@robota-sdk/agent-ui-terminal 3.0.0-beta.83 → 3.0.0-beta.84

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@robota-sdk/agent-ui-terminal",
-  "version": "3.0.0-beta.83",
+  "version": "3.0.0-beta.84",
   "description": "Terminal UI package (React + Ink) for the Robota SDK",
   "type": "module",
   "main": "dist/node/index.js",
@@ -25,9 +25,10 @@
   },
   "repository": {
     "type": "git",
-    "url": "https://github.com/woojubb/robota.git"
+    "url": "https://github.com/woojubb/robota.git",
+    "directory": "packages/agent-ui-terminal"
   },
-  "homepage": "https://robota.io/",
+  "homepage": "https://docs.robota.io/en/packages/agent-ui-terminal/",
   "bugs": {
     "url": "https://github.com/woojubb/robota/issues"
   },
@@ -46,15 +47,15 @@
     "marked-terminal": "^7.3.0",
     "react": "19.2.8",
     "string-width": "^8.2.2",
-    "@robota-sdk/agent-core": "3.0.0-beta.83",
-    "@robota-sdk/agent-framework": "3.0.0-beta.83",
-    "@robota-sdk/agent-interface-analytics": "3.0.0-beta.83",
-    "@robota-sdk/agent-interface-command": "3.0.0-beta.83",
-    "@robota-sdk/agent-interface-execution": "3.0.0-beta.83",
-    "@robota-sdk/agent-interface-session": "3.0.0-beta.83",
-    "@robota-sdk/agent-interface-transport": "3.0.0-beta.83",
-    "@robota-sdk/agent-transport": "3.0.0-beta.83",
-    "@robota-sdk/agent-interface-tui": "3.0.0-beta.83"
+    "@robota-sdk/agent-core": "3.0.0-beta.84",
+    "@robota-sdk/agent-framework": "3.0.0-beta.84",
+    "@robota-sdk/agent-interface-analytics": "3.0.0-beta.84",
+    "@robota-sdk/agent-interface-command": "3.0.0-beta.84",
+    "@robota-sdk/agent-interface-execution": "3.0.0-beta.84",
+    "@robota-sdk/agent-interface-session": "3.0.0-beta.84",
+    "@robota-sdk/agent-interface-transport": "3.0.0-beta.84",
+    "@robota-sdk/agent-interface-tui": "3.0.0-beta.84",
+    "@robota-sdk/agent-transport": "3.0.0-beta.84"
   },
   "devDependencies": {
     "@homebridge/node-pty-prebuilt-multiarch": "^0.14.1",
@@ -65,7 +66,7 @@
     "tsx": "^4.23.1",
     "typescript": "^6.0.3",
     "vitest": "^3.2.6",
-    "@robota-sdk/agent-command": "3.0.0-beta.83"
+    "@robota-sdk/agent-command": "3.0.0-beta.84"
   },
   "license": "AGPL-3.0-only OR LicenseRef-Commercial",
   "publishConfig": {

package/src/PermissionPrompt.tsx

@@ -153,11 +153,19 @@ export default function PermissionPrompt({
     ['confirm', 'Confirm'],
   ]);
 
+  // Issue #3288 §1: a background agent's own request, read out/shown before the tool name.
+  const backgroundAgentLabel =
+    request.requester?.kind === 'background-agent' ? request.requester.label : undefined;
+
   if (screenReader) {
     return (
       <NumberedList
         title={SCREEN_READER_LABELS.permissionRequired}
-        description={`${request.toolName} — ${formatArgs(request.toolArgs)}${
+        description={`${
+          backgroundAgentLabel !== undefined
+            ? `Background agent ${backgroundAgentLabel} wants to run `
+            : ''
+        }${request.toolName} — ${formatArgs(request.toolArgs)}${
           request.requestedByPeer !== undefined
             ? ` (requested by another session: ${request.requestedByPeer})`
             : ''
@@ -182,12 +190,21 @@ export default function PermissionPrompt({
         </Text>
         {armed ? null : <Text dimColor> keys answer in a moment</Text>}
       </Box>
-      <Text>
-        Tool:{' '}
-        <Text color={palette.text.accent} bold>
-          {request.toolName}
+      {backgroundAgentLabel !== undefined ? (
+        <Text color={palette.text.warning}>
+          Background agent <Text bold>{backgroundAgentLabel}</Text> wants to run{' '}
+          <Text color={palette.text.accent} bold>
+            {request.toolName}
+          </Text>
+        </Text>
+      ) : (
+        <Text>
+          Tool:{' '}
+          <Text color={palette.text.accent} bold>
+            {request.toolName}
+          </Text>
         </Text>
-      </Text>
+      )}
       <Text dimColor> {formatArgs(request.toolArgs)}</Text>
       {request.requestedByPeer !== undefined ? (
         <Text color={palette.text.warning}>

package/src/SupervisedSessionView.tsx

@@ -49,13 +49,28 @@ const ROLE: Readonly<Record<ISupervisedAttachRequest['mode'], string>> = {
   observe: 'observe (read only)',
 };
 
+/**
+ * How a new session starts in a folder that is not trusted: trusted first (`trust` records the grant),
+ * or `restricted`, without the project's own configuration. A person chose it in the view.
+ */
+export type TSupervisedStartTrustChoice = 'trust' | 'restricted';
+
+/** What the person is asked about: the folder a new session would start in, and what trust loads. */
+export interface ISupervisedStartTrustQuestion {
+  readonly folder: string;
+  /** What trusting it would load, one line each. */
+  readonly loads: readonly string[];
+}
+
 export interface ISupervisedSessionViewProps {
   readonly loadRows: (signal: AbortSignal) => Promise<readonly ISupervisedViewRow[]>;
   /** Called once the user confirmed; the view then closes so the host can attach this terminal. */
   readonly onAttach?: (request: ISupervisedAttachRequest) => void;
   /** Receives the generation the row displayed, so a session restarted under the same id is refused. */
   readonly onStop?: (id: string, generation: string) => Promise<void>;
-  readonly onStart?: () => Promise<string>;
+  readonly onStart?: (choice?: TSupervisedStartTrustChoice) => Promise<string>;
+  /** The question to ask when the folder a new session starts in is not trusted yet; none otherwise. */
+  readonly startTrustQuestion?: () => Promise<ISupervisedStartTrustQuestion | undefined>;
   readonly onOpenPr?: (id: string, url: string, generation: string) => Promise<void>;
   readonly filteredByCwd?: boolean;
   readonly filteredByName?: boolean;
@@ -68,6 +83,17 @@ export interface ISupervisedSessionViewProps {
 }
 
 const GROUP_ORDER = ['needs-input', 'working', 'idle', 'unknown', 'unverified', 'dead'] as const;
+
+const TRUST_CHOICES = 'y Trust and start / r Start Restricted / n Cancel';
+const TRUST_SUMMARY =
+  "Trusting it loads the project's own settings, hooks, plugins, skills and MCP servers:";
+
+/** `lines` in at most `room` lines, the last one saying how many more there are. */
+function fitLines(lines: readonly string[], room: number): readonly string[] {
+  if (lines.length <= room) return lines;
+  const shown = Math.max(1, room - 1);
+  return [...lines.slice(0, shown), `… ${lines.length - shown} more — see robota trust status`];
+}
 type TGroup = (typeof GROUP_ORDER)[number];
 type TDisplayLine =
   | { readonly kind: 'group'; readonly label: string }
@@ -200,6 +226,7 @@ export default function SupervisedSessionView({
   loadRows,
   onStop,
   onStart,
+  startTrustQuestion,
   onOpenPr,
   onAttach,
   filteredByCwd = false,
@@ -241,12 +268,32 @@ export default function SupervisedSessionView({
     'idle',
   );
   const [lastStartedId, setLastStartedId] = useState<string | undefined>();
+  const [trustQuestion, setTrustQuestion] = useState<ISupervisedStartTrustQuestion | undefined>();
   const startingRef = useRef(false);
   const [prOpenStatus, setPrOpenStatus] = useState<
     'idle' | 'opening' | 'opened' | 'failed' | 'unavailable'
   >('idle');
   const openingPrRef = useRef(false);
   const mountedRef = useRef(true);
+  const runStart = (choice?: TSupervisedStartTrustChoice): void => {
+    if (onStart === undefined) return;
+    startingRef.current = true;
+    setStartStatus('starting');
+    void Promise.resolve()
+      .then(() => onStart(choice))
+      .then((id) => {
+        if (!mountedRef.current) return;
+        setLastStartedId(id);
+        setStartStatus('started');
+      })
+      .catch(() => {
+        // A launch error can carry private paths, so the view shows none of it.
+        if (mountedRef.current) setStartStatus('failed');
+      })
+      .finally(() => {
+        startingRef.current = false;
+      });
+  };
   const ordered = useMemo(() => {
     const filtered = rows.filter(
       (row) => stateFilter === undefined || groupOf(row) === stateFilter,
@@ -362,6 +409,15 @@ export default function SupervisedSessionView({
       !(key.ctrl && input === 'c')
     )
       return;
+    if (trustQuestion !== undefined) {
+      if (input === 'y' || input === 'r') {
+        setTrustQuestion(undefined);
+        runStart(input === 'y' ? 'trust' : 'restricted');
+      } else if (input === 'n' || key.escape) {
+        setTrustQuestion(undefined);
+      }
+      return;
+    }
     if (confirmStopId !== undefined) {
       if (input === 'n' || key.escape) {
         setConfirmStop(undefined);
@@ -431,20 +487,22 @@ export default function SupervisedSessionView({
       return;
     }
     if (input === 'n' && onStart !== undefined) {
+      if (startTrustQuestion === undefined) {
+        runStart();
+        return;
+      }
+      // A folder not trusted yet is asked about first: the person chooses trust or Restricted.
       startingRef.current = true;
-      setStartStatus('starting');
-      void Promise.resolve()
-        .then(onStart)
-        .then((id) => {
+      void startTrustQuestion()
+        .then((question) => {
+          startingRef.current = false;
           if (!mountedRef.current) return;
-          setLastStartedId(id);
-          setStartStatus('started');
+          if (question !== undefined) setTrustQuestion(question);
+          else runStart();
         })
         .catch(() => {
-          if (mountedRef.current) setStartStatus('failed');
-        })
-        .finally(() => {
           startingRef.current = false;
+          if (mountedRef.current) setStartStatus('failed');
         });
       return;
     }
@@ -507,7 +565,11 @@ export default function SupervisedSessionView({
   });
 
   const numbered = useNumberedSelection({
-    enabled: screenReader && confirmStopId === undefined && stopStatus !== 'stopping',
+    enabled:
+      screenReader &&
+      confirmStopId === undefined &&
+      trustQuestion === undefined &&
+      stopStatus !== 'stopping',
     itemCount: ordered.length,
     cancellable: true,
     repeatable: true,
@@ -565,6 +627,7 @@ export default function SupervisedSessionView({
     (selectedLoopStatus ? 1 : 0) +
     (prOpenStatus === 'idle' ? 0 : 1) +
     (startStatus === 'idle' ? 0 : 1) +
+    (trustQuestion === undefined ? 0 : 1) +
     (confirmStopId !== undefined ? (screenReader ? 1 : 2) : stopStatus !== 'idle' ? 1 : 0) +
     (confirmStopId === undefined && attachStatus !== 'idle' ? 1 : 0) +
     1 +
@@ -580,12 +643,23 @@ export default function SupervisedSessionView({
     Math.max(0, displayLines.length - viewport),
   );
   const visible = screenReader ? displayLines : displayLines.slice(start, start + viewport);
+  // While the trust question is open it takes the rows' place, fitted to the rows' height, so the
+  // folder it names and the choices always show whole.
+  const questionLines =
+    trustQuestion === undefined
+      ? []
+      : fitLines(
+          [`Not trusted: ${trustQuestion.folder}`, TRUST_SUMMARY, ...trustQuestion.loads],
+          screenReader ? Number.POSITIVE_INFINITY : viewport,
+        );
   const chromeWrap = screenReader ? {} : { wrap: 'truncate-end' as const };
   // Attach and peek are offered only for a row this terminal could actually attach to.
   const attachable = onAttach !== undefined && status === 'ready' && isControllable(selectedRow);
   const footer =
     stopStatus === 'stopping'
       ? 'Stop in progress; wait for result.'
+      : trustQuestion !== undefined
+        ? 'Answer the trust question or cancel before closing.'
       : confirmStopId !== undefined
         ? `Confirm ${confirmStop?.action === 'attach' ? 'attach' : 'stop'} or cancel before closing.`
         : screenReader
@@ -617,8 +691,15 @@ export default function SupervisedSessionView({
       {status === 'ready' && ordered.length === 0 && (
         <Text {...chromeWrap}>No supervised sessions.</Text>
       )}
-      {start > 0 && !screenReader && <Text>{start} more above</Text>}
-      {visible.map((line) =>
+      {questionLines.map((line, index) => (
+        <Text key={`trust-${index}`} {...chromeWrap}>
+          {line}
+        </Text>
+      ))}
+      {trustQuestion === undefined && start > 0 && !screenReader && (
+        <Text>{start} more above</Text>
+      )}
+      {(trustQuestion === undefined ? visible : []).map((line) =>
         line.kind === 'group' ? (
           <Text key={`group-${line.label}`} {...chromeWrap}>
             {line.label}
@@ -652,9 +733,11 @@ export default function SupervisedSessionView({
           </Text>
         ),
       )}
-      {!screenReader && start + visible.length < displayLines.length && (
-        <Text>{displayLines.length - start - visible.length} more below</Text>
-      )}
+      {trustQuestion === undefined &&
+        !screenReader &&
+        start + visible.length < displayLines.length && (
+          <Text>{displayLines.length - start - visible.length} more below</Text>
+        )}
       {selectedId !== undefined && <Text {...chromeWrap}>Selected {selectedId}</Text>}
       {selectedName !== undefined && <Text {...chromeWrap}>Name: {selectedName}</Text>}
       {selectedPr !== undefined && (
@@ -685,6 +768,7 @@ export default function SupervisedSessionView({
           Start failed; check workspace trust or run session start --background for details.
         </Text>
       )}
+      {trustQuestion !== undefined && <Text {...chromeWrap}>{TRUST_CHOICES}</Text>}
       {confirmStopId !== undefined &&
         (screenReader ? (
           <Text>{confirmQuestion(confirmStopId)} y Yes / n No</Text>
@@ -751,6 +835,7 @@ export async function renderSupervisedSessionView(
         loadRows={options.loadRows}
         onStop={options.onStop}
         onStart={options.onStart}
+        startTrustQuestion={options.startTrustQuestion}
         onOpenPr={options.onOpenPr}
         onAttach={(request) => {
           attach = request;

package/src/TuiInteractionChannel.ts

@@ -100,13 +100,21 @@ export class TuiInteractionChannel implements ITuiAppChannelPort {
       session: this.interactiveSession,
       manager: this.stateManager,
       ...(this.attention ? { attention: this.attention } : {}),
-      requestPermission: (toolName, toolArgs, id, canPersistProjectPermission, requestedByPeer) =>
+      requestPermission: (
+        toolName,
+        toolArgs,
+        id,
+        canPersistProjectPermission,
+        requestedByPeer,
+        requester,
+      ) =>
         this.permissions.enqueue(
           toolName,
           toolArgs,
           id,
           canPersistProjectPermission,
           requestedByPeer,
+          requester,
         ),
       askUser: (request, id) => this.askUser(request, id),
       dismissPrompt: (id) => this.dismissPromptById(id),

package/src/__tests__/SupervisedSessionView.test.tsx

@@ -26,6 +26,11 @@ const THIRD: ISupervisedViewRow = {
   generation: 'thirdGenerationValue01',
 };
 
+const QUESTION = {
+  folder: '/work/repo',
+  loads: ['Project sources (metadata only; content not read):', '  [file] .robota/settings.json — settings'],
+};
+
 describe('supervised session view', () => {
   it('shows a linked PR only while verified and opens it only on explicit keypress', async () => {
     const url = 'https://github.com/team/repo/pull/123';
@@ -383,6 +388,109 @@ describe('supervised session view', () => {
     }
   });
 
+  it('asks about a folder not trusted yet, and starts as the answer says (#3268)', async () => {
+    const start = vi.fn(async () => SECOND.id);
+    const view = render(
+      <SupervisedSessionView
+        loadRows={async () => [FIRST]}
+        onStart={start}
+        startTrustQuestion={async () => QUESTION}
+      />,
+    );
+    try {
+      await vi.waitFor(() => expect(view.lastFrame()).toContain(`Selected ${FIRST.id}`));
+      view.stdin.write('n');
+      await vi.waitFor(() => expect(view.lastFrame()).toContain('r Start Restricted'));
+      // It names the folder and what trusting it would load.
+      expect(view.lastFrame()).toContain('Not trusted: /work/repo');
+      expect(view.lastFrame()).toContain('.robota/settings.json');
+      expect(start).not.toHaveBeenCalled();
+      // n cancels: nothing starts.
+      view.stdin.write('n');
+      await vi.waitFor(() => expect(view.lastFrame()).not.toContain('r Start Restricted'));
+      expect(start).not.toHaveBeenCalled();
+      view.stdin.write('n');
+      await vi.waitFor(() => expect(view.lastFrame()).toContain('r Start Restricted'));
+      view.stdin.write('r');
+      await vi.waitFor(() => expect(start).toHaveBeenLastCalledWith('restricted'));
+      await vi.waitFor(() => expect(view.lastFrame()).toContain(`Started ${SECOND.id}`));
+      view.stdin.write('n');
+      await vi.waitFor(() => expect(view.lastFrame()).toContain('r Start Restricted'));
+      view.stdin.write('y');
+      await vi.waitFor(() => expect(start).toHaveBeenLastCalledWith('trust'));
+    } finally {
+      view.unmount();
+    }
+  });
+
+  it('fits a long trust question in a 24-row terminal, the folder and the choices whole', async () => {
+    const loads = Array.from({ length: 32 }, (_, index) => `  [absent] source-${index} — a source`);
+    const view = render(
+      <SupervisedSessionView
+        loadRows={async () => [FIRST]}
+        onStart={async () => SECOND.id}
+        startTrustQuestion={async () => ({ folder: '/work/repo', loads })}
+      />,
+    );
+    try {
+      await vi.waitFor(() => expect(view.lastFrame()).toContain(`Selected ${FIRST.id}`));
+      view.stdin.write('n');
+      await vi.waitFor(() => expect(view.lastFrame()).toContain('r Start Restricted'));
+      const frame = view.lastFrame() ?? '';
+      const lines = frame.split('\n');
+      expect(lines.length).toBeLessThanOrEqual(24);
+      expect(lines).toContain('Not trusted: /work/repo');
+      expect(lines).toContain('y Trust and start / r Start Restricted / n Cancel');
+      expect(frame).toMatch(/… \d+ more — see robota trust status/);
+      expect(frame).toContain('source-0 — a source');
+    } finally {
+      view.unmount();
+    }
+  });
+
+  it('cancels the trust question on Escape in screen-reader mode, and keeps the view open', async () => {
+    const start = vi.fn(async () => SECOND.id);
+    const view = render(
+      <ScreenReaderProvider enabled>
+        <SupervisedSessionView
+          loadRows={async () => [FIRST]}
+          onStart={start}
+          startTrustQuestion={async () => QUESTION}
+        />
+      </ScreenReaderProvider>,
+    );
+    try {
+      await vi.waitFor(() => expect(view.lastFrame()).toContain(FIRST.id));
+      view.stdin.write('n');
+      await vi.waitFor(() => expect(view.lastFrame()).toContain('r Start Restricted'));
+      view.stdin.write('\u001b');
+      await vi.waitFor(() => expect(view.lastFrame()).not.toContain('r Start Restricted'));
+      expect(view.lastFrame()).toContain(FIRST.id);
+      expect(start).not.toHaveBeenCalled();
+    } finally {
+      view.unmount();
+    }
+  });
+
+  it('starts at once where the folder needs no answer', async () => {
+    const start = vi.fn(async () => SECOND.id);
+    const view = render(
+      <SupervisedSessionView
+        loadRows={async () => [FIRST]}
+        onStart={start}
+        startTrustQuestion={async () => undefined}
+      />,
+    );
+    try {
+      await vi.waitFor(() => expect(view.lastFrame()).toContain(`Selected ${FIRST.id}`));
+      view.stdin.write('n');
+      await vi.waitFor(() => expect(start).toHaveBeenCalledExactlyOnceWith(undefined));
+      expect(view.lastFrame()).not.toContain('r Start Restricted');
+    } finally {
+      view.unmount();
+    }
+  });
+
   it('keeps stop cancellation separate from starting a session', async () => {
     const start = vi.fn(async () => SECOND.id);
     const view = render(

package/src/__tests__/helpers/terminal-profiles.ts

@@ -1,7 +1,7 @@
 /**
- * CLI-062 — the terminal matrix, as data.
+ * The terminal matrix, as data.
  *
- * The backlog item's remaining work was a *manual* matrix ("iTerm2 + Terminal.app
+ * Checking IME cursor placement across terminals was a *manual* matrix ("iTerm2 + Terminal.app
  * ±ROBOTA_IME_CURSOR, kitty/WezTerm/Ghostty/Windows Terminal/tmux on real hardware"). This module
  * converts it into something a machine re-runs: each row is the environment handshake a terminal
  * emulator hands the program it launches, which is the ONLY channel through which the emulator's
@@ -22,7 +22,7 @@
 export type TerminalProvenance = 'measured' | 'documented';
 
 export interface ITerminalProfile {
-  /** Stable id used in test names and in the backlog matrix table. */
+  /** Stable id used to look a profile up. */
   id: string;
   /** Human label for the matrix. */
   label: string;
@@ -144,7 +144,7 @@ export function profileEnv(
   };
 }
 
-/** Matrix label used in test names and in the backlog's evidence table. */
+/** Matrix label used in test names. */
 export function cellLabel(profile: ITerminalProfile, override: string | undefined): string {
   const setting =
     override === undefined ? 'ROBOTA_IME_CURSOR unset' : `ROBOTA_IME_CURSOR=${override}`;

package/src/__tests__/permission-prompt-requester.test.tsx

@@ -0,0 +1,34 @@
+import React from 'react';
+import { render } from 'ink-testing-library';
+import { describe, expect, it } from 'vitest';
+
+import PermissionPrompt from '../PermissionPrompt.js';
+
+describe('issue #3288 §1: a background agent names itself on its own permission request', () => {
+  it('says which background agent is asking, instead of an unattributed prompt', () => {
+    const frame = render(
+      <PermissionPrompt
+        request={{
+          toolName: 'Glob',
+          toolArgs: { pattern: '**/*' },
+          requester: { kind: 'background-agent', label: 'general-purpose', taskId: 'agent_1' },
+          resolve: () => {},
+        }}
+      />,
+    ).lastFrame();
+
+    expect(frame).toContain('Background agent');
+    expect(frame).toContain('general-purpose');
+    expect(frame).toContain('Glob');
+  });
+
+  it('reads as an ordinary ask when no requester is present', () => {
+    const frame = render(
+      <PermissionPrompt
+        request={{ toolName: 'Bash', toolArgs: { command: 'ls' }, resolve: () => {} }}
+      />,
+    ).lastFrame();
+
+    expect(frame).not.toContain('Background agent');
+  });
+});

package/src/__tests__/pty/behavior-2437-git.ptytest.ts

@@ -224,6 +224,14 @@ async function expectCommitOnYes(session: IPtySession): Promise<void> {
   await session.waitForSince(since, /Committed: \[main [0-9a-f]{7}\] feat: add greeting/, WAIT_MS);
 }
 
+/** The fixture repository is not trusted, so the TUI asks first (issue #3268); these scenarios run Restricted. */
+async function startRestricted(session: IPtySession): Promise<void> {
+  await session.waitFor(/Trust this folder\? \[y\/N\]/, WAIT_MS);
+  await session.sendKeys('n');
+  await session.pressEnter();
+  await session.waitFor(/Type a message or \/help/, WAIT_MS);
+}
+
 async function exitTui(session: IPtySession): Promise<number> {
   await run(session, '/exit');
   await session.waitFor(/Exit the session\?/, WAIT_MS);
@@ -251,7 +259,7 @@ describe('/git through the real binary (BEHAVIOR-2437 TC-07)', () => {
     async () => {
       fixture = makeFixture(true);
       session = spawnTui({ projectDir: fixture.repo, homeDir: fixture.home });
-      await session.waitFor(/Type a message or \/help/, WAIT_MS);
+      await startRestricted(session);
       await session.waitFor(/Idle/, WAIT_MS);
 
       await expectReadSteps(session);
@@ -272,7 +280,7 @@ describe('/git through the real binary (BEHAVIOR-2437 TC-07)', () => {
     async () => {
       fixture = makeFixture(true);
       session = spawnTui({ projectDir: fixture.repo, homeDir: fixture.home });
-      await session.waitFor(/Type a message or \/help/, WAIT_MS);
+      await startRestricted(session);
       await session.waitFor(/Idle/, WAIT_MS);
 
       await expectSubjectRefusal(session, fixture);
@@ -296,7 +304,7 @@ describe('/git through the real binary (BEHAVIOR-2437 TC-07)', () => {
     async () => {
       fixture = makeFixture(false);
       session = spawnTui({ projectDir: fixture.repo, homeDir: fixture.home });
-      await session.waitFor(/Type a message or \/help/, WAIT_MS);
+      await startRestricted(session);
       await session.waitFor(/Idle/, WAIT_MS);
 
       const since = await run(session, '/git commit feat: nothing to commit');