@monster-orange/den 0.4.14 → 0.4.15

package/src/shared/claim-code.ts

@@ -0,0 +1,163 @@
+/**
+ * The claim code (0.4.15, Ward 2026-11-07): how the browser the person
+ * opens at the end of the install signs in without a sign-in step, so that
+ * approving an agent's changes (which needs a signed-in browser session,
+ * even on localhost) works from the first page.
+ *
+ *  - `c1.<nonce>.<expiry>.<mac>`, the mac HMAC-SHA256(web.secret, context +
+ *    the rest), its context its own: a login code (web-session.ts) is never
+ *    a claim code, and the other way round.
+ *  - Valid for 30 minutes: an install hands it over, and the person may take
+ *    a while to open it. An expiry further out than that is refused.
+ *  - Single use. Used nonces are kept in `<state dir>/claim-nonces.json`
+ *    (0600) until they expire, so a server restart can't revive one. The
+ *    file holds nonces only, never a code. A file that won't parse refuses
+ *    every claim (fail closed); the sign-in flows still work.
+ *  - Minted by the CLI (`<cli> web claim-link`), which reads web.secret as
+ *    the same OS user. The CLI refuses inside an agent's session
+ *    (claimRefusalForAgent): an agent must never hold one.
+ *
+ * Limit: an agent running as the same OS user could, in principle, read
+ * web.secret or the browser's cookie store from disk. That is the strength
+ * of Den's other person-only routes too; only an OS boundary is stronger.
+ */
+import { createHmac, randomBytes, timingSafeEqual } from "crypto";
+import * as fs from "fs";
+import * as path from "path";
+import { ACTOR_TOKEN_ENV } from "./actor-token.js";
+import { AGENT_ACTOR_ENV } from "./sessions/env.js";
+
+export const CLAIM_CODE_TTL_MS = 30 * 60_000;
+const SKEW_MS = 5_000;
+const CONTEXT = "den-claim-v1:";
+export const CLAIM_NONCES_FILE = "claim-nonces.json";
+
+function mac(secret: Buffer, body: string): Buffer {
+  return createHmac("sha256", secret)
+    .update(CONTEXT + body)
+    .digest();
+}
+
+/** A fresh claim code, valid for 30 minutes from `now`. */
+export function mintClaimCode(
+  secret: Buffer,
+  now: number = Date.now(),
+): string {
+  const nonce = randomBytes(16).toString("base64url");
+  const body = `c1.${nonce}.${(now + CLAIM_CODE_TTL_MS).toString(36)}`;
+  return `${body}.${mac(secret, body).toString("base64url")}`;
+}
+
+export type ClaimCodeCheck =
+  | { ok: true; nonce: string; expiresAt: number }
+  | { ok: false; reason: "malformed" | "bad_mac" | "expired" };
+
+/**
+ * Whether `code` is a claim code this secret minted, still in its 30
+ * minutes. Constant-time mac. Single use is ClaimNonces'.
+ */
+export function checkClaimCode(
+  code: string,
+  secret: Buffer,
+  now: number = Date.now(),
+): ClaimCodeCheck {
+  const m =
+    /^(c1\.([A-Za-z0-9_-]{22})\.([0-9a-z]{1,11}))\.([A-Za-z0-9_-]{43})$/.exec(
+      code,
+    );
+  if (!m) return { ok: false, reason: "malformed" };
+  const given = Buffer.from(m[4], "base64url");
+  const want = mac(secret, m[1]);
+  if (given.length !== want.length || !timingSafeEqual(given, want))
+    return { ok: false, reason: "bad_mac" };
+  const expiresAt = parseInt(m[3], 36);
+  if (
+    !Number.isFinite(expiresAt) ||
+    now >= expiresAt ||
+    expiresAt - now > CLAIM_CODE_TTL_MS + SKEW_MS
+  )
+    return { ok: false, reason: "expired" };
+  return { ok: true, nonce: m[2], expiresAt };
+}
+
+/**
+ * `<origin>/auth?claim=<code>`: the sign-in route, so it is classed as one
+ * (a mutating GET: another site can't open it; an agent's token can't).
+ */
+export function claimLink(origin: string, code: string): string {
+  return `${origin.replace(/\/+$/, "")}/auth?claim=${encodeURIComponent(code)}`;
+}
+
+/**
+ * Why the CLI won't let a browser in from here (a claim link, a sign-in
+ * link, pairing a device, the GitHub owner), or null when it may: inside
+ * an agent's session (DEN_AGENT or DEN_ACTOR_TOKEN set) it never does.
+ */
+export function personGrantRefusal(env: NodeJS.ProcessEnv): string | null {
+  if (env[AGENT_ACTOR_ENV] !== undefined || env[ACTOR_TOKEN_ENV] !== undefined)
+    return "An agent can't do this: it lets a browser in as you. Run it in your own terminal.";
+  return null;
+}
+
+/** Why the CLI won't mint a claim code here, or null when it may. */
+export function claimRefusalForAgent(env: NodeJS.ProcessEnv): string | null {
+  return personGrantRefusal(env)
+    ? "An agent can't make a claim link: it signs a browser in as the person. Run it in your own terminal."
+    : null;
+}
+
+/** The used claim nonces, kept until they expire (a file, 0600). */
+export class ClaimNonces {
+  constructor(private readonly stateDir: string) {}
+
+  private file(): string {
+    return path.join(this.stateDir, CLAIM_NONCES_FILE);
+  }
+
+  /** The used nonces; null when the file is there but won't parse (fail closed). */
+  private read(): Record<string, number> | null {
+    let raw: string;
+    try {
+      raw = fs.readFileSync(this.file(), "utf-8");
+    } catch (e) {
+      return (e as NodeJS.ErrnoException).code === "ENOENT" ? {} : null;
+    }
+    let o: unknown;
+    try {
+      o = JSON.parse(raw);
+    } catch {
+      return null;
+    }
+    if (!o || typeof o !== "object" || Array.isArray(o)) return null;
+    const out: Record<string, number> = {};
+    for (const [k, v] of Object.entries(o as Record<string, unknown>))
+      if (/^[A-Za-z0-9_-]{22}$/.test(k) && typeof v === "number") out[k] = v;
+    return out;
+  }
+
+  private write(used: Record<string, number>): void {
+    fs.mkdirSync(this.stateDir, { recursive: true });
+    const tmp = `${this.file()}.${process.pid}.${randomBytes(4).toString("hex")}`;
+    fs.writeFileSync(tmp, JSON.stringify(used) + "\n", { mode: 0o600 });
+    fs.chmodSync(tmp, 0o600);
+    fs.renameSync(tmp, this.file());
+  }
+
+  /**
+   * Use `nonce` (its code expires at `expiresAt`): true the first time,
+   * false once used. Expired entries are pruned on the way.
+   */
+  consume(nonce: string, expiresAt: number, now: number = Date.now()): boolean {
+    const used = this.read();
+    // Unreadable: refuse every claim rather than forget which were used.
+    if (!used) return false;
+    for (const [k, exp] of Object.entries(used)) if (exp <= now) delete used[k];
+    if (nonce in used) {
+      this.write(used);
+      return false;
+    }
+    used[nonce] = expiresAt;
+    this.write(used);
+    return true;
+  }
+}

package/src/shared/cli-command.ts

@@ -143,6 +143,37 @@ export function sshTarget(
   return /^[a-z0-9._:-]+$/.test(h) && !h.startsWith("-") ? h : fallback;
 }
 
+/** An account name ssh can take before `@`: letters, digits, `.`, `_`, `-`. */
+const SSH_USER_RE = /^[A-Za-z0-9_][A-Za-z0-9._-]{0,63}$/;
+
+/**
+ * `web.ssh_user` as stored (SEC-2a-UX): the account the signed-out page's
+ * ssh link and command log in as. undefined when unset (the account Den
+ * runs as); "" leaves the account off. Throws naming the key otherwise.
+ */
+export function parseSshUser(v: unknown): string | undefined {
+  if (v === undefined || v === null) return undefined;
+  if (typeof v !== "string" || (v.trim() !== "" && !SSH_USER_RE.test(v.trim())))
+    throw new Error(
+      `web.ssh_user must be an account name (letters, digits, ".", "_", "-"), or "" to leave it off; got ${JSON.stringify(v)}`,
+    );
+  return v.trim();
+}
+
+/**
+ * The account for the ssh link: `setting` when set ("" for none), else
+ * `osUser` when ssh can take it, else none.
+ */
+export function sshUser(setting: string | undefined, osUser: string): string {
+  if (setting !== undefined) return setting;
+  return SSH_USER_RE.test(osUser) ? osUser : "";
+}
+
+/** `user@target`, or the bare target when there's no user. */
+export function sshLogin(target: string, user: string): string {
+  return user ? `${user}@${target}` : target;
+}
+
 /** `Mac-Studio.localdomain` → `Mac-Studio`; an IP literal stays whole. */
 export function shortHostname(hostname: string): string {
   const h = hostname.trim();

package/src/shared/den-config.ts

@@ -831,6 +831,11 @@ export interface McpConfig {
   run_tests?: { envs?: string[] };
   /** `remote: true` lets the log tools read non-local sources (e.g. CloudWatch). */
   logs?: { remote?: boolean };
+  /**
+   * The held writes (workspace_create, repo_add, service_try): on by
+   * default, each run only after the person's Allow. false hides them.
+   */
+  approvals?: boolean;
 }
 
 /** `mcp:` with its defaults applied. */
@@ -838,6 +843,8 @@ export interface ResolvedMcpConfig {
   actions: McpAction[];
   runTestsEnvs: Environment[];
   logsRemote: boolean;
+  /** Whether the held writes are registered (default true). */
+  approvals: boolean;
 }
 
 /**
@@ -865,10 +872,15 @@ export function readMcpConfig(
       return e as Environment;
     },
   );
+  if (raw.approvals !== undefined && typeof raw.approvals !== "boolean")
+    throw new Error(
+      `mcp.approvals: true or false, not ${JSON.stringify(raw.approvals)}`,
+    );
   return {
     actions: [...new Set(actions)],
     runTestsEnvs: [...new Set(runTestsEnvs)],
     logsRemote: raw.logs?.remote === true,
+    approvals: raw.approvals !== false,
   };
 }
 

package/src/shared/environment-manager/workspaces.ts

@@ -355,6 +355,26 @@ export function repoFolders(cfg: WorkspaceConfig | undefined): string[] {
     .filter((p): p is string => typeof p === "string" && path.isAbsolute(p));
 }
 
+/**
+ * Where Bring in looks for a workspace's conversations (AG-17.1). Its own
+ * folder, and everything in it; each by-path repo's folder, outside it
+ * too. When its folder is only the shared repos root (no folder of its
+ * own), the root's other subfolders are other workspaces' repos or no
+ * repo at all: only its repos' folders count, and the root itself only
+ * exactly.
+ */
+export function conversationFolders(
+  name: string,
+  cfg: WorkspaceConfig,
+  reposRoot: string,
+): { under: string[]; exact: string[] } {
+  const dir = resolveWorkspaceDir(name, cfg, reposRoot);
+  const repos = repoFolders(cfg);
+  if (path.resolve(dir) === path.resolve(reposRoot))
+    return { under: repos, exact: [dir] };
+  return { under: [dir, ...repos], exact: [] };
+}
+
 export function getWorkspaceByName(name: string): {
   name: string;
   config: WorkspaceConfig;

package/src/shared/web-session.ts

@@ -21,7 +21,7 @@ import { createHash, createHmac, randomBytes, timingSafeEqual } from "crypto";
 import * as fs from "fs";
 import * as path from "path";
 import * as yaml from "yaml";
-import { parseMachineName } from "./cli-command.js";
+import { parseMachineName, parseSshUser } from "./cli-command.js";
 import { getStateDir } from "./paths.js";
 
 export const LOGIN_CODE_TTL_MS = 60_000;
@@ -195,6 +195,12 @@ export interface WebAuthConfig {
    * page gives this machine ("runs on <name>"). Unset: the short hostname.
    */
   machineName?: string;
+  /**
+   * `web.ssh_user` (SEC-2a-UX; user.yml, else the distribution's): the
+   * account the signed-out page's ssh link logs in as. Unset: the account
+   * Den runs as. "": no account on the page.
+   */
+  sshUser?: string;
 }
 
 /** `web.edge_unattested`'s values. */
@@ -290,8 +296,13 @@ export function readWebAuthConfig(
   const clientId =
     clientIdOf(user, "config/local/user.yml") ?? clientIdOf(team, configFile);
   const machineName = parseMachineName(user.machine_name);
+  const sshUser =
+    user.ssh_user !== undefined
+      ? parseSshUser(user.ssh_user)
+      : parseSshUser(team.ssh_user);
   return {
     ...(machineName ? { machineName } : {}),
+    ...(sshUser !== undefined ? { sshUser } : {}),
     allowPlainHttpRemote: plain === true,
     ignored,
     edgeUnattested: unattested ?? "signin",
@@ -319,6 +330,43 @@ function clientIdOf(
   return v.trim();
 }
 
+// ── The approval key (0.4.15) ─────────────────────────────────────────────
+
+/**
+ * Why a cookie alone can't approve an agent's change: browsers send a
+ * localhost cookie to every localhost port (cookies ignore ports), so a
+ * dev server an agent runs on another port receives Den's session cookie,
+ * and GET /api/session gives any cookie holder the session's CSRF token.
+ * The approval key is a second secret only the signed-in page holds: it
+ * comes in the sign-in's own answer (a 303's URL fragment, which never
+ * reaches a server, or the sign-in poll's JSON), the page keeps it in its
+ * localStorage (per origin, port included), and sends it as
+ * X-Den-Approve-Key.
+ */
+export const APPROVE_KEY_HEADER = "x-den-approve-key";
+/** The fragment parameter a sign-in's 303 carries it in. */
+export const APPROVE_KEY_FRAGMENT = "ak";
+
+export function approveKeyHash(key: string): string {
+  return createHash("sha256").update(`den-approve-v1:${key}`).digest("hex");
+}
+
+/** Whether `given` is the key whose hash the session keeps (constant time). */
+export function approveKeyMatches(
+  storedHash: string | undefined,
+  given: string | undefined | null,
+): boolean {
+  if (!storedHash || !given || !/^[A-Za-z0-9_-]{43}$/.test(given)) return false;
+  const a = Buffer.from(approveKeyHash(given), "hex");
+  const b = Buffer.from(storedHash, "hex");
+  return a.length === b.length && a.length > 0 && timingSafeEqual(a, b);
+}
+
+/** `next` with the approval key in its fragment (a sign-in's 303). */
+export function withApproveKey(next: string, key: string): string {
+  return `${next.split("#")[0]}#${APPROVE_KEY_FRAGMENT}=${key}`;
+}
+
 // ── The session store ──────────────────────────────────────────────────────
 
 export interface SessionRecord {
@@ -329,14 +377,21 @@ export interface SessionRecord {
   csrf: string;
   /** The Host it was issued on. */
   host: string;
-  /** SEC-2a: how it signed in: a GitHub sign-in, or a one-time link (pairing). Unset: a link (before 0.4.5). */
-  via?: "github" | "link" | "code";
+  /** SEC-2a: how it signed in: a GitHub sign-in, a one-time link, a code (pairing), or the install's setup link (claim, 0.4.15). Unset: a link (before 0.4.5). */
+  via?: "github" | "link" | "code" | "claim";
   /** SEC-2a: the client's address when Den could attest it. */
   client?: string;
   /** SEC-2a: a GitHub sign-in's login (the chip's "@login"). */
   login?: string;
   /** SEC-2a: not yet greeted ("This device is signed in…", once). */
   welcome?: true;
+  /**
+   * 0.4.15: sha256 of this session's approval key (approvalKeyMatches).
+   * The key itself is handed over once, at the end of the sign-in, and
+   * never by GET /api/session. Unset: a session from before 0.4.15, which
+   * must sign in again to approve.
+   */
+  approveKeyHash?: string;
 }
 
 interface StoreFile {
@@ -464,14 +519,17 @@ export class WebSessionStore {
   create(meta: {
     userAgent?: string;
     host?: string;
-    via?: "github" | "link" | "code";
+    via?: "github" | "link" | "code" | "claim";
     client?: string;
     login?: string;
   }): {
     id: string;
     session: SessionView;
+    /** The approval key, for the sign-in's answer only (never stored). */
+    approveKey: string;
   } {
     const id = randomBytes(32).toString("base64url");
+    const approveKey = randomBytes(32).toString("base64url");
     const key = this.keyOf(id);
     if (!key) throw new Error("web.secret is missing: no session can be made");
     const now = this.now();
@@ -487,12 +545,13 @@ export class WebSessionStore {
       ...(meta.client ? { client: String(meta.client).slice(0, 64) } : {}),
       ...(meta.login ? { login: String(meta.login).slice(0, 64) } : {}),
       welcome: true,
+      approveKeyHash: approveKeyHash(approveKey),
     };
     const data = structuredClone(this.load());
     this.prune(data, now);
     data.sessions[key] = rec;
     this.save(data);
-    return { id, session: { key, ...rec } };
+    return { id, session: { key, ...rec }, approveKey };
   }
 
   /**

package/src/ui/cli/agent-ops.ts

@@ -116,6 +116,7 @@ import {
   restoreRecord,
   writeRecord,
   checkDisplayName,
+  nameSlug,
   writeRuntimeFiles,
   type AgentRecord,
   type Override,
@@ -138,6 +139,7 @@ import type {
   RuntimePermissions,
 } from "../../shared/agents/runtime.js";
 import {
+  inScope,
   OPEN_ELSEWHERE_MESSAGE,
   openElsewhere,
   type RuntimeConversation,
@@ -195,7 +197,7 @@ export interface AgentsDeps extends SessionsDeps {
    * AG-17.1: the folders a workspace's conversations may have run in: its
    * own folder, and each repo's path, a repo added by path outside it too.
    */
-  workspaceFolders?: (ws: string) => string[];
+  workspaceFolders?: (ws: string) => { under: string[]; exact?: string[] };
   /** The MCP server binary and its env; Den adds the scoped args. */
   mcpServer?: () => { command: string[] | string; env: Record<string, string> };
   /**
@@ -232,7 +234,7 @@ export interface AgentsResolved extends Resolved {
   agentsConfig: () => ResolvedAgentsConfig;
   distRoot: () => string;
   workspaceDir: (ws: string) => string;
-  workspaceFolders: (ws: string) => string[];
+  workspaceFolders: (ws: string) => { under: string[]; exact?: string[] };
   mcpServer: () => { command: string[] | string; env: Record<string, string> };
   exitWatchMs: number;
   stopWaitMs: number;
@@ -292,7 +294,8 @@ const refused = (message: string, hints: string[] = [], status = 409) =>
   new AgentError(message, { status, hints });
 
 let workspaceDirFn: ((ws: string) => string) | null = null;
-let repoPathsFn: ((ws: string) => string[]) | null = null;
+let foldersFn: ((ws: string) => { under: string[]; exact?: string[] }) | null =
+  null;
 /** The workspaces config, for start and resume (loaded on first use). */
 export async function loadAgentWorkspaces(d: AgentsDeps): Promise<void> {
   await loadWorkspaces(d);
@@ -305,8 +308,11 @@ export async function loadAgentWorkspaces(d: AgentsDeps): Promise<void> {
     return ws.resolveWorkspaceDir(name, cfg, getReposRoot());
   };
   // A by-path repo's own folder (repo add <path>), wherever it is.
-  repoPathsFn = (name) =>
-    ws.repoFolders(ws.readWorkspacesFile().workspaces[name]);
+  foldersFn = (name) => {
+    const cfg = ws.readWorkspacesFile().workspaces[name];
+    if (!cfg) throw usage(`workspace "${name}" does not exist`, 404);
+    return ws.conversationFolders(name, cfg, getReposRoot());
+  };
 }
 
 /** The distribution's bin shim (as `mcp connect` registers), else Den's CLI. */
@@ -340,13 +346,10 @@ export function resolveAgentsDeps(d: AgentsDeps): AgentsResolved {
     workspaceFolders:
       d.workspaceFolders ??
       ((ws) => {
-        const dir = d.workspaceDir
-          ? d.workspaceDir(ws)
-          : (() => {
-              if (!workspaceDirFn) throw new Error("workspaces not loaded");
-              return workspaceDirFn(ws);
-            })();
-        return [dir, ...(repoPathsFn?.(ws) ?? [])];
+        // A caller that gives its own folder (a test) gives just it.
+        if (d.workspaceDir) return { under: [d.workspaceDir(ws)] };
+        if (!foldersFn) throw new Error("workspaces not loaded");
+        return foldersFn(ws);
       }),
     mcpServer: d.mcpServer ?? (() => defaultMcpServer(base.cli)),
     exitWatchMs: d.exitWatchMs ?? EXIT_WATCH_MS,
@@ -1048,6 +1051,48 @@ function sessionOf(
  * else the first of `<base>-2`, `<base>-3`… no agent has. A stopped agent's
  * id is never reused by a new start: only its Resume or Start fresh.
  */
+/**
+ * AG-10.10b: the id a Name gives: its slug while no agent has it; a
+ * running agent in the workspace with that id or that title is refused
+ * (open it instead); a stopped one, or another workspace's, makes it the
+ * next free `<slug>-2`… (Resume continues the stopped one). Null when the
+ * Name has no id characters: the persona's default then.
+ */
+async function namedId(
+  d: AgentsResolved,
+  name: string,
+  ws: string,
+): Promise<string | null> {
+  const slug = nameSlug(name);
+  const sessions = await withClient(d, (c) => c.list());
+  const live = (rec: AgentRecord) => {
+    const s = sessionOf(sessions, rec);
+    return s && !s.exited ? s : undefined;
+  };
+  // No two live agents in one workspace share a title, or this id.
+  for (const rec of listRecords(d.stateDir())) {
+    if (rec.workspace !== ws) continue;
+    const same =
+      rec.id === slug ||
+      (rec.displayName ?? "").toLowerCase() === name.toLowerCase();
+    const s = same ? live(rec) : undefined;
+    if (s)
+      throw new AgentError(`agent ${rec.id} is running (${s.name})`, {
+        status: 409,
+        hints: [`Attach: ${d.cli} sessions attach ${s.name}`],
+        running: { id: rec.id, sessionId: s.ref.id },
+      });
+  }
+  if (!slug) return null;
+  if (!readRecord(d.stateDir(), slug)) return slug;
+  const stem = slug.slice(0, 58);
+  for (let n = 2; n < 1000; n++) {
+    const id = `${stem}-${n}`;
+    if (!readRecord(d.stateDir(), id)) return id;
+  }
+  throw refused(`no free agent id for ${slug}: give one with --id`);
+}
+
 export function defaultId(
   stateDir: string,
   persona: string,
@@ -1487,8 +1532,6 @@ export async function startAgent(
     throw usage(
       `${where}: no persona "${req.persona}" (personas: ${[...all.keys()].sort().join(", ")})`,
     );
-  const id = req.id ?? defaultId(d.stateDir(), persona.id, ws);
-  checkId(where, id);
   let given: string | null = null;
   if (req.name !== undefined)
     try {
@@ -1496,6 +1539,11 @@ export async function startAgent(
     } catch (e) {
       throw usage(`${where}: ${(e as Error).message}`);
     }
+  const id =
+    req.id ??
+    (given ? await namedId(d, given, ws) : null) ??
+    defaultId(d.stateDir(), persona.id, ws);
+  checkId(where, id);
   syncCatalog(d);
   const rt = runtimeFor(req.runtime ?? persona.runtime ?? DEFAULT_RUNTIME_ID);
   const det = await availableOrRefuse(d, rt, ws);
@@ -1678,13 +1726,8 @@ export function listConversations(
     throw usage(`${where}: workspace "${ws}" does not exist`, 404);
   syncCatalog(d);
   if (runtime !== undefined) runtimeFor(runtime);
-  // Its folder and every repo's (one under another is scanned once).
-  const folders = [
-    ...new Set(d.workspaceFolders(ws).map((f) => path.resolve(f))),
-  ];
-  const scan = folders.filter(
-    (f) => !folders.some((o) => o !== f && f.startsWith(o + path.sep)),
-  );
+  // Its folder and every repo's; a shared root only exactly (AG-17.1).
+  const scope = d.workspaceFolders(ws);
   const taken = agentByToken(d);
   const now = Date.now();
   const conversations: ListedConversation[] = [];
@@ -1693,7 +1736,7 @@ export function listConversations(
     if (runtime !== undefined && id !== runtime) continue;
     const rt = getRuntime(id);
     if (!rt?.listSessions) continue;
-    for (const c of scan.flatMap((f) => rt.listSessions!(f, d.env))) {
+    for (const c of rt.listSessions(scope, d.env)) {
       if (seen.has(`${id} ${c.id}`)) continue;
       seen.add(`${id} ${c.id}`);
       const agent = taken.get(`${id} ${c.id}`);
@@ -1755,6 +1798,16 @@ export async function importAgent(
       422,
     );
   const c = conversations.find((x) => x.id === req.session);
+  // Another workspace's (or no repo's): say whose, never bring it in.
+  const elsewhere = c
+    ? null
+    : (getRuntime(runtime)?.conversationCwd?.(req.session, d.env) ?? null);
+  if (!c && elsewhere && !inScope(elsewhere, d.workspaceFolders(req.workspace)))
+    throw refused(
+      `This conversation belongs to ${elsewhere}, not to workspace ${req.workspace}`,
+      [`List this workspace's: ${d.cli} agents import -w ${req.workspace}`],
+      409,
+    );
   if (!c)
     throw refused(
       `${where}: no ${rt.label} conversation "${req.session}" in workspace ${req.workspace}'s folder`,

package/src/ui/cli/agents-command.ts

@@ -123,7 +123,7 @@ export const AGENTS_HELP = {
     "",
     "{cli} agents list -w <ws> [--stopped] [--json]",
     "    --stopped: only the stopped, interrupted and exited ones",
-    "{cli} agents start -w <ws> --persona <p> [--runtime <r>] [--model <m>] [--id <id>]",
+    "{cli} agents start -w <ws> --persona <p> [--runtime <r>] [--model <m>] [--name <name>] [--id <id>]",
     "    runs in the workspace's dir as <dist>-<ws>:<id>; its MCP is pinned to <ws>",
     "    (plus agents.<id>.grants); capped by agents.max_concurrent",
     "{cli} agents stop <id> [-w <ws>] [--no-wait]",
@@ -273,12 +273,14 @@ async function start(args: string[], d: AgentsResolved): Promise<number> {
     "--persona": true,
     "--runtime": true,
     "--model": true,
+    "--name": true,
     "--id": true,
   });
   noExtra(where, p);
   const ws = workspaceFlag(where, p);
   if (!ws) throw new UsageError(`${where} needs -w <workspace>`);
   const persona = str(p, "--persona");
+  const name = str(p, "--name");
   if (!persona) throw new UsageError(`${where} needs --persona <p>`);
   const s = await startAgent(d, {
     workspace: ws,
@@ -286,6 +288,7 @@ async function start(args: string[], d: AgentsResolved): Promise<number> {
     runtime: str(p, "--runtime"),
     model: str(p, "--model"),
     id: str(p, "--id"),
+    ...(name !== undefined ? { name } : {}),
   });
   return report(
     d,

package/src/ui/cli/doctor-command.ts

@@ -22,7 +22,12 @@
  * nothing is sent.
  */
 import chalk from "chalk";
-import { readDenConfig, type DenConfig } from "../../shared/den-config.js";
+import {
+  readDenConfig,
+  readMcpConfig,
+  type DenConfig,
+} from "../../shared/den-config.js";
+import { approvalsState } from "../mcp/tools.js";
 import { getStateDir } from "../../shared/paths.js";
 import { product } from "../../shared/product.js";
 import { listRecords } from "../../shared/agents/records.js";
@@ -216,6 +221,25 @@ export function agentsConfigured(
   }
 }
 
+/**
+ * The held writes' state (mcp.approvals), as doctor prints it. A bad value
+ * is a problem: the MCP server refuses to start on it.
+ */
+export function approvalsLines(read: () => boolean): {
+  lines: string[];
+  problem: boolean;
+} {
+  try {
+    const state = approvalsState({ approvals: read() });
+    return { lines: ["", `  ℹ MCP ${state}`], problem: false };
+  } catch (err) {
+    return {
+      lines: ["", chalk.red(`  ✗ MCP ${(err as Error).message}`)],
+      problem: true,
+    };
+  }
+}
+
 /** Informational lines after the rows: never a failure. */
 export function doctorNotes(cli: string, configured: boolean): string[] {
   return configured
@@ -312,6 +336,8 @@ export async function cmdDoctor(args: string[]): Promise<number> {
   }
   const rows = doctorRows();
   for (const l of formatDoctor(rows, readBrand().name)) console.log(l);
+  const held = approvalsLines(() => readMcpConfig().approvals);
+  for (const l of held.lines) console.log(l);
   for (const l of pollingLines(eventsFile(), readBrand().name)) console.log(l);
   const cli = product().cli;
   if (!probe) {
@@ -320,7 +346,7 @@ export async function cmdDoctor(args: string[]): Promise<number> {
       agentsConfigured(readConfigOrNull(), getStateDir()),
     ))
       console.log(l);
-    return rows.some((r) => r.problem) ? 1 : 0;
+    return rows.some((r) => r.problem) || held.problem ? 1 : 0;
   }
   const { runEnvProbe, formatProbe } = await import("./env-probe.js");
   const { resolveDeps, plainSessionEnv } =
@@ -339,5 +365,5 @@ export async function cmdDoctor(args: string[]): Promise<number> {
   console.log("");
   for (const l of formatProbe(results)) console.log(l);
   const found = results.some((r) => r.findings.length);
-  return rows.some((r) => r.problem) || found ? 1 : 0;
+  return rows.some((r) => r.problem) || held.problem || found ? 1 : 0;
 }