@monster-orange/den 0.4.13 → 0.4.15

package/src/ui/server/public/i18n/ja.js

@@ -260,6 +260,8 @@
     "err.signin.noTerminal":
       "{host} のターミナルがありませんか?このコンピューターで次を実行します:",
     "err.signin.openTerminal": "ターミナルを開く",
+    "err.signin.sshUserNote":
+      "{host} のアカウント({user})とそのパスワード、または SSH キーでログインします。",
     "err.signin.sshNote":
       "「ターミナルを開く」はターミナルアプリで ssh://{target} を開きます。{target} への SSH アクセスが必要です。",
     "err.signin.whyTitle": "なぜ?",
@@ -439,6 +441,14 @@
     "ag.new.plainP":
       "ワークスペースのフォルダーで開くターミナル。エージェントなし。",
     "ag.new.task": "最初の指示（任意）",
+    "ag.new.name": "名前（任意）",
+    "ag.new.as": "{id} として開始します",
+    "ag.new.openRunning": "実行中のものを開く",
+    "ag.new.isRunning": "{id} はすでに実行中です",
+    "ag.new.openIt": "開く",
+    "ag.new.isStopped": "{id} は停止しています",
+    "ag.new.resumeIt": "再開する",
+    "ag.new.orNext": "または開始で {id} を作成します",
     "ag.new.taskPh":
       "例: 空の状態のストーリーを担当。デザインに合わせ、テストを追加する。",
     "ag.new.adv": "詳細設定: モデルと権限",
@@ -448,6 +458,51 @@
     "ag.new.modelDef": "ペルソナの既定（{m}）",
     "ag.new.ver": "バージョン",
     "ag.new.verDef": "ペルソナの既定（{v}）",
+    // AG-17.1, Bring in.
+    "ag.bring": "取り込む",
+    "ag.bring.title": "会話を取り込む",
+    "ag.bring.conv": "会話",
+    "ag.bring.help":
+      "このワークスペースのフォルダーまたはそのリポジトリのフォルダーで、Den の外で始めた会話です。新しい順に並びます。",
+    "ag.bring.none":
+      "このワークスペースのフォルダーやそのリポジトリのフォルダーに、Den の外で始めた会話はありません。",
+    "ag.bring.untitled": "無題の会話",
+    "ag.bring.open": "別の場所で開いています",
+    "ag.bring.openTip":
+      "まだ別のターミナルで開いています。先にそちらで閉じてください",
+    "ag.bring.agent": "エージェント {id}",
+    "ag.bring.note":
+      "実行していたフォルダーで続けます。ここからは Den のツールとガードが適用されます。ペインを閉じても実行は続きます。先にほかのターミナルで閉じてください。Den が開いていると判断できるのは、直近 1 分以内に書き込まれた会話だけです。",
+    "ag.bring.go": "取り込む",
+    "ag.bring.going": "取り込み中…",
+    "ag.bring.done": "{id} として取り込みました",
+    "ag.bring.now": "たった今",
+    "ag.bring.min": "{n} 分前",
+    "ag.bring.h": "{n} 時間前",
+    "ap.title": "{agent}が次のことを求めています:",
+    "ap.agent": "エージェント {name} ",
+    "ap.noAgent": "このマシン上の何か（エージェントの識別なし）",
+    "ap.noAgentWarn":
+      "エージェントにこれを頼んでいなければ、拒否してください。",
+    "ap.signin.title": "承認を待っているものがあります。",
+    "ap.signin":
+      "サインインすると表示されます: {cmd} を実行してリンクを開いてください。",
+    "ap.do.workspace_create": "ワークスペース「{name}」を作成",
+    "ap.do.repo_add":
+      "{path} のリポジトリをワークスペース「{workspace}」に追加",
+    "ap.do.repo_add.new":
+      "{path} のリポジトリを新しいワークスペース「{workspace}」に追加",
+    "ap.do.service_try": "{service} を起動",
+    "ap.says": "エージェントのコメント:",
+    "ap.review": "確認",
+    "ap.hide": "詳細を隠す",
+    "ap.later": "あとで",
+    "ap.deny": "拒否",
+    "ap.allow": "許可",
+    "ap.waits": "許可するまで何も変わりません。{time} まで待ちます。",
+    "ap.more": "ほかに {n} 件が待機中",
+    "ap.failed": "実行しましたが失敗しました: {error}",
+    "ap.done": "完了: {what}",
     "ag.new.note":
       "ワークスペースのフォルダーで開始します。ペインを閉じても実行は続きます。",
     "ag.new.started": "{w} で {p} を開始しました",

package/src/ui/server/public/index.html

@@ -355,7 +355,7 @@
         white-space: nowrap;
       }
       .run-btn:hover:not(:disabled) {
-        opacity: 0.85;
+        filter: brightness(0.92);
       }
       .run-btn:disabled {
         opacity: 0.45;

package/src/ui/server/public/local-dev.html

@@ -344,7 +344,7 @@
         cursor: pointer;
       }
       .new-ws-form button:hover {
-        opacity: 0.85;
+        filter: brightness(0.92);
       }
       /* ── Content ──────────────────────────────────────────────────────────── */
       .content {
@@ -552,7 +552,7 @@
         cursor: pointer;
       }
       .add-btn:hover {
-        opacity: 0.85;
+        filter: brightness(0.92);
       }
       .form-msg {
         font-size: 11px;
@@ -688,8 +688,9 @@
       .add-svc-row.selected {
         background: color-mix(in srgb, var(--accent) 9%, transparent);
       }
+      /* Already in the workspace: readable (WCAG AA), not dimmed. */
       .add-svc-row.already {
-        opacity: 0.4;
+        color: var(--muted);
       }
       .add-svc-row-info {
         flex: 1;
@@ -839,7 +840,7 @@
         cursor: pointer;
       }
       .add-svc-submit:hover {
-        opacity: 0.85;
+        filter: brightness(0.92);
       }
       .add-svc-submit:disabled {
         opacity: 0.45;

package/src/ui/server/public/persona-ui.css

@@ -315,6 +315,20 @@ dialog.pe-dlg::backdrop {
   text-overflow: ellipsis;
   white-space: nowrap;
 }
+/* Bring in: the title is cut, never its badge ("Agent reviewer"). */
+.pr .pn.pnc {
+  display: flex;
+  align-items: center;
+  gap: 6px;
+}
+.pr .pnc .pt {
+  min-width: 0;
+  overflow: hidden;
+  text-overflow: ellipsis;
+}
+.pr .pnc .tagx {
+  flex: none;
+}
 .pr .pn .role,
 .prow .pn .role {
   color: var(--faint);
@@ -537,3 +551,34 @@ dialog.pe-dlg::backdrop {
   padding: 2px 9px;
   font-size: 12.5px;
 }
+
+/* AG-17.1, Bring in: a conversation that can't be picked (open elsewhere,
+   or an agent already continues it). */
+.pr[aria-disabled="true"] {
+  opacity: 0.6;
+  cursor: default;
+}
+.pr[aria-disabled="true"]:hover {
+  background: none;
+}
+
+/* ON-3's approval dialog (shell.js, every page): the Start dialog's frame,
+   the request in the body text's size and weight, and Review's lines in
+   the mono box the persona Details use. */
+.den-ap-dlg .den-ap-what {
+  color: var(--text);
+  font: 600 14.5px/1.45 var(--sans);
+  overflow-wrap: anywhere;
+}
+.den-ap-dlg .den-ap-det {
+  margin: 0;
+  max-height: 260px;
+  overflow: auto;
+  padding: 10px 12px;
+  border: 1px solid var(--border);
+  border-radius: var(--radius-button, 6px);
+  background: var(--surface, var(--raised));
+  font: 12px/1.5 var(--mono);
+  white-space: pre-wrap;
+  overflow-wrap: anywhere;
+}

package/src/ui/server/public/release.html

@@ -398,7 +398,6 @@
       .loading-note .sub {
         display: block;
         margin-top: 4px;
-        opacity: 0.75;
         font-size: 11px;
       }
       .loading-dots::after {

package/src/ui/server/public/settings-registry.js

@@ -160,7 +160,9 @@ export function deviceLine(d, now = Date.now()) {
       ? `signed in with GitHub${d.login ? ` (@${d.login})` : ""}`
       : d.via === "code"
         ? "approved with a code"
-        : "signed in with a one-time link";
+        : d.via === "claim"
+          ? "claimed with a setup link"
+          : "signed in with a one-time link";
   const name = d.name || "Unknown browser";
   const from = d.client || d.host;
   return {

package/src/ui/server/public/settings.html

@@ -340,10 +340,18 @@
       .set-radio:hover {
         background: var(--sunken);
       }
+      /* Not installed: the option stays readable (WCAG AA); only its
+         radio dims. */
       .set-radio.off {
-        opacity: 0.5;
+        color: var(--muted);
         cursor: default;
       }
+      .set-radio.off:hover {
+        background: none;
+      }
+      .set-radio.off input {
+        opacity: 0.5;
+      }
       .set-radio input {
         accent-color: var(--accent);
         margin: 0;

package/src/ui/server/public/shell.js

@@ -383,6 +383,8 @@
     "err.signin.noTerminal":
       "Don't have a terminal on {host}? From this computer, run:",
     "err.signin.openTerminal": "Open Terminal",
+    "err.signin.sshUserNote":
+      "Log in with your {host} account ({user}) and its password, or an SSH key.",
     "err.signin.sshNote":
       "Open Terminal opens ssh://{target} in your terminal app. It needs SSH access to {target}.",
     "err.signin.whyTitle": "Why?",
@@ -566,6 +568,14 @@
     "ag.new.plain": "Plain session",
     "ag.new.plainP": "A terminal in the workspace folder. No agent.",
     "ag.new.task": "First instruction (optional)",
+    "ag.new.name": "Name (optional)",
+    "ag.new.as": "Starts as {id}",
+    "ag.new.openRunning": "Open the running one",
+    "ag.new.isRunning": "{id} is already running",
+    "ag.new.openIt": "Open it",
+    "ag.new.isStopped": "{id} is stopped",
+    "ag.new.resumeIt": "Resume it",
+    "ag.new.orNext": "or Start makes {id}",
     "ag.new.taskPh":
       "e.g. Take the empty-state story. Match the design and add a test.",
     "ag.new.adv": "Advanced: model and permissions",
@@ -575,6 +585,47 @@
     "ag.new.modelDef": "Persona default ({m})",
     "ag.new.ver": "Version",
     "ag.new.verDef": "Persona default ({v})",
+    // AG-17.1, Bring in.
+    "ag.bring": "Bring in",
+    "ag.bring.title": "Bring in a conversation",
+    "ag.bring.conv": "Conversation",
+    "ag.bring.help":
+      "Conversations started outside Den in this workspace's folder or its repos' folders, newest first.",
+    "ag.bring.none":
+      "No conversations started outside Den in this workspace's folder or its repos' folders.",
+    "ag.bring.untitled": "Untitled conversation",
+    "ag.bring.open": "Open elsewhere",
+    "ag.bring.openTip": "Still open in another terminal. Close it there first",
+    "ag.bring.agent": "Agent {id}",
+    "ag.bring.note":
+      "Continues it in the folder it ran in, with Den's tools and guards from now on. It keeps running if you close the pane. Close it in any other terminal first: Den only sees a conversation as open if it was written in the last minute.",
+    "ag.bring.go": "Bring in",
+    "ag.bring.going": "Bringing in…",
+    "ag.bring.done": "Brought in as {id}",
+    "ag.bring.now": "just now",
+    "ag.bring.min": "{n} min ago",
+    "ag.bring.h": "{n} h ago",
+    "ap.title": "{agent} wants to:",
+    "ap.agent": "The {name} agent",
+    "ap.noAgent": "Something on this machine (no agent identity)",
+    "ap.noAgentWarn": "If you didn't ask an agent to do this, Deny.",
+    "ap.signin.title": "Something is waiting for your approval.",
+    "ap.signin": "Sign in to see it: run {cmd} and open the link.",
+    "ap.do.workspace_create": 'Create the workspace "{name}"',
+    "ap.do.repo_add": 'Add the repo at {path} to workspace "{workspace}"',
+    "ap.do.repo_add.new":
+      'Add the repo at {path} to a new workspace "{workspace}"',
+    "ap.do.service_try": "Start {service}",
+    "ap.says": "Agent says:",
+    "ap.review": "Review",
+    "ap.hide": "Hide details",
+    "ap.later": "Later",
+    "ap.deny": "Deny",
+    "ap.allow": "Allow",
+    "ap.waits": "Nothing changes until you allow it. It waits until {time}.",
+    "ap.more": "{n} more waiting",
+    "ap.failed": "It ran, and failed: {error}",
+    "ap.done": "Done: {what}",
     "ag.new.note":
       "Starts in the workspace folder. It keeps running if you close the pane.",
     "ag.new.started": "Started {p} in {w}",
@@ -3829,6 +3880,37 @@
   // server start: a 403 `csrf` (the server restarted) fetches a fresh one
   // and retries once. Never sent to another origin.
   var CSRF_METHODS = { POST: 1, PUT: 1, PATCH: 1, DELETE: 1 };
+  // 0.4.15: the approval key (web-session.ts). A sign-in's 303 carries it
+  // in the URL fragment (#ak=…), which never reaches a server: keep it in
+  // this origin's localStorage (other localhost ports can't read it),
+  // strip it from the address bar, and send it with every same-origin
+  // change as X-Den-Approve-Key. Only approving needs it.
+  var APPROVE_KEY_STORE = "den.approveKey";
+  (function takeApproveKey() {
+    var m = /(?:^#|&)ak=([A-Za-z0-9_-]{43})(?:&|$)/.exec(location.hash || "");
+    if (!m) return;
+    try {
+      localStorage.setItem(APPROVE_KEY_STORE, m[1]);
+    } catch (e) {
+      /* storage blocked: this browser signs in again to approve */
+    }
+    try {
+      history.replaceState(
+        history.state,
+        "",
+        location.pathname + location.search,
+      );
+    } catch (e) {
+      location.hash = "";
+    }
+  })();
+  function approveKey() {
+    try {
+      return localStorage.getItem(APPROVE_KEY_STORE);
+    } catch (e) {
+      return null;
+    }
+  }
   var csrf = { token: null, pending: null };
   function csrfToken(fresh) {
     if (fresh) csrf.token = null;
@@ -3867,6 +3949,9 @@
       (init && init.headers) || (isRequest(input) ? input.headers : undefined),
     );
     headers.set("X-Den-CSRF", token);
+    var ak = approveKey();
+    if (ak && !headers.has("X-Den-Approve-Key"))
+      headers.set("X-Den-Approve-Key", ak);
     return Object.assign({}, init || {}, { headers: headers });
   }
   function csrfFetch(input, init) {
@@ -3935,6 +4020,257 @@
     if (!apiOffPage) csrfToken(false);
   }
 
+  // ── ON-3: an agent's held write waits for the person ─────────────────
+  // (approval-routes.ts) Every page asks GET /api/approvals every few
+  // seconds while it is in view, and opens the oldest request: Den's own
+  // words for it (the agent's note only quoted), Review (what it will do),
+  // Later, Deny, Allow. Allow and Deny go through the wrapped fetch above,
+  // so they carry the CSRF token and the approval key; the server decides
+  // who may approve (a browser that isn't signed in is told to sign in).
+  // The frame is the Start dialog's (persona-ui.css's .pe-dlg).
+  var ap = { dlg: null, shown: null, later: {}, busy: false, css: null };
+  function apCss() {
+    if (ap.css) return ap.css;
+    ap.css = new Promise(function (done) {
+      if (document.querySelector('link[href="/persona-ui.css"]')) return done();
+      var l = document.createElement("link");
+      l.rel = "stylesheet";
+      l.href = "/persona-ui.css";
+      l.onload = l.onerror = function () {
+        done();
+      };
+      document.head.appendChild(l);
+    });
+    return ap.css;
+  }
+  function apWhat(a) {
+    var p = a.params || {};
+    var key = "ap.do." + a.action + (p.isNew ? ".new" : "");
+    var s = t(key, p);
+    if (s !== key) return s;
+    s = String(a.summary || a.action);
+    return s.charAt(0).toUpperCase() + s.slice(1);
+  }
+  function apDialog() {
+    if (ap.dlg) return ap.dlg;
+    var d = document.createElement("dialog");
+    d.className = "pe-dlg den-ap-dlg";
+    d.id = "den-ap-dlg";
+    d.setAttribute("aria-labelledby", "den-ap-h");
+    d.innerHTML =
+      '<form method="dialog">' +
+      '<h2 id="den-ap-h"></h2>' +
+      '<p class="help den-ap-who" id="den-ap-who" hidden></p>' +
+      '<p class="den-ap-what" id="den-ap-what"></p>' +
+      '<p class="help" id="den-ap-note" hidden></p>' +
+      '<pre class="den-ap-det" id="den-ap-det" hidden></pre>' +
+      '<p class="help" id="den-ap-waits"></p>' +
+      '<p class="err" id="den-ap-err" role="alert" hidden></p>' +
+      '<div class="btns">' +
+      '<button type="button" class="den-btn" id="den-ap-review" aria-expanded="false" aria-controls="den-ap-det"></button>' +
+      '<span class="sp help" id="den-ap-more"></span>' +
+      '<button type="button" class="den-btn" id="den-ap-later"></button>' +
+      '<button type="button" class="den-btn" id="den-ap-deny"></button>' +
+      '<button type="button" class="den-btn primary" id="den-ap-allow"></button>' +
+      "</div></form>";
+    document.body.appendChild(d);
+    var $ = function (id) {
+      return d.querySelector("#" + id);
+    };
+    $("den-ap-review").addEventListener("click", function () {
+      var det = $("den-ap-det");
+      det.hidden = !det.hidden;
+      $("den-ap-review").textContent = t(det.hidden ? "ap.review" : "ap.hide");
+      $("den-ap-review").setAttribute("aria-expanded", String(!det.hidden));
+    });
+    $("den-ap-later").addEventListener("click", function () {
+      apLater();
+    });
+    // Esc is Later: the request keeps waiting (and the agent with it).
+    d.addEventListener("cancel", function (e) {
+      e.preventDefault();
+      apLater();
+    });
+    $("den-ap-deny").addEventListener("click", function () {
+      apDecide("deny");
+    });
+    $("den-ap-allow").addEventListener("click", function () {
+      apDecide("allow");
+    });
+    ap.dlg = d;
+    return d;
+  }
+  function apLater() {
+    if (ap.shown) ap.later[ap.shown.id] = 1;
+    apClose();
+  }
+  function apClose() {
+    ap.shown = null;
+    if (ap.dlg && ap.dlg.open) ap.dlg.close();
+  }
+  function apShow(a, more) {
+    var d = apDialog();
+    var $ = function (id) {
+      return d.querySelector("#" + id);
+    };
+    var same = ap.shown && ap.shown.id === a.id;
+    ap.shown = a;
+    // No agent token: say so, and what to do if no agent was asked.
+    $("den-ap-h").textContent = t("ap.title", {
+      agent: a.agent ? t("ap.agent", { name: a.agent }) : t("ap.noAgent"),
+    });
+    $("den-ap-who").hidden = !!a.agent;
+    $("den-ap-who").textContent = a.agent ? "" : t("ap.noAgentWarn");
+    $("den-ap-what").textContent = apWhat(a);
+    var note = $("den-ap-note");
+    note.hidden = !a.note;
+    note.textContent = a.note ? t("ap.says") + " “" + a.note + "”" : "";
+    $("den-ap-det").textContent = (a.details || []).join("\n");
+    var time = new Date(a.expiresAt);
+    $("den-ap-waits").textContent = t("ap.waits", {
+      time: isNaN(time)
+        ? ""
+        : time.toLocaleTimeString([], { hour: "2-digit", minute: "2-digit" }),
+    });
+    $("den-ap-more").textContent = more ? t("ap.more", { n: more }) : "";
+    $("den-ap-later").textContent = t("ap.later");
+    $("den-ap-deny").textContent = t("ap.deny");
+    $("den-ap-allow").textContent = t("ap.allow");
+    if (!same) {
+      $("den-ap-det").hidden = true;
+      $("den-ap-review").textContent = t("ap.review");
+      $("den-ap-review").setAttribute("aria-expanded", "false");
+      $("den-ap-err").hidden = true;
+    }
+    if (!d.open)
+      apCss().then(function () {
+        if (ap.shown && ap.shown.id === a.id && !d.open) d.showModal();
+      });
+  }
+  function apError(msg) {
+    var e = apDialog().querySelector("#den-ap-err");
+    e.textContent = msg;
+    e.hidden = false;
+  }
+  function apDecide(decision) {
+    var a = ap.shown;
+    if (!a || ap.busy) return;
+    ap.busy = true;
+    var btns = ap.dlg.querySelectorAll("button");
+    for (var i = 0; i < btns.length; i++) btns[i].disabled = true;
+    fetch("/api/approvals/" + encodeURIComponent(a.id) + "/decide", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ decision: decision }),
+    })
+      .then(function (r) {
+        return r.json().then(
+          function (b) {
+            return { ok: r.ok, b: b || {} };
+          },
+          function () {
+            return { ok: false, b: {} };
+          },
+        );
+      })
+      .then(
+        function (x) {
+          if (!x.ok) {
+            apError(x.b.error || t("ap.failed", { error: x.b.code || "?" }));
+            return;
+          }
+          var res = x.b.result;
+          if (decision === "allow" && res && res.ok === false)
+            toast(t("ap.failed", { error: res.error || "?" }));
+          else if (decision === "allow")
+            toast(t("ap.done", { what: apWhat(a) }));
+          apClose();
+          apPoll();
+        },
+        function (e) {
+          apError(String((e && e.message) || e));
+        },
+      )
+      .then(function () {
+        ap.busy = false;
+        for (var j = 0; j < btns.length; j++) btns[j].disabled = false;
+      });
+  }
+  // Reading what waits needs what approving needs (approvals.ts): the
+  // session's CSRF token and the approval key, on a GET too. A browser
+  // without them is told only that something waits, and to sign in.
+  function apList(fresh) {
+    var ak = approveKey();
+    // No approval key: only the count, to say "sign in to see it".
+    if (!ak)
+      return rawFetch("/api/approvals?count=1", {
+        cache: "no-store",
+        credentials: "same-origin",
+      }).then(function (r) {
+        return r.ok
+          ? r.json().then(function (b) {
+              return { code: "signin_to_approve", waiting: b && b.waiting };
+            })
+          : null;
+      });
+    return csrfToken(fresh).then(function (token) {
+      var h = { "X-Den-Approve-Key": ak };
+      if (token) h["X-Den-CSRF"] = token;
+      return rawFetch("/api/approvals", {
+        cache: "no-store",
+        credentials: "same-origin",
+        headers: h,
+      }).then(function (r) {
+        return r.json().then(
+          function (b) {
+            if (!fresh && r.status === 403 && b && b.code === "csrf")
+              return apList(true);
+            return b;
+          },
+          function () {
+            return null;
+          },
+        );
+      });
+    });
+  }
+  function apSignin(b) {
+    if (b && b.code === "signin_to_approve" && b.waiting > 0)
+      showBanner("approvals", {
+        title: t("ap.signin.title"),
+        text: t("ap.signin", { cmd: "__DEN_CLI__ web login" }),
+      });
+    else hideBanner("approvals");
+  }
+  function apPoll() {
+    if (document.hidden || ap.busy) return;
+    apList(false).then(
+      function (b) {
+        apSignin(b);
+        var list = (b && b.ok && b.pending) || [];
+        var open = list.filter(function (a) {
+          return !ap.later[a.id];
+        });
+        if (!open.length) return apClose();
+        var cur =
+          (ap.shown &&
+            open.filter(function (a) {
+              return a.id === ap.shown.id;
+            })[0]) ||
+          open[0];
+        apShow(cur, open.length - 1);
+      },
+      function () {},
+    );
+  }
+  if (!apiOffPage && !configBad && rawFetch) {
+    setInterval(apPoll, 3000);
+    document.addEventListener("visibilitychange", function () {
+      if (!document.hidden) apPoll();
+    });
+    setTimeout(apPoll, 300);
+  }
+
   // ── the UI language (R19): a user pref ───────────────────────────────
   // /api/settings `language` (user.yml), then a reload: the server serves
   // every page with that language's catalog from its first paint.

package/src/ui/server/request-guard.ts

@@ -17,9 +17,9 @@
  *    and sign-in (/api/web/*, /auth, /api/session/logout), the lock (R8:
  *    /api/sudo-password*), or a shell-grade route other than its own
  *    session's /api/sessions/<id>/*: agent start and resume mint tokens.
- *    403 `agent_forbidden`. One exception (AG-14.4): MCP agent_resume,
- *    when mcp.actions lists it, for another agent of its own workspace
- *    or a granted one (agent-resume-grant.ts). WS-3a (0.4.2) adds the workspace check at
+ *    403 `agent_forbidden`. Two exceptions: MCP agent_resume (AG-14.4)
+ *    and agent_import (AG-17.1), each when mcp.actions lists it, inside
+ *    its own workspace or a granted one (agent-resume-grant.ts). WS-3a (0.4.2) adds the workspace check at
  *    agentRefusal's seam.
  *  - Sign-in (§4, route-classes.ts): beyond loopback (a LAN name, a peer
  *    that isn't loopback, or the edge hostname for a client on another
@@ -61,7 +61,12 @@
 import { randomBytes, timingSafeEqual, createHash } from "crypto";
 import type * as http from "http";
 import { readMcpConfig } from "../../shared/den-config.js";
-import { agentResumeRefusal, agentResumeTarget } from "./agent-resume-grant.js";
+import {
+  agentImportRefusal,
+  agentImportTarget,
+  agentResumeRefusal,
+  agentResumeTarget,
+} from "./agent-resume-grant.js";
 import * as net from "net";
 import * as os from "os";
 import {
@@ -105,6 +110,8 @@ export interface GuardSession {
   key: string;
   /** The session's own CSRF token. */
   csrf: string;
+  /** sha256 of its approval key (approvals.ts); unset before 0.4.15. */
+  approveKeyHash?: string;
 }
 
 /** How a request reached Den. `edge` and `lan` are beyond loopback. */
@@ -718,6 +725,14 @@ export function agentRefusal(
       agentResumeRefusal(p, target.ws, target.id, mcpActions()) ??
       workspaceRefusal(p, pathname)
     );
+  // AG-17.1: MCP agent_import, opted in, inside the agent's scope (its
+  // list as well as its import: conversation titles are a person's).
+  const imp = agentImportTarget(pathname);
+  if (imp)
+    return (
+      agentImportRefusal(p, imp.ws, mcpActions()) ??
+      workspaceRefusal(p, pathname)
+    );
   if (cls === "shell-grade")
     return `${p.actor} can't ${method === "GET" ? "open" : "use"} ${pathname}: starting or resuming an agent, and the browser sessions, are a person's.`;
   return workspaceRefusal(p, pathname);