) and a permalink to cite.",
+      {
+        workspace: external_exports2.string().optional().describe(
+          "Workspace slug. Omit to use the authenticated token scope."
+        ),
+        query: external_exports2.string().min(1).describe("Natural-language or keyword query to retrieve against."),
+        limit: external_exports2.number().int().min(1).max(25).optional().describe("Maximum results to return (default 10, server-capped)."),
+        source_types: external_exports2.array(
+          external_exports2.enum([
+            "message",
+            "coding_job",
+            "github_pr",
+            "github_pr_review",
+            "github_check_run",
+            "github_workflow_run",
+            "github_diff",
+            "dictation",
+            "file"
+          ])
+        ).optional().describe("Restrict results to these corpora; omit for all."),
+        authored_after: external_exports2.string().optional().describe(
+          "ISO8601 instant; only content authored at or after this time."
+        ),
+        authored_before: external_exports2.string().optional().describe(
+          "ISO8601 instant; only content authored at or before this time."
+        ),
+        repo: external_exports2.string().optional().describe(
+          "Restrict GitHub-sourced results to one repository by full name (owner/name)."
+        ),
+        check_status: external_exports2.enum(["pending", "success", "failed"]).optional().describe(
+          "Restrict check and workflow results to one conclusion bucket."
+        )
+      },
+      async (params) => mcpJsonResult(await client.searchWorkspace(params))
+    );
+    server.tool(
+      "linzumi_ask_workspace",
+      'Ask the Linzumi workspace a natural-language question and get a synthesized, citation-backed answer over what the authorizing user can access. Costs an LLM call on cache misses, so prefer linzumi_search_workspace for simple lookups. A "refused" status means there was not enough accessible evidence - treat it as "the workspace does not know", never retry verbatim.',
+      {
+        workspace: external_exports2.string().optional().describe(
+          "Workspace slug. Omit to use the authenticated token scope."
+        ),
+        question: external_exports2.string().min(1).max(2e3).describe("Natural-language question to answer with citations."),
+        channel: external_exports2.string().optional().describe(
+          "Optional channel slug providing conversational context; never widens access."
+        ),
+        allow_cached: external_exports2.boolean().optional().describe(
+          "Allow serving a cached synthesis when the evidence set is unchanged (default true). Set false to force fresh synthesis."
+        )
+      },
+      async (params) => mcpJsonResult(await client.askWorkspace(params))
+    );
     server.tool(
       "linzumi_get_coding_job_metadata",
       "Read the active coding job workflow metadata for a thread, including the agent-owned goal, ordered plan steps, step lock versions, and workflow status.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@linzumi/cli",
-  "version": "0.0.86-beta",
+  "version": "0.0.88-beta",
   "description": "Linzumi CLI — point a Codex agent at the real code on your laptop, with your team watching and steering from shared threads.",
   "type": "module",
   "bin": {