@nuvin/session 0.1.1-rc.2 → 0.2.0-rc.10

package/dist/controller/agent-channel.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-channel.d.ts","sourceRoot":"","sources":["../../src/controller/agent-channel.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,UAAU,EACV,cAAc,EACd,sBAAsB,EACtB,OAAO,EACP,2BAA2B,EAC3B,YAAY,EACb,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAEvD,kEAAkE;AAClE,MAAM,MAAM,oBAAoB,GAAG;IACjC,aAAa,EAAE,OAAO,EAAE,CAAC;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,UAAU,EAAE,CAAC;CACxB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,KAAK,EAAE,UAAU,CAAC;IAClB,KAAK,CAAC,EAAE,eAAe,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,gFAAgF;IAChF,SAAS,CAAC,EAAE,gBAAgB,CAAC;IAC7B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,EAAE,YAAY,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,EAAE,iBAAiB,KAAK,IAAI,CAAC;AACtE,MAAM,MAAM,qBAAqB,GAAG,CAAC,MAAM,EAAE,oBAAoB,KAAK,IAAI,CAAC;AAE3E,MAAM,MAAM,eAAe,GAAG,CAC5B,OAAO,EAAE,eAAe,KACrB,OAAO,CAAC,2BAA2B,CAAC,GAAG,2BAA2B,CAAC;AAExE,MAAM,MAAM,mBAAmB,GAAG,CAChC,OAAO,EAAE,sBAAsB,KAC5B,OAAO,CAAC,cAAc,CAAC,GAAG,cAAc,CAAC;AAO9C;;;;;;;;;GASG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAsB;IAC9C,OAAO,CAAC,OAAO,CAAgC;IAC/C,OAAO,CAAC,eAAe,CAAoC;IAI3D,YAAY,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE,eAAe,GAAG,IAAI;IAI9D,oBAAoB,CAAC,MAAM,EAAE,oBAAoB,GAAG,IAAI;IAIxD,mBAAmB,CACjB,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,2BAA2B,CAAC,GAAG,2BAA2B;IAOrE,mBAAmB,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,cAAc,CAAC;IAS7E,OAAO,CAAC,QAAQ,EAAE,kBAAkB,GAAG,MAAM,IAAI;IAOjD,eAAe,CAAC,QAAQ,EAAE,qBAAqB,GAAG,MAAM,IAAI;IAO5D,cAAc,CAAC,OAAO,EAAE,eAAe,GAAG,IAAI,GAAG,IAAI;IAIrD,kBAAkB,CAAC,OAAO,EAAE,mBAAmB,GAAG,IAAI,GAAG,IAAI;CAG9D"}
+{"version":3,"file":"agent-channel.d.ts","sourceRoot":"","sources":["../../src/controller/agent-channel.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,UAAU,EACV,cAAc,EACd,sBAAsB,EACtB,OAAO,EACP,mBAAmB,EACnB,2BAA2B,EAC3B,YAAY,EACb,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EACV,6BAA6B,EAC7B,gBAAgB,EAChB,kCAAkC,EAClC,4BAA4B,EAC5B,yBAAyB,EAC1B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAEvD,8DAA8D;AAC9D,MAAM,MAAM,oBAAoB,GAAG;IACjC,aAAa,EAAE,OAAO,EAAE,CAAC;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,UAAU,EAAE,CAAC;CACxB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,KAAK,EAAE,UAAU,CAAC;IAClB,KAAK,CAAC,EAAE,eAAe,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,6BAA6B,CAAC;IAC3C,gFAAgF;IAChF,SAAS,CAAC,EAAE,gBAAgB,CAAC;IAC7B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,eAAe,CAAC,EAAE,mBAAmB,CAAC;IACtC,qBAAqB,CAAC,EAAE,CACtB,OAAO,EAAE,4BAA4B,KAClC,OAAO,CAAC,kCAAkC,CAAC,CAAC;IACjD,QAAQ,EAAE,YAAY,CAAC;IACvB,kBAAkB,CAAC,EAAE,yBAAyB,CAAC;CAChD,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,EAAE,iBAAiB,KAAK,IAAI,CAAC;AACtE,MAAM,MAAM,qBAAqB,GAAG,CAAC,MAAM,EAAE,oBAAoB,KAAK,IAAI,CAAC;AAE3E,MAAM,MAAM,eAAe,GAAG,CAC5B,OAAO,EAAE,eAAe,KACrB,OAAO,CAAC,2BAA2B,CAAC,GAAG,2BAA2B,CAAC;AAExE,MAAM,MAAM,mBAAmB,GAAG,CAChC,OAAO,EAAE,sBAAsB,EAC/B,KAAK,CAAC,EAAE,eAAe,KACpB,OAAO,CAAC,cAAc,CAAC,GAAG,cAAc,CAAC;AAO9C;;;;;;;;;GASG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAsB;IAC9C,OAAO,CAAC,OAAO,CAAgC;IAC/C,OAAO,CAAC,eAAe,CAAoC;IAI3D,YAAY,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE,eAAe,GAAG,IAAI;IAI9D,oBAAoB,CAAC,MAAM,EAAE,oBAAoB,GAAG,IAAI;IAIxD,mBAAmB,CACjB,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,2BAA2B,CAAC,GAAG,2BAA2B;IAOrE,mBAAmB,CACjB,OAAO,EAAE,sBAAsB,EAC/B,KAAK,CAAC,EAAE,eAAe,GACtB,OAAO,CAAC,cAAc,CAAC;IAS1B,OAAO,CAAC,QAAQ,EAAE,kBAAkB,GAAG,MAAM,IAAI;IAOjD,eAAe,CAAC,QAAQ,EAAE,qBAAqB,GAAG,MAAM,IAAI;IAO5D,cAAc,CAAC,OAAO,EAAE,eAAe,GAAG,IAAI,GAAG,IAAI;IAIrD,kBAAkB,CAAC,OAAO,EAAE,mBAAmB,GAAG,IAAI,GAAG,IAAI;CAG9D"}

package/dist/controller/index.js

@@ -5,10 +5,10 @@ import {
   asJsonObject,
   createMessageStateFromMessages,
   createSessionViewState,
-  isAutoApprovedTool,
   isToolAutoApprovedForMode,
-  reduceSessionEvent
-} from "../chunk-COVRYM64.js";
+  reduceSessionEvent,
+  scopedToolKey
+} from "../chunk-KQHHBUVY.js";
 
 // src/controller/agent-channel.ts
 import { EventEmitter } from "events";
@@ -33,11 +33,11 @@ var AgentChannel = class {
     }
     return this.decider(request);
   }
-  requestUserQuestion(request) {
+  requestUserQuestion(request, scope) {
     if (!this.questionHandler) {
       return Promise.reject(new Error("UI is not ready to handle user questions."));
     }
-    return Promise.resolve(this.questionHandler(request));
+    return Promise.resolve(this.questionHandler(request, scope));
   }
   // ---------- UI-side (subscribers) ----------
   onEvent(listener) {
@@ -64,10 +64,20 @@ var AgentChannel = class {
 import {
   isAbortError
 } from "@nuvin/agent-core/shared";
+function formatBashPolicyDenial(diagnostics) {
+  const denied = diagnostics.operations.filter((operation) => operation.decision === "deny");
+  if (denied.length === 0) {
+    return "Bash command rejected by policy.";
+  }
+  const details = denied.map((operation) => {
+    const rules = operation.matchedRuleIds.length > 0 ? `rule ${operation.matchedRuleIds.join(", ")}` : "an unmatched Deny";
+    return `${rules} at source bytes ${operation.start}-${operation.end}`;
+  });
+  return `Bash command rejected by policy: ${details.join("; ")}.`;
+}
 var MAX_AUTO_COMPACTION_CHAIN = 10;
 function createSessionController(deps) {
   const now = deps.now ?? Date.now;
-  const isAutoApproved = deps.isAutoApproved ?? isAutoApprovedTool;
   const errorDetail = deps.errorDetail ?? ((error) => error instanceof Error ? error.message : String(error));
   let serverCommands = deps.serverCommands ?? [];
   let compaction = deps.compaction;
@@ -75,14 +85,20 @@ function createSessionController(deps) {
   let autoCompactionChain = 0;
   let state = createSessionViewState();
   let seq = 0;
-  let approvalMode = deps.approvalMode ?? "ask";
+  let approvalMode = deps.approvalMode ?? "readOnly";
   let abortController = null;
+  let activeTurnPromise = null;
+  let closePromise = null;
+  let closing = false;
+  let detached = false;
   let activeTurnId;
   let activePolicyDenial;
   let hostBusyCount = 0;
   let questionCounter = 0;
   const listeners = /* @__PURE__ */ new Set();
   const approvalResolvers = /* @__PURE__ */ new Map();
+  const privateApprovals = /* @__PURE__ */ new Map();
+  const persistenceInFlight = /* @__PURE__ */ new Set();
   const questionResolvers = /* @__PURE__ */ new Map();
   const alwaysApproved = /* @__PURE__ */ new Set();
   const queue = [];
@@ -133,7 +149,11 @@ function createSessionController(deps) {
     emit({ type: "agent-event", event, ...scope ? { scope } : {} });
   });
   const unsubscribeLoaded = deps.channel.onSessionLoaded((loaded) => {
+    if (persistenceInFlight.size > 0) {
+      return;
+    }
     queue.length = 0;
+    alwaysApproved.clear();
     abortController?.abort(new Error("Session loaded; the active turn was cancelled."));
     rejectAllPending("Session loaded; pending interactions were cancelled.");
     emit({
@@ -151,10 +171,12 @@ function createSessionController(deps) {
     });
   });
   deps.channel.setToolDecider((request) => {
-    const { toolCall, agentId, parentToolCallId, dirAccess } = request;
+    const { toolCall, agentId, parentToolCallId, dirAccess, bashPolicy } = request;
     const scope = parentToolCallId !== void 0 ? { agentId, parentToolCallId } : void 0;
-    const approvalKey = `${agentId}:${toolCall.name}`;
-    const auto = !dirAccess && (alwaysApproved.has(approvalKey) || isToolAutoApprovedForMode(approvalMode, toolCall.name, isAutoApproved));
+    const approvalKey = request.approvalKey ?? `${agentId}:${toolCall.name}`;
+    const permissionClass = request.permissionClass ?? "always-confirm";
+    const hasBashPolicy = toolCall.name === "Bash" && bashPolicy !== void 0;
+    const auto = !dirAccess && (alwaysApproved.has(approvalKey) || isToolAutoApprovedForMode(approvalMode, permissionClass));
     if (dirAccess && approvalMode === "sudo") {
       emit({
         type: "agent-event",
@@ -162,9 +184,50 @@ function createSessionController(deps) {
         toolStatus: "approved",
         ...scope ? { scope } : {}
       });
-      return { action: "run", grantDir: { dir: dirAccess.proposedDir, persist: false } };
+      return {
+        action: "run",
+        grantDir: { dir: dirAccess.proposedDir, persist: false },
+        ...toolCall.name === "Bash" ? { approvalSource: "sudo" } : {}
+      };
+    }
+    if (hasBashPolicy && approvalMode === "sudo") {
+      emit({
+        type: "agent-event",
+        event: { type: "tool_call", toolCall },
+        toolStatus: "approved",
+        ...scope ? { scope } : {}
+      });
+      return { action: "run", approvalSource: "sudo" };
+    }
+    if (hasBashPolicy && bashPolicy.decision === "deny") {
+      emit({
+        type: "agent-event",
+        event: { type: "tool_call", toolCall },
+        toolStatus: "rejected",
+        ...scope ? { scope } : {}
+      });
+      activePolicyDenial = formatBashPolicyDenial(bashPolicy);
+      return { action: "reject", reason: activePolicyDenial };
+    }
+    if (!dirAccess && hasBashPolicy && bashPolicy.decision === "allow") {
+      emit({
+        type: "agent-event",
+        event: { type: "tool_call", toolCall },
+        toolStatus: "approved",
+        ...scope ? { scope } : {}
+      });
+      return { action: "run", approvalSource: "policy" };
+    }
+    if (!dirAccess && hasBashPolicy && alwaysApproved.has(approvalKey)) {
+      emit({
+        type: "agent-event",
+        event: { type: "tool_call", toolCall },
+        toolStatus: "approved",
+        ...scope ? { scope } : {}
+      });
+      return { action: "run", approvalSource: "remembered" };
     }
-    if (auto) {
+    if (auto && !hasBashPolicy) {
       emit({
         type: "agent-event",
         event: { type: "tool_call", toolCall },
@@ -187,20 +250,33 @@ function createSessionController(deps) {
     const input = asJsonObject(toolCall.input);
     const descriptor = {
       agentId,
-      summary: findToolSummary(toolCall.id),
+      permissionClass,
+      summary: findToolSummary(toolCall.id, parentToolCallId),
       toolCallId: toolCall.id,
       toolName: toolCall.name,
       ...dirAccess !== void 0 ? { dirAccess } : {},
       ...input !== void 0 ? { input } : {},
       ...parentToolCallId !== void 0 ? { parentToolCallId } : {},
-      ...nickname !== void 0 ? { nickname } : {}
+      ...nickname !== void 0 ? { nickname } : {},
+      ...!dirAccess && bashPolicy !== void 0 ? { bashPolicy } : {},
+      ...request.workflowBashPolicy !== void 0 ? { workflowBashPolicy: request.workflowBashPolicy } : {}
     };
     return new Promise((resolve) => {
-      approvalResolvers.set(toolCall.id, resolve);
+      const toolKey = scopedToolKey(parentToolCallId, toolCall.id);
+      approvalResolvers.set(toolKey, {
+        resolve,
+        toolCallId: toolCall.id,
+        ...parentToolCallId !== void 0 ? { parentToolCallId } : {}
+      });
+      privateApprovals.set(toolKey, {
+        approvalKey,
+        bashPolicy: hasBashPolicy,
+        ...!dirAccess && toolCall.name === "Bash" && bashPolicy?.persistence.eligible && request.persistBashPermission !== void 0 ? { persistBashPermission: request.persistBashPermission } : {}
+      });
       emit({ type: "approval-requested", approval: descriptor });
     });
   });
-  deps.channel.setQuestionHandler((request) => {
+  deps.channel.setQuestionHandler((request, scope) => {
     if (deps.headless) {
       activePolicyDenial = "Questions are unavailable in headless mode.";
       return Promise.reject(new Error(activePolicyDenial));
@@ -209,41 +285,71 @@ function createSessionController(deps) {
     const questionId = `question-${questionCounter}`;
     return new Promise((resolve, reject) => {
       questionResolvers.set(questionId, { resolve, reject });
-      emit({ type: "question-asked", question: { questionId, request } });
+      const nickname = nicknameFor(scope?.parentToolCallId);
+      emit({
+        type: "question-asked",
+        question: {
+          questionId,
+          request,
+          ...scope?.agentId !== void 0 ? { agentId: scope.agentId } : {},
+          ...scope?.parentToolCallId !== void 0 ? { parentToolCallId: scope.parentToolCallId } : {},
+          ...nickname !== void 0 ? { nickname } : {}
+        }
+      });
     });
   });
-  function findToolSummary(toolCallId) {
-    const messageId = state.messages.toolMessageIds[toolCallId];
+  function findToolSummary(toolCallId, parentToolCallId) {
+    const messageId = state.messages.toolMessageIds[scopedToolKey(parentToolCallId, toolCallId)];
     const message = state.messages.messages.find((entry) => entry.id === messageId);
     return message?.role === "tool" ? message.summary : "";
   }
   function nicknameFor(parentToolCallId) {
     if (!parentToolCallId) return void 0;
-    const parentMessageId = state.messages.toolMessageIds[parentToolCallId];
+    const parentMessageId = state.messages.toolMessageIds[scopedToolKey(void 0, parentToolCallId)];
     const parentMessage = state.messages.messages.find((entry) => entry.id === parentMessageId);
     if (parentMessage?.role !== "tool") return void 0;
     const nickname = parentMessage.input?.nickname;
     return typeof nickname === "string" ? nickname : void 0;
   }
-  function findDescriptor(toolCallId) {
+  function findDescriptor(toolCallId, parentToolCallId) {
     return [state.approval.active, ...state.approval.pending].find(
-      (entry) => entry?.toolCallId === toolCallId
+      (entry) => entry?.toolCallId === toolCallId && entry.parentToolCallId === parentToolCallId
     );
   }
   function rejectAllPending(reason) {
-    for (const [toolCallId, resolve] of approvalResolvers) {
-      resolve({ action: "reject", reason });
-      emit({ type: "approval-settled", toolCallId, status: "rejected", by: "abort" });
+    for (const pending of approvalResolvers.values()) {
+      pending.resolve({ action: "reject", reason });
+      emit({
+        type: "approval-settled",
+        toolCallId: pending.toolCallId,
+        ...pending.parentToolCallId === void 0 ? {} : { parentToolCallId: pending.parentToolCallId },
+        status: "rejected",
+        by: "abort"
+      });
     }
     approvalResolvers.clear();
+    privateApprovals.clear();
+    persistenceInFlight.clear();
     for (const [questionId, { reject }] of questionResolvers) {
       reject(new Error(reason));
       emit({ type: "question-settled", questionId });
     }
     questionResolvers.clear();
   }
+  async function guardQueuedSteering(input) {
+    if (!guardPrompt) return { ok: true, prompt: input };
+    try {
+      const guarded = await guardPrompt(input);
+      if ("blocked" in guarded) {
+        return { ok: false, message: `Prompt blocked: ${guarded.blocked.reason}` };
+      }
+      return { ok: true, prompt: guarded.prompt };
+    } catch (error) {
+      return { ok: false, message: errorDetail(error) };
+    }
+  }
   function startNextQueuedSubmission() {
-    if (abortController || hostBusyCount > 0) return;
+    if (closing || abortController || hostBusyCount > 0) return;
     const next = queue.shift();
     if (!next) return;
     if (!next.opts.silent) {
@@ -256,7 +362,12 @@ function createSessionController(deps) {
         next.opts.turnId
       );
     }
-    void runTurn(next.input, { turnId: next.opts.turnId });
+    void startTrackedTurn(next.input, {
+      turnId: next.opts.turnId,
+      allowSteering: next.opts.turnId === void 0,
+      submission: next.opts.submission ?? { origin: "user" },
+      ...next.opts.signal === void 0 ? {} : { signal: next.opts.signal }
+    });
   }
   function finalizeTurn(controller, reason) {
     if (abortController !== controller) return false;
@@ -267,6 +378,39 @@ function createSessionController(deps) {
   }
   async function runTurn(input, opts) {
     const controller = new AbortController();
+    const abortFromCaller = () => controller.abort(opts.signal?.reason);
+    if (opts.signal !== void 0) {
+      if (opts.signal.aborted) abortFromCaller();
+      else opts.signal.addEventListener("abort", abortFromCaller, { once: true });
+    }
+    const drainSteering = async () => {
+      if (abortController !== controller || controller.signal.aborted) return [];
+      const barrierIndex = queue.findIndex((entry) => entry.delivery === "next-turn");
+      const steeringCount = barrierIndex === -1 ? queue.length : barrierIndex;
+      if (steeringCount === 0) return [];
+      const drained = queue.splice(0, steeringCount);
+      emitTurnStatus();
+      const accepted = [];
+      for (const entry of drained) {
+        const guarded = await guardQueuedSteering(entry.input);
+        if (guarded.ok) {
+          accepted.push({ input: guarded.prompt, opts: entry.opts });
+        } else {
+          emit({ type: "error", message: guarded.message });
+        }
+      }
+      if (abortController !== controller || controller.signal.aborted) return [];
+      for (const entry of accepted) {
+        if (!entry.opts.silent) {
+          emit({
+            type: "user-message",
+            text: entry.opts.displayText,
+            ...entry.opts.attachmentLabels?.length ? { attachmentLabels: entry.opts.attachmentLabels } : {}
+          });
+        }
+      }
+      return accepted.map((entry) => entry.input);
+    };
     const previousTurnId = activeTurnId;
     if (opts.turnId !== void 0) activeTurnId = opts.turnId;
     if (!opts.systemInitiated) activePolicyDenial = void 0;
@@ -296,7 +440,12 @@ function createSessionController(deps) {
         }
         finalInput = guarded.prompt;
       }
-      const compactionSend = (text) => runTurn(text, { systemInitiated: true });
+      const compactionSend = (text) => runTurn(text, {
+        systemInitiated: true,
+        allowSteering: opts.allowSteering,
+        submission: opts.submission,
+        ...opts.signal === void 0 ? {} : { signal: opts.signal }
+      });
       const compactionIo = {
         signal: controller.signal,
         send: compactionSend,
@@ -319,7 +468,9 @@ function createSessionController(deps) {
       try {
         const result = await deps.agent.send(finalInput, {
           streaming: true,
-          signal: controller.signal
+          signal: controller.signal,
+          submission: opts.submission,
+          ...opts.allowSteering ? { drainSteering } : {}
         });
         if (typeof result === "object" && result !== null && "status" in result && result.status === "aborted") {
           terminalStatus = "aborted";
@@ -350,6 +501,7 @@ function createSessionController(deps) {
         }
       }
     } finally {
+      opts.signal?.removeEventListener("abort", abortFromCaller);
       const ownedTurn = finalizeTurn(
         controller,
         "Turn ended before pending interactions could be resolved."
@@ -374,10 +526,28 @@ function createSessionController(deps) {
       if (ownedTurn) startNextQueuedSubmission();
     }
   }
+  function startTrackedTurn(input, opts) {
+    let tracked;
+    tracked = runTurn(input, opts).finally(() => {
+      if (activeTurnPromise === tracked) activeTurnPromise = null;
+    });
+    activeTurnPromise = tracked;
+    return tracked;
+  }
+  function detachController() {
+    if (detached) return;
+    detached = true;
+    unsubscribeEvents();
+    unsubscribeLoaded();
+    deps.channel.setToolDecider(null);
+    deps.channel.setQuestionHandler(null);
+    listeners.clear();
+  }
   return {
     abort() {
       queue.length = 0;
       abortController?.abort(new Error("User aborted the current turn."));
+      rejectAllPending("User aborted the current turn.");
     },
     attachHostHooks(hooks) {
       if (hooks.compaction) compaction = hooks.compaction;
@@ -398,13 +568,21 @@ function createSessionController(deps) {
       emit({ type: "info", message });
     },
     close() {
+      if (closePromise) return closePromise;
+      closing = true;
+      const shouldEmitTurnStatus = queue.length > 0 || abortController !== null || hostBusyCount > 0;
+      queue.length = 0;
       abortController?.abort(new Error("Session closed."));
       rejectAllPending("Session closed.");
-      unsubscribeEvents();
-      unsubscribeLoaded();
-      deps.channel.setToolDecider(null);
-      deps.channel.setQuestionHandler(null);
-      listeners.clear();
+      if (shouldEmitTurnStatus) emitTurnStatus();
+      const active = activeTurnPromise;
+      if (!active) {
+        detachController();
+        closePromise = Promise.resolve();
+        return closePromise;
+      }
+      closePromise = active.then(detachController, detachController);
+      return closePromise;
     },
     dequeue(queuedId) {
       const index = queue.findIndex((q) => q.id === queuedId);
@@ -413,20 +591,32 @@ function createSessionController(deps) {
       emitTurnStatus();
       return true;
     },
-    decideApproval(toolCallId, decision, comment, grantDir) {
-      const resolve = approvalResolvers.get(toolCallId);
-      if (!resolve) return false;
-      approvalResolvers.delete(toolCallId);
-      const descriptor = findDescriptor(toolCallId);
+    decideApproval(toolCallId, decision, comment, grantDir, parentToolCallId) {
+      const toolKey = scopedToolKey(parentToolCallId, toolCallId);
+      if (persistenceInFlight.has(toolKey)) {
+        return false;
+      }
+      const pending = approvalResolvers.get(toolKey);
+      if (!pending) return false;
+      approvalResolvers.delete(toolKey);
+      persistenceInFlight.delete(toolKey);
+      const descriptor = findDescriptor(toolCallId, parentToolCallId);
+      const privateApproval = privateApprovals.get(toolKey);
+      privateApprovals.delete(toolKey);
       if (decision === "a" && descriptor && !descriptor.dirAccess) {
-        alwaysApproved.add(`${descriptor.agentId}:${descriptor.toolName}`);
+        alwaysApproved.add(
+          privateApproval?.approvalKey ?? `${descriptor.agentId}:${descriptor.toolName}`
+        );
       }
       const rejected = decision === "n";
       if (rejected) {
         const baseReason = `User rejected tool execution (${descriptor?.toolName ?? "unknown tool"})`;
-        resolve({ action: "reject", reason: comment ? `${baseReason}: ${comment}` : baseReason });
+        pending.resolve({
+          action: "reject",
+          reason: comment ? `${baseReason}: ${comment}` : baseReason
+        });
       } else if (descriptor?.dirAccess) {
-        resolve({
+        pending.resolve({
           action: "run",
           grantDir: {
             dir: resolveGrantDir(
@@ -435,19 +625,85 @@ function createSessionController(deps) {
               grantDir
             ),
             persist: decision === "a"
-          }
+          },
+          ...descriptor.toolName === "Bash" && privateApproval?.bashPolicy ? {
+            approvalDecision: decision,
+            approvalSource: "user"
+          } : {}
+        });
+      } else if (descriptor?.toolName === "Bash" && privateApproval?.bashPolicy) {
+        pending.resolve({
+          action: "run",
+          approvalDecision: decision,
+          approvalSource: "user"
         });
       } else {
-        resolve({ action: "run" });
+        pending.resolve({ action: "run" });
       }
       emit({
         type: "approval-settled",
         toolCallId,
+        ...parentToolCallId !== void 0 ? { parentToolCallId } : {},
         status: rejected ? "rejected" : "approved",
         by: "client"
       });
       return true;
     },
+    async persistBashPermission(toolCallId, request, parentToolCallId) {
+      const toolKey = scopedToolKey(parentToolCallId, toolCallId);
+      const descriptor = state.approval.active;
+      const privateApproval = privateApprovals.get(toolKey);
+      const handler = privateApproval?.persistBashPermission;
+      if (descriptor?.toolCallId !== toolCallId || descriptor.parentToolCallId !== parentToolCallId || descriptor.toolName !== "Bash" || descriptor.dirAccess !== void 0 || descriptor.bashPolicy?.persistence.eligible !== true || handler === void 0 || !approvalResolvers.has(toolKey)) {
+        return void 0;
+      }
+      if (persistenceInFlight.has(toolKey)) {
+        return {
+          status: "validation-error",
+          message: "A persistent Bash permission save is already in progress.",
+          fieldErrors: { server: "Wait for the current save to finish." }
+        };
+      }
+      if (hostBusyCount > 0) {
+        return {
+          status: "validation-error",
+          message: "A server operation is already in progress.",
+          fieldErrors: { server: "Wait for the current operation to finish." }
+        };
+      }
+      persistenceInFlight.add(toolKey);
+      hostBusyCount += 1;
+      emitTurnStatus();
+      try {
+        const outcome = await handler(request);
+        if (outcome.status === "validation-error") {
+          return outcome;
+        }
+        const pending = approvalResolvers.get(toolKey);
+        if (pending === void 0 || state.approval.active?.toolCallId !== toolCallId || state.approval.active.parentToolCallId !== parentToolCallId || privateApprovals.get(toolKey) !== privateApproval) {
+          return void 0;
+        }
+        approvalResolvers.delete(toolKey);
+        privateApprovals.delete(toolKey);
+        pending.resolve({
+          action: "run",
+          executionAuthorization: outcome.executionAuthorization,
+          approvalSource: "user"
+        });
+        emit({
+          type: "approval-settled",
+          toolCallId,
+          ...parentToolCallId !== void 0 ? { parentToolCallId } : {},
+          status: "approved",
+          by: "client"
+        });
+        return { status: "approved" };
+      } finally {
+        persistenceInFlight.delete(toolKey);
+        hostBusyCount = Math.max(0, hostBusyCount - 1);
+        emitTurnStatus();
+      }
+    },
     echoUserMessage(text, attachmentLabels) {
       emit({
         type: "user-message",
@@ -461,6 +717,9 @@ function createSessionController(deps) {
     isHostBusy() {
       return hostBusyCount > 0;
     },
+    isTurnActive() {
+      return abortController !== null;
+    },
     onEvent(listener) {
       listeners.add(listener);
       return () => listeners.delete(listener);
@@ -484,12 +743,15 @@ function createSessionController(deps) {
       emit({ type: "workflow-progress", runId, delta });
     },
     reset() {
+      if (persistenceInFlight.size > 0) {
+        return;
+      }
       queue.length = 0;
       hostBusyCount = 0;
       abortController?.abort(new Error("Session reset."));
       rejectAllPending("Session reset; pending interactions were cancelled.");
       alwaysApproved.clear();
-      approvalMode = "ask";
+      approvalMode = "readOnly";
       emit({
         type: "state-reset",
         state: { ...createSessionViewState(), meta: state.meta, mcp: state.mcp }
@@ -508,8 +770,15 @@ function createSessionController(deps) {
       startNextQueuedSubmission();
     },
     async submit(input, opts) {
+      if (closing) throw new Error("Session is closing.");
+      opts.signal?.throwIfAborted();
       if (abortController || hostBusyCount > 0) {
-        queue.push({ id: `q-${++queueCounter}`, input, opts });
+        queue.push({
+          id: `q-${++queueCounter}`,
+          input,
+          opts,
+          delivery: abortController !== null && opts.turnId === void 0 ? "steering" : "next-turn"
+        });
         emitTurnStatus();
         return;
       }
@@ -523,11 +792,17 @@ function createSessionController(deps) {
           opts.turnId
         );
       }
-      await runTurn(input, { turnId: opts.turnId });
+      await startTrackedTurn(input, {
+        turnId: opts.turnId,
+        allowSteering: opts.turnId === void 0,
+        submission: opts.submission ?? { origin: "user" },
+        ...opts.signal === void 0 ? {} : { signal: opts.signal }
+      });
     }
   };
 }
 export {
   AgentChannel,
-  createSessionController
+  createSessionController,
+  formatBashPolicyDenial
 };