@mrciphersmith/keryx 0.3.66 → 0.3.67

package/README.md

@@ -1053,8 +1053,16 @@ once to HTML and once to plain text, so a reply is never dropped. `keryx remote
 format-sample` prints the sample in every mode with no network, and `/channels`
 shows the mode and the last fallback; see
 [how replies look in Telegram](docs/docs/guides/drive-keryx-remotely.md#how-replies-look-in-telegram).
-This has been verified against a fake Bot API only; no run against real Telegram has
-been done yet. Setup and limits:
+An approval question is confirmed by the shell: after you press Allow or Deny,
+`serve` waits five seconds for the shell to say it applied the answer to the question
+it was waiting on, then edits the message to "Allowed by ... at ..." or "Denied by ... at ...".
+If the shell was no longer waiting (the question had timed out or the session had
+reconnected) the message says "Not applied" and that the answer changed nothing. If the shell does
+not answer in time the message says the answer was sent to the shell, **not
+confirmed**: the shell did not say in time that it received the answer (a shell that never got an Allow lets its own question time out as a denial; one that got it late still applies it); while
+that is so the shell shows an "Approvals not confirmed" count in `/remote-control`
+and in the sidebar row. This has been verified against a fake Bot API only; no run
+against real Telegram has been done yet. Setup and limits:
 [drive keryx remotely](docs/docs/guides/drive-keryx-remotely.md#remote-control-from-telegram).
 
 ## CI integration

package/dist/cli.js

@@ -20107,7 +20107,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@mrciphersmith/keryx",
-    version: "0.3.66",
+    version: "0.3.67",
     description: "Version-controlled project context for AI coding agents: code graph, architecture wiki, project memory, relevant tests, quality signals, and task flows.",
     private: false,
     publishConfig: {
@@ -114789,6 +114789,9 @@ function channelsRoutePath(route) {
 function isSessionId(value) {
   return typeof value === "string" && SESSION_ID_PATTERN.test(value);
 }
+function isApprovalId(value) {
+  return typeof value === "string" && APPROVAL_ID_PATTERN.test(value);
+}
 function approvalCallbackData(approvalId, decision) {
   return `ap:${approvalId}:${decision}`;
 }
@@ -114861,7 +114864,7 @@ class SseParser {
     return frames;
   }
 }
-var REMOTE_API_PREFIX = "/v1/remote", REMOTE_SCHEMA_VERSION = "1.0.0", REMOTE_ROUTE_METHODS, CHANNELS_ROUTE_METHODS, MAX_REMOTE_BODY_BYTES, MAX_PROJECT_CHARS = 256, MAX_APPROVAL_PROMPT_CHARS = 3000, MAX_KEYBOARD_ROWS = 8, MAX_KEYBOARD_BUTTONS_PER_ROW = 8, MAX_BUTTON_TEXT_CHARS = 64, MAX_CALLBACK_DATA_BYTES = 64, DEFAULT_APPROVAL_TIMEOUT_MS, MAX_APPROVAL_TIMEOUT_MS, MIN_APPROVAL_TIMEOUT_MS = 100, DEFAULT_KEEPALIVE_MS = 15000, DEFAULT_ACK_TIMEOUT_MS = 30000, SESSION_ID_PATTERN, APPROVAL_CALLBACK_PATTERN, RESERVED_CALLBACK_PREFIX = "ap:", CHOICE_CALLBACK_PATTERN, RESERVED_CHOICE_PREFIX = "pk:", MAX_PROMPT_BUTTONS = 24, MESSAGE_STATES, SSE_KEEPALIVE_FRAME = `: keepalive
+var REMOTE_API_PREFIX = "/v1/remote", REMOTE_SCHEMA_VERSION = "1.0.0", REMOTE_ROUTE_METHODS, CHANNELS_ROUTE_METHODS, MAX_REMOTE_BODY_BYTES, MAX_PROJECT_CHARS = 256, MAX_APPROVAL_PROMPT_CHARS = 3000, MAX_KEYBOARD_ROWS = 8, MAX_KEYBOARD_BUTTONS_PER_ROW = 8, MAX_BUTTON_TEXT_CHARS = 64, MAX_CALLBACK_DATA_BYTES = 64, DEFAULT_APPROVAL_TIMEOUT_MS, MAX_APPROVAL_TIMEOUT_MS, MIN_APPROVAL_TIMEOUT_MS = 100, DEFAULT_APPROVAL_ACK_MS = 5000, DEFAULT_KEEPALIVE_MS = 15000, DEFAULT_ACK_TIMEOUT_MS = 30000, SESSION_ID_PATTERN, APPROVAL_ID_PATTERN, APPROVAL_CALLBACK_PATTERN, RESERVED_CALLBACK_PREFIX = "ap:", CHOICE_CALLBACK_PATTERN, RESERVED_CHOICE_PREFIX = "pk:", MAX_PROMPT_BUTTONS = 24, MESSAGE_STATES, SSE_KEEPALIVE_FRAME = `: keepalive
 
 `;
 var init_protocol2 = __esm(() => {
@@ -114874,6 +114877,7 @@ var init_protocol2 = __esm(() => {
     prompt: "POST",
     state: "POST",
     ack: "POST",
+    "approval-ack": "POST",
     stream: "GET"
   };
   CHANNELS_ROUTE_METHODS = {
@@ -114889,6 +114893,7 @@ var init_protocol2 = __esm(() => {
   DEFAULT_APPROVAL_TIMEOUT_MS = 5 * 60000;
   MAX_APPROVAL_TIMEOUT_MS = 60 * 60000;
   SESSION_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
+  APPROVAL_ID_PATTERN = /^ap[0-9a-f]{12}$/;
   APPROVAL_CALLBACK_PATTERN = /^ap:(ap[0-9a-f]{12}):(allow|deny)$/;
   CHOICE_CALLBACK_PATTERN = /^pk:(pk[0-9a-f]{12}):(\d{1,3})$/;
   MESSAGE_STATES = ["reading", "working", "done", "failed"];
@@ -115253,6 +115258,10 @@ class RemoteClient {
   inboundChain = Promise.resolve();
   waiters = new Map;
   earlyDecisions = new Map;
+  seenApprovals = new Map;
+  earlyDecisionMs;
+  unackedApprovals = new Map;
+  lingerTimers = new Set;
   choiceWaiters = new Map;
   earlyChoices = new Map;
   firstResult;
@@ -115269,10 +115278,20 @@ class RemoteClient {
     this.sleep = options.sleep ?? abortableSleep2;
     this.requestTimeoutMs = options.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
     this.isAlive = options.isAlive ?? ownProcessIsAlive;
+    this.earlyDecisionMs = options.earlyDecisionMs ?? DEFAULT_EARLY_DECISION_MS;
   }
   get connected() {
     return this.streamOpen && !this.stopped;
   }
+  get unconfirmedApprovals() {
+    const cutoff = Date.now() - UNCONFIRMED_APPROVAL_LINGER_MS;
+    for (const [id, at] of [...this.unackedApprovals.entries()]) {
+      if (at < cutoff) {
+        this.unackedApprovals.delete(id);
+      }
+    }
+    return this.unackedApprovals.size;
+  }
   start() {
     if (this.started) {
       return Promise.resolve({ ok: false, code: "already-started", message: "this client was already started", retrying: false });
@@ -115323,6 +115342,10 @@ class RemoteClient {
     }
     this.lifetime.abort();
     this.streamAbort?.abort();
+    for (const timer of this.lingerTimers) {
+      clearTimeout(timer);
+    }
+    this.lingerTimers.clear();
     this.failApprovals();
     this.firstResult?.({ ok: false, code: "stopped", message: "the client was stopped before it connected", retrying: false });
     this.firstResult = undefined;
@@ -115356,8 +115379,10 @@ class RemoteClient {
     }
     const early = this.earlyDecisions.get(approvalId);
     if (early !== undefined) {
+      clearTimeout(early.timer);
       this.earlyDecisions.delete(approvalId);
-      return early;
+      this.settleApproval(approvalId, early.decision, true);
+      return early.decision;
     }
     if (!this.connected) {
       return "deny";
@@ -115599,8 +115624,7 @@ class RemoteClient {
         return;
       });
     } else if (event === "approval") {
-      const approval = parsed;
-      this.resolveApproval(approval.approvalId, approval.decision);
+      this.handleApprovalFrame(parsed);
     } else if (event === "choice") {
       const choice = parsed;
       this.resolveChoice(choice.promptId, choice.index);
@@ -115645,16 +115669,115 @@ class RemoteClient {
       await this.post("ack", { sessionId: this.options.sessionId, updateId });
     } catch {}
   }
+  handleApprovalFrame(approval) {
+    const approvalId = approval?.approvalId;
+    if (!isApprovalId(approvalId) || approval.decision !== "allow" && approval.decision !== "deny") {
+      return;
+    }
+    const decision = approval.decision;
+    const seen = this.seenApprovals.get(approvalId);
+    if (seen === "pending") {
+      return;
+    }
+    this.countUnconfirmed(approvalId);
+    if (seen !== undefined) {
+      this.ackApproval(approvalId, seen === "applied");
+      return;
+    }
+    if (this.waiters.has(approvalId)) {
+      this.settleApproval(approvalId, decision, true, () => this.resolveApproval(approvalId, decision));
+      return;
+    }
+    this.rememberSeen(approvalId, "pending");
+    this.parkEarlyDecision(approvalId, decision);
+  }
+  rememberSeen(approvalId, outcome) {
+    this.seenApprovals.delete(approvalId);
+    this.seenApprovals.set(approvalId, outcome);
+    if (this.seenApprovals.size > MAX_SEEN_APPROVALS) {
+      const oldest = this.seenApprovals.keys().next().value;
+      if (oldest !== undefined) {
+        this.seenApprovals.delete(oldest);
+      }
+    }
+  }
+  countUnconfirmed(approvalId) {
+    this.unackedApprovals.delete(approvalId);
+    this.unackedApprovals.set(approvalId, Date.now());
+    this.notifyUnconfirmed();
+    while (this.unackedApprovals.size > MAX_UNCONFIRMED_APPROVALS) {
+      const oldest = this.unackedApprovals.keys().next().value;
+      if (oldest === undefined) {
+        break;
+      }
+      this.unackedApprovals.delete(oldest);
+    }
+  }
+  settleApproval(approvalId, decision, applied, apply) {
+    this.rememberSeen(approvalId, applied ? "applied" : "not-applied");
+    try {
+      this.options.onApprovalFrame?.({ approvalId, decision, applied });
+    } catch {}
+    apply?.();
+    this.ackApproval(approvalId, applied);
+  }
+  parkEarlyDecision(approvalId, decision) {
+    while (this.earlyDecisions.size >= MAX_EARLY_DECISIONS) {
+      const oldest = this.earlyDecisions.keys().next().value;
+      if (oldest === undefined) {
+        break;
+      }
+      this.dropEarlyDecision(oldest);
+    }
+    const timer = setTimeout(() => this.dropEarlyDecision(approvalId), this.earlyDecisionMs);
+    timer.unref?.();
+    this.earlyDecisions.set(approvalId, { decision, timer });
+  }
+  dropEarlyDecision(approvalId) {
+    const early = this.earlyDecisions.get(approvalId);
+    if (early === undefined) {
+      return;
+    }
+    clearTimeout(early.timer);
+    this.earlyDecisions.delete(approvalId);
+    if (!this.stopped) {
+      this.settleApproval(approvalId, early.decision, false);
+    }
+  }
+  async ackApproval(approvalId, applied) {
+    let confirmed = false;
+    try {
+      const response = await this.post("approval-ack", { sessionId: this.options.sessionId, approvalId, applied });
+      confirmed = response.ok;
+    } catch {}
+    if (this.stopped) {
+      return;
+    }
+    if (confirmed) {
+      this.unackedApprovals.delete(approvalId);
+      this.notifyUnconfirmed();
+      return;
+    }
+    this.lingerTimers.add(this.scheduleUnref(() => {
+      this.notifyUnconfirmed();
+    }, UNCONFIRMED_APPROVAL_LINGER_MS + 50));
+  }
+  notifyUnconfirmed() {
+    try {
+      this.options.onUnconfirmedChange?.();
+    } catch {}
+  }
+  scheduleUnref(fn, ms) {
+    const timer = setTimeout(() => {
+      this.lingerTimers.delete(timer);
+      fn();
+    }, ms);
+    timer.unref?.();
+    return timer;
+  }
   resolveApproval(approvalId, decision) {
     const waiter = this.waiters.get(approvalId);
     if (waiter === undefined) {
-      if (this.earlyDecisions.size >= MAX_EARLY_DECISIONS) {
-        const oldest = this.earlyDecisions.keys().next().value;
-        if (oldest !== undefined) {
-          this.earlyDecisions.delete(oldest);
-        }
-      }
-      this.earlyDecisions.set(approvalId, decision);
       return;
     }
     clearTimeout(waiter.timer);
@@ -115691,11 +115814,13 @@ class RemoteClient {
       this.waiters.delete(id);
       waiter.resolve("deny");
     }
-    this.earlyDecisions.clear();
+    for (const id of [...this.earlyDecisions.keys()]) {
+      this.dropEarlyDecision(id);
+    }
     this.failChoices();
   }
 }
-var UNVERIFIED_SERVE_MESSAGE = "the program answering on keryx serve's port did not prove it is the keryx serve this shell trusts; its answer was ignored. Restart `keryx serve` (an older serve cannot prove itself; update keryx on both sides)", FatalClientError, TransientClientError, DEFAULT_BACKOFF_INITIAL_MS = 250, DEFAULT_BACKOFF_MAX_MS = 15000, DEFAULT_REQUEST_TIMEOUT_MS = 1e4, MAX_EARLY_DECISIONS = 32, MAX_COMPLETED_IDS = 256;
+var UNVERIFIED_SERVE_MESSAGE = "the program answering on keryx serve's port did not prove it is the keryx serve this shell trusts; its answer was ignored. Restart `keryx serve` (an older serve cannot prove itself; update keryx on both sides)", FatalClientError, TransientClientError, DEFAULT_BACKOFF_INITIAL_MS = 250, DEFAULT_BACKOFF_MAX_MS = 15000, DEFAULT_REQUEST_TIMEOUT_MS = 1e4, MAX_EARLY_DECISIONS = 32, DEFAULT_EARLY_DECISION_MS = 2000, MAX_SEEN_APPROVALS = 256, UNCONFIRMED_APPROVAL_LINGER_MS = 60000, MAX_UNCONFIRMED_APPROVALS = 64, MAX_COMPLETED_IDS = 256;
 var init_client3 = __esm(() => {
   init_serve_config();
   init_lease();
@@ -116375,10 +116500,12 @@ class RemoteBridge {
     }
     const online = this.clientConnected && client.connected;
     const heartbeat = client.lastHeartbeatAt;
+    const unconfirmed = client.unconfirmedApprovals ?? 0;
     return {
       state: online ? "on" : "offline",
       ...client.name !== undefined ? { name: client.name } : {},
       ...heartbeat !== undefined ? { heartbeatAgeMs: Math.max(0, this.now() - heartbeat) } : {},
+      ...unconfirmed > 0 ? { unconfirmedApprovals: unconfirmed } : {},
       events: [...this.events]
     };
   }
@@ -116405,7 +116532,9 @@ class RemoteBridge {
       ...name !== undefined ? { name } : {},
       ...this.options.dir !== undefined ? { dir: this.options.dir } : {},
       onLine: (text, meta) => this.accept(text, meta),
-      onStatus: (status) => this.onStatus(status)
+      onStatus: (status) => this.onStatus(status),
+      onApprovalFrame: (frame) => this.host.notice(frame.applied ? `\u25C7 approval ${frame.approvalId} ${frame.decision === "allow" ? "allowed" : "denied"} from Telegram` : `\u25C7 approval ${frame.approvalId}: ${frame.decision === "allow" ? "an allow" : "a deny"} from Telegram arrived but nothing here was waiting for it; not applied`),
+      onUnconfirmedChange: () => this.host.onChange?.()
     };
     const client = this.options.makeClient !== undefined ? this.options.makeClient(clientOptions) : new RemoteClient(clientOptions);
     this.client = client;
@@ -118034,6 +118163,10 @@ function formatRemoteStatusLines(status) {
   lines.push(`Last heartbeat: ${status.heartbeatAgeMs === undefined ? "none yet" : `${formatAge(status.heartbeatAgeMs)} ago`}`);
   if (status.state === "offline")
     lines.push("Serve is not reachable. The shell keeps retrying; nothing is lost from Telegram.");
+  if (status.unconfirmedApprovals !== undefined && status.unconfirmedApprovals > 0) {
+    const n = status.unconfirmedApprovals;
+    lines.push(`Approvals not confirmed: ${n}. The topic shows ${n === 1 ? "it" : "them"} as "not confirmed" until serve takes the shell's ack.`);
+  }
   lines.push(`Turn it off with ${REMOTE_CONTROL_COMMAND} off, or press o here. Rename: ${REMOTE_CONTROL_COMMAND} off, then ${REMOTE_CONTROL_COMMAND} <name>.`);
   return lines;
 }
@@ -118154,7 +118287,11 @@ function projectRemoteRow(status, width) {
     return { text: fit3("off", width), role: "muted", action: "open" };
   if (status.state === "offline")
     return { text: fit3("offline", width), role: "attention", action: "open" };
-  return { text: fit3(status.name ?? "connecting", width), role: "ok", action: "open" };
+  const topic = status.name ?? "connecting";
+  const unconfirmed = status.unconfirmedApprovals ?? 0;
+  if (unconfirmed > 0)
+    return { text: fit3(`${topic} \xB7 ${unconfirmed} unconfirmed`, width), role: "attention", action: "open" };
+  return { text: fit3(topic, width), role: "ok", action: "open" };
 }
 function mountRemotePanel(otui, renderer, parent, options) {
   const core = otui;
@@ -121375,7 +121512,7 @@ var init_serve_turn_store = __esm(() => {
 import { randomUUID as randomUUID34 } from "crypto";
 import { existsSync as existsSync45, readdirSync as readdirSync10 } from "fs";
 import path261 from "path";
-function isApprovalId(value) {
+function isApprovalId2(value) {
   return ID_PATTERN2.test(value);
 }
 function root(dir) {
@@ -121401,7 +121538,7 @@ function appendEvidence(event, dir) {
   appendOwnerOnlyLine(ledgerFile(dir), JSON.stringify(event));
 }
 function createApproval(input, dir, now = new Date) {
-  if (!isApprovalId(input.approvalId)) {
+  if (!isApprovalId2(input.approvalId)) {
     throw new Error("approvalId is not an approval id");
   }
   ensureKeryxSubdir(["approvals"], dir);
@@ -121468,7 +121605,7 @@ function parseResolution(text) {
   }
 }
 function readRaw(id, dir) {
-  if (!isApprovalId(id)) {
+  if (!isApprovalId2(id)) {
     return { ok: false, reason: "not-an-approval-id" };
   }
   const read = readConfigFile(requestFile(id, dir));
@@ -121572,7 +121709,7 @@ function approvalIds(dir) {
   if (!existsSync45(base)) {
     return [];
   }
-  return readdirSync10(base).filter((name) => name.endsWith(".json") && !name.endsWith(".resolution.json")).map((name) => name.slice(0, -".json".length)).filter(isApprovalId);
+  return readdirSync10(base).filter((name) => name.endsWith(".json") && !name.endsWith(".resolution.json")).map((name) => name.slice(0, -".json".length)).filter(isApprovalId2);
 }
 function listApprovals(dir, options = {}) {
   const views = [];
@@ -141950,6 +142087,98 @@ function drainIdleMainQueue(items, options) {
   return true;
 }
 
+// src/tui/remote-queue-wiring.ts
+function createRemoteQueueWiring(deps) {
+  let pendingEdit;
+  return {
+    removeMainQueue(index) {
+      const queue = deps.getQueue();
+      if (index < 0 || index >= queue.length)
+        return;
+      const removed = queue[index];
+      if (removed?.source === TG_SOURCE) {
+        deps.getBridge()?.queuedLineRemoved(removed.question);
+      }
+      deps.setQueue(removeMainQueueItem(queue, index));
+      deps.paint();
+    },
+    editMainQueue(index) {
+      const edited = editMainQueueItem(deps.getQueue(), index);
+      if (edited === undefined)
+        return;
+      deps.setQueue(edited.rest);
+      pendingEdit = pendingQueueEditFor(edited.removed, index);
+      deps.composer.setText(edited.text);
+      deps.composer.focus();
+      deps.paint();
+    },
+    requeuePendingEdit(line, displayLine) {
+      if (pendingEdit === undefined)
+        return false;
+      const edit = pendingEdit;
+      pendingEdit = undefined;
+      deps.setQueue(reinsertEditedMainQueueItem(deps.getQueue(), edit, line, displayLine));
+      deps.paint();
+      return true;
+    },
+    hasPendingEdit: () => pendingEdit !== undefined,
+    stopRemoteForSessionSwitch() {
+      const bridge = deps.getBridge();
+      if (bridge?.keepingTopic === true) {
+        bridge.sessionLeaving();
+        return;
+      }
+      if (bridge?.active !== true)
+        return;
+      const closing = bridge.disable();
+      deps.say(`\u25C7 remote control is turning off: the session changed, and its Telegram topic is being deleted. Turn it on again with /remote-control <name>.
+`);
+      closing.then(() => deps.say(`\u25C7 remote control off: the topic is deleted.
+`));
+    },
+    dropQueuedTelegramLines() {
+      const { kept, dropped } = dropQueuedBySource(deps.getQueue(), TG_SOURCE);
+      if (dropped.length === 0)
+        return [];
+      deps.setQueue(kept);
+      deps.paint();
+      return dropped.map((item) => item.question);
+    },
+    enqueueTelegramLine(text) {
+      const queue = deps.getQueue();
+      queue.push({ id: deps.nextId(), question: text, displayQuestion: deps.summarize(text), source: TG_SOURCE });
+      deps.paint();
+      deps.say(`\u25C7 a line from Telegram is queued as q${queue.length}.
+`);
+    },
+    runTelegramLine(text) {
+      deps.runLine(text, "operator", TG_SOURCE);
+    },
+    runQueued(item) {
+      deps.runLine(item.question, "operator", item.source);
+    },
+    turnStarted(source) {
+      deps.getBridge()?.turnStarted(source);
+    },
+    assistantText(text) {
+      deps.getBridge()?.assistantText(text);
+    },
+    wrapOnToolCall(base) {
+      return (...args) => {
+        deps.getBridge()?.toolCall();
+        base?.(...args);
+      };
+    },
+    turnSettled(outcome) {
+      const bridge = deps.getBridge();
+      return bridge === undefined ? Promise.resolve() : bridge.turnSettled({ failed: outcome.failed || outcome.aborted });
+    }
+  };
+}
+var init_remote_queue_wiring = __esm(() => {
+  init_shell_bridge();
+});
+
 // src/tui/worker-fleet.ts
 function clip4(s, max) {
   if (s.length <= max) {
@@ -151763,17 +151992,31 @@ async function launchTuiAgentShell(opts) {
       guardCollector.onToolResult(name, toolResult);
       baseOnToolResultForGuard?.(name, toolResult);
     };
+    const remoteQueue = createRemoteQueueWiring({
+      getBridge: () => remoteBridge,
+      getQueue: () => mainQueue,
+      setQueue: (next) => {
+        mainQueue = next;
+      },
+      nextId: () => `mq${mainQueueSeq++}`,
+      summarize: summarizeSubmittedLine,
+      paint: () => paintMainQueue(),
+      composer: {
+        setText: (text) => {
+          input.value = text;
+        },
+        focus: () => input.focus()
+      },
+      say: (text) => io.onSystem?.(text),
+      runLine: (line, origin, source) => runLine(line, origin, source)
+    });
     const baseOnAssistantTextForGuard = io.onAssistantText?.bind(io);
     io.onAssistantText = (text) => {
       guardCollector.onAssistantText(text);
-      remoteBridge?.assistantText(text);
+      remoteQueue.assistantText(text);
       baseOnAssistantTextForGuard?.(text);
     };
-    const baseOnToolCallForRemote = io.onToolCall?.bind(io);
-    io.onToolCall = (name, toolInput) => {
-      remoteBridge?.toolCall();
-      baseOnToolCallForRemote?.(name, toolInput);
-    };
+    io.onToolCall = remoteQueue.wrapOnToolCall(io.onToolCall?.bind(io));
     const refreshGuardSidebar = () => {
       clearTranscriptChildren(sbGuard);
       if (!guardEnabled)
@@ -152419,19 +152662,7 @@ async function launchTuiAgentShell(opts) {
     deps = { ...deps, onContextCompaction };
     liveDeps = deps;
     let splash = undefined;
-    const stopRemoteForSessionSwitch = () => {
-      if (remoteBridge?.keepingTopic === true) {
-        remoteBridge.sessionLeaving();
-        return;
-      }
-      if (remoteBridge?.active !== true)
-        return;
-      const closing = remoteBridge.disable();
-      io.onSystem?.(`\u25C7 remote control is turning off: the session changed, and its Telegram topic is being deleted. Turn it on again with /remote-control <name>.
-`);
-      closing.then(() => io.onSystem?.(`\u25C7 remote control off: the topic is deleted.
-`));
-    };
+    const stopRemoteForSessionSwitch = () => remoteQueue.stopRemoteForSessionSwitch();
     const applyOpened = (opened, previewHistory) => {
       if (opened.history.length > 0) {
         splash?.removeIfShown();
@@ -153567,7 +153798,6 @@ ${formatThemeList(getThemeId())}`);
     const sideQueue = [];
     let mainQueue = [];
     let mainQueueSeq = 0;
-    let pendingQueueEdit;
     const forceHandoff = createForegroundForceHandoff();
     let sideWorkerRunning = false;
     let sideClearTimeout;
@@ -153675,26 +153905,8 @@ ${formatThemeList(getThemeId())}`);
         fleet.remove("agent:queue");
       }
     };
-    const removeMainQueue = (index) => {
-      if (index < 0 || index >= mainQueue.length)
-        return;
-      const removedItem = mainQueue[index];
-      if (removedItem?.source === TG_SOURCE) {
-        remoteBridge?.queuedLineRemoved(removedItem.question);
-      }
-      mainQueue = removeMainQueueItem(mainQueue, index);
-      paintMainQueue();
-    };
-    const editMainQueue = (index) => {
-      const edited = editMainQueueItem(mainQueue, index);
-      if (edited === undefined)
-        return;
-      mainQueue = edited.rest;
-      pendingQueueEdit = pendingQueueEditFor(edited.removed, index);
-      input.value = edited.text;
-      input.focus();
-      paintMainQueue();
-    };
+    const removeMainQueue = (index) => remoteQueue.removeMainQueue(index);
+    const editMainQueue = (index) => remoteQueue.editMainQueue(index);
     const forceMainQueue = (index) => {
       const item = mainQueue[index];
       if (item === undefined)
@@ -153709,7 +153921,7 @@ ${formatThemeList(getThemeId())}`);
       forceForegroundQueueItem(foregroundOperation, forceHandoff, item, {
         announce: () => io.onSystem?.(`\u25C7 main turn interrupted \u2014 q${index + 1} will run next.
 `),
-        run: (next) => runLine(next.question, "operator", next.source)
+        run: (next) => remoteQueue.runQueued(next)
       });
     };
     const handleQueueNavKey = (key) => {
@@ -154118,11 +154330,7 @@ ${formatThemeList(getThemeId())}`);
           case "not-a-command":
             break;
         }
-        if (pendingQueueEdit !== undefined) {
-          const edit = pendingQueueEdit;
-          pendingQueueEdit = undefined;
-          mainQueue = reinsertEditedMainQueueItem(mainQueue, edit, line, displayLine);
-          paintMainQueue();
+        if (remoteQueue.requeuePendingEdit(line, displayLine)) {
           return;
         }
         if (leaseView()?.held() === true) {
@@ -154163,7 +154371,7 @@ ${formatThemeList(getThemeId())}`);
               takeForced: () => forceHandoff.takeNext(),
               dispatch: (next) => {
                 paintMainQueue();
-                runLine(next.question, "operator", next.source);
+                remoteQueue.runQueued(next);
               }
             });
           } else {
@@ -154939,7 +155147,7 @@ ${formatThemeList(getThemeId())}`);
                   const next = forceHandoff.takeNext() ?? mainQueue.shift();
                   paintMainQueue();
                   if (next !== undefined)
-                    runLine(next.question, "operator", next.source);
+                    remoteQueue.runQueued(next);
                 }
               }
             });
@@ -154951,7 +155159,7 @@ ${formatThemeList(getThemeId())}`);
       sessions.clear();
       deps.resetSubagentBudget?.();
       const operation = foregroundOperation.begin();
-      remoteBridge?.turnStarted(source);
+      remoteQueue.turnStarted(source);
       blockIo.resetReasoningLiveState();
       setMainAgent("running", "waiting");
       startBusy("waiting for model");
@@ -155046,7 +155254,7 @@ ${formatThemeList(getThemeId())}`);
           ...slateSession !== undefined ? { slateSession, pruneArchive: true } : {}
         }).finally(() => {
           foregroundOperation.settle(operation);
-          remoteBridge?.turnSettled({ failed: turnFailed || turnSignal.aborted });
+          remoteQueue.turnSettled({ failed: turnFailed, aborted: turnSignal.aborted });
           if (foregroundOperation.isDisposed)
             return;
           refreshRewindSidebar();
@@ -155099,7 +155307,7 @@ ${formatThemeList(getThemeId())}`);
             const next = forceHandoff.takeNext() ?? mainQueue.shift();
             paintMainQueue();
             if (next !== undefined) {
-              runLine(next.question, "operator", next.source);
+              remoteQueue.runQueued(next);
             } else {
               busWakeController?.onSettle();
             }
@@ -155143,7 +155351,7 @@ ${formatThemeList(getThemeId())}`);
         const drained = forceHandoff.takeNext() ?? mainQueue.shift();
         paintMainQueue();
         if (drained !== undefined)
-          runLine(drained.question, "operator", drained.source);
+          remoteQueue.runQueued(drained);
       }
     });
     const captureShellOutput = async (run) => {
@@ -155255,14 +155463,8 @@ Turn: ${chrome.isBusy() ? "running" : "idle"} \xB7 queue: ${mainQueue.length} wa
         sessionId: () => liveSession.summary.id,
         project: () => sessionCwd,
         isBusy: () => chrome.isBusy() || foregroundOperation.isActive || forceHandoff.isAwaitingSettlement || mainQueue.length > 0 || leaseView()?.held() === true,
-        runLine: (text) => runLine(text, "operator", TG_SOURCE),
-        enqueue: (text) => {
-          const id = `mq${mainQueueSeq++}`;
-          mainQueue.push({ id, question: text, displayQuestion: summarizeSubmittedLine(text), source: TG_SOURCE });
-          paintMainQueue();
-          io.onSystem?.(`\u25C7 a line from Telegram is queued as q${mainQueue.length}.
-`);
-        },
+        runLine: (text) => remoteQueue.runTelegramLine(text),
+        enqueue: (text) => remoteQueue.enqueueTelegramLine(text),
         notice: (text) => io.onSystem?.(`${text}
 `),
         cancelTurn: () => foregroundOperation.cancel("remote run time limit"),
@@ -155280,14 +155482,7 @@ Turn: ${chrome.isBusy() ? "running" : "idle"} \xB7 queue: ${mainQueue.length} wa
             liveSession = recordRemoteOff(liveSession);
           } catch {}
         },
-        dropQueuedTelegramLines: () => {
-          const { kept, dropped } = dropQueuedBySource(mainQueue, TG_SOURCE);
-          if (dropped.length === 0)
-            return [];
-          mainQueue = kept;
-          paintMainQueue();
-          return dropped.map((item) => item.question);
-        },
+        dropQueuedTelegramLines: () => remoteQueue.dropQueuedTelegramLines(),
         runCommand: runRemoteCommand,
         busyRefusal: (line) => {
           const command = findAgentCommand(line, "agent");
@@ -155514,6 +155709,7 @@ var init_tui_shell = __esm(() => {
   init_composer_choice();
   init_filter_list();
   init_shell_chrome();
+  init_remote_queue_wiring();
   init_queue_nav();
   init_subagent_inspector();
   init_subagent_session();
@@ -192911,7 +193107,7 @@ function listApprovalsRoute(request, ctx) {
   });
 }
 async function answerApprovalRoute(request, approvalId, ctx) {
-  if (!isApprovalId(approvalId)) {
+  if (!isApprovalId2(approvalId)) {
     return approvalNotFound();
   }
   const declared = Number(request.headers.get("content-length") ?? "0");
@@ -193178,6 +193374,7 @@ var init_serve_server = __esm(() => {
     ["prompt", "POST"],
     ["state", "POST"],
     ["ack", "POST"],
+    ["approval-ack", "POST"],
     ["stream", "GET"],
     ["channels-status", "GET"],
     ["channels-pair", "POST"],
@@ -196665,6 +196862,7 @@ class RemoteHttpSurface {
   timers;
   keepaliveMs;
   ackTimeoutMs;
+  approvalAckMs;
   newApprovalId;
   newPromptId;
   streams = new Map;
@@ -196673,6 +196871,8 @@ class RemoteHttpSurface {
   bound = new Map;
   pendingAcks = new Map;
   approvals = new Map;
+  awaiting = new Map;
+  decided = new Map;
   choices = new Map;
   finished = new Map;
   constructor(options) {
@@ -196681,6 +196881,7 @@ class RemoteHttpSurface {
     this.timers = options.timers ?? realTimers;
     this.keepaliveMs = options.keepaliveMs ?? DEFAULT_KEEPALIVE_MS;
     this.ackTimeoutMs = options.ackTimeoutMs ?? DEFAULT_ACK_TIMEOUT_MS;
+    this.approvalAckMs = options.approvalAckMs ?? DEFAULT_APPROVAL_ACK_MS;
     this.newApprovalId = options.approvalIds ?? (() => `ap${randomBytes15(6).toString("hex")}`);
     this.newPromptId = options.promptIds ?? (() => `pk${randomBytes15(6).toString("hex")}`);
     this.consumer = {
@@ -196747,6 +196948,8 @@ class RemoteHttpSurface {
         return this.messageState(hub, request);
       case "ack":
         return this.ack(hub, request);
+      case "approval-ack":
+        return this.approvalAck(hub, request);
       case "stream":
         return this.openStream(hub, request, io);
     }
@@ -196765,6 +196968,9 @@ class RemoteHttpSurface {
     for (const id of [...this.approvals.keys()]) {
       this.dropApproval(id);
     }
+    for (const id of [...this.awaiting.keys()]) {
+      this.dropAwaiting(id);
+    }
     for (const id of [...this.choices.keys()]) {
       this.dropChoice(id);
     }
@@ -197088,6 +197294,48 @@ ${asCodeBlock(redactSensitiveText(value.prompt))}`, {
     this.complete(value.sessionId, value.updateId);
     return ok2({ acknowledged: true });
   }
+  async approvalAck(hub, request) {
+    const body = await readJsonBody(request);
+    if (!body.ok) {
+      return body.response;
+    }
+    const value = body.value;
+    if (!isSessionId(value.sessionId)) {
+      return invalid2("sessionId must be 1 to 64 characters of letters, digits, '-' and '_'.");
+    }
+    if (!isApprovalId(value.approvalId)) {
+      return invalid2("approvalId must be 'ap' and 12 lowercase hex characters.");
+    }
+    if (!hub.hasSession(value.sessionId)) {
+      return fail4(404, "unknown-session", "This session is not registered for remote control; register again.");
+    }
+    if (value.applied !== undefined && typeof value.applied !== "boolean") {
+      return invalid2("applied must be true or false when present.");
+    }
+    const sessionId = value.sessionId;
+    const id = value.approvalId;
+    const waiting = this.awaiting.get(id);
+    if (waiting !== undefined && waiting.sessionId === sessionId) {
+      this.dropAwaiting(id);
+      this.rememberDecided(id, sessionId);
+      if (value.applied === false) {
+        this.finishApproval(id, sessionId, waiting.messageId, waiting.text, {
+          result: `Not applied at ${waiting.sentAt}: the shell was no longer waiting for this question, so the ${waiting.decision === "allow" ? "Allow" : "Deny"} from ${waiting.who} changed nothing.`,
+          shortReply: "Not applied: the shell was no longer waiting for this question."
+        });
+        return ok2({ acknowledged: true });
+      }
+      this.finishApproval(id, sessionId, waiting.messageId, waiting.text, {
+        result: waiting.decision === "allow" ? `Allowed by ${waiting.who} at ${waiting.sentAt}.` : `Denied by ${waiting.who} at ${waiting.sentAt}.`,
+        shortReply: waiting.decision === "allow" ? "Approval granted." : "Approval denied."
+      });
+      return ok2({ acknowledged: true });
+    }
+    if (this.decided.get(id) === sessionId) {
+      return ok2({ acknowledged: true });
+    }
+    return fail4(404, "unknown-approval", "No approval with that id was sent to this session.");
+  }
   openStream(hub, request, io) {
     const sessionId = new URL(request.url).searchParams.get("sessionId");
     if (!isSessionId(sessionId)) {
@@ -197244,10 +197492,14 @@ ${asCodeBlock(redactSensitiveText(value.prompt))}`, {
         });
         return;
       }
-      const who = `user ${callback.fromId}`;
-      this.finishApproval(id, sessionId, messageId, entry.text, {
-        result: approval.decision === "allow" ? `Allowed by ${who} at ${when}.` : `Denied by ${who} at ${when}.`,
-        shortReply: approval.decision === "allow" ? "Approval granted." : "Approval denied."
+      this.awaiting.set(id, {
+        sessionId,
+        decision: approval.decision,
+        who: `user ${callback.fromId}`,
+        sentAt: when,
+        ...messageId === undefined ? {} : { messageId },
+        ...entry.text === undefined ? {} : { text: entry.text },
+        timer: this.timers.setTimeout(() => this.giveUpOnAck(id), this.approvalAckMs)
       });
       return;
     }
@@ -197255,6 +197507,9 @@ ${asCodeBlock(redactSensitiveText(value.prompt))}`, {
       this.expireApproval(id);
       return;
     }
+    if (this.awaiting.has(id)) {
+      return;
+    }
     const done = this.finished.get(id);
     if (done !== undefined) {
       if (done.sessionId === sessionId) {
@@ -197275,7 +197530,7 @@ ${asCodeBlock(redactSensitiveText(value.prompt))}`, {
     }
   }
   carriesLivePrompt(messageId) {
-    return [...this.approvals.values(), ...this.choices.values()].some((live) => live.messageId === messageId);
+    return [...this.approvals.values(), ...this.awaiting.values(), ...this.choices.values()].some((live) => live.messageId === messageId);
   }
   pressChoice(sessionId, callback, choice, stream) {
     const id = choice.promptId;
@@ -197358,7 +197613,7 @@ ${asCodeBlock(redactSensitiveText(value.prompt))}`, {
     });
   }
   onApprovalSent(approvalId, sessionId, messageId, text) {
-    const live = this.approvals.get(approvalId);
+    const live = this.approvals.get(approvalId) ?? this.awaiting.get(approvalId);
     if (live !== undefined) {
       live.messageId = messageId;
       live.text = text;
@@ -197411,6 +197666,37 @@ ${asCodeBlock(redactSensitiveText(value.prompt))}`, {
     this.timers.clearTimeout(entry.timer);
     this.approvals.delete(approvalId);
   }
+  dropAwaiting(approvalId) {
+    const entry = this.awaiting.get(approvalId);
+    if (entry === undefined) {
+      return;
+    }
+    this.timers.clearTimeout(entry.timer);
+    this.awaiting.delete(approvalId);
+  }
+  rememberDecided(approvalId, sessionId) {
+    this.decided.delete(approvalId);
+    this.decided.set(approvalId, sessionId);
+    while (this.decided.size > MAX_DECIDED_APPROVALS) {
+      const oldest = this.decided.keys().next().value;
+      if (oldest === undefined) {
+        break;
+      }
+      this.decided.delete(oldest);
+    }
+  }
+  giveUpOnAck(approvalId) {
+    const entry = this.awaiting.get(approvalId);
+    if (entry === undefined) {
+      return;
+    }
+    this.dropAwaiting(approvalId);
+    this.rememberDecided(approvalId, entry.sessionId);
+    this.finishApproval(approvalId, entry.sessionId, entry.messageId, entry.text, {
+      result: `Sent to the shell at ${entry.sentAt}, not confirmed; the shell denies by itself if it did not receive it.`,
+      shortReply: "Sent to the shell, not confirmed; it denies by itself if it did not receive it."
+    });
+  }
   expireApproval(approvalId) {
     const entry = this.approvals.get(approvalId);
     if (entry === undefined) {
@@ -197447,6 +197733,11 @@ ${asCodeBlock(redactSensitiveText(value.prompt))}`, {
         }
       }
     }
+    for (const [id, entry] of [...this.awaiting.entries()]) {
+      if (entry.sessionId === stream.sessionId && !this.closed) {
+        this.giveUpOnAck(id);
+      }
+    }
     for (const [id, entry] of [...this.choices.entries()]) {
       if (entry.sessionId === stream.sessionId) {
         this.dropChoice(id);
@@ -197472,7 +197763,7 @@ function asCodeBlock(text) {
 ${safe}
 ${fence}`;
 }
-var MAX_REPLY_CHARS = 20000, MAX_PENDING_APPROVALS_PER_SESSION = 8, MAX_PENDING_CHOICES_PER_SESSION = 8, MAX_REMEMBERED_IDS_PER_SESSION = 512, MAX_PROJECT_NAME_CHARS = 128, CONTROL_CHARS2, JSON_HEADERS2, MAX_FINISHED_PROMPTS = 128, MAX_SETTLED_TEXT_CHARS = 3600, MAX_BACKTICK_RUN = 8;
+var MAX_REPLY_CHARS = 20000, MAX_PENDING_APPROVALS_PER_SESSION = 8, MAX_PENDING_CHOICES_PER_SESSION = 8, MAX_REMEMBERED_IDS_PER_SESSION = 512, MAX_PROJECT_NAME_CHARS = 128, CONTROL_CHARS2, JSON_HEADERS2, MAX_FINISHED_PROMPTS = 128, MAX_DECIDED_APPROVALS = 256, MAX_SETTLED_TEXT_CHARS = 3600, MAX_BACKTICK_RUN = 8;
 var init_http_surface = __esm(() => {
   init_service2();
   init_hub();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mrciphersmith/keryx",
-  "version": "0.3.66",
+  "version": "0.3.67",
   "description": "Version-controlled project context for AI coding agents: code graph, architecture wiki, project memory, relevant tests, quality signals, and task flows.",
   "private": false,
   "publishConfig": {