@poncho-ai/cli 0.18.0 → 0.19.0

package/dist/{chunk-ETZ3YKFP.js → chunk-7P53QSP5.js}

@@ -310,6 +310,22 @@ var WEB_UI_STYLES = `
       flex-direction: column;
       padding: 12px 8px;
     }
+    .sidebar-header {
+      display: flex;
+      align-items: center;
+      gap: 8px;
+    }
+    .sidebar-agent-name {
+      font-size: 14px;
+      font-weight: 500;
+      color: var(--fg-strong);
+      flex: 1;
+      min-width: 0;
+      overflow: hidden;
+      text-overflow: ellipsis;
+      white-space: nowrap;
+      padding-left: 10px;
+    }
     .new-chat-btn {
       background: transparent;
       border: 0;
@@ -322,6 +338,7 @@ var WEB_UI_STYLES = `
       gap: 8px;
       font-size: 13px;
       cursor: pointer;
+      flex-shrink: 0;
       transition: background 0.15s, color 0.15s;
     }
     .new-chat-btn:hover { color: var(--fg); }
@@ -824,6 +841,30 @@ var WEB_UI_STYLES = `
       opacity: 0.55;
       cursor: not-allowed;
     }
+    .approval-batch-actions {
+      display: flex;
+      gap: 6px;
+      margin-bottom: 8px;
+    }
+    .approval-batch-btn {
+      border-radius: 6px;
+      border: 1px solid var(--border-5);
+      background: var(--surface-4);
+      color: var(--fg-approval-btn);
+      font-size: 11px;
+      font-weight: 600;
+      padding: 4px 10px;
+      cursor: pointer;
+    }
+    .approval-batch-btn:hover { background: var(--surface-7); }
+    .approval-batch-btn.approve {
+      border-color: var(--approve-border);
+      color: var(--approve);
+    }
+    .approval-batch-btn.deny {
+      border-color: var(--deny-border);
+      color: var(--deny);
+    }
     .user-bubble {
       background: var(--bg-elevated);
       border: 1px solid var(--border-2);
@@ -1220,6 +1261,9 @@ var WEB_UI_STYLES = `
       .shell.sidebar-open .sidebar { transform: translateX(0); }
       .sidebar-toggle { display: grid; place-items: center; }
       .topbar-new-chat { display: grid; place-items: center; }
+      .sidebar-header { padding-right: 130px; }
+      .sidebar-agent-name { padding-left: 0; }
+      .new-chat-btn { order: -1; }
       .poncho-badge {
         display: none;
         position: fixed;
@@ -1359,15 +1403,17 @@ var WEB_UI_STYLES = `
       font-size: 13px;
     }
     @media (max-width: 768px) {
+      .main-body { flex-direction: column; }
       .browser-panel {
-        position: fixed;
-        inset: 0;
-        width: 100% !important;
+        position: relative;
+        order: -1;
+        max-height: 35vh;
         flex: none !important;
-        z-index: 200;
+        width: auto !important;
+        border-bottom: 1px solid var(--border-1);
       }
       .browser-panel-resize { display: none !important; }
-      .main-chat.has-browser { flex: 1 1 auto !important; min-width: 0; }
+      .main-chat.has-browser { flex: 1 1 auto !important; min-width: 0; min-height: 0; }
     }
 
     /* --- Subagent UI --- */
@@ -1649,6 +1695,62 @@ var getWebUiClientScript = (markedSource2) => `
         }
       };
 
+      // During streaming, incomplete backtick sequences cause marked to
+      // swallow all subsequent text into an invisible code element. This
+      // helper detects unclosed fences and inline code delimiters and
+      // appends the missing closing so marked can render partial text.
+      const closeStreamingMarkdown = (text) => {
+        const BT = "\\x60";
+        let result = text;
+
+        // 1. Unclosed fenced code blocks (lines starting with 3+ backticks)
+        const lines = result.split("\\n");
+        let openFenceLen = 0;
+        for (let li = 0; li < lines.length; li++) {
+          const trimmed = lines[li].trimStart();
+          let btCount = 0;
+          while (btCount < trimmed.length && trimmed[btCount] === BT) btCount++;
+          if (btCount >= 3) {
+            if (openFenceLen === 0) {
+              openFenceLen = btCount;
+            } else if (btCount >= openFenceLen) {
+              openFenceLen = 0;
+            }
+          }
+        }
+        if (openFenceLen > 0) {
+          let fence = "";
+          for (let k = 0; k < openFenceLen; k++) fence += BT;
+          return result + "\\n" + fence;
+        }
+
+        // 2. Unclosed inline code delimiters
+        let idx = 0;
+        let inCode = false;
+        let delimLen = 0;
+        while (idx < result.length) {
+          if (result[idx] === BT) {
+            let run = 0;
+            while (idx < result.length && result[idx] === BT) { run++; idx++; }
+            if (!inCode) {
+              inCode = true;
+              delimLen = run;
+            } else if (run === delimLen) {
+              inCode = false;
+            }
+          } else {
+            idx++;
+          }
+        }
+        if (inCode) {
+          let closing = "";
+          for (let k = 0; k < delimLen; k++) closing += BT;
+          result += closing;
+        }
+
+        return result;
+      };
+
       const extractToolActivity = (value) => {
         const source = String(value || "");
         let markerIndex = source.lastIndexOf("\\n### Tool activity\\n");
@@ -1715,8 +1817,15 @@ var getWebUiClientScript = (markedSource2) => `
             );
           })
           .join("");
+        const batchButtons = requests.length > 1
+          ? '<div class="approval-batch-actions">' +
+            '<button class="approval-batch-btn approve" data-approval-batch="approve">Approve all (' + requests.length + ')</button>' +
+            '<button class="approval-batch-btn deny" data-approval-batch="deny">Deny all (' + requests.length + ')</button>' +
+            "</div>"
+          : "";
         return (
           '<div class="approval-requests">' +
+          batchButtons +
           rows +
           "</div>"
         );
@@ -2246,7 +2355,7 @@ var getWebUiClientScript = (markedSource2) => `
                 // Show current text being typed
                 if (isStreaming && i === messages.length - 1 && m._currentText) {
                   const textDiv = document.createElement("div");
-                  textDiv.innerHTML = renderAssistantMarkdown(m._currentText);
+                  textDiv.innerHTML = renderAssistantMarkdown(closeStreamingMarkdown(m._currentText));
                   content.appendChild(textDiv);
                 }
               } else {
@@ -3828,45 +3937,20 @@ var getWebUiClientScript = (markedSource2) => `
         openLightbox(img.src);
       });
 
-      elements.messages.addEventListener("click", async (event) => {
-        const target = event.target;
-        if (!(target instanceof Element)) {
-          return;
-        }
-        const button = target.closest(".approval-action-btn");
-        if (!button) {
-          return;
-        }
-        const approvalId = button.getAttribute("data-approval-id") || "";
-        const decision = button.getAttribute("data-approval-decision") || "";
-        if (!approvalId || (decision !== "approve" && decision !== "deny")) {
-          return;
-        }
-        if (state.approvalRequestsInFlight[approvalId]) {
-          return;
-        }
+      const submitApproval = async (approvalId, decision, opts) => {
+        const wasStreaming = opts && opts.wasStreaming;
         state.approvalRequestsInFlight[approvalId] = true;
-        const wasStreaming = state.isStreaming;
-        if (!wasStreaming) {
-          setStreaming(true);
-        }
         updatePendingApproval(approvalId, (request) => ({
           ...request,
           state: "submitting",
           pendingDecision: decision,
         }));
-        renderMessages(state.activeMessages, state.isStreaming);
         try {
           await api("/api/approvals/" + encodeURIComponent(approvalId), {
             method: "POST",
             body: JSON.stringify({ approved: decision === "approve" }),
           });
           updatePendingApproval(approvalId, () => null);
-          renderMessages(state.activeMessages, state.isStreaming);
-          loadConversations();
-          if (!wasStreaming && state.activeConversationId) {
-            await streamConversationEvents(state.activeConversationId, { liveOnly: true });
-          }
         } catch (error) {
           const isStale = error && error.payload && error.payload.code === "APPROVAL_NOT_FOUND";
           if (isStale) {
@@ -3880,13 +3964,77 @@ var getWebUiClientScript = (markedSource2) => `
               _error: errMsg,
             }));
           }
-          renderMessages(state.activeMessages, state.isStreaming);
         } finally {
+          delete state.approvalRequestsInFlight[approvalId];
+        }
+      };
+
+      elements.messages.addEventListener("click", async (event) => {
+        const target = event.target;
+        if (!(target instanceof Element)) {
+          return;
+        }
+
+        // Batch approve/deny all
+        const batchBtn = target.closest(".approval-batch-btn");
+        if (batchBtn) {
+          const decision = batchBtn.getAttribute("data-approval-batch") || "";
+          if (decision !== "approve" && decision !== "deny") return;
+          const messages = state.activeMessages || [];
+          const pending = [];
+          for (const m of messages) {
+            if (Array.isArray(m._pendingApprovals)) {
+              for (const req of m._pendingApprovals) {
+                if (req.approvalId && req.state !== "submitting" && !state.approvalRequestsInFlight[req.approvalId]) {
+                  pending.push(req.approvalId);
+                }
+              }
+            }
+          }
+          if (pending.length === 0) return;
+          const wasStreaming = state.isStreaming;
+          if (!wasStreaming) setStreaming(true);
+          renderMessages(state.activeMessages, state.isStreaming);
+          await Promise.all(pending.map((aid) => submitApproval(aid, decision, { wasStreaming })));
+          renderMessages(state.activeMessages, state.isStreaming);
+          loadConversations();
+          if (!wasStreaming && state.activeConversationId) {
+            await streamConversationEvents(state.activeConversationId, { liveOnly: true });
+          }
           if (!wasStreaming) {
             setStreaming(false);
             renderMessages(state.activeMessages, false);
           }
-          delete state.approvalRequestsInFlight[approvalId];
+          return;
+        }
+
+        // Individual approve/deny
+        const button = target.closest(".approval-action-btn");
+        if (!button) {
+          return;
+        }
+        const approvalId = button.getAttribute("data-approval-id") || "";
+        const decision = button.getAttribute("data-approval-decision") || "";
+        if (!approvalId || (decision !== "approve" && decision !== "deny")) {
+          return;
+        }
+        if (state.approvalRequestsInFlight[approvalId]) {
+          return;
+        }
+        const wasStreaming = state.isStreaming;
+        if (!wasStreaming) {
+          setStreaming(true);
+        }
+        renderMessages(state.activeMessages, state.isStreaming);
+        await submitApproval(approvalId, decision, { wasStreaming });
+        renderMessages(state.activeMessages, state.isStreaming);
+        loadConversations();
+        if (!wasStreaming && state.activeConversationId) {
+          await streamConversationEvents(state.activeConversationId, { liveOnly: true });
+        }
+        if (!wasStreaming) {
+          setStreaming(false);
+          renderMessages(state.activeMessages, false);
         }
       });
 
@@ -4443,7 +4591,7 @@ var getWebUiClientScript = (markedSource2) => `
 `;
 
 // src/web-ui-store.ts
-import { createHash, randomUUID, timingSafeEqual } from "crypto";
+import { createHash, createHmac, randomUUID, timingSafeEqual } from "crypto";
 import { mkdir, readFile, writeFile } from "fs/promises";
 import { basename, dirname, resolve } from "path";
 import { homedir } from "os";
@@ -4451,9 +4599,13 @@ var DEFAULT_OWNER = "local-owner";
 var SessionStore = class {
   sessions = /* @__PURE__ */ new Map();
   ttlMs;
+  signingKey;
   constructor(ttlMs = 1e3 * 60 * 60 * 8) {
     this.ttlMs = ttlMs;
   }
+  setSigningKey(key) {
+    if (key) this.signingKey = key;
+  }
   create(ownerId = DEFAULT_OWNER) {
     const now = Date.now();
     const session = {
@@ -4482,6 +4634,57 @@ var SessionStore = class {
   delete(sessionId) {
     this.sessions.delete(sessionId);
   }
+  /**
+   * Encode a session into a signed cookie value that survives serverless
+   * cold starts. Format: `base64url(payload).signature`
+   */
+  signSession(session) {
+    if (!this.signingKey) return void 0;
+    const payload = Buffer.from(
+      JSON.stringify({
+        sid: session.sessionId,
+        o: session.ownerId,
+        csrf: session.csrfToken,
+        exp: session.expiresAt
+      })
+    ).toString("base64url");
+    const sig = createHmac("sha256", this.signingKey).update(payload).digest("base64url");
+    return `${payload}.${sig}`;
+  }
+  /**
+   * Restore a session from a signed cookie value. Returns the session
+   * (also added to the in-memory store) or undefined if invalid/expired.
+   */
+  restoreFromSigned(cookieValue) {
+    if (!this.signingKey) return void 0;
+    const dotIdx = cookieValue.lastIndexOf(".");
+    if (dotIdx <= 0) return void 0;
+    const payload = cookieValue.slice(0, dotIdx);
+    const sig = cookieValue.slice(dotIdx + 1);
+    const expected = createHmac("sha256", this.signingKey).update(payload).digest("base64url");
+    if (sig.length !== expected.length) return void 0;
+    if (!timingSafeEqual(Buffer.from(sig, "utf8"), Buffer.from(expected, "utf8")))
+      return void 0;
+    try {
+      const data = JSON.parse(
+        Buffer.from(payload, "base64url").toString("utf8")
+      );
+      if (!data.sid || !data.o || !data.csrf || !data.exp) return void 0;
+      if (Date.now() > data.exp) return void 0;
+      const session = {
+        sessionId: data.sid,
+        ownerId: data.o,
+        csrfToken: data.csrf,
+        createdAt: data.exp - this.ttlMs,
+        expiresAt: data.exp,
+        lastSeenAt: Date.now()
+      };
+      this.sessions.set(session.sessionId, session);
+      return session;
+    } catch {
+      return void 0;
+    }
+  }
 };
 var LoginRateLimiter = class {
   constructor(maxAttempts = 5, windowMs = 1e3 * 60 * 5, lockoutMs = 1e3 * 60 * 10) {
@@ -4698,9 +4901,12 @@ ${WEB_UI_STYLES}
 
   <div id="app" class="shell hidden">
     <aside class="sidebar">
-      <button id="new-chat" class="new-chat-btn">
-        <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 5v14M5 12h14"/></svg>
-      </button>
+      <div class="sidebar-header">
+        <span class="sidebar-agent-name">${agentName}</span>
+        <button id="new-chat" class="new-chat-btn">
+          <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 5v14M5 12h14"/></svg>
+        </button>
+      </div>
       <div id="conversation-list" class="conversation-list"></div>
       <div class="sidebar-footer">
         <button id="logout" class="logout-btn">Log out</button>
@@ -6305,11 +6511,17 @@ export default {
   ],
   // Tool access: true (available), false (disabled), 'approval' (requires human approval)
   tools: {
+    list_directory: true,
+    read_file: true,
     write_file: true,           // gated by environment for writes
+    delete_file: 'approval',    // requires human approval
+    delete_directory: 'approval', // requires human approval
     send_email: 'approval',     // requires human approval
     byEnvironment: {
       production: {
         write_file: false,
+        delete_file: false,
+        delete_directory: false,
       },
       development: {
         send_email: true,       // skip approval in dev
@@ -6392,6 +6604,7 @@ Connect your agent to email so users can interact by sending emails:
    RESEND_API_KEY=re_...
    RESEND_WEBHOOK_SECRET=whsec_...
    RESEND_FROM=Agent <agent@yourdomain.com>
+   RESEND_REPLY_TO=support@yourdomain.com   # optional
    \`\`\`
 5. Add to \`poncho.config.js\`:
    \`\`\`javascript
@@ -7228,71 +7441,72 @@ var createRequestHandler = async (options) => {
         if (event.type === "tool:approval:checkpoint") {
           const cpConv = await conversationStore.get(childConversationId);
           if (cpConv) {
-            const cpData = {
-              approvalId: event.approvalId,
+            const allCpData = event.approvals.map((a) => ({
+              approvalId: a.approvalId,
               runId: latestRunId,
-              tool: event.tool,
-              toolCallId: event.toolCallId,
-              input: event.input,
+              tool: a.tool,
+              toolCallId: a.toolCallId,
+              input: a.input,
               checkpointMessages: [...historyMessages, ...event.checkpointMessages],
               baseMessageCount: 0,
               pendingToolCalls: event.pendingToolCalls
-            };
-            cpConv.pendingApprovals = [cpData];
+            }));
+            cpConv.pendingApprovals = allCpData;
             cpConv.updatedAt = Date.now();
             await conversationStore.update(cpConv);
-            const approved = await new Promise((resolve4) => {
-              pendingSubagentApprovals.set(event.approvalId, {
-                resolve: resolve4,
-                childHarness,
-                checkpoint: cpData,
-                childConversationId,
-                parentConversationId
-              });
+            const decidedApprovals = await new Promise((resolve4) => {
+              for (const cpData of allCpData) {
+                pendingSubagentApprovals.set(cpData.approvalId, {
+                  resolve: resolve4,
+                  childHarness,
+                  checkpoint: cpData,
+                  childConversationId,
+                  parentConversationId
+                });
+              }
             });
-            let toolResults;
-            if (approved) {
-              const toolContext = {
-                runId: cpData.runId,
-                agentId: identity.id,
-                step: 0,
-                workingDir,
-                parameters: {},
-                conversationId: childConversationId
-              };
-              const execResults = await childHarness.executeTools(
-                [{ id: cpData.toolCallId, name: cpData.tool, input: cpData.input }],
-                toolContext
-              );
-              toolResults = execResults.map((r) => ({
+            const checkpointRef = allCpData[0];
+            const toolContext = {
+              runId: checkpointRef.runId,
+              agentId: identity.id,
+              step: 0,
+              workingDir,
+              parameters: {},
+              conversationId: childConversationId
+            };
+            const approvalToolCallIds = new Set(decidedApprovals.map((a) => a.toolCallId));
+            const callsToExecute = [];
+            const deniedResults = [];
+            for (const a of decidedApprovals) {
+              if (a.decision === "approved" && a.toolCallId) {
+                callsToExecute.push({ id: a.toolCallId, name: a.tool, input: a.input });
+                const toolText = `- done \`${a.tool}\``;
+                toolTimeline.push(toolText);
+                currentTools.push(toolText);
+              } else if (a.toolCallId) {
+                deniedResults.push({ callId: a.toolCallId, toolName: a.tool, error: "Tool execution denied by user" });
+                const toolText = `- denied \`${a.tool}\``;
+                toolTimeline.push(toolText);
+                currentTools.push(toolText);
+              }
+            }
+            const pendingToolCalls = checkpointRef.pendingToolCalls ?? [];
+            for (const tc of pendingToolCalls) {
+              if (!approvalToolCallIds.has(tc.id)) {
+                callsToExecute.push(tc);
+              }
+            }
+            let toolResults = [...deniedResults];
+            if (callsToExecute.length > 0) {
+              const execResults = await childHarness.executeTools(callsToExecute, toolContext);
+              toolResults.push(...execResults.map((r) => ({
                 callId: r.callId,
                 toolName: r.tool,
                 result: r.output,
                 error: r.error
-              }));
-              const toolText = `- done \`${cpData.tool}\``;
-              toolTimeline.push(toolText);
-              currentTools.push(toolText);
-            } else {
-              toolResults = [{
-                callId: cpData.toolCallId,
-                toolName: cpData.tool,
-                error: "Tool execution denied by user"
-              }];
-              const toolText = `- denied \`${cpData.tool}\``;
-              toolTimeline.push(toolText);
-              currentTools.push(toolText);
-            }
-            broadcastEvent(
-              childConversationId,
-              approved ? { type: "tool:approval:granted", approvalId: event.approvalId } : { type: "tool:approval:denied", approvalId: event.approvalId }
-            );
-            const cpConv2 = await conversationStore.get(childConversationId);
-            if (cpConv2) {
-              cpConv2.pendingApprovals = [];
-              await conversationStore.update(cpConv2);
+              })));
             }
-            const resumeMessages = [...cpData.checkpointMessages];
+            const resumeMessages = [...checkpointRef.checkpointMessages];
             for await (const resumeEvent of childHarness.continueFromToolResult({
               messages: resumeMessages,
               toolResults,
@@ -7576,16 +7790,16 @@ var createRequestHandler = async (options) => {
         if (event.type === "tool:approval:checkpoint") {
           const conv = await conversationStore.get(conversationId);
           if (conv) {
-            conv.pendingApprovals = [{
-              approvalId: event.approvalId,
+            conv.pendingApprovals = event.approvals.map((a) => ({
+              approvalId: a.approvalId,
               runId: latestRunId,
-              tool: event.tool,
-              toolCallId: event.toolCallId,
-              input: event.input,
+              tool: a.tool,
+              toolCallId: a.toolCallId,
+              input: a.input,
               checkpointMessages: [...fullCheckpointMessages, ...event.checkpointMessages],
               baseMessageCount: 0,
               pendingToolCalls: event.pendingToolCalls
-            }];
+            }));
             conv.updatedAt = Date.now();
             await conversationStore.update(conv);
           }
@@ -7820,16 +8034,16 @@ var createRequestHandler = async (options) => {
           if (event.type === "tool:approval:checkpoint") {
             await updateConversation((c) => {
               c.messages = buildMessages();
-              c.pendingApprovals = [{
-                approvalId: event.approvalId,
+              c.pendingApprovals = event.approvals.map((a) => ({
+                approvalId: a.approvalId,
                 runId: latestRunId,
-                tool: event.tool,
-                toolCallId: event.toolCallId,
-                input: event.input,
+                tool: a.tool,
+                toolCallId: a.toolCallId,
+                input: a.input,
                 checkpointMessages: event.checkpointMessages,
                 baseMessageCount: historyMessages.length,
                 pendingToolCalls: event.pendingToolCalls
-              }];
+              }));
             });
             checkpointedRun = true;
           }
@@ -7898,9 +8112,9 @@ var createRequestHandler = async (options) => {
           waitUntil: waitUntilHook,
           ownerId: "local-owner"
         });
-        adapter.registerRoutes(messagingRouteRegistrar);
         try {
           await bridge.start();
+          adapter.registerRoutes(messagingRouteRegistrar);
           messagingBridges.push(bridge);
           console.log(`  Slack messaging enabled at /api/messaging/slack`);
         } catch (err) {
@@ -7913,6 +8127,7 @@ var createRequestHandler = async (options) => {
           apiKeyEnv: channelConfig.apiKeyEnv,
           webhookSecretEnv: channelConfig.webhookSecretEnv,
           fromEnv: channelConfig.fromEnv,
+          replyToEnv: channelConfig.replyToEnv,
           allowedSenders: channelConfig.allowedSenders,
           mode: channelConfig.mode,
           allowedRecipients: channelConfig.allowedRecipients,
@@ -7924,9 +8139,9 @@ var createRequestHandler = async (options) => {
           waitUntil: waitUntilHook,
           ownerId: "local-owner"
         });
-        adapter.registerRoutes(messagingRouteRegistrar);
         try {
           await bridge.start();
+          adapter.registerRoutes(messagingRouteRegistrar);
           messagingBridges.push(bridge);
           const adapterTools = adapter.getToolDefinitions?.() ?? [];
           if (adapterTools.length > 0) {
@@ -7948,6 +8163,9 @@ var createRequestHandler = async (options) => {
   const authToken = process.env[authTokenEnv] ?? "";
   const authRequired = config?.auth?.required ?? false;
   const requireAuth = authRequired && authToken.length > 0;
+  if (requireAuth) {
+    sessionStore.setSigningKey(authToken);
+  }
   const webUiEnabled = config?.webUi !== false;
   const isProduction = resolveHarnessEnvironment() === "production";
   const secureCookies = isProduction;
@@ -8021,8 +8239,8 @@ var createRequestHandler = async (options) => {
       }
     }
     const cookies = parseCookies(request);
-    const sessionId = cookies.poncho_session;
-    const session = sessionId ? sessionStore.get(sessionId) : void 0;
+    const cookieValue = cookies.poncho_session;
+    const session = cookieValue ? sessionStore.get(cookieValue) ?? sessionStore.restoreFromSigned(cookieValue) : void 0;
     const ownerId = session?.ownerId ?? "local-owner";
     const requiresCsrfValidation = request.method !== "GET" && request.method !== "HEAD" && request.method !== "OPTIONS";
     if (pathname === "/api/auth/session" && request.method === "GET") {
@@ -8070,7 +8288,8 @@ var createRequestHandler = async (options) => {
       }
       loginRateLimiter.registerSuccess(ip);
       const createdSession = sessionStore.create(ownerId);
-      setCookie(response, "poncho_session", createdSession.sessionId, {
+      const signedValue = sessionStore.signSession(createdSession);
+      setCookie(response, "poncho_session", signedValue ?? createdSession.sessionId, {
         httpOnly: true,
         secure: secureCookies,
         sameSite: "Lax",
@@ -8265,13 +8484,26 @@ data: ${JSON.stringify(data)}
       const approved = body.approved === true;
       const pendingSubagent = pendingSubagentApprovals.get(approvalId);
       if (pendingSubagent) {
-        pendingSubagentApprovals.delete(approvalId);
+        pendingSubagent.checkpoint.decision = approved ? "approved" : "denied";
+        broadcastEvent(
+          pendingSubagent.childConversationId,
+          approved ? { type: "tool:approval:granted", approvalId } : { type: "tool:approval:denied", approvalId }
+        );
         const childConv = await conversationStore.get(pendingSubagent.childConversationId);
-        if (childConv && Array.isArray(childConv.pendingApprovals)) {
-          childConv.pendingApprovals = childConv.pendingApprovals.filter((pa) => pa.approvalId !== approvalId);
+        const allApprovals2 = childConv?.pendingApprovals ?? [];
+        const allDecided2 = allApprovals2.length > 0 && allApprovals2.every((pa) => pa.decision != null);
+        if (allDecided2) {
+          for (const pa of allApprovals2) {
+            pendingSubagentApprovals.delete(pa.approvalId);
+          }
+          if (childConv) {
+            childConv.pendingApprovals = [];
+            await conversationStore.update(childConv);
+          }
+          pendingSubagent.resolve(allApprovals2);
+        } else if (childConv) {
           await conversationStore.update(childConv);
         }
-        pendingSubagent.resolve(approved);
         writeJson(response, 200, { ok: true, approvalId, approved });
         return;
       }
@@ -8304,47 +8536,63 @@ data: ${JSON.stringify(data)}
         });
         return;
       }
-      foundConversation.pendingApprovals = (foundConversation.pendingApprovals ?? []).filter((a) => a.approvalId !== approvalId);
-      await conversationStore.update(foundConversation);
+      foundApproval.decision = approved ? "approved" : "denied";
       broadcastEvent(
         conversationId,
         approved ? { type: "tool:approval:granted", approvalId } : { type: "tool:approval:denied", approvalId }
       );
+      const allApprovals = foundConversation.pendingApprovals ?? [];
+      const allDecided = allApprovals.length > 0 && allApprovals.every((a) => a.decision != null);
+      if (!allDecided) {
+        await conversationStore.update(foundConversation);
+        writeJson(response, 200, { ok: true, approvalId, approved, batchComplete: false });
+        return;
+      }
+      foundConversation.pendingApprovals = [];
+      await conversationStore.update(foundConversation);
+      const checkpointRef = allApprovals[0];
       void (async () => {
-        let toolResults;
-        if (approved) {
-          const toolContext = {
-            runId: foundApproval.runId,
-            agentId: identity.id,
-            step: 0,
-            workingDir,
-            parameters: {}
-          };
-          const execResults = await harness.executeTools(
-            [{ id: foundApproval.toolCallId, name: foundApproval.tool, input: foundApproval.input }],
-            toolContext
-          );
-          toolResults = execResults.map((r) => ({
+        const toolContext = {
+          runId: checkpointRef.runId,
+          agentId: identity.id,
+          step: 0,
+          workingDir,
+          parameters: {}
+        };
+        const approvalToolCallIds = new Set(allApprovals.map((a) => a.toolCallId));
+        const callsToExecute = [];
+        const deniedResults = [];
+        for (const a of allApprovals) {
+          if (a.decision === "approved" && a.toolCallId) {
+            callsToExecute.push({ id: a.toolCallId, name: a.tool, input: a.input });
+          } else if (a.decision === "denied" && a.toolCallId) {
+            deniedResults.push({ callId: a.toolCallId, toolName: a.tool, error: "Tool execution denied by user" });
+          }
+        }
+        const pendingToolCalls = checkpointRef.pendingToolCalls ?? [];
+        for (const tc of pendingToolCalls) {
+          if (!approvalToolCallIds.has(tc.id)) {
+            callsToExecute.push(tc);
+          }
+        }
+        let toolResults = [...deniedResults];
+        if (callsToExecute.length > 0) {
+          const execResults = await harness.executeTools(callsToExecute, toolContext);
+          toolResults.push(...execResults.map((r) => ({
             callId: r.callId,
             toolName: r.tool,
             result: r.output,
             error: r.error
-          }));
-        } else {
-          toolResults = [{
-            callId: foundApproval.toolCallId,
-            toolName: foundApproval.tool,
-            error: "Tool execution denied by user"
-          }];
+          })));
         }
         await resumeRunFromCheckpoint(
           conversationId,
           foundConversation,
-          foundApproval,
+          checkpointRef,
           toolResults
         );
       })();
-      writeJson(response, 200, { ok: true, approvalId, approved });
+      writeJson(response, 200, { ok: true, approvalId, approved, batchComplete: true });
       return;
     }
     const conversationEventsMatch = pathname.match(
@@ -8828,16 +9076,16 @@ data: ${JSON.stringify(data)}
                 metadata: toolTimeline.length > 0 || checkpointSections.length > 0 ? { toolActivity: [...toolTimeline], sections: checkpointSections.length > 0 ? checkpointSections : void 0 } : void 0
               }] : []
             ];
-            conversation.pendingApprovals = [{
-              approvalId: event.approvalId,
+            conversation.pendingApprovals = event.approvals.map((a) => ({
+              approvalId: a.approvalId,
               runId: latestRunId,
-              tool: event.tool,
-              toolCallId: event.toolCallId,
-              input: event.input,
+              tool: a.tool,
+              toolCallId: a.toolCallId,
+              input: a.input,
               checkpointMessages: event.checkpointMessages,
               baseMessageCount: historyMessages.length,
               pendingToolCalls: event.pendingToolCalls
-            }];
+            }));
             conversation.updatedAt = Date.now();
             await conversationStore.update(conversation);
             checkpointedRun = true;
@@ -9372,7 +9620,7 @@ var runInteractive = async (workingDir, params) => {
   await harness.initialize();
   const identity = await ensureAgentIdentity2(workingDir);
   try {
-    const { runInteractiveInk } = await import("./run-interactive-ink-VSO7GB3Y.js");
+    const { runInteractiveInk } = await import("./run-interactive-ink-4KVVPMR3.js");
     await runInteractiveInk({
       harness,
       params,