@mrciphersmith/keryx 0.3.56 → 0.3.57

package/dist/cli.js

@@ -20104,7 +20104,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@mrciphersmith/keryx",
-    version: "0.3.56",
+    version: "0.3.57",
     description: "Version-controlled project context for AI coding agents: code graph, architecture wiki, project memory, relevant tests, quality signals, and task flows.",
     private: false,
     publishConfig: {
@@ -20152,7 +20152,7 @@ var init_package = __esm(() => {
       "test:core": "bun test src/cli src/core src/impact-evidence/ src/shell-source-audits.test.ts src/acp/ src/assets/ src/bundle/ src/capability/ src/commands/ src/contracts/ src/ctx/ src/eval/ src/flow/ src/forgetting/ src/gdgraph/ src/gdskills/ src/governance/ src/product/ src/health/ src/integrations/ src/job/ src/learning/ src/lib/ src/mcp/ src/memory/ src/metrics/ src/retention/ src/review/ src/rules/ src/sac/ src/security/ src/stack/ src/standard/ src/sync/ src/testing/ src/trigger/ src/wiki/ scripts/",
       "test:client:terminal": "bun test src/tui/ src/commands/shell",
       "test:client:streaming": "bun test src/harness/provider/",
-      "test:client:cancel-resume": "bun test src/harness/run/ src/harness/resume/ src/harness/session/ src/session/ src/bus/ src/rewind/ src/remote/ src/commands/sessions",
+      "test:client:cancel-resume": "bun test src/harness/run/ src/harness/resume/ src/harness/session/ src/session/ src/bus/ src/rewind/ src/remote/ src/docs/ src/commands/sessions",
       "test:client:runtime": "bun test src/harness/ src/mcp-client/ src/mcp-servers/ src/agents/ src/commands/agent src/commands/harness src/commands/providers",
       "test:client": "bun run test:client:terminal && bun run test:client:streaming && bun run test:client:cancel-resume && bun run test:client:runtime",
       check: "bun run lint && bun run typecheck && bun run typecheck:scripts && bun test",
@@ -111379,6 +111379,19 @@ function parseApprovalCallback(data) {
   }
   return { approvalId: match[1], decision: match[2] };
 }
+function choiceCallbackData(promptId, index) {
+  return `pk:${promptId}:${index}`;
+}
+function parseChoiceCallback(data) {
+  const match = CHOICE_CALLBACK_PATTERN.exec(data);
+  if (match === null) {
+    return;
+  }
+  return { promptId: match[1], index: Number(match[2]) };
+}
+function isMessageState(value) {
+  return typeof value === "string" && MESSAGE_STATES.includes(value);
+}
 function encodeSseEvent(name, data, id) {
   return `event: ${name}
 ${id === undefined ? "" : `id: ${id}
@@ -111428,7 +111441,7 @@ class SseParser {
     return frames;
   }
 }
-var REMOTE_API_PREFIX = "/v1/remote", REMOTE_SCHEMA_VERSION = "1.0.0", REMOTE_ROUTE_METHODS, CHANNELS_ROUTE_METHODS, MAX_REMOTE_BODY_BYTES, MAX_PROJECT_CHARS = 256, MAX_APPROVAL_PROMPT_CHARS = 3000, MAX_KEYBOARD_ROWS = 8, MAX_KEYBOARD_BUTTONS_PER_ROW = 8, MAX_BUTTON_TEXT_CHARS = 64, MAX_CALLBACK_DATA_BYTES = 64, DEFAULT_APPROVAL_TIMEOUT_MS, MAX_APPROVAL_TIMEOUT_MS, MIN_APPROVAL_TIMEOUT_MS = 100, DEFAULT_KEEPALIVE_MS = 15000, DEFAULT_ACK_TIMEOUT_MS = 30000, SESSION_ID_PATTERN, APPROVAL_CALLBACK_PATTERN, RESERVED_CALLBACK_PREFIX = "ap:", SSE_KEEPALIVE_FRAME = `: keepalive
+var REMOTE_API_PREFIX = "/v1/remote", REMOTE_SCHEMA_VERSION = "1.0.0", REMOTE_ROUTE_METHODS, CHANNELS_ROUTE_METHODS, MAX_REMOTE_BODY_BYTES, MAX_PROJECT_CHARS = 256, MAX_APPROVAL_PROMPT_CHARS = 3000, MAX_KEYBOARD_ROWS = 8, MAX_KEYBOARD_BUTTONS_PER_ROW = 8, MAX_BUTTON_TEXT_CHARS = 64, MAX_CALLBACK_DATA_BYTES = 64, DEFAULT_APPROVAL_TIMEOUT_MS, MAX_APPROVAL_TIMEOUT_MS, MIN_APPROVAL_TIMEOUT_MS = 100, DEFAULT_KEEPALIVE_MS = 15000, DEFAULT_ACK_TIMEOUT_MS = 30000, SESSION_ID_PATTERN, APPROVAL_CALLBACK_PATTERN, RESERVED_CALLBACK_PREFIX = "ap:", CHOICE_CALLBACK_PATTERN, RESERVED_CHOICE_PREFIX = "pk:", MAX_PROMPT_BUTTONS = 24, MESSAGE_STATES, SSE_KEEPALIVE_FRAME = `: keepalive
 
 `;
 var init_protocol2 = __esm(() => {
@@ -111438,6 +111451,8 @@ var init_protocol2 = __esm(() => {
     heartbeat: "POST",
     reply: "POST",
     approval: "POST",
+    prompt: "POST",
+    state: "POST",
     ack: "POST",
     stream: "GET"
   };
@@ -111455,6 +111470,8 @@ var init_protocol2 = __esm(() => {
   MAX_APPROVAL_TIMEOUT_MS = 60 * 60000;
   SESSION_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
   APPROVAL_CALLBACK_PATTERN = /^ap:(ap[0-9a-f]{12}):(allow|deny)$/;
+  CHOICE_CALLBACK_PATTERN = /^pk:(pk[0-9a-f]{12}):(\d{1,3})$/;
+  MESSAGE_STATES = ["reading", "working", "done", "failed"];
 });
 
 // src/remote/paths.ts
@@ -111835,6 +111852,8 @@ class RemoteClient {
   inboundChain = Promise.resolve();
   waiters = new Map;
   earlyDecisions = new Map;
+  choiceWaiters = new Map;
+  earlyChoices = new Map;
   firstResult;
   name;
   threadId;
@@ -111950,6 +111969,45 @@ class RemoteClient {
       this.waiters.set(approvalId, { resolve, timer });
     });
   }
+  async requestChoice(text, rows, timeoutMs, forUserId) {
+    if (!this.connected) {
+      return;
+    }
+    const body = { sessionId: this.options.sessionId, text, rows, timeoutMs, ...forUserId === undefined ? {} : { forUserId } };
+    let promptId;
+    try {
+      const response = await this.post("prompt", body);
+      if (!response.ok) {
+        return;
+      }
+      promptId = (await response.json()).promptId;
+    } catch {
+      return;
+    }
+    const early = this.earlyChoices.get(promptId);
+    if (early !== undefined) {
+      this.earlyChoices.delete(promptId);
+      return early;
+    }
+    if (!this.connected) {
+      return;
+    }
+    return new Promise((resolve) => {
+      const timer = setTimeout(() => {
+        this.choiceWaiters.delete(promptId);
+        resolve(undefined);
+      }, timeoutMs);
+      this.choiceWaiters.set(promptId, { resolve, timer });
+    });
+  }
+  async reportState(updateId, state) {
+    if (!this.connected) {
+      return;
+    }
+    try {
+      await this.post("state", { sessionId: this.options.sessionId, updateId, state });
+    } catch {}
+  }
   target(route, query = "") {
     const token = readShellToken(this.options.dir);
     const endpoint = readEndpoint(this.options.dir);
@@ -112142,6 +112200,9 @@ class RemoteClient {
     } else if (event === "approval") {
       const approval = parsed;
       this.resolveApproval(approval.approvalId, approval.decision);
+    } else if (event === "choice") {
+      const choice = parsed;
+      this.resolveChoice(choice.promptId, choice.index);
     } else if (event === "callback") {
       const callback = parsed;
       if (this.options.onCallback !== undefined) {
@@ -112199,6 +112260,30 @@ class RemoteClient {
     this.waiters.delete(approvalId);
     waiter.resolve(decision);
   }
+  resolveChoice(promptId, index) {
+    const waiter = this.choiceWaiters.get(promptId);
+    if (waiter === undefined) {
+      if (this.earlyChoices.size >= MAX_EARLY_DECISIONS) {
+        const oldest = this.earlyChoices.keys().next().value;
+        if (oldest !== undefined) {
+          this.earlyChoices.delete(oldest);
+        }
+      }
+      this.earlyChoices.set(promptId, index);
+      return;
+    }
+    clearTimeout(waiter.timer);
+    this.choiceWaiters.delete(promptId);
+    waiter.resolve(index);
+  }
+  failChoices() {
+    for (const [id, waiter] of [...this.choiceWaiters.entries()]) {
+      clearTimeout(waiter.timer);
+      this.choiceWaiters.delete(id);
+      waiter.resolve(undefined);
+    }
+    this.earlyChoices.clear();
+  }
   failApprovals() {
     for (const [id, waiter] of [...this.waiters.entries()]) {
       clearTimeout(waiter.timer);
@@ -112206,6 +112291,7 @@ class RemoteClient {
       waiter.resolve("deny");
     }
     this.earlyDecisions.clear();
+    this.failChoices();
   }
 }
 var UNVERIFIED_SERVE_MESSAGE = "the program answering on keryx serve's port did not prove it is the keryx serve this shell trusts; its answer was ignored. Restart `keryx serve` (an older serve cannot prove itself; update keryx on both sides)", FatalClientError, TransientClientError, DEFAULT_BACKOFF_INITIAL_MS = 250, DEFAULT_BACKOFF_MAX_MS = 15000, DEFAULT_REQUEST_TIMEOUT_MS = 1e4, MAX_EARLY_DECISIONS = 32, MAX_COMPLETED_IDS = 256;
@@ -112226,6 +112312,539 @@ var init_client3 = __esm(() => {
   };
 });
 
+// src/remote/command-gateway.ts
+function menuName(name) {
+  return name.replace(/-/g, "_");
+}
+function split(line) {
+  const trimmed = line.trim();
+  const space = trimmed.search(/\s/);
+  const head = space === -1 ? trimmed : trimmed.slice(0, space);
+  const args = space === -1 ? "" : trimmed.slice(space).trim();
+  const at = head.indexOf("@");
+  const bare = (at === -1 ? head : head.slice(0, at)).replace(/^\/+/, "").toLowerCase();
+  return { token: bare, args };
+}
+function refuse3(command, reason, known) {
+  return { kind: "refuse", command, reason, known };
+}
+function refusalText(command, reason) {
+  return `Not available remotely: /${command}. ${reason.charAt(0).toUpperCase()}${reason.slice(1)}${/[.!?]$/.test(reason) ? "" : "."}`;
+}
+function classifyRemoteCommand(line) {
+  const { token, args } = split(line);
+  if (token.length === 0) {
+    return refuse3("", "an empty command", false);
+  }
+  const canonical = token.replace(/_/g, "-");
+  const refusedReason = REMOTE_REFUSED[canonical] ?? REMOTE_REFUSED[token];
+  const spec = BY_NAME.get(canonical) ?? BY_MENU.get(token);
+  if (canonical === "remote-control") {
+    const sub = args.split(/\s+/)[0]?.toLowerCase() ?? "";
+    return refuse3(canonical, sub === "off" ? "it would delete this topic; turn it off in the shell" : refusedReason ?? "its panel is local", true);
+  }
+  if (spec === undefined) {
+    if (refusedReason !== undefined) {
+      return refuse3(canonical, refusedReason, true);
+    }
+    return refuse3(canonical, "it is not on the list of commands a topic may run; /help shows the list", false);
+  }
+  const name = spec.name;
+  const rest = args.trim();
+  const first = rest.split(/\s+/)[0]?.toLowerCase() ?? "";
+  const asTyped = rest.length === 0 ? `/${name}` : `/${name} ${rest}`;
+  switch (name) {
+    case "mode":
+      if (first === "trust" || first === "auto") {
+        return { kind: "confirm", command: name, line: `/mode ${first}`, summary: `Switch the permission mode to ${first}?` };
+      }
+      if (first === "" || first === "ask") {
+        return { kind: "run", command: name, line: asTyped };
+      }
+      return refuse3(name, "the mode is ask, trust or auto", true);
+    case "plan":
+      if (first === "off") {
+        return { kind: "confirm", command: name, line: "/plan off", summary: "Turn read-only mode off?" };
+      }
+      if (first === "") {
+        return { kind: "run", command: name, line: "/plan" };
+      }
+      return first === "on" ? { kind: "run", command: name, line: "/plan on" } : refuse3(name, "use /plan on or /plan off", true);
+    case "theme":
+      return first === "" ? refuse3(name, "bare /theme opens a picker in the shell; use /theme <name>", true) : { kind: "run", command: name, line: asTyped };
+    case "think":
+      return first === "auto" || first === "expand" || first === "hide" ? { kind: "run", command: name, line: `/think ${first}` } : refuse3(name, "bare /think and /think collapse only flip the view in the shell; use /think auto, expand or hide", true);
+    case "delegate":
+      return confirmDelegate(rest);
+    case "external":
+      if (first === "on" || first === "off") {
+        return {
+          kind: "confirm",
+          command: name,
+          line: `/external ${first}`,
+          summary: `Switch sending private work to external providers ${first}? This changes what leaves this machine.`
+        };
+      }
+      return first === "" ? { kind: "run", command: name, line: "/external" } : refuse3(name, "use /external, /external on or /external off", true);
+    case "external-agents":
+      if (first === "on" || first === "off") {
+        return {
+          kind: "confirm",
+          command: name,
+          line: `/external-agents ${first}`,
+          summary: `Turn the external agent runtime ${first}? External agents are paid and run outside keryx.`
+        };
+      }
+      return first === "" ? { kind: "run", command: name, line: "/external-agents" } : refuse3(name, "use /external_agents, /external_agents on or /external_agents off", true);
+    default:
+      break;
+  }
+  switch (spec.kind) {
+    case "builtin":
+      return { kind: "builtin", command: name, args: rest };
+    case "picker":
+      return { kind: "picker", command: name, args: rest };
+    default:
+      return { kind: "run", command: name, line: name === "new" || name === "clear" ? `/${name}` : asTyped };
+  }
+}
+function confirmDelegate(rest) {
+  const match = /^(\S+)\s+([\s\S]+)$/.exec(rest);
+  if (match === null) {
+    return refuse3("delegate", "it needs an agent and a task: /delegate <agent> <task>", true);
+  }
+  const agent = (match[1] ?? "").toLowerCase();
+  const task = (match[2] ?? "").trim();
+  const shown = task.length > 200 ? `${task.slice(0, 200)}... [shortened for this question: the full task is ${task.length} characters and runs as typed]` : task;
+  return {
+    kind: "confirm",
+    command: "delegate",
+    line: `/delegate ${match[1] ?? ""} ${task}`,
+    agent,
+    summary: `Hand this task to ${agent}? It is an external agent and runs outside keryx; the run is paid.
+Task: ${shown}`
+  };
+}
+function remoteMenu() {
+  return REMOTE_COMMANDS.map((spec) => ({ command: menuName(spec.name), description: spec.description.slice(0, 256) }));
+}
+function remoteHelpText() {
+  const lines = ["Commands you can use from this topic:"];
+  for (const spec of REMOTE_COMMANDS) {
+    lines.push(`/${menuName(spec.name)} - ${spec.description}`);
+  }
+  lines.push("", "Anything else typed here goes to the model as a message. Other commands run in the shell.");
+  return lines.join(`
+`);
+}
+function isBusyDeferred(name) {
+  return BUSY_DEFERRED_COMMANDS.includes(name);
+}
+var REMOTE_COMMANDS, REMOTE_REFUSED, BUSY_DEFERRED_COMMANDS, BUSY_REASON = "main is busy: command deferred", BY_NAME, BY_MENU;
+var init_command_gateway = __esm(() => {
+  REMOTE_COMMANDS = [
+    { name: "help", kind: "builtin", description: "List the commands you can use from this topic" },
+    { name: "status", kind: "text", description: "Show the session: model, mode, queue, usage" },
+    { name: "doctor", kind: "text", description: "Run the health checks" },
+    { name: "model", kind: "picker", description: "Pick another model with buttons" },
+    { name: "connect", kind: "picker", description: "Switch to a connected provider with buttons" },
+    { name: "resume", kind: "picker", description: "Return to an earlier session with buttons" },
+    { name: "sessions", kind: "builtin", description: "List recent sessions" },
+    { name: "new", kind: "text", description: "Start a new session; this topic stays bound to it" },
+    { name: "clear", kind: "text", description: "Same as /new" },
+    { name: "compact", kind: "text", description: "Compact the conversation: /compact [focus]" },
+    { name: "think", kind: "text", description: "Set how reasoning shows: /think <auto|expand|hide>" },
+    { name: "goal", kind: "text", description: "Show or set the session goal" },
+    { name: "queue", kind: "text", description: "Manage the queue: /queue <remove|edit|force> [N]" },
+    { name: "mode", kind: "confirm", description: "Show or set the permission mode; trust and auto ask for a button press" },
+    { name: "plan", kind: "confirm", description: "Read-only mode: /plan [on|off]; bare shows it, off asks for a button press" },
+    { name: "reasoning", kind: "text", description: "Show or set reasoning effort" },
+    { name: "theme", kind: "text", description: "Set the theme: /theme <name>" },
+    { name: "jevrules", kind: "text", description: "Show the Jev rules" },
+    { name: "staledocs", kind: "text", description: "Show stale documents" },
+    { name: "opencomments", kind: "text", description: "Show open review comments" },
+    { name: "contract", kind: "text", description: "Show the contract check" },
+    { name: "triage", kind: "text", description: "Advisory triage of the latest review package" },
+    { name: "risk", kind: "text", description: "Risk map of the working diff" },
+    { name: "scenarios", kind: "text", description: "User scenarios the working diff likely changes" },
+    { name: "delegate", kind: "confirm", description: "Hand a paid task to an external agent: /delegate <agent> <task>; asks first" },
+    { name: "external", kind: "confirm", description: "Show or switch sending work to external providers; on and off ask first" },
+    { name: "external-agents", kind: "confirm", description: "Show or switch the external agent runtime; on and off ask first" }
+  ];
+  REMOTE_REFUSED = {
+    exit: "it would close the shell",
+    quit: "it would close the shell",
+    channels: "it manages the Telegram connection itself",
+    provider: "it asks for provider keys and addresses, which are never typed into a chat",
+    "search-provider": "it asks for provider keys, which are never typed into a chat",
+    "search-connect": "it changes where searches are sent",
+    "remote-control": "turning remote control off would delete this topic, and its panel is local",
+    integrate: "it edits other tools' configuration on this machine",
+    copy: "it uses this machine's clipboard",
+    game: "it needs the shell's screen",
+    setup: "it asks for keys and changes the configuration",
+    mcp: "it can trust tools and change server connections; use the shell",
+    guard: "it changes a safety guard; use the shell",
+    route: "it changes where work is routed; use the shell",
+    editguard: "it changes a safety guard; use the shell",
+    settings: "it edits settings, some of them secret; use the shell",
+    bus: "it talks to other agents on this machine",
+    review: "it needs the shell's screen",
+    reviews: "it needs the shell's screen",
+    product: "it needs the shell's screen",
+    governance: "it needs the shell's screen",
+    expand: "it needs the shell's screen",
+    interrupt: "use the Stop button on a message, or stop it in the shell",
+    demote: "it works on the shell's own tasks",
+    models: "use /model",
+    "external-diff": "listing and applying external patches stays in the shell, where the patch hash is typed",
+    flows: "it opens a panel in the shell",
+    ac: "it opens a panel in the shell",
+    workspace: "it opens a panel in the shell",
+    approvals: "it opens a panel in the shell",
+    triggers: "it opens a panel in the shell",
+    routing: "it opens a panel in the shell",
+    schedules: "it opens a panel in the shell",
+    schedule: "it opens a form in the shell",
+    rewind: "it opens a picker of earlier points in the shell",
+    conform: "it opens a picker in the shell",
+    ci: "it opens a panel in the shell",
+    jevprofile: "it opens a panel with toggles in the shell"
+  };
+  BUSY_DEFERRED_COMMANDS = ["new", "clear", "resume", "sessions", "compact", "model", "connect"];
+  BY_NAME = new Map(REMOTE_COMMANDS.map((spec) => [spec.name, spec]));
+  BY_MENU = new Map(REMOTE_COMMANDS.map((spec) => [menuName(spec.name), spec]));
+});
+
+// src/remote/command-router.ts
+function ended(end, result) {
+  try {
+    end?.(result);
+  } catch {}
+}
+
+class RemoteCommandRouter {
+  ctx;
+  chain = Promise.resolve();
+  detached = 0;
+  detachedDone = [];
+  constructor(ctx) {
+    this.ctx = ctx;
+  }
+  handle(line, fromId, end) {
+    const decision = classifyRemoteCommand(line);
+    switch (decision.kind) {
+      case "refuse":
+        this.refuse(decision);
+        ended(end, "failed");
+        return;
+      case "builtin":
+        this.ctx.record(`/${decision.command}`);
+        if (decision.command === "sessions") {
+          this.detach(async () => {
+            await this.listSessionsText();
+            ended(end, "done");
+          });
+        } else {
+          this.ctx.reply(this.ctx.compose(remoteHelpText())).catch(() => false);
+          ended(end, "done");
+        }
+        return;
+      case "run":
+        this.enqueue(decision.line, decision.command, end);
+        return;
+      case "picker":
+        this.detach(async () => {
+          const result = await this.picker(decision.command, fromId, end);
+          if (result !== "deferred") {
+            ended(end, result);
+          }
+        });
+        return;
+      case "confirm":
+        this.detach(async () => {
+          const result = await this.confirm(decision, fromId, end);
+          if (result !== "deferred") {
+            ended(end, result);
+          }
+        });
+        return;
+    }
+  }
+  async idle() {
+    await this.chain;
+    if (this.detached > 0) {
+      await new Promise((resolve) => this.detachedDone.push(resolve));
+      await this.idle();
+    }
+  }
+  detach(work) {
+    this.detached += 1;
+    work().catch(() => {
+      return;
+    }).finally(() => {
+      this.detached -= 1;
+      if (this.detached === 0) {
+        for (const done of this.detachedDone.splice(0)) {
+          done();
+        }
+      }
+    });
+  }
+  refuse(decision) {
+    const shown = decision.command.length === 0 ? "/" : `/${decision.command}`;
+    this.ctx.record(`refused ${shown}: ${decision.reason}`);
+    this.ctx.reply(refusalText(decision.command, decision.reason)).catch(() => false);
+  }
+  enqueue(line, command, end) {
+    this.chain = this.chain.then(() => this.execute(command, line, async () => this.ctx.host.runCommand === undefined ? undefined : this.ctx.host.runCommand(line), end)).catch(() => {
+      return;
+    });
+  }
+  busyReason(line, command) {
+    if (!this.ctx.host.isBusy()) {
+      return;
+    }
+    const fromHost = this.ctx.host.busyRefusal?.(line);
+    if (fromHost !== undefined) {
+      return fromHost;
+    }
+    return this.ctx.host.busyRefusal === undefined && isBusyDeferred(command) ? BUSY_REASON : undefined;
+  }
+  async execute(command, line, work, end) {
+    const { limits } = this.ctx;
+    const busy = this.busyReason(line, command);
+    if (busy !== undefined) {
+      this.ctx.record(`/${command} not run: ${busy}`);
+      ended(end, "failed");
+      await this.ctx.reply(`/${command} was not run: ${busy}.`).catch(() => false);
+      return;
+    }
+    this.ctx.record(`/${command} started`);
+    const holds = SESSION_COMMANDS.includes(command);
+    if (holds) {
+      this.ctx.holdTopic(true);
+    }
+    let finished = false;
+    const notice = setTimeout(() => {
+      if (!finished) {
+        this.ctx.reply(`Still running /${command}...`).catch(() => false);
+      }
+    }, limits.runningNoticeMs);
+    let limitTimer;
+    const limit = new Promise((resolve) => {
+      limitTimer = setTimeout(() => resolve("limit"), limits.commandLimitMs);
+    });
+    let outcome;
+    try {
+      outcome = await Promise.race([work(), limit]);
+    } catch (error) {
+      outcome = { output: error instanceof Error ? error.message : String(error), ok: false };
+    } finally {
+      finished = true;
+      clearTimeout(notice);
+      if (limitTimer !== undefined) {
+        clearTimeout(limitTimer);
+      }
+      if (holds) {
+        this.ctx.holdTopic(false);
+      }
+    }
+    if (outcome === "limit") {
+      this.ctx.record(`/${command} still running: stopped waiting after the time limit`);
+      ended(end, "failed");
+      await this.ctx.reply(`/${command} is still running in the shell. Stopped waiting for it after ${Math.max(1, Math.round(limits.commandLimitMs / 1000))} seconds.`).catch(() => false);
+      return;
+    }
+    if (outcome === undefined) {
+      this.ctx.record(`/${command} not run: this shell cannot run it from the topic`);
+      ended(end, "failed");
+      await this.ctx.reply(`/${command} was not run: this shell cannot run it from the topic.`).catch(() => false);
+      return;
+    }
+    this.ctx.record(`/${command} ${outcome.ok ? "done" : "failed"}`);
+    ended(end, outcome.ok ? "done" : "failed");
+    if (this.ctx.takeSwitched()) {
+      return;
+    }
+    const text = outcome.output.trim();
+    if (text.length === 0) {
+      await this.ctx.reply(outcome.ok ? `/${command}: done. It printed nothing.` : `/${command} failed. The details are in the shell.`).catch(() => false);
+      return;
+    }
+    await this.ctx.reply(this.ctx.compose(outcome.ok ? text : `/${command} failed:
+${text}`)).catch(() => false);
+  }
+  async confirm(decision, fromId, end) {
+    const yes = decision.agent !== undefined ? `Yes, send to ${decision.agent} (paid)` : "Yes";
+    this.ctx.record(`/${decision.command} waiting for a press in the topic`);
+    const index = await this.ctx.choose(this.ctx.compose(decision.summary), [[this.label(yes), "No"]], this.ctx.limits.choiceTimeoutMs, fromId);
+    if (index === 0) {
+      this.ctx.record(`/${decision.command} confirmed in the topic`);
+      this.enqueue(decision.line, decision.command, end);
+      return "deferred";
+    }
+    this.ctx.record(index === 1 ? `/${decision.command} declined in the topic; nothing changed` : `/${decision.command} not confirmed in time; nothing changed`);
+    return index === 1 ? "done" : "failed";
+  }
+  label(text) {
+    const one = this.ctx.compose(text).replace(/\s+/g, " ").trim();
+    const shown = one.length === 0 ? "(unnamed)" : one;
+    return shown.length > LABEL_CHARS ? `${shown.slice(0, LABEL_CHARS - 3)}...` : shown;
+  }
+  async pick(title, options, fromId) {
+    const pages = Math.max(1, Math.ceil(options.length / PICKER_PAGE_SIZE));
+    let page = 0;
+    for (;; ) {
+      const slice = options.slice(page * PICKER_PAGE_SIZE, (page + 1) * PICKER_PAGE_SIZE);
+      const rows = slice.map((option) => [this.label(option.label)]);
+      const nav = [];
+      if (page > 0) {
+        nav.push("Previous");
+      }
+      if (page < pages - 1) {
+        nav.push("More");
+      }
+      if (nav.length > 0) {
+        rows.push([...nav]);
+      }
+      const text = pages > 1 ? `${title}
+Page ${page + 1} of ${pages}` : title;
+      const index = await this.ctx.choose(this.ctx.compose(text), rows, this.ctx.limits.choiceTimeoutMs, fromId);
+      if (index === undefined) {
+        return;
+      }
+      if (index < slice.length) {
+        return slice[index];
+      }
+      const pressed = nav[index - slice.length];
+      page += pressed === "More" ? 1 : -1;
+    }
+  }
+  async picker(command, fromId, end) {
+    const line = `/${command}`;
+    const busy = this.busyReason(line, command);
+    if (busy !== undefined) {
+      this.ctx.record(`${line} not run: ${busy}`);
+      await this.ctx.reply(`${line} was not run: ${busy}.`).catch(() => false);
+      return "failed";
+    }
+    this.ctx.record(line);
+    switch (command) {
+      case "model":
+        return await this.pickModel(undefined, fromId);
+      case "connect":
+        return await this.pickProvider(fromId);
+      case "resume":
+        return await this.pickSession(fromId, end);
+      default:
+        await this.ctx.reply(`${line} is not available from this shell.`).catch(() => false);
+        return "failed";
+    }
+  }
+  async pickModel(providerId, fromId) {
+    const host = this.ctx.host;
+    if (host.listModels === undefined || host.switchModel === undefined) {
+      await this.ctx.reply("/model is not available from this shell.").catch(() => false);
+      return "failed";
+    }
+    const listing = await host.listModels(providerId);
+    if (listing === undefined || listing.models.length === 0) {
+      await this.ctx.reply(this.ctx.compose(`There are no models to pick from${providerId !== undefined ? ` for ${providerId}` : ""}. Use the shell to connect a provider.`)).catch(() => false);
+      return "failed";
+    }
+    const current = listing.models.find((model) => model.current === true);
+    const title = `Pick a model (${listing.provider})${current !== undefined ? `
+Now: ${current.label}` : ""}`;
+    const options = listing.models.map((model) => ({ id: model.id, label: model.current === true ? `* ${model.label}` : model.label }));
+    const chosen = await this.pick(title, options, fromId);
+    if (chosen === undefined) {
+      this.ctx.record("/model not answered in time; nothing changed");
+      return "failed";
+    }
+    const line = "/model";
+    const busy = this.busyReason(line, "model");
+    if (busy !== undefined) {
+      await this.ctx.reply(`/model was not run: ${busy}.`).catch(() => false);
+      return "failed";
+    }
+    const outcome = await host.switchModel(chosen.id, providerId);
+    this.ctx.record(`/model ${outcome.ok ? "switched" : "failed"}`);
+    const text = outcome.output.trim();
+    await this.ctx.reply(this.ctx.compose(text.length > 0 ? text : outcome.ok ? `Model: ${chosen.label.replace(/^\* /, "")}.` : "The model was not changed.")).catch(() => false);
+    return outcome.ok ? "done" : "failed";
+  }
+  async pickProvider(fromId) {
+    const host = this.ctx.host;
+    if (host.listProviders === undefined || host.listModels === undefined || host.switchModel === undefined) {
+      await this.ctx.reply("/connect is not available from this shell.").catch(() => false);
+      return "failed";
+    }
+    const providers = await host.listProviders();
+    if (providers.length === 0) {
+      await this.ctx.reply("No provider is connected yet. Connecting one needs a key, which is never typed into a chat; use the shell.").catch(() => false);
+      return "failed";
+    }
+    const options = providers.map((provider) => ({ id: provider.id, label: provider.current === true ? `* ${provider.label}` : provider.label }));
+    const chosen = await this.pick("Connected providers. Pick one to switch to:", options, fromId);
+    if (chosen === undefined) {
+      this.ctx.record("/connect not answered in time; nothing changed");
+      return "failed";
+    }
+    return await this.pickModel(chosen.id, fromId);
+  }
+  async pickSession(fromId, end) {
+    const host = this.ctx.host;
+    if (host.listSessions === undefined || host.resumeSession === undefined) {
+      await this.ctx.reply("/resume is not available from this shell.").catch(() => false);
+      return "failed";
+    }
+    const sessions = (await host.listSessions()).filter((session) => session.current !== true);
+    if (sessions.length === 0) {
+      await this.ctx.reply("There is no earlier session to return to.").catch(() => false);
+      return "done";
+    }
+    const chosen = await this.pick("Return to an earlier session:", sessions.map((s) => ({ id: s.id, label: s.label })), fromId);
+    if (chosen === undefined) {
+      this.ctx.record("/resume not answered in time; nothing changed");
+      return "failed";
+    }
+    const resume = host.resumeSession.bind(host);
+    this.chain = this.chain.then(() => this.execute("resume", "/resume", () => resume(chosen.id), end)).catch(() => {
+      return;
+    });
+    return "deferred";
+  }
+  async listSessionsText() {
+    const host = this.ctx.host;
+    const busy = this.busyReason("/sessions", "sessions");
+    if (busy !== undefined) {
+      this.ctx.record(`/sessions not run: ${busy}`);
+      await this.ctx.reply(`/sessions was not run: ${busy}.`).catch(() => false);
+      return;
+    }
+    if (host.listSessions === undefined) {
+      await this.ctx.reply("/sessions is not available from this shell.").catch(() => false);
+      return;
+    }
+    const sessions = await host.listSessions();
+    if (sessions.length === 0) {
+      await this.ctx.reply("There are no recorded sessions yet.").catch(() => false);
+      return;
+    }
+    const lines = sessions.slice(0, 20).map((session) => `${session.current === true ? "* " : "- "}${session.label}`);
+    await this.ctx.reply(this.ctx.compose(`Recent sessions:
+${lines.join(`
+`)}`)).catch(() => false);
+  }
+}
+var DEFAULT_ROUTER_LIMITS, PICKER_PAGE_SIZE = 7, LABEL_CHARS = 56, SESSION_COMMANDS;
+var init_command_router = __esm(() => {
+  init_command_gateway();
+  DEFAULT_ROUTER_LIMITS = { runningNoticeMs: 4000, commandLimitMs: 120000, choiceTimeoutMs: 120000 };
+  SESSION_COMMANDS = ["new", "clear", "resume"];
+});
+
 // src/remote/shell-bridge.ts
 function preview2(text) {
   const one = redactSensitiveText(text).replace(/\s+/g, " ").trim();
@@ -112287,11 +112906,59 @@ class RemoteBridge {
   runTimer;
   timedOut = false;
   closing;
+  router;
+  keepTopic = false;
+  switched = false;
+  waiting = [];
+  currentUpdate;
   constructor(options) {
     this.options = options;
     this.host = options.host;
     this.now = options.now ?? Date.now;
     this.approvalTimeoutMs = options.approvalTimeoutMs ?? DEFAULT_APPROVAL_TIMEOUT_MS;
+    this.router = new RemoteCommandRouter({
+      host: {
+        isBusy: () => this.host.isBusy(),
+        cancelTurn: () => this.host.cancelTurn(),
+        ...this.host.runCommand !== undefined ? { runCommand: (line) => this.host.runCommand(line) } : {},
+        ...this.host.busyRefusal !== undefined ? { busyRefusal: (line) => this.host.busyRefusal(line) } : {},
+        ...this.host.listModels !== undefined ? { listModels: (id) => this.host.listModels(id) } : {},
+        ...this.host.listProviders !== undefined ? { listProviders: () => this.host.listProviders() } : {},
+        ...this.host.switchModel !== undefined ? { switchModel: (model, provider) => this.host.switchModel(model, provider) } : {},
+        ...this.host.listSessions !== undefined ? { listSessions: () => this.host.listSessions() } : {},
+        ...this.host.resumeSession !== undefined ? { resumeSession: (id) => this.host.resumeSession(id) } : {}
+      },
+      reply: async (text) => this.client !== undefined ? await this.client.reply(text) : false,
+      record: (text) => this.push("command", text),
+      compose: composeReply,
+      choose: async (text, rows, timeoutMs, forUserId) => {
+        const client = this.client;
+        if (client === undefined || !client.connected) {
+          return;
+        }
+        try {
+          return await client.requestChoice(text, rows, timeoutMs, forUserId);
+        } catch {
+          return;
+        }
+      },
+      holdTopic: (on) => {
+        this.keepTopic = on;
+        if (on) {
+          this.switched = false;
+        }
+      },
+      takeSwitched: () => {
+        const was = this.switched;
+        this.switched = false;
+        return was;
+      },
+      limits: {
+        runningNoticeMs: options.commandRunningNoticeMs ?? DEFAULT_ROUTER_LIMITS.runningNoticeMs,
+        commandLimitMs: options.commandLimitMs ?? DEFAULT_ROUTER_LIMITS.commandLimitMs,
+        choiceTimeoutMs: options.choiceTimeoutMs ?? DEFAULT_ROUTER_LIMITS.choiceTimeoutMs
+      }
+    });
   }
   get active() {
     return this.client !== undefined;
@@ -112367,6 +113034,7 @@ class RemoteBridge {
     this.client = undefined;
     this.clientConnected = false;
     this.endTurnState();
+    this.waiting.length = 0;
     this.host.recordOff();
     const dropped = this.host.dropQueuedTelegramLines?.() ?? [];
     if (dropped.length > 0) {
@@ -112406,26 +113074,73 @@ class RemoteBridge {
       this.push("status", `stopped${status.reason !== undefined ? `: ${preview2(status.reason)}` : ""}`);
     }
   }
-  accept(text, _meta) {
+  accept(text, meta) {
     const line = text.trim();
     if (line.length === 0 || this.client === undefined)
       return;
     if (line.startsWith("/")) {
-      this.push("line", `Telegram: slash command refused (${preview2(line.split(/\s+/)[0] ?? "")})`);
-      this.client.reply("Slash commands are not run from Telegram. Send plain text.").catch(() => false);
+      this.push("line", `Telegram: ${preview2(line)}`);
+      this.router.handle(line, meta.fromId, (result) => this.report(meta.updateId, result));
       return;
     }
     this.push("line", `Telegram: ${preview2(line)}`);
+    this.waiting.push({ updateId: meta.updateId, line });
     if (this.host.isBusy()) {
       this.host.enqueue(line);
     } else {
+      this.report(meta.updateId, "reading");
       this.host.runLine(line);
     }
   }
+  report(updateId, state) {
+    const client = this.client;
+    if (client?.reportState === undefined)
+      return;
+    const previous = this.reportTails.get(updateId);
+    const post = client.reportState.bind(client);
+    const started = previous === undefined ? post(updateId, state) : previous.then(() => post(updateId, state));
+    const tail = started.then(() => {
+      return;
+    }, () => {
+      return;
+    }).then(() => {
+      if (this.reportTails.get(updateId) === tail)
+        this.reportTails.delete(updateId);
+    });
+    this.reportTails.set(updateId, tail);
+  }
+  reportTails = new Map;
+  idle() {
+    return this.router.idle();
+  }
+  get keepingTopic() {
+    return this.keepTopic && this.client !== undefined;
+  }
+  sessionLeaving() {
+    if (this.client === undefined)
+      return;
+    this.endTurnState();
+    this.host.recordOff();
+    this.push("status", "session changing; this topic stays bound");
+  }
+  sessionEntered(kind = "new") {
+    const client = this.client;
+    if (client === undefined)
+      return;
+    this.switched = true;
+    if (client.name !== undefined)
+      this.host.recordOn(client.name);
+    this.push("status", kind === "new" ? "new session; same topic" : "resumed session; same topic");
+    client.reply(kind === "new" ? "--- new session ---" : "--- resumed session ---").catch(() => false);
+  }
   turnStarted(source) {
     this.endTurnState();
     if (source !== TG_SOURCE || this.client === undefined)
       return;
+    const next = this.waiting.shift();
+    this.currentUpdate = next?.updateId;
+    if (next !== undefined)
+      this.report(next.updateId, "working");
     this.tgTurn = true;
     this.lastAssistantText = "";
     this.timedOut = false;
@@ -112454,6 +113169,12 @@ class RemoteBridge {
     if (client === undefined)
       return;
     this.push("line", `Telegram line removed from the queue: ${preview2(line)}`);
+    const index = this.waiting.findIndex((entry) => entry.line === line.trim());
+    if (index >= 0) {
+      const [gone] = this.waiting.splice(index, 1);
+      if (gone !== undefined)
+        this.report(gone.updateId, "failed");
+    }
     client.reply(`Your message "${preview2(line)}" was removed from the queue in the shell, so it will not run.`).catch(() => false);
   }
   async turnSettled(outcome) {
@@ -112462,9 +113183,12 @@ class RemoteBridge {
     const client = this.client;
     const text = this.lastAssistantText;
     const timedOut = this.timedOut;
+    const updateId = this.currentUpdate;
     this.endTurnState();
     if (client === undefined)
       return;
+    if (updateId !== undefined)
+      this.report(updateId, outcome.failed || timedOut ? "failed" : "done");
     let body;
     if (timedOut) {
       body = "Stopped: this run went over the time limit for runs started from Telegram.";
@@ -112480,6 +113204,7 @@ class RemoteBridge {
   }
   endTurnState() {
     this.tgTurn = false;
+    this.currentUpdate = undefined;
     this.lastAssistantText = "";
     this.timedOut = false;
     if (this.runTimer !== undefined) {
@@ -112508,6 +113233,7 @@ var TG_SOURCE = "tg", REMOTE_EVENT_LIMIT = 20, REMOTE_REPLY_MAX_CHARS = 16000, E
 var init_shell_bridge = __esm(() => {
   init_service2();
   init_client3();
+  init_command_router();
   init_protocol2();
 });
 
@@ -113995,6 +114721,9 @@ var init_channels_surface = __esm(() => {
 });
 
 // src/tui/remote-control-surface.ts
+function commandEchoText(line, source) {
+  return source === TG_SOURCE ? `${TG_ECHO_MARKER} ${line}` : `\u276F ${line}`;
+}
 function labelTelegramLine(text) {
   return `[${TG_LABEL}] ${text}`;
 }
@@ -114048,6 +114777,12 @@ function formatRemoteEventLines(status) {
     return ["No remote events yet."];
   return [...status.events].reverse().slice(0, REMOTE_EVENT_LIMIT).map((event) => `${clock(event.at)}  ${event.kind.padEnd(8)} ${event.text}`);
 }
+function formatRemoteCommandLines(status) {
+  const commands = status.events.filter((event) => event.kind === "command");
+  if (commands.length === 0)
+    return ["No remote commands yet."];
+  return [...commands].reverse().slice(0, REMOTE_EVENT_LIMIT).map((event) => `${clock(event.at)}  ${event.text}`);
+}
 function renderRemoteControlText(status) {
   return `${[...formatRemoteStatusLines(status), "", "Recent events:", ...formatRemoteEventLines(status)].join(`
 `)}
@@ -114084,7 +114819,11 @@ function presentRemoteControl(open, otui, chrome, options) {
   let unsubscribeKey;
   const linesFor = (tab) => {
     const status = options.getStatus();
-    return tab === "events" ? formatRemoteEventLines(status) : formatRemoteStatusLines(status);
+    if (tab === "events")
+      return formatRemoteEventLines(status);
+    if (tab === "commands")
+      return formatRemoteCommandLines(status);
+    return formatRemoteStatusLines(status);
   };
   const content = (tab) => {
     const lines = linesFor(tab);
@@ -114211,7 +114950,8 @@ var init_remote_control_surface = __esm(() => {
   STATE_WORDS = { off: "off", on: "on", offline: "offline" };
   REMOTE_TABS = [
     { id: "status", label: "Status" },
-    { id: "events", label: "Events" }
+    { id: "events", label: "Events" },
+    { id: "commands", label: "Commands" }
   ];
 });
 
@@ -118415,7 +119155,7 @@ function viewWriteRun(cwd, runIdOrPrefix, deps = {}) {
   const patch = readVerifiedPatch(located.dir, located.record);
   return patch.ok ? { record: located.record, patch: patch.text } : { record: located.record };
 }
-function refuse3(reason, detail) {
+function refuse4(reason, detail) {
   return { kind: "refused", reason, detail };
 }
 function decisionBody(decision) {
@@ -118425,33 +119165,33 @@ function decisionBody(decision) {
 async function landWriteRun(input, deps = {}) {
   const located = locate(input.cwd, input.runId, deps.dataDir);
   if (located === undefined)
-    return refuse3("not-found", `no external write run "${input.runId}" in this checkout`);
+    return refuse4("not-found", `no external write run "${input.runId}" in this checkout`);
   const { record, dir } = located;
   if (record.state !== "pending-review" || located.decided) {
-    return refuse3("not-pending", record.state === "refused" ? "the run was refused at capture; it can only be discarded" : "the run was already decided");
+    return refuse4("not-pending", record.state === "refused" ? "the run was refused at capture; it can only be discarded" : "the run was already decided");
   }
   const patch = readVerifiedPatch(dir, record);
   if (!patch.ok)
-    return refuse3(patch.reason, patch.detail);
+    return refuse4(patch.reason, patch.detail);
   if (input.confirmedPatchHash !== record.patchHash) {
-    return refuse3("hash-mismatch", "the confirmed hash is not the hash of the stored patch");
+    return refuse4("hash-mismatch", "the confirmed hash is not the hash of the stored patch");
   }
   if (record.redacted) {
-    return refuse3("redacted", "the stored patch was altered by redaction, so landing it would land content the agent did not write");
+    return refuse4("redacted", "the stored patch was altered by redaction, so landing it would land content the agent did not write");
   }
   const binary = record.files.filter((file) => file.binary === true).map((file) => file.path);
   if (binary.length > 0) {
-    return refuse3("binary", `binary content is not carried by the patch: ${binary.join(", ")}`);
+    return refuse4("binary", `binary content is not carried by the patch: ${binary.join(", ")}`);
   }
   if (record.flaggedPaths.length > 0 && input.allowFlagged !== true) {
-    return refuse3("flagged", `the run changes flagged paths (${record.flaggedPaths.join(", ")}); allow them explicitly to land`);
+    return refuse4("flagged", `the run changes flagged paths (${record.flaggedPaths.join(", ")}); allow them explicitly to land`);
   }
   const git = deps.git ?? defaultGit;
   const repo = record.projectRoot;
   const branch = `external/${record.runId}`;
   try {
     await git(["rev-parse", "--verify", "--quiet", `refs/heads/${branch}`], repo);
-    return refuse3("branch-exists", `branch ${branch} already exists`);
+    return refuse4("branch-exists", `branch ${branch} already exists`);
   } catch {}
   const ownedDir = deps.worktreesDir === undefined ? await mkdtemp6(path261.join(tmpdir12(), "keryx-external-land-")) : undefined;
   const worktreesDir = deps.worktreesDir ?? ownedDir;
@@ -118473,7 +119213,7 @@ async function landWriteRun(input, deps = {}) {
         return;
       });
       createdBranch = false;
-      return refuse3("not-pending", "the run was decided by someone else while it was being landed");
+      return refuse4("not-pending", "the run was decided by someone else while it was being landed");
     }
     return { kind: "landed", branch, commit };
   } catch (error) {
@@ -118481,7 +119221,7 @@ async function landWriteRun(input, deps = {}) {
       await git(["branch", "-D", branch], repo).catch(() => {
         return;
       });
-    return refuse3("apply-failed", errorMessage3(error));
+    return refuse4("apply-failed", errorMessage3(error));
   } finally {
     await port.remove(worktreeId).catch(() => {
       return;
@@ -145920,6 +146660,16 @@ async function launchTuiAgentShell(opts) {
       detachExternal = attached.detach;
       return attached.operator;
     })();
+    const commandWork = new Set;
+    const commandWorkFailures = [];
+    const trackCommandWork = (work) => {
+      const settled = work().catch((error) => {
+        commandWorkFailures.push(error instanceof Error ? error.message : String(error));
+      }).finally(() => {
+        commandWork.delete(settled);
+      });
+      commandWork.add(settled);
+    };
     const runDelegate = (line) => {
       const parsed = parseDelegateCommand(line.trim().replace(/^\/\S+\s*/, ""));
       if (!parsed.ok) {
@@ -146244,7 +146994,7 @@ async function launchTuiAgentShell(opts) {
       }).catch(() => {});
     };
     const showExternalStatus = () => {
-      loadExternalStatus().then((status) => {
+      trackCommandWork(() => loadExternalStatus().then((status) => {
         externalStatus = status;
         refreshExternalSidebar();
         const jevAvailable = resolveJevApiKey(process.env) !== undefined;
@@ -146255,7 +147005,7 @@ async function launchTuiAgentShell(opts) {
       }).catch((error) => {
         io.onSystem?.(`external: ${error instanceof Error ? error.message : String(error)}
 `);
-      });
+      }));
     };
     const approvalContext = createApprovalContextLoader(opts.session?.cwd ?? process.cwd());
     const confirmScheduleCard = async (card) => {
@@ -146727,6 +147477,10 @@ async function launchTuiAgentShell(opts) {
     liveDeps = deps;
     let splash = undefined;
     const stopRemoteForSessionSwitch = () => {
+      if (remoteBridge?.keepingTopic === true) {
+        remoteBridge.sessionLeaving();
+        return;
+      }
       if (remoteBridge?.active !== true)
         return;
       const closing = remoteBridge.disable();
@@ -146741,6 +147495,8 @@ async function launchTuiAgentShell(opts) {
       }
       stopRemoteForSessionSwitch();
       liveSession = opened.handle;
+      if (remoteBridge?.keepingTopic === true)
+        remoteBridge.sessionEntered(opened.resumed ? "resumed" : "new");
       io.trustedMcpTools?.clear();
       history = previewHistory === true ? opened.history.slice(-SESSION_PREVIEW_MESSAGE_COUNT) : opened.history;
       archive = opened.archive.length > 0 ? [...opened.archive] : [...opened.history];
@@ -147103,6 +147859,8 @@ Staying in the current session.
       io.trustedMcpTools?.clear();
       stopRemoteForSessionSwitch();
       liveSession = opened.handle;
+      if (remoteBridge?.keepingTopic === true)
+        remoteBridge.sessionEntered("new");
       history = [];
       archive = [];
       nextArchiveIndex = 0;
@@ -147115,8 +147873,10 @@ Staying in the current session.
       }
       return true;
     };
+    let pendingResumeTarget;
     const resumeSessionInteractive = async () => {
-      const found = await pickRecentSession();
+      const found = pendingResumeTarget ?? await pickRecentSession();
+      pendingResumeTarget = undefined;
       if (found === undefined) {
         return;
       }
@@ -148473,7 +149233,7 @@ ${formatThemeList(getThemeId())}`);
       if (line.startsWith("/")) {
         transcript.add(new otui.TextRenderable(r, {
           id: `c${uid++}`,
-          content: otui.t`${roleChunk(otui, "accent", `\u276F ${line}`)}`,
+          content: otui.t`${roleChunk(otui, "accent", commandEchoText(line, source))}`,
           marginTop: 1
         }));
       }
@@ -148726,7 +149486,7 @@ ${formatThemeList(getThemeId())}`);
           const cwd = inspectorCwd();
           io.onSystem?.(`review-jev-risk: scoring the working diff's hunks\u2026
 `);
-          (async () => {
+          trackCommandWork(async () => {
             try {
               io.onSystem?.(`${await runJevRiskForShell(cwd)}
 `);
@@ -148734,14 +149494,14 @@ ${formatThemeList(getThemeId())}`);
               io.onSystem?.(`review-jev-risk: ${error instanceof Error ? error.message : String(error)}
 `);
             }
-          })();
+          });
           return;
         }
         if (isJevScenariosCommand(command.name)) {
           const cwd = inspectorCwd();
           io.onSystem?.(`review-jev-scenarios: checking likely-affected scenarios\u2026
 `);
-          (async () => {
+          trackCommandWork(async () => {
             try {
               io.onSystem?.(`${await runJevScenariosForShell(cwd)}
 `);
@@ -148749,14 +149509,14 @@ ${formatThemeList(getThemeId())}`);
               io.onSystem?.(`review-jev-scenarios: ${error instanceof Error ? error.message : String(error)}
 `);
             }
-          })();
+          });
           return;
         }
         if (isJevRulesCommand(command.name)) {
           const cwd = inspectorCwd();
           io.onSystem?.(`review-jev-rules: checking the working diff against project rules\u2026
 `);
-          (async () => {
+          trackCommandWork(async () => {
             try {
               io.onSystem?.(`${await runJevRulesForShell(cwd)}
 `);
@@ -148764,14 +149524,14 @@ ${formatThemeList(getThemeId())}`);
               io.onSystem?.(`review-jev-rules: ${error instanceof Error ? error.message : String(error)}
 `);
             }
-          })();
+          });
           return;
         }
         if (isStaledocsCommand(command.name)) {
           const cwd = inspectorCwd();
           io.onSystem?.(`review-jev-docs: checking the working diff against documentation\u2026
 `);
-          (async () => {
+          trackCommandWork(async () => {
             try {
               io.onSystem?.(`${await runStaledocsForShell(cwd)}
 `);
@@ -148779,7 +149539,7 @@ ${formatThemeList(getThemeId())}`);
               io.onSystem?.(`review-jev-docs: ${error instanceof Error ? error.message : String(error)}
 `);
             }
-          })();
+          });
           return;
         }
         if (isOpencommentsCommand(command.name)) {
@@ -148794,7 +149554,7 @@ ${formatThemeList(getThemeId())}`);
           }
           io.onSystem?.(`review-jev-comments: checking open comments on ${repoArg}#${prNumber}\u2026
 `);
-          (async () => {
+          trackCommandWork(async () => {
             try {
               io.onSystem?.(`${await runOpencommentsForShell(cwd, repoArg, prNumber)}
 `);
@@ -148802,14 +149562,14 @@ ${formatThemeList(getThemeId())}`);
               io.onSystem?.(`review-jev-comments: ${error instanceof Error ? error.message : String(error)}
 `);
             }
-          })();
+          });
           return;
         }
         if (isJevContractCommand(command.name)) {
           const cwd = inspectorCwd();
           io.onSystem?.(`review-jev-contract: checking claims against the working diff\u2026
 `);
-          (async () => {
+          trackCommandWork(async () => {
             try {
               io.onSystem?.(`${await runJevContractForShell(cwd)}
 `);
@@ -148817,14 +149577,14 @@ ${formatThemeList(getThemeId())}`);
               io.onSystem?.(`review-jev-contract: ${error instanceof Error ? error.message : String(error)}
 `);
             }
-          })();
+          });
           return;
         }
         if (isJevTriageCommand(command.name)) {
           const cwd = inspectorCwd();
           io.onSystem?.(`review-jev-triage: triaging the latest review package\u2026
 `);
-          (async () => {
+          trackCommandWork(async () => {
             try {
               io.onSystem?.(`${await runJevTriageForShell(cwd)}
 `);
@@ -148832,7 +149592,7 @@ ${formatThemeList(getThemeId())}`);
               io.onSystem?.(`review-jev-triage: ${error instanceof Error ? error.message : String(error)}
 `);
             }
-          })();
+          });
           return;
         }
         if (isRewindCommand(command.name)) {
@@ -148888,13 +149648,13 @@ ${formatThemeList(getThemeId())}`);
         }
         if (isExternalAgentsCommand(command.name)) {
           const arg = line.trim().split(/\s+/).slice(1).join(" ");
-          runExternalAgentsCommand(arg, opts.session?.cwd ?? process.cwd()).then((text) => io.onSystem?.(text));
+          trackCommandWork(() => runExternalAgentsCommand(arg, opts.session?.cwd ?? process.cwd()).then((text) => io.onSystem?.(text)));
           return;
         }
         if (isExternalCommand(command.name)) {
           const arg = line.trim().split(/\s+/).slice(1).join(" ").trim().toLowerCase();
           if (arg === "on" || arg === "off") {
-            setExternalEnabled(arg);
+            trackCommandWork(() => setExternalEnabled(arg));
             return;
           }
           if (arg.length > 0) {
@@ -148938,11 +149698,11 @@ ${formatThemeList(getThemeId())}`);
           return;
         }
         if (command.name === "/doctor") {
-          (async () => {
+          trackCommandWork(async () => {
             const report = await buildDoctorReport(sessionCwd);
             io.onSystem?.(`${formatDoctorReport2(report)}
 `);
-          })();
+          });
           return;
         }
         if (command.name === "/setup") {
@@ -149414,6 +150174,110 @@ ${formatThemeList(getThemeId())}`);
           runLine(drained.question, "operator", drained.source);
       }
     });
+    const captureShellOutput = async (run) => {
+      const chunks = [];
+      let active = true;
+      let ok = true;
+      const previous = io.onSystem;
+      const previousToast = chrome.showToast;
+      const capture = (text) => {
+        if (active)
+          chunks.push(text);
+        previous?.(text);
+      };
+      const captureToast = (message) => {
+        if (active)
+          chunks.push(`${message}
+`);
+        previousToast(message);
+      };
+      const before = new Set(commandWork);
+      commandWorkFailures.length = 0;
+      io.onSystem = capture;
+      chrome.showToast = captureToast;
+      try {
+        await run();
+        let seen = chunks.length;
+        let quiet = 0;
+        while (quiet < 2 || [...commandWork].some((work) => !before.has(work))) {
+          await new Promise((resolve) => setTimeout(resolve, 150));
+          if (chunks.length !== seen) {
+            seen = chunks.length;
+            quiet = 0;
+          } else {
+            quiet += 1;
+          }
+        }
+      } catch (error) {
+        ok = false;
+        chunks.push(`${error instanceof Error ? error.message : String(error)}
+`);
+      } finally {
+        active = false;
+        if (io.onSystem === capture) {
+          if (previous)
+            io.onSystem = previous;
+          else
+            delete io.onSystem;
+        }
+        if (chrome.showToast === captureToast)
+          chrome.showToast = previousToast;
+      }
+      if (commandWorkFailures.length > 0) {
+        ok = false;
+        chunks.push(`${commandWorkFailures.splice(0).join(`
+`)}
+`);
+      }
+      return { output: chunks.join("").trim(), ok };
+    };
+    const echoRemoteCommand = (line) => {
+      transcript.add(new otui.TextRenderable(r, {
+        id: `c${uid++}`,
+        content: otui.t`${roleChunk(otui, "accent", commandEchoText(line, TG_SOURCE))}`,
+        marginTop: 1
+      }));
+    };
+    const remoteStatusText = async () => {
+      const cwd = inspectorCwd();
+      const [workspaces, flows] = await Promise.all([loadInspectorWorkspaces(cwd), loadInspectorFlows(cwd)]);
+      const snapshot = buildSessionInfoSnapshot({
+        summary: liveSession.summary,
+        selection: currentSel,
+        version: package_default.version,
+        usage: lastUsage,
+        estimateTokens: estimateContextTokens(history),
+        sessionText: history.map((message) => message.content).join(`
+`),
+        workspaces,
+        flows
+      });
+      return `${formatSessionInfoText(snapshot).trimEnd()}
+
+Mode: ${permissionMode}${readOnly ? " (read-only on)" : ""}
+Turn: ${chrome.isBusy() ? "running" : "idle"} \xB7 queue: ${mainQueue.length} waiting`;
+    };
+    const runRemoteCommand = async (line) => {
+      const name = findAgentCommand(line, "agent")?.name;
+      const first = (line.trim().split(/\s+/)[1] ?? "").toLowerCase();
+      if (name === "/status") {
+        echoRemoteCommand(line);
+        return await captureShellOutput(async () => {
+          io.onSystem?.(`${await remoteStatusText()}
+`);
+        });
+      }
+      if (name === "/mode" && (first === "" || first === "auto")) {
+        echoRemoteCommand(line);
+        return await captureShellOutput(() => {
+          if (first === "auto")
+            commitPermissionMode("auto");
+          io.onSystem?.(`Permission mode: ${permissionMode} (ask, trust or auto)
+`);
+        });
+      }
+      return await captureShellOutput(() => runLine(line, "operator", TG_SOURCE));
+    };
     remoteBridge = new RemoteBridge({
       host: {
         sessionId: () => liveSession.summary.id,
@@ -149452,6 +150316,78 @@ ${formatThemeList(getThemeId())}`);
           paintMainQueue();
           return dropped.map((item) => item.question);
         },
+        runCommand: runRemoteCommand,
+        busyRefusal: (line) => {
+          const command = findAgentCommand(line, "agent");
+          const decision = classifyBusyDispatch({
+            line,
+            commandName: command?.name,
+            isSessionInfo: isSessionInfoCommand(line),
+            isFlows: isFlowsCommand(line),
+            isWorkspace: isWorkspaceCommand(line),
+            isReview: isReviewCommand(line),
+            isMcp: isMcpToolsCommand(line),
+            isMcpConsumer: isMcpConsumerCommand(line)
+          });
+          return decision === "deferred" || decision === "not-a-command" ? BUSY_REASON : undefined;
+        },
+        listProviders: async () => {
+          const detected = opts.redetect !== undefined ? await opts.redetect() : opts.detected;
+          const connected = await filterConnectedDetectedProviders(detected, {});
+          return connected.map((prov) => ({
+            id: prov.name,
+            label: prov.label ?? prov.name,
+            ...prov.name === currentSel.provider ? { current: true } : {}
+          }));
+        },
+        listModels: async (providerId) => {
+          const detected = opts.redetect !== undefined ? await opts.redetect() : opts.detected;
+          const name = providerId ?? currentSel.provider;
+          const prov = detected.find((d) => d.name === name);
+          if (prov === undefined)
+            return;
+          const resolved = await modelsForPicker(prov);
+          return {
+            provider: prov.label ?? prov.name,
+            models: resolved.models.map((id) => ({
+              id,
+              label: id,
+              ...name === currentSel.provider && id === currentSel.model ? { current: true } : {}
+            }))
+          };
+        },
+        switchModel: async (modelId, providerId) => {
+          const detected = opts.redetect !== undefined ? await opts.redetect() : opts.detected;
+          const name = providerId ?? currentSel.provider;
+          const prov = detected.find((d) => d.name === name);
+          if (prov === undefined)
+            return { output: "That provider is not connected here.", ok: false };
+          const baseUrl = name === currentSel.provider ? currentSel.baseUrl : prov.baseUrl;
+          await switchTo(baseUrl === undefined ? { provider: name, model: modelId } : { provider: name, model: modelId, baseUrl });
+          try {
+            await applyRuntimeSwitchToSlate({
+              slateSession,
+              runtime: { provider: currentSel.provider, model: currentSel.model },
+              history,
+              onHistoryChange: io.onHistoryChange
+            });
+          } catch {}
+          return { output: `Model: ${currentSel.provider}/${currentSel.model}`, ok: true };
+        },
+        listSessions: async () => listSessions(sessionCwd).map((row) => ({
+          id: row.id,
+          label: `${shortSessionId(row.id)} \xB7 ${row.title}`,
+          ...row.id === liveSession.summary.id ? { current: true } : {}
+        })),
+        resumeSession: async (id) => {
+          const found = findSession(sessionCwd, id);
+          if (found === undefined)
+            return { output: "Session not found in this project.", ok: false };
+          pendingResumeTarget = found;
+          const outcome = await captureShellOutput(() => resumeSessionInteractive());
+          pendingResumeTarget = undefined;
+          return liveSession.summary.id === found.id ? { ...outcome, ok: true } : { ...outcome, ok: false };
+        },
         onChange: () => liveRemotePanel?.refresh()
       }
     });
@@ -149504,6 +150440,7 @@ var init_tui_shell = __esm(() => {
   init_product_open_surface();
   init_reviews_inspector();
   init_shell_bridge();
+  init_command_gateway();
   init_channels_client();
   init_channels_surface();
   init_remote_control_surface();
@@ -184248,7 +185185,7 @@ function finishReasonToStopReason(finishReason) {
       return "end_turn";
   }
 }
-function refuse4(error) {
+function refuse5(error) {
   throw new AcpError(error.code, error.message, error.data);
 }
 async function runAcpServer(options) {
@@ -184321,7 +185258,7 @@ async function runAcpServer(options) {
     if (!activeTurns.has(sessionId)) {
       return;
     }
-    refuse4(invalidRequest({
+    refuse5(invalidRequest({
       reason: `${method}: a turn is already running for session ${sessionId}; ` + "wait for its session/prompt response \u2014 send session/cancel first if you do not want to wait for it to finish, " + "then prompt again once the cancelled turn has replied",
       method,
       sessionId,
@@ -184370,7 +185307,7 @@ async function runAcpServer(options) {
   let stopping = false;
   function refuseIfStopping(method) {
     if (stopping) {
-      refuse4({
+      refuse5({
         code: JSON_RPC_ERROR_CODES.invalidRequest,
         message: `${method}: keryx acp is shutting down`,
         data: { method, condition: "shutting-down" }
@@ -184379,7 +185316,7 @@ async function runAcpServer(options) {
   }
   function requireProvider(method) {
     if (options.provider === undefined) {
-      refuse4({
+      refuse5({
         code: JSON_RPC_ERROR_CODES.invalidRequest,
         message: options.providerUnavailable ?? `${method}: keryx acp has no provider configured`,
         data: { method, condition: "provider-not-configured" }
@@ -184494,7 +185431,7 @@ async function runAcpServer(options) {
     const choice = findAcpModelChoice(choices, requested, allowBareModelId);
     const available = choices.map((entry) => entry.value);
     if (choice === undefined) {
-      refuse4(invalidParams(`${method}: "${requested.length > 80 ? `${requested.slice(0, 80)}\u2026` : requested}" is not a model this session can run; ` + `choose one of: ${available.join(", ")}`, { value: requested, available }));
+      refuse5(invalidParams(`${method}: "${requested.length > 80 ? `${requested.slice(0, 80)}\u2026` : requested}" is not a model this session can run; ` + `choose one of: ${available.join(", ")}`, { value: requested, available }));
     }
     const seq = beginSwitch(sessionId);
     const current = sessionModel(sessionId, method);
@@ -184503,7 +185440,7 @@ async function runAcpServer(options) {
       return "cancelled";
     }
     if (typeof built === "string") {
-      refuse4(invalidParams(`${method}: cannot switch to ${choice.value}: ${built}`, { value: choice.value, reason: built }));
+      refuse5(invalidParams(`${method}: cannot switch to ${choice.value}: ${built}`, { value: choice.value, reason: built }));
     }
     const next = { choice, binding: built };
     applySwitch(sessionId, seq, next);
@@ -184620,14 +185557,14 @@ async function runAcpServer(options) {
   })();
   function requireInitialized(method) {
     if (!initialized) {
-      refuse4(invalidRequest({ reason: `${method}: call initialize before any other request`, method }));
+      refuse5(invalidRequest({ reason: `${method}: call initialize before any other request`, method }));
     }
   }
   function handleInitialize(params) {
     const obj = requireObjectParams(params, ACP_AGENT_METHODS.initialize);
     const negotiation = negotiateProtocolVersion(obj["protocolVersion"]);
     if (negotiation.kind === "refuse") {
-      refuse4(negotiation.error);
+      refuse5(negotiation.error);
     }
     initialized = true;
     const rawCaps = obj["clientCapabilities"];
@@ -184751,13 +185688,13 @@ Switch with /model <model>; it applies from the next turn.`;
     const sessionId = requireStringField(obj, "sessionId", ACP_AGENT_METHODS.sessionPrompt);
     const promptField = obj["prompt"];
     if (!Array.isArray(promptField)) {
-      refuse4(invalidParams(`${ACP_AGENT_METHODS.sessionPrompt}: prompt must be an array of content blocks`, {
+      refuse5(invalidParams(`${ACP_AGENT_METHODS.sessionPrompt}: prompt must be an array of content blocks`, {
         received: promptField
       }));
     }
     const state = registry.get(sessionId);
     if (state === undefined) {
-      refuse4({
+      refuse5({
         code: JSON_RPC_ERROR_CODES.resourceNotFound,
         message: `Unknown ACP session: ${sessionId}`,
         data: { sessionId }
@@ -184849,7 +185786,7 @@ Switch with /model <model>; it applies from the next turn.`;
     const obj = requireObjectParams(params, ACP_AGENT_METHODS.sessionList);
     const rawCwd = obj["cwd"];
     if (rawCwd !== undefined && rawCwd !== null && typeof rawCwd !== "string") {
-      refuse4(invalidParams(`${ACP_AGENT_METHODS.sessionList}: cwd must be a string, null or omitted`, { received: rawCwd }));
+      refuse5(invalidParams(`${ACP_AGENT_METHODS.sessionList}: cwd must be a string, null or omitted`, { received: rawCwd }));
     }
     const cwd = typeof rawCwd === "string" && rawCwd.length > 0 ? rawCwd : process.cwd();
     const summaries = listSessions(cwd, options.dataDir);
@@ -184915,14 +185852,14 @@ Switch with /model <model>; it applies from the next turn.`;
       if (!(cause instanceof AcpSessionTranscriptUnreadableError)) {
         throw cause;
       }
-      refuse4({
+      refuse5({
         code: JSON_RPC_ERROR_CODES.internalError,
         message: `Cannot load session ${sessionId}: ${cause.cause.message}`,
         data: { sessionId, cwd, file: cause.cause.file, reason: cause.cause.reason }
       });
     }
     if (state === undefined) {
-      refuse4({
+      refuse5({
         code: JSON_RPC_ERROR_CODES.resourceNotFound,
         message: `Unknown ACP session: ${sessionId}`,
         data: { sessionId, cwd }
@@ -184944,17 +185881,17 @@ Switch with /model <model>; it applies from the next turn.`;
     const configId = requireStringField(obj, "configId", method);
     const value = obj["value"];
     if (typeof value !== "string" || value.length === 0) {
-      refuse4(invalidParams(`${method}: value must be a non-empty string`, { received: value }));
+      refuse5(invalidParams(`${method}: value must be a non-empty string`, { received: value }));
     }
     if (registry.get(sessionId) === undefined) {
-      refuse4({
+      refuse5({
         code: JSON_RPC_ERROR_CODES.resourceNotFound,
         message: `Unknown ACP session: ${sessionId}`,
         data: { sessionId }
       });
     }
     if (configId !== ACP_MODEL_CONFIG_ID) {
-      refuse4(invalidParams(`${method}: keryx has no config option "${configId}"; the only one is "${ACP_MODEL_CONFIG_ID}"`, {
+      refuse5(invalidParams(`${method}: keryx has no config option "${configId}"; the only one is "${ACP_MODEL_CONFIG_ID}"`, {
         configId
       }));
     }
@@ -186676,40 +187613,40 @@ var init_serve_turn = __esm(() => {
 });
 
 // src/lib/serve-server.ts
-function refuse5(reason, message) {
+function refuse6(reason, message) {
   return { ok: false, state: "refused", reason, message };
 }
 function resolveServeStartup(input) {
   const { config, credential } = input;
   if (config === null) {
-    return refuse5("no-configuration", serveConfigAdvice(input.configState ?? "absent"));
+    return refuse6("no-configuration", serveConfigAdvice(input.configState ?? "absent"));
   }
   if (!config.enabled) {
-    return refuse5("disabled", serveConfigAdvice("valid"));
+    return refuse6("disabled", serveConfigAdvice("valid"));
   }
   if (config.credentialRef.store !== "auth-json") {
-    return refuse5("unsupported-credential-store", `credentialRef.store "${config.credentialRef.store}" is not implemented in this release; only "auth-json" is supported.`);
+    return refuse6("unsupported-credential-store", `credentialRef.store "${config.credentialRef.store}" is not implemented in this release; only "auth-json" is supported.`);
   }
   if (credential.status === "unreadable") {
-    return refuse5("unreadable-credential", `${credential.message}. Inspect it, then run \`keryx serve token rotate\`.`);
+    return refuse6("unreadable-credential", `${credential.message}. Inspect it, then run \`keryx serve token rotate\`.`);
   }
   if (credential.status === "absent") {
-    return refuse5("no-credential", "no serve credential exists. Run `keryx serve token issue` \u2014 the token is printed once and never again.");
+    return refuse6("no-credential", "no serve credential exists. Run `keryx serve token issue` \u2014 the token is printed once and never again.");
   }
   if (credential.record.id !== config.credentialRef.id) {
-    return refuse5("no-credential", "the configured credential reference does not match the credential in the store. Run `keryx serve token rotate` to re-issue and re-point it.");
+    return refuse6("no-credential", "the configured credential reference does not match the credential in the store. Run `keryx serve token rotate` to re-issue and re-point it.");
   }
   const nonLoopback = !isLoopbackAddress(config.bind.address);
   if (nonLoopback && config.bind.acknowledgeNonLoopback !== true) {
-    return refuse5("non-loopback-not-acknowledged", `the configured bind address is reachable beyond loopback. Run \`keryx serve config set --bind ${config.bind.address} --acknowledge-non-loopback\` to acknowledge it explicitly; there is no TLS in this release.`);
+    return refuse6("non-loopback-not-acknowledged", `the configured bind address is reachable beyond loopback. Run \`keryx serve config set --bind ${config.bind.address} --acknowledge-non-loopback\` to acknowledge it explicitly; there is no TLS in this release.`);
   }
   const remoteProfile = resolveRemoteProfile(config.profile);
   if (remoteProfile === null) {
-    return refuse5("unknown-profile", `profile "${config.profile}" is not implemented in this release; valid profiles are ${REMOTE_PROFILE_NAMES.join(", ")}. Run \`keryx serve config set --profile remote-restricted\``);
+    return refuse6("unknown-profile", `profile "${config.profile}" is not implemented in this release; valid profiles are ${REMOTE_PROFILE_NAMES.join(", ")}. Run \`keryx serve config set --profile remote-restricted\``);
   }
   const comparison = compareProfiles((input.localBaseline ?? localBaselineProfile)(), remoteProfile);
   if (!comparison.ok) {
-    return refuse5("widening-profile", `profile "${config.profile}" would grant more than the local profile allows (${comparison.widened.join(", ")}). Run \`keryx serve config set --profile remote-restricted\``);
+    return refuse6("widening-profile", `profile "${config.profile}" would grant more than the local profile allows (${comparison.widened.join(", ")}). Run \`keryx serve config set --profile remote-restricted\``);
   }
   return { ok: true, config, credential: credential.record, nonLoopback, profile: remoteProfile };
 }
@@ -187057,11 +187994,11 @@ async function startServeListener(input) {
       error: internalErrorResponse
     });
   } catch (error) {
-    return refuse5("bind-failed", `could not bind ${hostname}:${startup.config.bind.port}: ${error instanceof Error ? error.message : String(error)}`);
+    return refuse6("bind-failed", `could not bind ${hostname}:${startup.config.bind.port}: ${error instanceof Error ? error.message : String(error)}`);
   }
   if (typeof server.port !== "number" || server.port <= 0) {
     await server.stop(true);
-    return refuse5("bind-failed", "the listener reported no bound port");
+    return refuse6("bind-failed", "the listener reported no bound port");
   }
   boundPort = server.port;
   try {
@@ -187111,6 +188048,8 @@ var init_serve_server = __esm(() => {
     ["heartbeat", "POST"],
     ["reply", "POST"],
     ["approval", "POST"],
+    ["prompt", "POST"],
+    ["state", "POST"],
     ["ack", "POST"],
     ["stream", "GET"],
     ["channels-status", "GET"],
@@ -187348,6 +188287,46 @@ function createHttpBotApi(options) {
       }
       return call("sendMessage", body);
     },
+    async editMessageReplyMarkup(params) {
+      await call("editMessageReplyMarkup", {
+        chat_id: params.chatId,
+        message_id: params.messageId,
+        reply_markup: { inline_keyboard: params.inlineKeyboard ?? [] }
+      });
+    },
+    async editMessageText(params) {
+      const body = {
+        chat_id: params.chatId,
+        message_id: params.messageId,
+        text: params.text,
+        reply_markup: { inline_keyboard: params.inlineKeyboard ?? [] }
+      };
+      if (params.parseMode !== undefined) {
+        body.parse_mode = params.parseMode;
+      }
+      await call("editMessageText", body);
+    },
+    async setMyCommands(params) {
+      const body = { commands: params.commands };
+      if (params.chatId !== undefined) {
+        body.scope = { type: "chat", chat_id: params.chatId };
+      }
+      await call("setMyCommands", body);
+    },
+    async setMessageReaction(params) {
+      await call("setMessageReaction", {
+        chat_id: params.chatId,
+        message_id: params.messageId,
+        reaction: params.emoji === undefined ? [] : [{ type: "emoji", emoji: params.emoji }]
+      });
+    },
+    async sendChatAction(params) {
+      const body = { chat_id: params.chatId, action: params.action };
+      if (params.messageThreadId !== undefined) {
+        body.message_thread_id = params.messageThreadId;
+      }
+      await call("sendChatAction", body);
+    },
     async createForumTopic(params) {
       return call("createForumTopic", { chat_id: params.chatId, name: params.name });
     },
@@ -187808,6 +188787,22 @@ async function sendHtml(api, params, onFallback) {
     return api.sendMessage(plain);
   }
 }
+async function editHtml(api, params, onFallback) {
+  try {
+    await api.editMessageText({ ...params, text: renderTelegramHtml(params.text), parseMode: "HTML" });
+  } catch (error) {
+    if (!isEntityParseError(error)) {
+      throw error;
+    }
+    try {
+      onFallback?.(error);
+    } catch {}
+    await api.editMessageText(params);
+  }
+}
+function isNotModified(error) {
+  return isBotApiError(error) && error.kind === "rejected" && /message is not modified/i.test(error.message);
+}
 var OUTSIDE, WORD, ALNUM, SPACE, SINGLE_OPEN_BAD, SINGLE_CLOSE_BAD, HTTP_URL, LANGUAGE, EXPANDABLE_QUOTE_LINES = 8, TAGS2, HEADING2, BULLET, QUOTE, SIMPLE_TAGS;
 var init_format_html = __esm(() => {
   init_format2();
@@ -188168,6 +189163,7 @@ class OutboundQueue {
   onDrop;
   onFallback;
   retryDelayMs;
+  sentHooks = new Map;
   blockedUntil = 0;
   flushing;
   constructor(options) {
@@ -188208,8 +189204,12 @@ class OutboundQueue {
         ...message.keyboard === undefined || index !== parts.length - 1 ? {} : { keyboard: message.keyboard },
         createdAt: this.now()
       };
+      if (message.onSent !== undefined && index === parts.length - 1) {
+        this.sentHooks.set(entry.id, message.onSent);
+      }
       const { dropped } = this.log.add(entry);
       for (const gone of dropped) {
+        this.sentHooks.delete(gone.id);
         this.onDrop(gone, "outbound queue is full; oldest message dropped");
       }
       entries.push(entry);
@@ -188220,6 +189220,7 @@ class OutboundQueue {
     let removed = 0;
     for (const entry of this.log.pending()) {
       if (entry.chatId === chatId && entry.threadId === threadId) {
+        this.sentHooks.delete(entry.id);
         this.log.ack(entry.id);
         removed += 1;
       }
@@ -188234,6 +189235,21 @@ class OutboundQueue {
     }
     return this.flushing;
   }
+  notifySent(entry, messageId) {
+    const hook = this.sentHooks.get(entry.id);
+    if (hook === undefined) {
+      return;
+    }
+    this.sentHooks.delete(entry.id);
+    try {
+      hook({
+        messageId,
+        chatId: entry.chatId,
+        ...entry.threadId === undefined ? {} : { threadId: entry.threadId },
+        text: entry.text
+      });
+    } catch {}
+  }
   async run() {
     let sent = 0;
     let dropped = 0;
@@ -188247,7 +189263,7 @@ class OutboundQueue {
         return { sent, dropped, remaining: this.log.size, retryInMs: wait, stoppedBy: "rate limited" };
       }
       try {
-        await sendHtml(this.api, {
+        const result = await sendHtml(this.api, {
           chatId: entry.chatId,
           text: entry.text,
           ...entry.threadId === undefined ? {} : { messageThreadId: entry.threadId },
@@ -188255,6 +189271,7 @@ class OutboundQueue {
         }, () => this.onFallback(entry));
         this.log.ack(entry.id);
         sent += 1;
+        this.notifySent(entry, result.message_id);
       } catch (error) {
         const description = describe(error);
         if (isBotApiError(error) && error.kind === "rate-limited") {
@@ -188266,6 +189283,7 @@ class OutboundQueue {
           return { sent, dropped, remaining: this.log.size, retryInMs: this.retryDelayMs, stoppedBy: description };
         }
         this.log.ack(entry.id);
+        this.sentHooks.delete(entry.id);
         dropped += 1;
         this.onDrop(entry, description);
       }
@@ -188285,6 +189303,24 @@ var init_outbound_queue = __esm(() => {
   init_types11();
 });
 
+// src/remote/message-state.ts
+function isReactionForbidden(status, message) {
+  if (status === 403) {
+    return true;
+  }
+  return /REACTION_INVALID|REACTIONS?_(DISABLED|NOT_ALLOWED)|not enough rights|reactions? (are|is) (disabled|not allowed)|CHAT_ADMIN_REQUIRED/i.test(message);
+}
+var REACTION_FOR_STATE, TYPING_REFRESH_MS = 4000, STATE_CALL_TIMEOUT_MS = 5000, MAX_TRACKED_MESSAGES = 256;
+var init_message_state = __esm(() => {
+  REACTION_FOR_STATE = {
+    received: "\uD83D\uDC40",
+    reading: "\uD83E\uDD14",
+    working: "\u26A1",
+    done: "\uD83D\uDC4D",
+    failed: "\uD83D\uDC4E"
+  };
+});
+
 // src/remote/poller.ts
 function defaultSleep2(ms, signal) {
   return new Promise((resolve) => {
@@ -188563,6 +189599,9 @@ class RemoteHub {
   flushTimer;
   sweepTimer;
   stopped = false;
+  tracked = new Map;
+  typing = new Map;
+  reactionsOff = false;
   constructor(options) {
     this.api = options.api;
     this.config = options.config;
@@ -188636,6 +189675,14 @@ class RemoteHub {
     for (const record of this.registry.records()) {
       this.dispatch(nameKey(record.name));
     }
+    await this.publishCommandMenu();
+  }
+  async publishCommandMenu() {
+    try {
+      await this.api.setMyCommands({ commands: remoteMenu(), chatId: this.config.chatId });
+    } catch (error) {
+      this.event("menu-failed", describeError4(error));
+    }
   }
   async stop() {
     this.stopped = true;
@@ -188651,6 +189698,10 @@ class RemoteHub {
       this.timers.clearTimeout(handle);
     }
     this.retryTimers.clear();
+    for (const handle of this.typing.values()) {
+      this.timers.clearInterval(handle);
+    }
+    this.typing.clear();
     await this.poller.stop();
   }
   pollerStatus() {
@@ -188753,6 +189804,7 @@ class RemoteHub {
           record.unavailableSince = Math.min(now, record.lastHeartbeat + SESSION_LEASE_STALE_MS);
           this.registry.save();
           this.event("session-unavailable", record.name);
+          this.endActivity(record.sessionId);
           if (now - record.unavailableSince < this.config.orphanMs) {
             this.queueStatus(record, `Session unavailable: the shell stopped responding. This topic is deleted in ${formatDuration(this.config.orphanMs)} unless the session returns.`);
           }
@@ -188773,11 +189825,31 @@ class RemoteHub {
       chatId: record.chatId,
       threadId: record.threadId,
       text,
-      ...options.keyboard === undefined ? {} : { keyboard: options.keyboard }
+      ...options.keyboard === undefined ? {} : { keyboard: options.keyboard },
+      ...options.onSent === undefined ? {} : { onSent: options.onSent }
     });
     await this.flushOutbound();
     return true;
   }
+  async settleMessage(sessionId, messageId, text, shortReply = text) {
+    const record = this.registry.bySession(sessionId);
+    if (record === undefined) {
+      return "gone";
+    }
+    try {
+      await editHtml(this.api, { chatId: record.chatId, messageId, text }, () => this.event("format-fallback", `Telegram refused the formatting; edited as plain text (topic ${record.threadId})`));
+      return "edited";
+    } catch (error) {
+      if (isNotModified(error)) {
+        return "edited";
+      }
+      try {
+        await this.api.editMessageReplyMarkup({ chatId: record.chatId, messageId });
+      } catch {}
+      await this.send(sessionId, shortReply);
+      return "replied";
+    }
+  }
   async flushOutbound() {
     const result = await this.outbound.flush();
     if (result.retryInMs !== undefined && !this.stopped && this.flushTimer === undefined) {
@@ -188946,6 +190018,7 @@ class RemoteHub {
   }
   async retire(record, why, strict = false) {
     this.outbound.discardForThread(record.chatId, record.threadId);
+    this.stopTyping(record);
     try {
       await this.api.deleteForumTopic({ chatId: record.chatId, messageThreadId: record.threadId });
     } catch (error) {
@@ -188993,7 +190066,11 @@ class RemoteHub {
       if (typeof message.text !== "string" || message.text.length === 0) {
         return;
       }
-      const appended = this.inbound.append(key, { ...base, kind: "text", text: message.text });
+      const appended = this.inbound.append(key, { ...base, kind: "text", text: message.text, messageId: message.message_id });
+      if (appended.added) {
+        const tracked = this.track(record, update.update_id, message.message_id);
+        this.react(tracked, "received");
+      }
       return { key, dropped: appended.dropped };
     }
     if (query?.data === undefined) {
@@ -189006,6 +190083,108 @@ class RemoteHub {
     });
     return { key, dropped: appended.dropped, callbackQueryId: query.id };
   }
+  trackKey(threadId, updateId) {
+    return `${threadId}:${updateId}`;
+  }
+  track(record, updateId, messageId) {
+    const key = this.trackKey(record.threadId, updateId);
+    const existing = this.tracked.get(key);
+    if (existing !== undefined) {
+      return existing;
+    }
+    const entry = { chatId: record.chatId, threadId: record.threadId, messageId, state: "received", chain: Promise.resolve() };
+    this.tracked.set(key, entry);
+    while (this.tracked.size > MAX_TRACKED_MESSAGES) {
+      const oldest = this.tracked.keys().next().value;
+      if (oldest === undefined) {
+        break;
+      }
+      this.tracked.delete(oldest);
+    }
+    return entry;
+  }
+  react(message, state) {
+    message.state = state;
+    if (this.reactionsOff || this.stopped) {
+      return;
+    }
+    message.chain = message.chain.then(async () => {
+      if (this.reactionsOff) {
+        return;
+      }
+      let timer;
+      const timeout = new Promise((resolve) => {
+        timer = this.timers.setTimeout(resolve, STATE_CALL_TIMEOUT_MS);
+      });
+      const call = this.api.setMessageReaction({ chatId: message.chatId, messageId: message.messageId, emoji: REACTION_FOR_STATE[state] }).then(() => {
+        return;
+      }, (error) => this.reactionFailed(error));
+      await Promise.race([call, timeout]);
+      this.timers.clearTimeout(timer);
+    });
+  }
+  reactionFailed(error) {
+    if (!isBotApiError(error) || error.kind !== "rejected" || !isReactionForbidden(error.status, error.message)) {
+      return;
+    }
+    if (!this.reactionsOff) {
+      this.reactionsOff = true;
+      this.event("reactions-unavailable", `this bot may not react in the group; the topic shows typing only (${describeError4(error)})`);
+    }
+  }
+  messageState(sessionId, updateId, state) {
+    const record = this.registry.bySession(sessionId);
+    if (record === undefined) {
+      return false;
+    }
+    const message = this.tracked.get(this.trackKey(record.threadId, updateId));
+    if (message === undefined) {
+      return false;
+    }
+    this.react(message, state);
+    if (state === "working") {
+      this.startTyping(record);
+    } else if (state === "done" || state === "failed") {
+      this.stopTyping(record);
+    }
+    return true;
+  }
+  endActivity(sessionId) {
+    const record = this.registry.bySession(sessionId);
+    if (record === undefined) {
+      return;
+    }
+    this.stopTyping(record);
+    for (const message of this.tracked.values()) {
+      if (message.threadId === record.threadId && (message.state === "reading" || message.state === "working")) {
+        this.react(message, "failed");
+      }
+    }
+  }
+  typingKey(record) {
+    return `${record.chatId}:${record.threadId}`;
+  }
+  startTyping(record) {
+    const key = this.typingKey(record);
+    if (this.typing.has(key) || this.stopped) {
+      return;
+    }
+    const send = () => {
+      this.api.sendChatAction({ chatId: record.chatId, action: "typing", messageThreadId: record.threadId }).catch(() => {
+        return;
+      });
+    };
+    send();
+    this.typing.set(key, this.timers.setInterval(send, TYPING_REFRESH_MS));
+  }
+  stopTyping(record) {
+    const key = this.typingKey(record);
+    const handle = this.typing.get(key);
+    if (handle !== undefined) {
+      this.timers.clearInterval(handle);
+      this.typing.delete(key);
+    }
+  }
   dispatch(key) {
     const running = this.dispatching.get(key);
     if (running !== undefined) {
@@ -189028,6 +190207,9 @@ class RemoteHub {
         }
         try {
           if (entry.kind === "text") {
+            if (entry.messageId !== undefined) {
+              this.track(record, entry.updateId, entry.messageId);
+            }
             await this.consumer.deliver(record.sessionId, entry.text ?? "", {
               updateId: entry.updateId,
               threadId: record.threadId,
@@ -189073,6 +190255,8 @@ var init_hub = __esm(() => {
   init_journal2();
   init_naming();
   init_outbound_queue();
+  init_command_gateway();
+  init_message_state();
   init_poller();
   init_registry6();
   init_types11();
@@ -189186,6 +190370,7 @@ class ShellStream {
   onEnded;
   controller;
   closed = false;
+  endedBecause;
   keepalive;
   encoder = new TextEncoder;
   constructor(sessionId, timers, onEnded) {
@@ -189209,6 +190394,7 @@ class ShellStream {
     if (this.closed) {
       return;
     }
+    this.endedBecause = kind;
     if (kind !== undefined) {
       this.write(encodeSseEvent("status", { kind }));
     }
@@ -189229,6 +190415,18 @@ class ShellStream {
     this.onEnded(this);
   }
 }
+function clockText(at) {
+  return `${new Date(at).toISOString().slice(11, 19)} UTC`;
+}
+function settledText(original, result) {
+  if (original === undefined || original.length === 0) {
+    return result;
+  }
+  const kept = `${original}
+
+${result}`;
+  return kept.length <= MAX_SETTLED_TEXT_CHARS ? kept : result;
+}
 function isChannelsRoute(route) {
   return Object.hasOwn(CHANNELS_ROUTE_METHODS, route);
 }
@@ -189245,12 +190443,15 @@ class RemoteHttpSurface {
   keepaliveMs;
   ackTimeoutMs;
   newApprovalId;
+  newPromptId;
   streams = new Map;
   completed = new Map;
   sent = new Map;
   bound = new Map;
   pendingAcks = new Map;
   approvals = new Map;
+  choices = new Map;
+  finished = new Map;
   constructor(options) {
     this.options = options;
     this.now = options.now ?? Date.now;
@@ -189258,6 +190459,7 @@ class RemoteHttpSurface {
     this.keepaliveMs = options.keepaliveMs ?? DEFAULT_KEEPALIVE_MS;
     this.ackTimeoutMs = options.ackTimeoutMs ?? DEFAULT_ACK_TIMEOUT_MS;
     this.newApprovalId = options.approvalIds ?? (() => `ap${randomBytes14(6).toString("hex")}`);
+    this.newPromptId = options.promptIds ?? (() => `pk${randomBytes14(6).toString("hex")}`);
     this.consumer = {
       deliver: (sessionId, line, meta) => this.deliver(sessionId, line, meta),
       deliverCallback: (sessionId, callback) => this.deliverCallback(sessionId, callback)
@@ -189316,6 +190518,10 @@ class RemoteHttpSurface {
         return this.reply(hub, request);
       case "approval":
         return this.requestApproval(hub, request);
+      case "prompt":
+        return this.requestPrompt(hub, request);
+      case "state":
+        return this.messageState(hub, request);
       case "ack":
         return this.ack(hub, request);
       case "stream":
@@ -189336,6 +190542,9 @@ class RemoteHttpSurface {
     for (const id of [...this.approvals.keys()]) {
       this.dropApproval(id);
     }
+    for (const id of [...this.choices.keys()]) {
+      this.dropChoice(id);
+    }
   }
   setChannels(handler) {
     this.channels = handler;
@@ -189443,6 +190652,9 @@ class RemoteHttpSurface {
         if (data.startsWith(RESERVED_CALLBACK_PREFIX)) {
           return { ok: false, message: `button data may not start with "${RESERVED_CALLBACK_PREFIX}" (reserved for approvals).` };
         }
+        if (data.startsWith(RESERVED_CHOICE_PREFIX)) {
+          return { ok: false, message: `button data may not start with "${RESERVED_CHOICE_PREFIX}" (reserved for pickers).` };
+        }
         out.push({ text: redactSensitiveText(text), callback_data: data });
       }
       keyboard.push(out);
@@ -189521,7 +190733,8 @@ ${asCodeBlock(redactSensitiveText(value.prompt))}`, {
           { text: "Allow", callback_data: approvalCallbackData(approvalId, "allow") },
           { text: "Deny", callback_data: approvalCallbackData(approvalId, "deny") }
         ]
-      ]
+      ],
+      onSent: (info) => this.onApprovalSent(approvalId, sessionId, info.messageId, info.text)
     });
     if (!sent) {
       this.dropApproval(approvalId);
@@ -189529,6 +190742,111 @@ ${asCodeBlock(redactSensitiveText(value.prompt))}`, {
     }
     return ok2({ approvalId, expiresAt });
   }
+  async requestPrompt(hub, request) {
+    const body = await readJsonBody(request);
+    if (!body.ok) {
+      return body.response;
+    }
+    const value = body.value;
+    if (!isSessionId(value.sessionId)) {
+      return invalid2("sessionId must be 1 to 64 characters of letters, digits, '-' and '_'.");
+    }
+    if (typeof value.text !== "string" || value.text.length === 0 || value.text.length > MAX_APPROVAL_PROMPT_CHARS) {
+      return invalid2(`text must be a string of 1 to ${MAX_APPROVAL_PROMPT_CHARS} characters.`);
+    }
+    const timeoutMs = value.timeoutMs ?? DEFAULT_APPROVAL_TIMEOUT_MS;
+    if (typeof timeoutMs !== "number" || !Number.isSafeInteger(timeoutMs) || timeoutMs < MIN_APPROVAL_TIMEOUT_MS || timeoutMs > MAX_APPROVAL_TIMEOUT_MS) {
+      return invalid2(`timeoutMs must be an integer from ${MIN_APPROVAL_TIMEOUT_MS} to ${MAX_APPROVAL_TIMEOUT_MS}.`);
+    }
+    if (value.forUserId !== undefined && (typeof value.forUserId !== "number" || !Number.isSafeInteger(value.forUserId))) {
+      return invalid2("forUserId must be an integer.");
+    }
+    const rows = value.rows;
+    if (!Array.isArray(rows) || rows.length === 0 || rows.length > MAX_KEYBOARD_ROWS) {
+      return invalid2(`rows must be 1 to ${MAX_KEYBOARD_ROWS} rows of button labels.`);
+    }
+    const labels = [];
+    const layout = [];
+    for (const row of rows) {
+      if (!Array.isArray(row) || row.length === 0 || row.length > MAX_KEYBOARD_BUTTONS_PER_ROW) {
+        return invalid2(`each row must hold 1 to ${MAX_KEYBOARD_BUTTONS_PER_ROW} labels.`);
+      }
+      for (const label of row) {
+        if (typeof label !== "string" || label.length === 0 || label.length > MAX_BUTTON_TEXT_CHARS) {
+          return invalid2(`a label must be 1 to ${MAX_BUTTON_TEXT_CHARS} characters.`);
+        }
+        labels.push(redactSensitiveText(label));
+      }
+      layout.push(row.length);
+    }
+    if (labels.length > MAX_PROMPT_BUTTONS) {
+      return invalid2(`a prompt may carry at most ${MAX_PROMPT_BUTTONS} buttons.`);
+    }
+    const sessionId = value.sessionId;
+    if (!hub.hasSession(sessionId)) {
+      return fail4(404, "unknown-session", "This session is not registered for remote control; register again.");
+    }
+    if (this.streams.get(sessionId) === undefined) {
+      return fail4(409, "no-stream", "No stream is connected for this session; the prompt cannot be answered.");
+    }
+    let held = 0;
+    for (const entry of this.choices.values()) {
+      if (entry.sessionId === sessionId) {
+        held += 1;
+      }
+    }
+    if (held >= MAX_PENDING_CHOICES_PER_SESSION) {
+      return fail4(429, "too-many-prompts", "Too many questions are waiting for this session.");
+    }
+    const promptId = this.newPromptId();
+    const expiresAt = this.now() + timeoutMs;
+    this.choices.set(promptId, {
+      sessionId,
+      expiresAt,
+      labels,
+      ...value.forUserId === undefined ? {} : { forUserId: value.forUserId },
+      timer: this.timers.setTimeout(() => this.expireChoice(promptId), timeoutMs)
+    });
+    const keyboard = [];
+    let position = 0;
+    for (const width of layout) {
+      const line = [];
+      for (let column = 0;column < width; column += 1) {
+        line.push({ text: labels[position], callback_data: choiceCallbackData(promptId, position) });
+        position += 1;
+      }
+      keyboard.push(line);
+    }
+    const sent = await hub.send(sessionId, redactSensitiveText(value.text), {
+      keyboard,
+      onSent: (info) => this.onChoiceSent(promptId, sessionId, info.messageId, info.text)
+    });
+    if (!sent) {
+      this.dropChoice(promptId);
+      return fail4(404, "unknown-session", "This session is not registered for remote control; register again.");
+    }
+    return ok2({ promptId, expiresAt });
+  }
+  async messageState(hub, request) {
+    const body = await readJsonBody(request);
+    if (!body.ok) {
+      return body.response;
+    }
+    const value = body.value;
+    if (!isSessionId(value.sessionId)) {
+      return invalid2("sessionId must be 1 to 64 characters of letters, digits, '-' and '_'.");
+    }
+    if (typeof value.updateId !== "number" || !Number.isSafeInteger(value.updateId) || value.updateId < 0) {
+      return invalid2("updateId must be a non-negative integer.");
+    }
+    if (!isMessageState(value.state)) {
+      return invalid2("state must be one of reading, working, done, failed.");
+    }
+    if (!hub.hasSession(value.sessionId)) {
+      return fail4(404, "unknown-session", "This session is not registered for remote control; register again.");
+    }
+    return ok2({ shown: hub.messageState(value.sessionId, value.updateId, value.state) });
+  }
   async ack(hub, request) {
     const body = await readJsonBody(request);
     if (!body.ok) {
@@ -189666,15 +190984,12 @@ ${asCodeBlock(redactSensitiveText(value.prompt))}`, {
     const stream = this.streams.get(sessionId);
     const approval = parseApprovalCallback(callback.data);
     if (approval !== undefined) {
-      const entry = this.approvals.get(approval.approvalId);
-      if (entry !== undefined && entry.sessionId === sessionId && entry.expiresAt > this.now()) {
-        this.dropApproval(approval.approvalId);
-        const event = { updateId: callback.updateId, approvalId: approval.approvalId, decision: approval.decision };
-        const told = stream?.write(encodeSseEvent("approval", event, callback.updateId)) === true;
-        if (told) {
-          this.noteDecision(sessionId, approval.decision);
-        }
-      }
+      this.pressApproval(sessionId, callback, approval, stream);
+      return Promise.resolve();
+    }
+    const choice = parseChoiceCallback(callback.data);
+    if (choice !== undefined) {
+      this.pressChoice(sessionId, callback, choice, stream);
       return Promise.resolve();
     }
     const event = {
@@ -189687,8 +191002,181 @@ ${asCodeBlock(redactSensitiveText(value.prompt))}`, {
     stream?.write(encodeSseEvent("callback", event, callback.updateId));
     return Promise.resolve();
   }
-  async noteDecision(sessionId, decision) {
-    await this.hub?.send(sessionId, decision === "allow" ? "Approval granted." : "Approval denied.").catch(() => {
+  pressApproval(sessionId, callback, approval, stream) {
+    const id = approval.approvalId;
+    const entry = this.approvals.get(id);
+    if (entry !== undefined && entry.sessionId !== sessionId) {
+      return;
+    }
+    if (entry !== undefined && entry.expiresAt > this.now()) {
+      this.dropApproval(id);
+      const event = { updateId: callback.updateId, approvalId: id, decision: approval.decision };
+      const told = stream?.write(encodeSseEvent("approval", event, callback.updateId)) === true;
+      const messageId = entry.messageId ?? callback.messageId;
+      const when = clockText(this.now());
+      if (!told) {
+        this.finishApproval(id, sessionId, messageId, entry.text, {
+          result: `Not delivered at ${when}: the shell is not connected, so nothing was approved.`,
+          shortReply: "Approval not delivered: the shell is not connected, so nothing was approved."
+        });
+        return;
+      }
+      const who = `user ${callback.fromId}`;
+      this.finishApproval(id, sessionId, messageId, entry.text, {
+        result: approval.decision === "allow" ? `Allowed by ${who} at ${when}.` : `Denied by ${who} at ${when}.`,
+        shortReply: approval.decision === "allow" ? "Approval granted." : "Approval denied."
+      });
+      return;
+    }
+    if (entry !== undefined) {
+      this.expireApproval(id);
+      return;
+    }
+    const done = this.finished.get(id);
+    if (done !== undefined) {
+      if (done.sessionId === sessionId) {
+        const messageId = callback.messageId ?? done.messageId;
+        if (messageId !== undefined) {
+          this.hub?.settleMessage(sessionId, messageId, done.finalText, done.shortReply).catch(() => {
+            return;
+          });
+        }
+      }
+      return;
+    }
+    const pressed = callback.messageId;
+    if (pressed !== undefined && !this.carriesLivePrompt(pressed)) {
+      this.hub?.settleMessage(sessionId, pressed, "This request is no longer active.", "That request is no longer active.").catch(() => {
+        return;
+      });
+    }
+  }
+  carriesLivePrompt(messageId) {
+    return [...this.approvals.values(), ...this.choices.values()].some((live) => live.messageId === messageId);
+  }
+  pressChoice(sessionId, callback, choice, stream) {
+    const id = choice.promptId;
+    const entry = this.choices.get(id);
+    if (entry !== undefined && entry.sessionId !== sessionId) {
+      return;
+    }
+    if (entry !== undefined && entry.expiresAt > this.now()) {
+      const sameMessage = entry.messageId !== undefined && callback.messageId === entry.messageId;
+      const sameUser = entry.forUserId === undefined || entry.forUserId === callback.fromId;
+      if (!sameMessage || !sameUser || choice.index >= entry.labels.length) {
+        return;
+      }
+      this.dropChoice(id);
+      const event = { updateId: callback.updateId, promptId: id, index: choice.index, fromId: callback.fromId };
+      const told = stream?.write(encodeSseEvent("choice", event, callback.updateId)) === true;
+      const when = clockText(this.now());
+      if (!told) {
+        this.finishApproval(id, sessionId, entry.messageId, entry.text, {
+          result: `Not delivered at ${when}: the shell is not connected, so nothing changed.`,
+          shortReply: "Not delivered: the shell is not connected, so nothing changed."
+        });
+        return;
+      }
+      this.finishApproval(id, sessionId, entry.messageId, entry.text, {
+        result: `Chosen: ${entry.labels[choice.index]} (user ${callback.fromId}, ${when}).`,
+        shortReply: `Chosen: ${entry.labels[choice.index]}.`
+      });
+      return;
+    }
+    if (entry !== undefined) {
+      this.expireChoice(id);
+      return;
+    }
+    const done = this.finished.get(id);
+    if (done !== undefined) {
+      if (done.sessionId === sessionId) {
+        const messageId = callback.messageId ?? done.messageId;
+        if (messageId !== undefined) {
+          this.hub?.settleMessage(sessionId, messageId, done.finalText, done.shortReply).catch(() => {
+            return;
+          });
+        }
+      }
+      return;
+    }
+    const pressed = callback.messageId;
+    if (pressed !== undefined && !this.carriesLivePrompt(pressed)) {
+      this.hub?.settleMessage(sessionId, pressed, "This request is no longer active.", "That request is no longer active.").catch(() => {
+        return;
+      });
+    }
+  }
+  onChoiceSent(promptId, sessionId, messageId, text) {
+    const live = this.choices.get(promptId);
+    if (live !== undefined) {
+      live.messageId = messageId;
+      live.text = text;
+      return;
+    }
+    this.onApprovalSent(promptId, sessionId, messageId, text);
+  }
+  dropChoice(promptId) {
+    const entry = this.choices.get(promptId);
+    if (entry === undefined) {
+      return;
+    }
+    this.timers.clearTimeout(entry.timer);
+    this.choices.delete(promptId);
+  }
+  expireChoice(promptId) {
+    const entry = this.choices.get(promptId);
+    if (entry === undefined) {
+      return;
+    }
+    this.dropChoice(promptId);
+    this.finishApproval(promptId, entry.sessionId, entry.messageId, entry.text, {
+      result: `Expired at ${clockText(this.now())}: no answer, nothing changed.`,
+      shortReply: "That question expired: no answer, nothing changed."
+    });
+  }
+  onApprovalSent(approvalId, sessionId, messageId, text) {
+    const live = this.approvals.get(approvalId);
+    if (live !== undefined) {
+      live.messageId = messageId;
+      live.text = text;
+      return;
+    }
+    const done = this.finished.get(approvalId);
+    if (done !== undefined && done.messageId === undefined) {
+      done.messageId = messageId;
+      done.finalText = settledText(text, done.finalText);
+      this.hub?.settleMessage(sessionId, messageId, done.finalText, done.shortReply).catch(() => {
+        return;
+      });
+    }
+  }
+  finishApproval(approvalId, sessionId, messageId, original, outcome) {
+    const finalText = messageId === undefined ? outcome.result : settledText(original, outcome.result);
+    this.finished.delete(approvalId);
+    this.finished.set(approvalId, {
+      sessionId,
+      ...messageId === undefined ? {} : { messageId },
+      finalText,
+      shortReply: outcome.shortReply
+    });
+    while (this.finished.size > MAX_FINISHED_PROMPTS) {
+      const oldest = this.finished.keys().next().value;
+      if (oldest === undefined) {
+        break;
+      }
+      this.finished.delete(oldest);
+    }
+    const hub = this.hub;
+    if (hub === undefined) {
+      return;
+    }
+    if (messageId === undefined) {
+      hub.send(sessionId, outcome.shortReply).catch(() => {
+        return;
+      });
+      return;
+    }
+    hub.settleMessage(sessionId, messageId, finalText, outcome.shortReply).catch(() => {
       return;
     });
   }
@@ -189705,9 +191193,11 @@ ${asCodeBlock(redactSensitiveText(value.prompt))}`, {
     if (entry === undefined) {
       return;
     }
+    this.timers.clearTimeout(entry.timer);
     this.approvals.delete(approvalId);
-    this.hub?.send(entry.sessionId, "Approval request expired: no answer, so it was denied.").catch(() => {
-      return;
+    this.finishApproval(approvalId, entry.sessionId, entry.messageId, entry.text, {
+      result: `Expired at ${clockText(this.now())}: no answer, so it was denied.`,
+      shortReply: "Approval request expired: no answer, so it was denied."
     });
   }
   onStreamEnded(stream) {
@@ -189726,8 +191216,28 @@ ${asCodeBlock(redactSensitiveText(value.prompt))}`, {
     for (const [id, entry] of [...this.approvals.entries()]) {
       if (entry.sessionId === stream.sessionId) {
         this.dropApproval(id);
+        if (!this.closed && entry.messageId !== undefined) {
+          this.finishApproval(id, stream.sessionId, entry.messageId, entry.text, {
+            result: `Cancelled at ${clockText(this.now())}: the shell disconnected, so it was denied.`,
+            shortReply: "Approval cancelled: the shell disconnected, so it was denied."
+          });
+        }
+      }
+    }
+    for (const [id, entry] of [...this.choices.entries()]) {
+      if (entry.sessionId === stream.sessionId) {
+        this.dropChoice(id);
+        if (!this.closed && entry.messageId !== undefined) {
+          this.finishApproval(id, stream.sessionId, entry.messageId, entry.text, {
+            result: `Cancelled at ${clockText(this.now())}: the shell disconnected, nothing changed.`,
+            shortReply: "Question cancelled: the shell disconnected, nothing changed."
+          });
+        }
       }
     }
+    if (stream.endedBecause === "closing") {
+      this.hub?.endActivity(stream.sessionId);
+    }
   }
 }
 function asCodeBlock(text) {
@@ -189739,7 +191249,7 @@ function asCodeBlock(text) {
 ${safe}
 ${fence}`;
 }
-var MAX_REPLY_CHARS = 20000, MAX_PENDING_APPROVALS_PER_SESSION = 8, MAX_REMEMBERED_IDS_PER_SESSION = 512, MAX_PROJECT_NAME_CHARS = 128, CONTROL_CHARS2, JSON_HEADERS2, MAX_BACKTICK_RUN = 8;
+var MAX_REPLY_CHARS = 20000, MAX_PENDING_APPROVALS_PER_SESSION = 8, MAX_PENDING_CHOICES_PER_SESSION = 8, MAX_REMEMBERED_IDS_PER_SESSION = 512, MAX_PROJECT_NAME_CHARS = 128, CONTROL_CHARS2, JSON_HEADERS2, MAX_FINISHED_PROMPTS = 128, MAX_SETTLED_TEXT_CHARS = 3600, MAX_BACKTICK_RUN = 8;
 var init_http_surface = __esm(() => {
   init_service2();
   init_hub();