@peakflo/agent-harness 0.2.9-rc.5 → 0.2.9-rc.6

package/README.md

@@ -121,6 +121,11 @@ The runner never answers a request with "always allow", and does not offer
 that answer to the person approving: Codex and Cursor would save it as a
 standing rule in their own configuration.
 
+An approval request says what will happen in its first line ("Run: npm test",
+"Write: src/a.ts", "Change: 3 files" with the list), for every kind of request
+Codex can send. "Deny" refuses the action and lets the turn go on, so the agent
+says that it was not allowed; the denied action never runs.
+
 Cursor reports an account limit as a normal reply ("Upgrade your plan to
 continue"). The runner turns a reply that is only that sentence into a failed
 turn that says it comes from the Cursor account on the runner.

package/dist/adapters/claude-code-adapter.js

@@ -1284,7 +1284,20 @@ class ClaudeCodeAdapter {
             const errName = error instanceof Error ? error.name : '';
             const errMsg = error instanceof Error ? error.message : String(error);
             const errStack = error instanceof Error ? error.stack : undefined;
-            if (errName === 'AbortError' || errMsg.includes('aborted by user')) {
+            // CHANGED from 20x: the runner stops the session at the end of EVERY
+            // turn (one process per turn), and the SDK reports that stop as a plain
+            // `Error: Operation aborted`. That is the expected end of a finished
+            // turn, not a failure: it used to be logged as "Stream error" with a
+            // stack trace after every successful turn, and marked the session failed.
+            // Both conditions: the adapter asked for the stop AND the error is the
+            // SDK's own word for a stopped process. An unrelated failure that
+            // happens to arrive after the stop is still reported below.
+            const stoppedByUs = session.abortController?.signal.aborted === true &&
+                /\babort(ed)?\b/i.test(errMsg);
+            if (stoppedByUs) {
+                console.log('[ClaudeCodeAdapter] Stream stopped at the end of the turn');
+            }
+            else if (errName === 'AbortError' || errMsg.includes('aborted by user')) {
                 console.log('[ClaudeCodeAdapter] Stream aborted by user');
                 // Don't set error status - this is normal when sending a new message
             }

package/dist/adapters/codex-app-server-adapter.d.ts

@@ -40,6 +40,8 @@ interface PendingApproval {
         kind: string;
     }>;
     responseKind: 'execCommand' | 'commandExecution' | 'fileChange' | 'permissions' | 'elicitation' | 'userInput' | 'generic';
+    /** What `item/permissions/requestApproval` asked for; echoed back on allow. */
+    requestedPermissions?: unknown;
 }
 export declare class CodexAppServerAdapter implements CodingAgentAdapter {
     private sessions;

package/dist/adapters/codex-app-server-adapter.js

@@ -57,6 +57,7 @@ const os_1 = require("os");
 const path_1 = require("path");
 const util_1 = require("util");
 const coding_agent_adapter_1 = require("./coding-agent-adapter");
+const codex_approval_text_1 = require("./codex-approval-text");
 const DEFAULT_CODEX_APP_SERVER_MODEL = 'gpt-5.5';
 /**
  * `thread/items/list` returns each item inside an envelope:
@@ -277,12 +278,6 @@ function isSubpath(parent, child) {
     const rel = (0, path_1.relative)((0, path_1.resolve)(parent), (0, path_1.resolve)(child));
     return rel === '' || (!!rel && !rel.startsWith('..') && !(0, path_1.isAbsolute)(rel));
 }
-function summarizeApproval(params, fallback) {
-    const command = asString(params.command);
-    const reason = asString(params.reason);
-    const itemId = asString(params.itemId) || asString(params.callId);
-    return [command || fallback, reason, itemId ? `id: ${itemId}` : ''].filter(Boolean).join('\n');
-}
 function normalizeDecisionName(decision) {
     if (typeof decision === 'string')
         return decision;
@@ -291,24 +286,6 @@ function normalizeDecisionName(decision) {
     }
     return 'accept';
 }
-function decisionLabel(decision) {
-    switch (decision) {
-        case 'accept':
-        case 'approved':
-            return 'Allow';
-        case 'acceptForSession':
-        case 'approved_for_session':
-            return 'Allow for Session';
-        case 'decline':
-        case 'denied':
-            return 'Deny';
-        case 'cancel':
-        case 'abort':
-            return 'Deny and Stop';
-        default:
-            return decision;
-    }
-}
 class CodexAppServerAdapter {
     sessions = new Map();
     codexExecutablePath = null;
@@ -540,14 +517,24 @@ class CodexAppServerAdapter {
         if (!approval)
             return;
         const selected = optionId || approval.options.find((option) => approved
-            ? ['acceptForSession', 'accept', 'approved_for_session', 'approved'].includes(option.optionId)
-            : ['cancel', 'abort', 'decline', 'denied'].includes(option.optionId))?.optionId || (approved ? 'accept' : 'cancel');
-        const response = this.buildApprovalResponse(approval.responseKind, selected, approved);
+            ? ['accept', 'approved'].includes(option.optionId)
+            : ['decline', 'denied'].includes(option.optionId))?.optionId || (
+        // The older requests take `approved` / `denied`.
+        approval.responseKind === 'execCommand'
+            ? (approved ? 'approved' : 'denied')
+            : (approved ? 'accept' : 'decline'));
+        const response = this.buildApprovalResponse(approval.responseKind, selected, approved, approval.requestedPermissions);
         this.sendRpcResponse(session, approval.requestId, response);
         session.pendingApproval = null;
-        if (!approved) {
-            session.status = coding_agent_adapter_1.SessionStatusType.IDLE;
-        }
+        // CHANGED from 20x, which marked the session idle on every denial. A
+        // denial that continues the turn (`decline`, `denied`) is followed by the
+        // model's own answer; calling the session idle here ended the turn before
+        // that answer arrived. Only a denial that stops the turn is idle at once.
+        // (No button sends `cancel` or `abort` any more; a caller that names one
+        // explicitly still gets the stop it asked for.)
+        session.status = !approved && (selected === 'cancel' || selected === 'abort')
+            ? coding_agent_adapter_1.SessionStatusType.IDLE
+            : coding_agent_adapter_1.SessionStatusType.BUSY;
     }
     async getRunningTools(sessionId, _config) {
         return Array.from(this.sessions.get(sessionId)?.runningTools.values() || []);
@@ -879,7 +866,7 @@ class CodexAppServerAdapter {
         if (session.config.permissionMode === 'allow') {
             const responseKind = this.getApprovalResponseKind(request.method);
             const selected = responseKind === 'execCommand' ? 'approved' : 'accept';
-            this.sendRpcResponse(session, request.id, this.buildApprovalResponse(responseKind, selected, true));
+            this.sendRpcResponse(session, request.id, this.buildApprovalResponse(responseKind, selected, true, params.permissions));
             return;
         }
         const toolCallId = asString(params.approvalId) || asString(params.itemId) || asString(params.callId) || String(request.id);
@@ -889,44 +876,63 @@ class CodexAppServerAdapter {
         // the amendment is saved into the Codex config on the runner. Offer only
         // the decisions known to answer this one request; the rest are logged.
         const offered = Array.isArray(params.availableDecisions) ? params.availableDecisions : [];
-        const rawDecisions = offered
-            .filter((decision) => !isStandingApprovalDecision(normalizeDecisionName(decision)));
-        if (rawDecisions.length !== offered.length) {
-            const withheld = offered.map(normalizeDecisionName).filter(isStandingApprovalDecision);
+        const withheld = offered.map(normalizeDecisionName).filter(isStandingApprovalDecision);
+        if (withheld.length > 0) {
             console.log(`[CodexAppServerAdapter] Not offering approval decisions: ${withheld.join(', ')}`);
         }
-        const approvalOptions = rawDecisions.length > 0
-            ? rawDecisions.map((decision) => {
-                const optionId = normalizeDecisionName(decision);
-                return {
-                    optionId,
-                    name: decisionLabel(optionId),
-                    kind: optionId.includes('accept') || optionId === 'approved' ? 'allow' : 'reject'
-                };
-            })
+        /*
+         * CHANGED from 20x: ONE "Allow" AND ONE "Deny", AND DENY LETS THE TURN GO ON.
+         *
+         * Codex has two denials. `cancel` ("abort" in the older form) also
+         * interrupts the turn: the chat went idle with no word from the agent, as
+         * if nothing had been asked. `decline` ("denied") refuses the action and
+         * lets the model carry on, so it can say that it was not allowed and what
+         * it will do instead. Both are in the protocol for every request that has
+         * a decision, whether or not `availableDecisions` lists them, so "Deny" is
+         * always the one that continues.
+         */
+        const legacy = responseKind === 'execCommand';
+        const approvalOptions = legacy
+            ? [
+                { optionId: 'approved', name: 'Allow', kind: 'allow' },
+                { optionId: 'denied', name: 'Deny', kind: 'reject' }
+            ]
             : [
                 { optionId: 'accept', name: 'Allow', kind: 'allow' },
-                { optionId: 'cancel', name: 'Deny', kind: 'reject' }
+                { optionId: 'decline', name: 'Deny', kind: 'reject' }
             ];
+        // The item the request is about, when it has been announced: a file
+        // change's paths are on the item, not on the request.
+        const itemId = asString(params.itemId) || asString(params.callId);
+        const item = itemId ? session.runningTools.get(`tool-${itemId}`)?.input : undefined;
         session.pendingApproval = {
             requestId: request.id,
             toolCallId,
-            question: summarizeApproval(params, request.method),
+            question: (0, codex_approval_text_1.describeCodexApproval)(request.method, params, item, session.config.workspaceDir),
             options: approvalOptions,
-            responseKind
+            responseKind,
+            ...(responseKind === 'permissions' ? { requestedPermissions: params.permissions } : {})
         };
         session.status = coding_agent_adapter_1.SessionStatusType.WAITING_APPROVAL;
         this.onDataAvailable?.(session.threadId || session.sessionId);
     }
-    buildApprovalResponse(responseKind, selected, approved) {
+    buildApprovalResponse(responseKind, selected, approved, requestedPermissions) {
         switch (responseKind) {
             case 'execCommand':
-                return { decision: approved ? (selected === 'approved_for_session' ? 'approved_for_session' : 'approved') : (selected === 'denied' ? 'denied' : 'abort') };
+                // The older requests (`execCommandApproval`, `applyPatchApproval`)
+                // take a ReviewDecision. `denied` continues the turn; `abort` stops it.
+                return { decision: approved ? 'approved' : (selected === 'abort' ? 'abort' : 'denied') };
             case 'commandExecution':
-                return { decision: selected };
             case 'fileChange':
+                return { decision: approved ? 'accept' : (selected === 'cancel' ? 'cancel' : 'decline') };
             case 'permissions':
-                return { decision: selected };
+                // CHANGED from 20x, which answered `{ decision }`. This request has no
+                // decision: the answer is the permissions granted, for this turn only.
+                // Granting nothing is the denial.
+                return {
+                    permissions: approved && isObject(requestedPermissions) ? requestedPermissions : {},
+                    scope: 'turn'
+                };
             case 'elicitation':
                 return approved
                     ? { action: 'accept', content: {} }
@@ -936,11 +942,11 @@ class CodexAppServerAdapter {
                     ? { response: selected }
                     : { response: null };
             default:
-                return { decision: approved ? selected : 'cancel' };
+                return { decision: approved ? 'accept' : 'decline' };
         }
     }
     getApprovalResponseKind(method) {
-        if (method === 'execCommandApproval')
+        if (method === 'execCommandApproval' || method === 'applyPatchApproval')
             return 'execCommand';
         if (method.includes('commandExecution'))
             return 'commandExecution';

package/dist/adapters/codex-approval-text.d.ts

@@ -0,0 +1,46 @@
+/**
+ * What a person is shown when `codex app-server` asks for an approval.
+ *
+ * The card used to show the protocol itself: `item/fileChange/requestApproval`
+ * and `id: exec-…`, with the file name only in the item above it. This module
+ * turns each kind of request the app-server can send into a first line that
+ * says what will happen ("Write: src/a.ts", "Run: npm test") and further lines
+ * with what helps to decide (where, why, which files).
+ *
+ * The first line is the title; the control plane's card shows it on its own.
+ * No ids: nobody can decide anything from one.
+ *
+ * Request kinds, from `codex app-server generate-json-schema` (ServerRequest):
+ *   item/commandExecution/requestApproval   a command, or input to a terminal
+ *   item/fileChange/requestApproval         a patch; the files are on the item
+ *   item/permissions/requestApproval        wider sandbox access for the turn
+ *   mcpServer/elicitation/request           an MCP server asks (incl. to run
+ *                                           one of its tools)
+ *   item/tool/requestUserInput              the model asks a question
+ *   execCommandApproval, applyPatchApproval the older forms of the first two
+ * Kept out of the adapter, which is a copy of 20x's, so it can be tested alone.
+ */
+type Json = Record<string, unknown>;
+interface FileChange {
+    path: string;
+    kind: string;
+    added: number;
+    removed: number;
+}
+/**
+ * The files of a change, from either shape Codex uses:
+ *   v2 item       `changes: [{ path, kind: { type }, diff }]`
+ *   older request `fileChanges: { [path]: { add | delete | update: {…} } }`
+ */
+export declare function readFileChanges(source: unknown): FileChange[];
+/**
+ * The text of one approval request.
+ *
+ * @param item the thread item the request is about, when the adapter has seen
+ *   it (`item/started` arrives before the request). A file change's paths are
+ *   only there.
+ */
+export declare function describeCodexApproval(method: string, params: Json, item?: Json, 
+/** The session's workspace; paths inside it are shown relative to it. */
+workspaceDir?: string): string;
+export {};

package/dist/adapters/codex-approval-text.js

@@ -0,0 +1,314 @@
+"use strict";
+/**
+ * What a person is shown when `codex app-server` asks for an approval.
+ *
+ * The card used to show the protocol itself: `item/fileChange/requestApproval`
+ * and `id: exec-…`, with the file name only in the item above it. This module
+ * turns each kind of request the app-server can send into a first line that
+ * says what will happen ("Write: src/a.ts", "Run: npm test") and further lines
+ * with what helps to decide (where, why, which files).
+ *
+ * The first line is the title; the control plane's card shows it on its own.
+ * No ids: nobody can decide anything from one.
+ *
+ * Request kinds, from `codex app-server generate-json-schema` (ServerRequest):
+ *   item/commandExecution/requestApproval   a command, or input to a terminal
+ *   item/fileChange/requestApproval         a patch; the files are on the item
+ *   item/permissions/requestApproval        wider sandbox access for the turn
+ *   mcpServer/elicitation/request           an MCP server asks (incl. to run
+ *                                           one of its tools)
+ *   item/tool/requestUserInput              the model asks a question
+ *   execCommandApproval, applyPatchApproval the older forms of the first two
+ * Kept out of the adapter, which is a copy of 20x's, so it can be tested alone.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readFileChanges = readFileChanges;
+exports.describeCodexApproval = describeCodexApproval;
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function text(value) {
+    return typeof value === 'string' ? value.trim() : '';
+}
+/** One line, however the value was written. */
+function oneLine(value) {
+    return value.replace(/\s*\n\s*/g, ' ⏎ ').trim();
+}
+const MAX_LISTED_PATHS = 12;
+/** `/work/space/src/a.ts` in `/work/space` → `src/a.ts`. Others unchanged. */
+function relativeTo(workspaceDir, path) {
+    const root = (workspaceDir ?? '').replace(/\/+$/, '');
+    if (!root)
+        return path;
+    // macOS reports the same directory as /tmp/… and /private/tmp/….
+    for (const prefix of [
+        root,
+        `/private${root}`,
+        root.replace(/^\/private/, '')
+    ]) {
+        if (prefix && path.startsWith(`${prefix}/`)) {
+            return path.slice(prefix.length + 1);
+        }
+    }
+    return path;
+}
+function countDiff(diff) {
+    let added = 0;
+    let removed = 0;
+    for (const line of diff.split('\n')) {
+        if (line.startsWith('+++') || line.startsWith('---'))
+            continue;
+        if (line.startsWith('+'))
+            added += 1;
+        else if (line.startsWith('-'))
+            removed += 1;
+    }
+    return { added, removed };
+}
+function changeKind(value) {
+    if (typeof value === 'string')
+        return value;
+    if (isRecord(value)) {
+        return text(value.type) || Object.keys(value)[0] || 'update';
+    }
+    return 'update';
+}
+/**
+ * The files of a change, from either shape Codex uses:
+ *   v2 item       `changes: [{ path, kind: { type }, diff }]`
+ *   older request `fileChanges: { [path]: { add | delete | update: {…} } }`
+ */
+function readFileChanges(source) {
+    if (Array.isArray(source)) {
+        const changes = [];
+        for (const entry of source) {
+            if (!isRecord(entry) || !text(entry.path))
+                continue;
+            const diff = text(entry.diff);
+            const kind = changeKind(entry.kind);
+            // A new file's "diff" is its whole content, without `+` marks.
+            const counted = kind === 'add' && diff && !/^[+-]/m.test(diff)
+                ? { added: diff.split('\n').length, removed: 0 }
+                : countDiff(diff);
+            changes.push({ path: text(entry.path), kind, ...counted });
+        }
+        return changes;
+    }
+    if (isRecord(source)) {
+        return Object.entries(source).map(([path, change]) => {
+            const kind = changeKind(change);
+            const body = isRecord(change) && isRecord(change[kind]) ? change[kind] : {};
+            const diff = text(body.unified_diff) || text(body.diff);
+            const content = text(body.content);
+            return {
+                path,
+                kind,
+                ...(diff
+                    ? countDiff(diff)
+                    : { added: content ? content.split('\n').length : 0, removed: 0 })
+            };
+        });
+    }
+    return [];
+}
+function verbFor(kind) {
+    if (kind === 'add')
+        return 'Create';
+    if (kind === 'delete')
+        return 'Delete';
+    return 'Write';
+}
+function changeSummary(change) {
+    if (change.kind === 'delete')
+        return '';
+    const parts = [];
+    if (change.added)
+        parts.push(`+${change.added}`);
+    if (change.removed)
+        parts.push(`−${change.removed}`);
+    return parts.length ? ` (${parts.join(' ')})` : '';
+}
+function describeFileChanges(changes) {
+    if (changes.length === 0)
+        return ['Write: files in the workspace'];
+    if (changes.length === 1) {
+        const [only] = changes;
+        return [`${verbFor(only.kind)}: ${only.path}${changeSummary(only)}`];
+    }
+    const kinds = new Set(changes.map((change) => change.kind));
+    const verb = kinds.size === 1 ? verbFor(changes[0].kind) : 'Change';
+    const lines = [`${verb}: ${changes.length} files`];
+    for (const change of changes.slice(0, MAX_LISTED_PATHS)) {
+        // Said once in the first line when every file is the same kind of change.
+        const mark = kinds.size === 1
+            ? ''
+            : change.kind === 'add'
+                ? 'new'
+                : change.kind === 'delete'
+                    ? 'deleted'
+                    : '';
+        lines.push(`• ${change.path}${changeSummary(change)}${mark ? ` — ${mark}` : ''}`);
+    }
+    if (changes.length > MAX_LISTED_PATHS) {
+        lines.push(`• and ${changes.length - MAX_LISTED_PATHS} more`);
+    }
+    return lines;
+}
+/**
+ * `/bin/zsh -lc 'npm test'` → `npm test`. Codex runs every command through a
+ * login shell; the wrapper is the same every time and hides the command. Only
+ * the plain one-quoted form is unwrapped, so nothing is ever shown that is not
+ * literally what the shell will be given.
+ */
+function unwrapShell(command) {
+    const match = /^(?:\/(?:usr\/)?bin\/)?(?:zsh|bash|sh) -l?c (['"])([\s\S]*)\1$/.exec(command.trim());
+    if (!match)
+        return command;
+    const [, quote, inner] = match;
+    return inner.includes(quote) || inner.includes('\\') ? command : inner;
+}
+function commandText(value) {
+    if (Array.isArray(value)) {
+        return value
+            .filter((part) => typeof part === 'string')
+            .join(' ');
+    }
+    return text(value);
+}
+function describePermissions(permissions) {
+    const lines = [];
+    if (!isRecord(permissions))
+        return lines;
+    if (isRecord(permissions.network) && permissions.network.enabled === true) {
+        lines.push('• network access');
+    }
+    if (isRecord(permissions.fileSystem)) {
+        const fileSystem = permissions.fileSystem;
+        const list = (key, label) => {
+            const paths = Array.isArray(fileSystem[key])
+                ? fileSystem[key].filter((path) => typeof path === 'string')
+                : [];
+            for (const path of paths)
+                lines.push(`• ${label} ${path}`);
+        };
+        list('write', 'write to');
+        list('read', 'read');
+        if (Array.isArray(fileSystem.entries)) {
+            for (const entry of fileSystem.entries) {
+                if (!isRecord(entry))
+                    continue;
+                const path = isRecord(entry.path)
+                    ? text(entry.path.path) || JSON.stringify(entry.path)
+                    : text(entry.path);
+                const access = text(entry.access) || 'access';
+                if (path)
+                    lines.push(`• ${access} ${path}`);
+            }
+        }
+    }
+    return lines;
+}
+/** `item/somethingNew/requestApproval` → "something new". */
+function humanise(method) {
+    const words = method
+        .replace(/^item\//, '')
+        .replace(/\/?(requestApproval|request)$/i, '')
+        .replace(/Approval$/i, '')
+        .replace(/[/_]/g, ' ')
+        .replace(/([a-z])([A-Z])/g, '$1 $2')
+        .trim()
+        .toLowerCase();
+    return words || 'an action';
+}
+/**
+ * The text of one approval request.
+ *
+ * @param item the thread item the request is about, when the adapter has seen
+ *   it (`item/started` arrives before the request). A file change's paths are
+ *   only there.
+ */
+function describeCodexApproval(method, params, item, 
+/** The session's workspace; paths inside it are shown relative to it. */
+workspaceDir) {
+    const reason = text(params.reason);
+    const lines = [];
+    const shown = (path) => relativeTo(workspaceDir, path);
+    if (method === 'item/commandExecution/requestApproval' ||
+        method === 'execCommandApproval') {
+        const command = unwrapShell(commandText(params.command) || commandText(item?.command) || '');
+        const network = isRecord(params.networkApprovalContext)
+            ? params.networkApprovalContext
+            : null;
+        if (params.kind === 'writeStdin') {
+            lines.push(`Send input to a running command: ${oneLine(command)}`);
+        }
+        else if (command) {
+            lines.push(`Run: ${oneLine(command)}`);
+        }
+        else if (network) {
+            lines.push(`Network access: ${text(network.host)}`);
+        }
+        else {
+            lines.push('Run: a command');
+        }
+        const cwd = text(params.cwd) || text(item?.cwd);
+        // The workspace itself goes without saying; anywhere else is worth a line.
+        const where = cwd
+            ? shown(`${cwd.replace(/\/+$/, '')}/.`).replace(/\/?\.$/, '')
+            : '';
+        if (where)
+            lines.push(`In: ${where}`);
+        if (network && command) {
+            lines.push(`Network access: ${text(network.host)}${text(network.protocol) ? ` (${text(network.protocol)})` : ''}`);
+        }
+    }
+    else if (method === 'item/fileChange/requestApproval' ||
+        method === 'applyPatchApproval') {
+        lines.push(...describeFileChanges(readFileChanges(params.fileChanges ?? item?.changes).map((change) => ({
+            ...change,
+            path: shown(change.path)
+        }))));
+        const root = text(params.grantRoot);
+        if (root)
+            lines.push(`Also asks to write under: ${root}`);
+    }
+    else if (method === 'item/permissions/requestApproval') {
+        const wanted = describePermissions(params.permissions);
+        lines.push('Grant more access for this turn');
+        lines.push(...(wanted.length ? wanted : ['• wider sandbox access']));
+        const cwd = text(params.cwd);
+        if (cwd)
+            lines.push(`In: ${cwd}`);
+    }
+    else if (method === 'mcpServer/elicitation/request') {
+        const server = text(params.serverName) || 'An MCP server';
+        const message = text(params.message);
+        lines.push(message
+            ? `${server} asks: ${oneLine(message)}`
+            : `${server} asks to continue`);
+        const url = text(params.url);
+        if (url)
+            lines.push(`Opens: ${url}`);
+    }
+    else if (method === 'item/tool/requestUserInput') {
+        const first = Array.isArray(params.questions) ? params.questions[0] : null;
+        const question = isRecord(first)
+            ? text(first.question) || text(first.header)
+            : '';
+        lines.push(question ? `Codex asks: ${oneLine(question)}` : 'Codex asks a question');
+    }
+    else {
+        // A kind this build does not know. Say what is asked in plain words and
+        // show what the request itself says about it, never the method name alone.
+        const command = commandText(params.command);
+        lines.push(`Codex asks to approve: ${humanise(method)}`);
+        if (command)
+            lines.push(`Command: ${oneLine(command)}`);
+        const cwd = text(params.cwd);
+        if (cwd)
+            lines.push(`In: ${cwd}`);
+    }
+    if (reason)
+        lines.push(`Reason: ${oneLine(reason)}`);
+    return lines.join('\n');
+}

package/dist/runtime/session-runner.d.ts

@@ -277,6 +277,35 @@ export declare function decodeQuestionAnswers(answer: string | undefined): Recor
  * Codex's "Allow" read as a denial.
  */
 export declare function isApprovingOptionId(optionId: string): boolean;
+/**
+ * Decide what a user's answer actually means, and fail closed when it is not
+ * clear.
+ *
+ * THREE PATHS REACH HERE AND THEY DO NOT CARRY THE SAME INFORMATION:
+ *
+ *   1. An option BUTTON in the question card. Sends `optionId`. Unambiguous,
+ *      and this is the ordinary case.
+ *   2. The card's Reject button. Sends no `optionId` and the fixed text
+ *      "Rejected by the user."
+ *   3. The COMPOSER. When a question is open, typing a message posts it as an
+ *      answer instead (composer.tsx:76-106) — with no `optionId` at all.
+ *
+ * So free text has to be interpreted, and the rule is: interpret it only when
+ * it plainly matches something the backend offered. Anything else DENIES, and
+ * says so in the transcript rather than silently doing the safer thing without
+ * telling the user why they are being asked again.
+ */
+export declare function resolveApproval(command: {
+    answer?: string;
+    optionId?: string;
+}, open: {
+    knownOptionIds: Set<string>;
+    optionIdByLabel: Map<string, string>;
+}): {
+    approved: boolean;
+    optionId?: string;
+    transcriptText: string;
+};
 export interface McpCheckState {
     checked: Map<string, number>;
     failed: Map<string, FailedMcpCheck>;

package/dist/runtime/session-runner.js

@@ -29,6 +29,7 @@ exports.modelGatewayRefusal = modelGatewayRefusal;
 exports.permissionFingerprint = permissionFingerprint;
 exports.decodeQuestionAnswers = decodeQuestionAnswers;
 exports.isApprovingOptionId = isApprovingOptionId;
+exports.resolveApproval = resolveApproval;
 const node_crypto_1 = require("node:crypto");
 const model_gateway_1 = require("../adapters/model-gateway");
 const contract_1 = require("../contract");
@@ -1869,7 +1870,11 @@ class SessionRunner {
                         question: approval.question,
                         options: approval.options.map((option) => ({
                             id: option.optionId,
-                            label: option.name
+                            label: option.name,
+                            // Whether this answer says yes, decided HERE by the same rule
+                            // that will read the answer back. The card colours its buttons
+                            // from this and never from the words on them.
+                            kind: isApprovingOptionId(option.optionId) ? 'allow' : 'reject'
                         }))
                     }
                 ]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@peakflo/agent-harness",
-  "version": "0.2.9-rc.5",
+  "version": "0.2.9-rc.6",
   "description": "Headless Peakflo coding-agent harness. One codebase, three hosting modes: a Daytona cloud sandbox, a customer VM, and the 20x desktop.",
   "license": "MIT",
   "type": "commonjs",