@scotthuang/agent-knock-knock 0.2.46 → 0.2.47

package/dist/src/cli.js

@@ -6,6 +6,10 @@ import path from "node:path";
 import process from "node:process";
 import { fileURLToPath } from "node:url";
 import { createCodexTerminalAgentAdapter, detectCodexDurableCompletion } from "./codex-terminal-agent-adapter.js";
+import { createClaudeTerminalAgentAdapter } from "./claude-terminal-agent-adapter.js";
+import { ClaudeHookStore, ClaudeHookStoreError, defaultClaudeHookStoreDir } from "./claude-hook-store.js";
+import { claudePermissionHookOutput } from "./claude-hook-protocol.js";
+import { defaultClaudeSettingsPath, installClaudeHooks, loadTrustedClaudeTokenjuiceLaunchers } from "./claude-hook-installer.js";
 import { CodexLocalSessionProvider } from "./codex-local-session-provider.js";
 import { CodexStoreAdapter } from "./codex-store-adapter.js";
 import { applyMessageToConversation, budgetAction, createConversation, createMessage, executorForConversation, extractStructuredMessage, parseMessageJson, resolveExecutor } from "./protocol.js";
@@ -26,6 +30,22 @@ const DEFAULT_AGENT_HARD_TIMEOUT_MINUTES = 720;
 const DEFAULT_MONITOR_POLL_INTERVAL_MS = 5000;
 const CALLBACK_RETRY_DELAYS_MS = [5000, 15000, 60000, 60000];
 const DEFAULT_CODEX_ACPX_AGENT_COMMAND = "npx -y @agentclientprotocol/codex-acp@^1.1.0";
+const CONVERSATION_STATUSES = new Set([
+    "created",
+    "running",
+    "waiting_for_agent",
+    "waiting_for_openclaw",
+    "idle",
+    "stalled",
+    "needs_recovery",
+    "needs_model_selection",
+    "callback_pending",
+    "callback_failed",
+    "failed",
+    "closed",
+    "cancelled",
+    "cancelling"
+]);
 class InlineCodexSessionAdapter {
     threads;
     processes;
@@ -127,6 +147,12 @@ async function runCommand(commandName, options) {
     else if (commandName === "install-openclaw") {
         runInstallOpenClaw(options);
     }
+    else if (commandName === "install-claude-hooks") {
+        runInstallClaudeHooks(options);
+    }
+    else if (commandName === "claude-hook") {
+        await runClaudeHook(options);
+    }
     else if (commandName === "doctor") {
         runDoctor(options);
     }
@@ -197,6 +223,88 @@ function runInstallOpenClaw(options) {
             : "Agent Knock Knock is installed. Try: AKK list"
     });
 }
+function runInstallClaudeHooks(options) {
+    const configuredExecutable = stringValue(options.executablePath ?? options.binPath);
+    let executablePath;
+    if (configuredExecutable) {
+        executablePath = path.resolve(expandHome(configuredExecutable));
+    }
+    else {
+        try {
+            executablePath = resolveExecutable("agent-knock-knock");
+        }
+        catch {
+            executablePath = path.resolve(process.argv[1]);
+        }
+    }
+    const result = installClaudeHooks({
+        executablePath,
+        settingsPath: expandHome(options.settingsPath ?? options.settings),
+        dryRun: options.dryRun === true
+    });
+    printJson({
+        installed: result.written || !result.changed,
+        ...result,
+        executablePath,
+        next: result.dryRun
+            ? "Run again without --dry-run to install the Claude Code hooks."
+            : "Claude Code hooks are configured. Existing sessions pick them up through settings reload; start a new session if needed."
+    });
+}
+async function runClaudeHook(options) {
+    const rawInput = fs.readFileSync(0, "utf8");
+    let input;
+    try {
+        input = JSON.parse(rawInput);
+    }
+    catch {
+        throw new Error("Claude hook input must be valid JSON");
+    }
+    const agentRows = loadClaudeAgentRows(options);
+    const claudePid = inferClaudeAncestorPid(agentRows);
+    const store = createClaudeHookStore(options);
+    const record = store.record(input, {
+        ...(claudePid === undefined ? {} : { claudePid })
+    });
+    if (record.event.input.hook_event_name !== "PermissionRequest" || !record.permission) {
+        return;
+    }
+    const permission = record.permission;
+    const requestedTimeout = options.permissionWaitTimeoutMs ?? options.timeoutMs;
+    const timeoutMs = requestedTimeout === undefined
+        ? undefined
+        : Math.max(0, Number(requestedTimeout));
+    try {
+        const decision = await store.waitForPermissionDecision({
+            sessionId: permission.sessionId,
+            requestId: permission.requestId,
+            fingerprint: permission.fingerprint,
+            conversationId: permission.conversationId,
+            messageId: permission.messageId,
+            ...(timeoutMs === undefined ? {} : { timeoutMs })
+        });
+        process.stdout.write(`${JSON.stringify(decision?.hookOutput ?? claudePermissionHookOutput({
+            behavior: "deny",
+            interrupt: false,
+            message: "Agent Knock Knock approval timed out. Review the request and retry the task."
+        }))}\n`);
+    }
+    catch (error) {
+        if (error instanceof ClaudeHookStoreError && [
+            "PERMISSION_EXPIRED",
+            "PERMISSION_CONSUMED",
+            "PERMISSION_ALREADY_DECIDED"
+        ].includes(error.code)) {
+            process.stdout.write(`${JSON.stringify(claudePermissionHookOutput({
+                behavior: "deny",
+                interrupt: false,
+                message: "Agent Knock Knock approval expired before a safe decision was received."
+            }))}\n`);
+            return;
+        }
+        throw error;
+    }
+}
 function installOpenClawPlugin(openclawBin, root) {
     const linked = spawnSync(openclawBin, ["plugins", "install", "--link", root], {
         encoding: "utf8",
@@ -575,9 +683,107 @@ function createTerminalProcessSource(options) {
     }
     return new SystemTerminalProcessSource();
 }
+function createClaudeHookStore(options = {}) {
+    const configuredRoot = stringValue(options.claudeHookStoreDir);
+    return new ClaudeHookStore({
+        rootDir: expandHome(configuredRoot ?? defaultClaudeHookStoreDir())
+    });
+}
+function loadClaudeAgentRows(options = {}) {
+    let value;
+    if (options.claudeAgentsJson !== undefined) {
+        value = typeof options.claudeAgentsJson === "string"
+            ? parseJsonOption(options.claudeAgentsJson, "--claude-agents-json")
+            : options.claudeAgentsJson;
+    }
+    else if (options.processesJson || options.terminalsJson || options.terminalScreensJson) {
+        return [];
+    }
+    else {
+        const claudeExecutable = resolveOptionalExecutable("claude");
+        if (!claudeExecutable) {
+            return [];
+        }
+        const result = spawnSync(claudeExecutable, ["agents", "--json", "--all"], {
+            encoding: "utf8",
+            maxBuffer: 1024 * 1024 * 10,
+            timeout: 10_000
+        });
+        if (result.error || result.status !== 0) {
+            runtimeLog("warn", "claude_agents_list_failed", {
+                status: result.status ?? null,
+                error: result.error?.message,
+                stderr: textSummary(cleanProcessText(result.stderr))
+            });
+            return [];
+        }
+        try {
+            value = JSON.parse(result.stdout);
+        }
+        catch {
+            runtimeLog("warn", "claude_agents_list_invalid_json", {
+                stdout: textSummary(result.stdout)
+            });
+            return [];
+        }
+    }
+    const rows = Array.isArray(value)
+        ? value
+        : isRecord(value) && Array.isArray(value.agents)
+            ? value.agents
+            : [];
+    return rows.flatMap((row) => {
+        if (!isRecord(row) || !Number.isInteger(Number(row.pid))) {
+            return [];
+        }
+        return [{
+                pid: Number(row.pid),
+                ...(stringValue(row.cwd) ? { cwd: stringValue(row.cwd) } : {}),
+                ...(stringValue(row.kind) ? { kind: stringValue(row.kind) } : {}),
+                ...(stringValue(row.sessionId) ? { sessionId: stringValue(row.sessionId) } : {}),
+                ...(stringValue(row.status) ? { status: stringValue(row.status) } : {})
+            }];
+    });
+}
+function inferClaudeAncestorPid(agentRows, startingPid = process.ppid) {
+    const interactivePids = new Set(agentRows
+        .filter((row) => row.kind === undefined || row.kind === "interactive")
+        .map((row) => row.pid)
+        .filter((pid) => Number.isInteger(pid)));
+    let pid = startingPid;
+    const visited = new Set();
+    for (let depth = 0; depth < 16 && Number.isInteger(pid) && pid > 1 && !visited.has(pid); depth += 1) {
+        visited.add(pid);
+        const processRow = spawnSync("ps", ["-p", String(pid), "-o", "pid=,ppid=,command="], {
+            encoding: "utf8",
+            timeout: 2_000
+        });
+        if (processRow.error || processRow.status !== 0) {
+            return undefined;
+        }
+        const match = /^\s*(\d+)\s+(\d+)\s+(.+)$/u.exec(String(processRow.stdout).trim());
+        if (!match) {
+            return undefined;
+        }
+        const currentPid = Number(match[1]);
+        const parentPid = Number(match[2]);
+        const commandText = match[3];
+        if (interactivePids.has(currentPid) || isClaudeProcessCommand(commandText)) {
+            return currentPid;
+        }
+        pid = parentPid;
+    }
+    return undefined;
+}
+function isClaudeProcessCommand(commandText) {
+    const executable = commandText.trim().split(/\s+/u, 1)[0];
+    return path.basename(executable) === "claude" ||
+        /[\\/]\.local[\\/]share[\\/]claude[\\/]versions[\\/][^\\/\s]+$/u.test(executable);
+}
 function createRuntimeTerminalAgentRegistry(options) {
     return createProductionTerminalAgentRegistry({
-        overrides: [createCodexTerminalAgentAdapter({
+        overrides: [
+            createCodexTerminalAgentAdapter({
                 async detectDurableCompletion(request) {
                     const runtime = isRecord(request.context) ? request.context : undefined;
                     const conversation = runtime?.conversation;
@@ -611,7 +817,13 @@ function createRuntimeTerminalAgentRegistry(options) {
                         }
                         : undefined;
                 }
-            })]
+            }),
+            createClaudeTerminalAgentAdapter({
+                agentRows: loadClaudeAgentRows(options),
+                hookStore: createClaudeHookStore(options),
+                trustedTokenjuiceLaunchers: loadTrustedClaudeTokenjuiceLaunchers(expandHome(options.claudeSettingsPath ?? defaultClaudeSettingsPath()))
+            })
+        ]
     });
 }
 function createTerminalAgentBridge(options, terminalProvider = createTerminalControlProvider(options)) {
@@ -695,6 +907,25 @@ function terminalControlFromTakeover(nativeTakeover) {
             ]
     };
 }
+function terminalRuntimeIdentityForConversation(conversation, terminalControl) {
+    const nativeTakeover = isRecord(conversation?.native_session_takeover)
+        ? conversation.native_session_takeover
+        : undefined;
+    const nativeSessionId = stringValue(nativeTakeover?.native_session_id);
+    const terminalIdentity = parseTerminalConversationId(nativeSessionId);
+    const explicitSessionId = stringValue(nativeTakeover?.terminal_agent_session_id) ??
+        (terminalIdentity ? undefined : nativeSessionId);
+    return {
+        pid: Number.isInteger(Number(nativeTakeover?.terminal_agent_pid))
+            ? Number(nativeTakeover?.terminal_agent_pid)
+            : terminalIdentity?.pid,
+        sessionId: explicitSessionId,
+        cwd: stringValue(nativeTakeover?.source_cwd) ?? terminalControl.currentPath,
+        conversationId: stringValue(conversation?.conversation_id),
+        messageId: stringValue(nativeTakeover?.terminal_bridge_message_id),
+        terminalTarget: terminalControl.target
+    };
+}
 function isTerminalControlCapability(value) {
     return typeof value === "string" && [
         "screen_status",
@@ -1246,7 +1477,7 @@ function startExecutorMonitor({ statePath, logPath, pid, outputPath, agentTimeou
     child.unref();
     return child;
 }
-function startTerminalBridgeMonitor({ statePath, logPath, agentTimeoutMinutes, agentHardTimeoutMinutes, pollIntervalMs, codexHome }) {
+function startTerminalBridgeMonitor({ statePath, logPath, agentTimeoutMinutes, agentHardTimeoutMinutes, pollIntervalMs, codexHome, claudeHookStoreDir }) {
     const args = [
         new URL(import.meta.url).pathname,
         "monitor",
@@ -1265,6 +1496,9 @@ function startTerminalBridgeMonitor({ statePath, logPath, agentTimeoutMinutes, a
     if (codexHome) {
         args.push("--codex-home", codexHome);
     }
+    if (claudeHookStoreDir) {
+        args.push("--claude-hook-store-dir", claudeHookStoreDir);
+    }
     const child = spawn(process.execPath, args, {
         detached: true,
         stdio: "ignore",
@@ -1291,7 +1525,8 @@ function startTerminalBridgeMonitorForConversation({ conversation, statePath, lo
             nativeTakeover?.["terminal_bridge_hard_timeout_minutes"] ??
             DEFAULT_AGENT_HARD_TIMEOUT_MINUTES),
         pollIntervalMs: Number(options.monitorPollIntervalMs ?? DEFAULT_MONITOR_POLL_INTERVAL_MS),
-        codexHome: options.codexHome
+        codexHome: options.codexHome,
+        claudeHookStoreDir: options.claudeHookStoreDir ?? nativeTakeover?.["claude_hook_store_dir"]
     });
 }
 function terminalBridgeEnabled(conversation) {
@@ -1314,6 +1549,7 @@ function withTerminalBridgeState({ conversation, message, startedAt, agentTimeou
             terminal_bridge_request_text: String(message.body ?? ""),
             terminal_bridge_request_hash: terminalBridgeRequestFingerprint(message.body),
             terminal_bridge_pre_send_screen_fingerprint: preSendScreenFingerprint,
+            terminal_bridge_completion_claim: undefined,
             terminal_bridge_monitor_started_at: startedAt,
             terminal_bridge_last_activity_at: startedAt,
             terminal_bridge_inactivity_timeout_minutes: agentTimeoutMinutes,
@@ -1324,6 +1560,165 @@ function withTerminalBridgeState({ conversation, message, startedAt, agentTimeou
         updated_at: startedAt
     };
 }
+function activateClaudeHookLease({ options, conversation, message, terminalControl, expiresAt }) {
+    const runtime = terminalRuntimeIdentityForConversation(conversation, terminalControl);
+    const pid = runtime.pid;
+    const agentRow = pid === undefined
+        ? undefined
+        : loadClaudeAgentRows(options).find((row) => row.pid === pid && (row.kind === undefined || row.kind === "interactive"));
+    const sessionId = agentRow?.sessionId ?? runtime.sessionId;
+    const cwd = agentRow?.cwd ?? runtime.cwd ?? terminalControl.currentPath;
+    if (!cwd || (pid === undefined && !sessionId)) {
+        runtimeLog("warn", "claude_hook_lease_unavailable", {
+            conversation_id: conversation.conversation_id,
+            terminal_target: terminalControl.target,
+            reason: "exact Claude pid/session identity is unavailable"
+        });
+        return undefined;
+    }
+    const store = createClaudeHookStore(options);
+    try {
+        const previous = store.resolveLease({
+            ...(sessionId === undefined ? {} : { sessionId }),
+            ...(pid === undefined ? {} : { pid }),
+            cwd,
+            requireUnique: true
+        });
+        if (previous && (previous.lease.conversationId !== conversation.conversation_id ||
+            previous.lease.messageId !== message.id)) {
+            store.releaseLease({ leaseId: previous.lease.id });
+        }
+        const lease = store.activateLease({
+            ...(sessionId === undefined ? {} : { sessionId }),
+            ...(pid === undefined ? {} : { pid }),
+            cwd,
+            conversationId: conversation.conversation_id,
+            messageId: message.id,
+            terminalTarget: terminalControl.target,
+            expiresAt
+        });
+        runtimeLog("info", "claude_hook_lease_activated", {
+            conversation_id: conversation.conversation_id,
+            message_id: message.id,
+            terminal_target: terminalControl.target,
+            lease_id: lease.id,
+            pid,
+            session_id: sessionId,
+            expires_at: lease.expiresAt
+        });
+        return {
+            lease,
+            storeDir: store.rootDir,
+            ...(pid === undefined ? {} : { pid }),
+            ...(sessionId === undefined ? {} : { sessionId })
+        };
+    }
+    catch (error) {
+        runtimeLog("warn", "claude_hook_lease_unavailable", {
+            conversation_id: conversation.conversation_id,
+            terminal_target: terminalControl.target,
+            reason: error instanceof Error ? error.message : String(error)
+        });
+        return undefined;
+    }
+}
+function withClaudeHookLeaseState(conversation, state) {
+    const nativeTakeover = isRecord(conversation.native_session_takeover)
+        ? conversation.native_session_takeover
+        : {};
+    return {
+        ...conversation,
+        native_session_takeover: {
+            ...nativeTakeover,
+            claude_hook_mode: "enabled",
+            claude_hook_store_dir: state.storeDir,
+            claude_hook_lease_id: state.lease.id,
+            terminal_agent_pid: state.pid,
+            terminal_agent_session_id: state.sessionId
+        }
+    };
+}
+function releaseClaudeHookLease(conversation) {
+    const nativeTakeover = isRecord(conversation?.native_session_takeover)
+        ? conversation.native_session_takeover
+        : undefined;
+    const leaseId = stringValue(nativeTakeover?.claude_hook_lease_id);
+    if (!leaseId || nativeTakeover?.agent !== "claude") {
+        return;
+    }
+    const storeDir = stringValue(nativeTakeover.claude_hook_store_dir) ?? defaultClaudeHookStoreDir();
+    try {
+        const released = new ClaudeHookStore({ rootDir: storeDir }).releaseLease({ leaseId });
+        runtimeLog("info", "claude_hook_lease_released", {
+            conversation_id: conversation.conversation_id,
+            message_id: released?.messageId,
+            lease_id: leaseId
+        });
+    }
+    catch (error) {
+        runtimeLog("warn", "claude_hook_lease_release_failed", {
+            conversation_id: conversation.conversation_id,
+            lease_id: leaseId,
+            reason: error instanceof Error ? error.message : String(error)
+        });
+    }
+}
+function renewClaudeHookLease(conversation, expiresAt) {
+    const nativeTakeover = isRecord(conversation?.native_session_takeover)
+        ? conversation.native_session_takeover
+        : undefined;
+    if (nativeTakeover?.agent !== "claude") {
+        return undefined;
+    }
+    const conversationId = stringValue(conversation.conversation_id);
+    const messageId = stringValue(nativeTakeover.terminal_bridge_message_id);
+    const terminalControl = terminalControlFromTakeover(nativeTakeover);
+    const cwd = stringValue(nativeTakeover.source_cwd) ?? terminalControl?.currentPath;
+    const pid = Number.isInteger(Number(nativeTakeover.terminal_agent_pid))
+        ? Number(nativeTakeover.terminal_agent_pid)
+        : undefined;
+    const sessionId = stringValue(nativeTakeover.terminal_agent_session_id);
+    if (!conversationId || !messageId || !terminalControl || !cwd || (pid === undefined && !sessionId)) {
+        return undefined;
+    }
+    const storeDir = stringValue(nativeTakeover.claude_hook_store_dir) ?? defaultClaudeHookStoreDir();
+    try {
+        return new ClaudeHookStore({ rootDir: storeDir }).activateLease({
+            ...(sessionId === undefined ? {} : { sessionId }),
+            ...(pid === undefined ? {} : { pid }),
+            cwd,
+            conversationId,
+            messageId,
+            terminalTarget: terminalControl.target,
+            expiresAt
+        });
+    }
+    catch (error) {
+        runtimeLog("warn", "claude_hook_lease_renew_failed", {
+            conversation_id: conversationId,
+            message_id: messageId,
+            reason: error instanceof Error ? error.message : String(error)
+        });
+        return undefined;
+    }
+}
+function releaseClaudeHookLeasesForTerminal({ storeDir, terminalControl, replacementConversationId }) {
+    for (const candidate of listConversations(storeDir)) {
+        if (candidate.conversation_id === replacementConversationId) {
+            continue;
+        }
+        const nativeTakeover = isRecord(candidate.native_session_takeover)
+            ? candidate.native_session_takeover
+            : undefined;
+        const candidateControl = terminalControlFromTakeover(nativeTakeover);
+        if (nativeTakeover?.agent === "claude" &&
+            nativeTakeover?.terminal_bridge === true &&
+            candidateControl?.target === terminalControl.target &&
+            candidateControl?.socketPath === terminalControl.socketPath) {
+            releaseClaudeHookLease(candidate);
+        }
+    }
+}
 function uniqueDelegateSessionName(kind) {
     const { sessionPrefix } = executorDefinitionForKind(kind || "claude");
     const timestamp = new Date().toISOString().replace(/\D/g, "").slice(0, 14);
@@ -1554,7 +1949,12 @@ async function terminalControlledListEntry(session, activeSessions, options, bri
     if (!terminalControl) {
         throw new Error(`process ${session.pid} is not terminal-controlled`);
     }
-    const terminalState = await listStateForTerminal(session.agent, terminalControl, options, bridge);
+    const terminalState = await listStateForTerminal(session.agent, terminalControl, options, bridge, {
+        pid: session.pid,
+        sessionId: session.sessionId,
+        cwd: session.cwd,
+        terminalTarget: terminalControl.target
+    });
     return {
         id: bridge.terminalConversationId(session),
         source: "terminal_control",
@@ -1583,7 +1983,7 @@ async function terminalControlledListEntry(session, activeSessions, options, bri
         }
     };
 }
-async function listStateForTerminal(agent, terminalControl, options, bridge = createTerminalAgentBridge(options)) {
+async function listStateForTerminal(agent, terminalControl, options, bridge = createTerminalAgentBridge(options), runtime) {
     if (options.noApprovalScan) {
         return {
             approval_state: {
@@ -1598,7 +1998,8 @@ async function listStateForTerminal(agent, terminalControl, options, bridge = cr
     }
     try {
         const status = await bridge.status(agent, terminalControl, {
-            scrollbackLines: Number(options.scrollbackLines ?? 120)
+            scrollbackLines: Number(options.scrollbackLines ?? 120),
+            runtime
         });
         return {
             approval_state: {
@@ -1671,7 +2072,11 @@ async function runStatus(options) {
     cleanupIdleConversations(storeDirFromOptions(options), options);
     const terminalConversation = await resolveTerminalConversationFromOptions(options);
     if (terminalConversation) {
-        const terminalStatus = await terminalStatusForControl(terminalConversation.agent, terminalConversation.terminalControl, options);
+        const terminalStatus = await terminalStatusForControl(terminalConversation.agent, terminalConversation.terminalControl, options, {
+            pid: terminalConversation.pid,
+            cwd: terminalConversation.terminalControl.currentPath,
+            terminalTarget: terminalConversation.terminalControl.target
+        });
         printJson({
             conversation_id: terminalConversation.conversationId,
             source: "terminal_control",
@@ -1703,7 +2108,7 @@ async function runStatus(options) {
     if (terminalControl) {
         const executor = executorForConversation(conversation);
         result.terminal_control = terminalControl;
-        result.terminal_status = await terminalStatusForControl(executor.kind, terminalControl, options);
+        result.terminal_status = await terminalStatusForControl(executor.kind, terminalControl, options, terminalRuntimeIdentityForConversation(conversation, terminalControl));
         result.terminal_screen = result.terminal_status.screen;
     }
     printJson(result);
@@ -1721,7 +2126,11 @@ async function runDescribe(options) {
     const conversationId = required(options.conversation ?? options.conversationId, "--conversation is required");
     const terminalConversation = await resolveTerminalConversationFromOptions(options);
     if (terminalConversation) {
-        const terminalStatus = await terminalStatusForControl(terminalConversation.agent, terminalConversation.terminalControl, options);
+        const terminalStatus = await terminalStatusForControl(terminalConversation.agent, terminalConversation.terminalControl, options, {
+            pid: terminalConversation.pid,
+            cwd: terminalConversation.terminalControl.currentPath,
+            terminalTarget: terminalConversation.terminalControl.target
+        });
         if (terminalConversation.agent !== "codex") {
             const adapter = createRuntimeTerminalAgentRegistry(options).require(terminalConversation.agent);
             printJson({
@@ -1767,7 +2176,7 @@ async function runDescribe(options) {
     const events = readExistingEvents(logPath);
     const terminalControl = terminalControlFromTakeover(isRecord(conversation.native_session_takeover) ? conversation.native_session_takeover : undefined);
     const terminalStatus = terminalControl
-        ? await terminalStatusForControl(executorForConversation(conversation).kind, terminalControl, options)
+        ? await terminalStatusForControl(executorForConversation(conversation).kind, terminalControl, options, terminalRuntimeIdentityForConversation(conversation, terminalControl))
         : undefined;
     printJson({
         conversation_id: conversation.conversation_id,
@@ -1786,9 +2195,10 @@ async function runDescribe(options) {
         event_log_path: logPath
     });
 }
-async function terminalStatusForControl(agent, terminalControl, options) {
+async function terminalStatusForControl(agent, terminalControl, options, runtime) {
     return createTerminalAgentBridge(options).status(agent, terminalControl, {
-        scrollbackLines: Number(options.scrollbackLines ?? 120)
+        scrollbackLines: Number(options.scrollbackLines ?? 120),
+        runtime
     });
 }
 function terminalBridgeApprovalFingerprint({ terminalControl, terminalStatus }) {
@@ -1805,10 +2215,26 @@ function terminalBridgeApprovalFingerprint({ terminalControl, terminalStatus })
         label: approval.label,
         prompt_kind: approval.prompt_kind,
         command: approval.command,
+        tool_name: approval.tool_name,
+        request_detail: approval.request_detail,
         excerpt: screen.excerpt
     }))
         .digest("hex");
 }
+function assertSafeClaudeTerminalSend(terminalStatus) {
+    const approval = isRecord(terminalStatus?.approval_state)
+        ? terminalStatus.approval_state
+        : undefined;
+    if (terminalStatus?.reachable !== true) {
+        throw new Error("Claude Code terminal status is unavailable");
+    }
+    if (approval?.blocked === true) {
+        throw new Error(stringValue(approval.reason) ?? "Claude Code is waiting at a permission dialog");
+    }
+    if (terminalStatus.activity_state !== "idle") {
+        throw new Error(`Claude Code terminal is ${stringValue(terminalStatus.activity_state) ?? "unknown"}, not idle`);
+    }
+}
 function terminalBridgeApprovalInstructions({ conversation, terminalControl, terminalStatus }) {
     const approval = isRecord(terminalStatus?.approval_state) ? terminalStatus.approval_state : {};
     const screen = isRecord(terminalStatus?.screen) ? terminalStatus.screen : {};
@@ -1818,10 +2244,18 @@ function terminalBridgeApprovalInstructions({ conversation, terminalControl, ter
     const keys = Array.isArray(approval.keys)
         ? approval.keys.filter((value) => typeof value === "string")
         : [];
-    const keyDescription = keys.length > 0
-        ? keys.join(" then ")
-        : stringValue(approval.key) || "the detected approve key sequence";
+    const decisionMode = stringValue(approval.decision_mode);
+    const keyDescription = decisionMode === "structured"
+        ? "structured one-time Hook decision"
+        : keys.length > 0
+            ? keys.join(" then ")
+            : stringValue(approval.key) || "the detected approve key sequence";
     const fingerprint = stringValue(approval.fingerprint);
+    const promptKind = stringValue(approval.prompt_kind);
+    const command = stringValue(approval.command);
+    const toolName = stringValue(approval.tool_name);
+    const requestDetail = stringValue(approval.request_detail);
+    const requestId = stringValue(approval.request_id);
     const excerpt = stringValue(screen.excerpt) || "(No terminal excerpt was available.)";
     return [
         `${agentName} is waiting for approval in a terminal-controlled AKK session.`,
@@ -1829,6 +2263,11 @@ function terminalBridgeApprovalInstructions({ conversation, terminalControl, ter
         `Conversation: ${conversation.conversation_id}`,
         `Terminal: ${terminalControl.kind}:${terminalControl.target}`,
         `Approval option: ${label} (${keyDescription})`,
+        promptKind ? `Request kind: ${promptKind}` : undefined,
+        toolName ? `Tool: ${toolName}` : undefined,
+        requestDetail ? `Request: ${requestDetail}` : undefined,
+        command ? `Command: ${command}` : undefined,
+        requestId ? `Structured request id: ${requestId}` : undefined,
         "",
         "Safe terminal excerpt:",
         "```text",
@@ -1850,7 +2289,7 @@ function terminalBridgeApprovalInstructions({ conversation, terminalControl, ter
         "Equivalent user command: `AKK cancel " + conversation.conversation_id + "`",
         "",
         "Do not use raw tmux, shell, or manual key presses for this approval. Do not approve without explicit user confirmation."
-    ].join("\n");
+    ].filter((line) => line !== undefined).join("\n");
 }
 function recordTerminalBridgeApprovalNotification({ statePath, logPath, terminalControl, terminalStatus, fingerprint }) {
     const releaseLock = acquireFileLock(`${statePath}.lock`);
@@ -1913,6 +2352,7 @@ async function runSend(options) {
                 options,
                 conversationId: terminalConversation.conversationId,
                 agent: terminalConversation.agent,
+                pid: terminalConversation.pid,
                 messageBody,
                 terminalControl: terminalConversation.terminalControl
             });
@@ -1933,6 +2373,7 @@ async function runSend(options) {
             options,
             conversationId: terminalConversation.conversationId,
             agent: terminalConversation.agent,
+            pid: terminalConversation.pid,
             messageBody,
             terminalControl: terminalConversation.terminalControl
         });
@@ -2297,7 +2738,8 @@ async function runApprove(options) {
             options,
             conversationId: terminalConversation.conversationId,
             agent: terminalConversation.agent,
-            terminalControl: terminalConversation.terminalControl
+            terminalControl: terminalConversation.terminalControl,
+            pid: terminalConversation.pid
         });
         return;
     }
@@ -2320,7 +2762,11 @@ async function runApprove(options) {
     const policyFingerprint = stringValue(options.policyFingerprint);
     const approval = await createTerminalAgentBridge(options).approve(executor.kind, terminalControl, {
         expectedFingerprint,
-        scrollbackLines: Number(options.scrollbackLines ?? 120)
+        scrollbackLines: Number(options.scrollbackLines ?? 120),
+        runtime: terminalRuntimeIdentityForConversation(conversation, terminalControl),
+        requiredDecisionMode: autoApproved && executor.kind === "claude"
+            ? "structured"
+            : undefined
     });
     const actualFingerprint = approval.fingerprint;
     if (!approval.approved) {
@@ -2358,6 +2804,8 @@ async function runApprove(options) {
         key: approval.key,
         keys: approval.keys,
         label: approval.label,
+        decision_mode: approval.decisionMode,
+        request_id: approval.requestId,
         approval_fingerprint: actualFingerprint,
         auto_approved: autoApproved,
         policy_rule_id: policyRuleId,
@@ -2381,6 +2829,8 @@ async function runApprove(options) {
         key: approval.key,
         keys: approval.keys,
         label: approval.label,
+        decision_mode: approval.decisionMode,
+        request_id: approval.requestId,
         approval_fingerprint: actualFingerprint,
         auto_approved: autoApproved,
         policy_rule_id: policyRuleId,
@@ -2409,12 +2859,28 @@ async function runApprove(options) {
         terminal_bridge_hard_deadline_at: deadlineAt(stringValue(nativeTakeoverForUpdate.terminal_bridge_started_at) ?? approvalResolvedAt, agentHardTimeoutMinutes)
     };
     delete nextNativeTakeover.terminal_bridge_approval;
-    const nextConversation = {
+    let nextConversation = {
         ...conversation,
         status: terminalBridgeEnabled(conversation) ? "waiting_for_agent" : conversation.status,
         native_session_takeover: nextNativeTakeover,
         updated_at: approvalResolvedAt
     };
+    const approvalLeaseDeadlines = [
+        stringValue(nextNativeTakeover.terminal_bridge_inactivity_deadline_at),
+        stringValue(nextNativeTakeover.terminal_bridge_hard_deadline_at)
+    ].filter((value) => Boolean(value));
+    if (approvalLeaseDeadlines.length > 0) {
+        const renewedLease = renewClaudeHookLease(nextConversation, new Date(Math.min(...approvalLeaseDeadlines.map((value) => Date.parse(value)))).toISOString());
+        if (renewedLease) {
+            nextConversation = {
+                ...nextConversation,
+                native_session_takeover: {
+                    ...nextNativeTakeover,
+                    claude_hook_lease_id: renewedLease.id
+                }
+            };
+        }
+    }
     saveState(statePath, nextConversation);
     const bridgeMonitor = startTerminalBridgeMonitorForConversation({
         conversation: nextConversation,
@@ -2447,16 +2913,23 @@ async function runApprove(options) {
         key: approval.key,
         keys: approval.keys,
         label: approval.label,
+        decision_mode: approval.decisionMode,
+        request_id: approval.requestId,
         approval_fingerprint: actualFingerprint,
         auto_approved: autoApproved,
         policy_rule_id: policyRuleId,
         monitor_pid: bridgeMonitor?.pid ?? null
     });
 }
-async function runTerminalConversationApprove({ options, conversationId, agent, terminalControl }) {
+async function runTerminalConversationApprove({ options, conversationId, agent, terminalControl, pid }) {
     const approval = await createTerminalAgentBridge(options).approve(agent, terminalControl, {
         expectedFingerprint: stringValue(options.expectedApprovalFingerprint),
-        scrollbackLines: Number(options.scrollbackLines ?? 120)
+        scrollbackLines: Number(options.scrollbackLines ?? 120),
+        runtime: {
+            pid,
+            cwd: terminalControl.currentPath,
+            terminalTarget: terminalControl.target
+        }
     });
     if (!approval.approved) {
         printJson({
@@ -2476,7 +2949,9 @@ async function runTerminalConversationApprove({ options, conversationId, agent,
         terminal_target: terminalControl.target,
         key: approval.key,
         keys: approval.keys,
-        label: approval.label
+        label: approval.label,
+        decision_mode: approval.decisionMode,
+        request_id: approval.requestId
     });
     printJson({
         conversation_id: conversationId,
@@ -2486,12 +2961,26 @@ async function runTerminalConversationApprove({ options, conversationId, agent,
         key: approval.key,
         keys: approval.keys,
         label: approval.label,
-        approval_fingerprint: approval.fingerprint
+        approval_fingerprint: approval.fingerprint,
+        decision_mode: approval.decisionMode,
+        request_id: approval.requestId
     });
 }
-async function runTerminalConversationSend({ options, conversationId, agent, messageBody, terminalControl }) {
+async function runTerminalConversationSend({ options, conversationId, agent, pid, messageBody, terminalControl }) {
     const terminalPayload = terminalSubmissionPayload(String(messageBody));
-    await createTerminalAgentBridge(options).send(agent, terminalControl, terminalPayload);
+    const terminalBridge = createTerminalAgentBridge(options);
+    if (agent === "claude") {
+        const status = await terminalBridge.status(agent, terminalControl, {
+            scrollbackLines: Number(options.scrollbackLines ?? 120),
+            runtime: {
+                pid,
+                cwd: terminalControl.currentPath,
+                terminalTarget: terminalControl.target
+            }
+        });
+        assertSafeClaudeTerminalSend(status);
+    }
+    await terminalBridge.send(agent, terminalControl, terminalPayload);
     runtimeLog("info", "terminal_message_send", {
         conversation_id: conversationId,
         agent,
@@ -2552,19 +3041,60 @@ async function runTerminalControlSend({ options, conversation, nextConversation,
             forkTakeover: undefined
         }))
         : terminalSubmissionPayload(String(message.body ?? ""));
+    const preSendRuntime = {
+        ...terminalRuntimeIdentityForConversation(nextConversation, terminalControl),
+        messageId: message.id
+    };
     let preSendScreenFingerprint;
     if (bridge) {
         try {
             const status = await terminalBridge.status(executor.kind, terminalControl, {
-                scrollbackLines: Number(options.scrollbackLines ?? 120)
+                scrollbackLines: Number(options.scrollbackLines ?? 120),
+                runtime: preSendRuntime
             });
+            if (executor.kind === "claude") {
+                assertSafeClaudeTerminalSend(status);
+            }
             preSendScreenFingerprint = terminalBridgeScreenFingerprint(status.screen.excerpt);
         }
-        catch {
-            // Delivery can still succeed when capture is unavailable; prompt matching remains the fallback boundary.
+        catch (error) {
+            if (executor.kind === "claude") {
+                throw new Error(`refusing to send to Claude Code without a verified idle terminal: ${error instanceof Error ? error.message : String(error)}`);
+            }
+            // Codex delivery can still use its established fallback when capture is unavailable.
         }
     }
-    await terminalBridge.send(executor.kind, terminalControl, terminalPayload);
+    if (bridge && executor.kind === "claude") {
+        releaseClaudeHookLeasesForTerminal({
+            storeDir: storeDirFromOptions(options),
+            terminalControl,
+            replacementConversationId: conversation.conversation_id
+        });
+        releaseClaudeHookLease(nextConversation);
+    }
+    const claudeHookLeaseState = bridge && executor.kind === "claude"
+        ? activateClaudeHookLease({
+            options,
+            conversation: nextConversation,
+            message,
+            terminalControl,
+            expiresAt: deadlineAt(bridgeStartedAt, agentTimeoutMinutes > 0
+                ? Math.min(agentTimeoutMinutes, agentHardTimeoutMinutes)
+                : agentHardTimeoutMinutes)
+        })
+        : undefined;
+    const conversationWithHookLease = claudeHookLeaseState
+        ? withClaudeHookLeaseState(nextConversation, claudeHookLeaseState)
+        : nextConversation;
+    try {
+        await terminalBridge.send(executor.kind, terminalControl, terminalPayload);
+    }
+    catch (error) {
+        if (claudeHookLeaseState) {
+            releaseClaudeHookLease(conversationWithHookLease);
+        }
+        throw error;
+    }
     const supersededConversationIds = bridge
         ? supersedeTerminalBridgeConversations({
             storeDir: storeDirFromOptions(options),
@@ -2592,7 +3122,7 @@ async function runTerminalControlSend({ options, conversation, nextConversation,
     });
     const bridgeConversation = bridge
         ? withTerminalBridgeState({
-            conversation: nextConversation,
+            conversation: conversationWithHookLease,
             message,
             startedAt: bridgeStartedAt,
             agentTimeoutMinutes,
@@ -2654,7 +3184,7 @@ async function runTerminalControlSend({ options, conversation, nextConversation,
 function terminalSubmissionPayload(payload) {
     return payload.replace(/[\r\n]+$/u, "");
 }
-function createManagedTerminalConversationFromRawId({ options, conversationId, agent, messageBody, terminalControl }) {
+function createManagedTerminalConversationFromRawId({ options, conversationId, agent, pid, messageBody, terminalControl }) {
     const workspace = terminalControl.currentPath ?? process.cwd();
     const storeDir = expandHome(options.storeDir ?? options.logDir ?? defaultStoreDir(workspace));
     cleanupIdleConversations(storeDir, options);
@@ -2685,6 +3215,9 @@ function createManagedTerminalConversationFromRawId({ options, conversationId, a
             gatewaySession: options.gatewaySession,
             openclawBin: options.openclawBin ?? resolveOptionalExecutable("openclaw")
         });
+    const claudeAgent = agent === "claude"
+        ? loadClaudeAgentRows(options).find((row) => row.pid === pid)
+        : undefined;
     const attachedConversation = withStoragePaths({
         ...conversation,
         executor,
@@ -2701,6 +3234,8 @@ function createManagedTerminalConversationFromRawId({ options, conversationId, a
         native_session_takeover: {
             agent,
             native_session_id: conversationId,
+            terminal_agent_pid: pid,
+            terminal_agent_session_id: claudeAgent?.sessionId,
             source_cwd: workspace,
             source_title: `Terminal-controlled ${executor.display_name} ${terminalControl.target}`,
             strategy: "terminal_control",
@@ -2805,14 +3340,16 @@ function supersedeTerminalBridgeConversations({ storeDir, terminalControl, repla
                 continue;
             }
             const now = new Date().toISOString();
-            saveState(candidateStatePath, {
+            const closedConversation = {
                 ...current,
                 status: "closed",
                 closed_at: now,
                 close_reason: "terminal bridge superseded by a newer task on the same terminal",
                 superseded_by_conversation_id: replacementConversationId,
                 updated_at: now
-            });
+            };
+            saveState(candidateStatePath, closedConversation);
+            releaseClaudeHookLease(closedConversation);
             appendEvent(logPathForStatePath(candidateStatePath), {
                 ts: now,
                 conversation_id: current.conversation_id,
@@ -3242,17 +3779,37 @@ async function runRenew(options) {
         throw new Error(`cannot renew ${conversation.conversation_id}; terminal bridge hard lifetime of ${hardTimeoutMinutes} minutes has elapsed`);
     }
     const now = new Date().toISOString();
+    const currentMessageId = stringValue(nativeTakeover?.terminal_bridge_message_id);
+    const hardDeadline = deadlineAt(startedAt ?? now, hardTimeoutMinutes) ??
+        new Date(Date.now() + hardTimeoutMinutes * 60 * 1000).toISOString();
+    const inactivityDeadline = deadlineAt(now, inactivityTimeoutMinutes) ??
+        new Date(Date.now() + inactivityTimeoutMinutes * 60 * 1000).toISOString();
+    const renewedLease = executorForConversation(conversation).kind === "claude" && currentMessageId
+        ? activateClaudeHookLease({
+            options,
+            conversation,
+            message: { id: currentMessageId },
+            terminalControl,
+            expiresAt: new Date(Math.min(Date.parse(hardDeadline), Date.parse(inactivityDeadline))).toISOString()
+        })
+        : undefined;
+    const renewedBase = renewedLease
+        ? withClaudeHookLeaseState(conversation, renewedLease)
+        : conversation;
+    const renewedNativeTakeover = isRecord(renewedBase.native_session_takeover)
+        ? renewedBase.native_session_takeover
+        : nativeTakeover;
     const renewed = {
-        ...conversation,
+        ...renewedBase,
         status: "waiting_for_agent",
         native_session_takeover: {
-            ...nativeTakeover,
+            ...renewedNativeTakeover,
             terminal_bridge_monitor_started_at: now,
             terminal_bridge_last_activity_at: now,
             terminal_bridge_inactivity_timeout_minutes: inactivityTimeoutMinutes,
             terminal_bridge_hard_timeout_minutes: hardTimeoutMinutes,
-            terminal_bridge_inactivity_deadline_at: deadlineAt(now, inactivityTimeoutMinutes),
-            terminal_bridge_hard_deadline_at: deadlineAt(startedAt ?? now, hardTimeoutMinutes),
+            terminal_bridge_inactivity_deadline_at: inactivityDeadline,
+            terminal_bridge_hard_deadline_at: hardDeadline,
             terminal_bridge_renewed_at: now
         },
         updated_at: now
@@ -3324,7 +3881,8 @@ async function runCancel(options) {
             options,
             conversationId: terminalConversation.conversationId,
             agent: terminalConversation.agent,
-            terminalControl: terminalConversation.terminalControl
+            terminalControl: terminalConversation.terminalControl,
+            pid: terminalConversation.pid
         });
         return;
     }
@@ -3405,14 +3963,23 @@ async function runCancel(options) {
         budget: budgetAction(nextConversation)
     });
 }
-async function runTerminalConversationCancel({ options, conversationId, agent, terminalControl }) {
-    const cancellation = await createTerminalAgentBridge(options).cancel(agent, terminalControl);
+async function runTerminalConversationCancel({ options, conversationId, agent, terminalControl, pid }) {
+    const cancellation = await createTerminalAgentBridge(options).cancel(agent, terminalControl, {
+        runtime: {
+            pid,
+            cwd: terminalControl.currentPath,
+            terminalTarget: terminalControl.target
+        },
+        scrollbackLines: Number(options.scrollbackLines ?? 120)
+    });
     runtimeLog("info", "terminal_cancel_requested", {
         conversation_id: conversationId,
         agent,
         terminal_target: terminalControl.target,
         key: cancellation.key,
         keys: cancellation.keys,
+        denied_approval: cancellation.deniedApproval,
+        request_id: cancellation.requestId,
         cancel_requested: cancellation.cancelRequested,
         reason: cancellation.reason
     });
@@ -3423,11 +3990,16 @@ async function runTerminalConversationCancel({ options, conversationId, agent, t
         reason: cancellation.reason,
         terminal_control: terminalControl,
         key: cancellation.key,
-        keys: cancellation.keys
+        keys: cancellation.keys,
+        denied_approval: cancellation.deniedApproval,
+        request_id: cancellation.requestId
     });
 }
 async function runTerminalControlCancel({ options, conversation, statePath, logPath, agent, terminalControl }) {
-    const cancellation = await createTerminalAgentBridge(options).cancel(agent, terminalControl);
+    const cancellation = await createTerminalAgentBridge(options).cancel(agent, terminalControl, {
+        runtime: terminalRuntimeIdentityForConversation(conversation, terminalControl),
+        scrollbackLines: Number(options.scrollbackLines ?? 120)
+    });
     if (!cancellation.cancelRequested) {
         printJson({
             conversation,
@@ -3445,27 +4017,36 @@ async function runTerminalControlCancel({ options, conversation, statePath, logP
         event: "terminal_cancel_requested",
         terminal_control: terminalControl,
         key: cancellation.key,
-        keys: cancellation.keys
+        keys: cancellation.keys,
+        denied_approval: cancellation.deniedApproval,
+        request_id: cancellation.requestId
     });
     runtimeLog("info", "terminal_cancel_requested", {
         conversation_id: conversation.conversation_id,
         agent,
         terminal_target: terminalControl.target,
         key: cancellation.key,
-        keys: cancellation.keys
+        keys: cancellation.keys,
+        denied_approval: cancellation.deniedApproval,
+        request_id: cancellation.requestId
     });
     const nextConversation = {
         ...conversation,
+        status: "cancelled",
+        cancelled_at: now,
         terminal_cancel_requested_at: now,
         updated_at: now
     };
     saveState(statePath, nextConversation);
+    releaseClaudeHookLease(nextConversation);
     printJson({
         conversation: nextConversation,
         cancel_requested: true,
         terminal_control: terminalControl,
         key: cancellation.key,
         keys: cancellation.keys,
+        denied_approval: cancellation.deniedApproval,
+        request_id: cancellation.requestId,
         budget: budgetAction(nextConversation)
     });
 }
@@ -3647,6 +4228,7 @@ function runClose(options) {
         updated_at: now
     };
     saveState(statePath, closed);
+    releaseClaudeHookLease(closed);
     appendEvent(logPath, {
         ts: now,
         conversation_id: conversation.conversation_id,
@@ -3977,6 +4559,7 @@ async function runTerminalBridgeMonitor(options) {
         }
         const requestText = String(nativeTakeover?.["terminal_bridge_request_text"] ?? conversation.user_request ?? "");
         const startedAt = stringValue(nativeTakeover?.["terminal_bridge_started_at"]);
+        const terminalRuntime = terminalRuntimeIdentityForConversation(conversation, terminalControl);
         const screenChangedSinceSend = preSendScreenFingerprint !== undefined &&
             previousScreenFingerprint !== undefined &&
             previousScreenFingerprint !== preSendScreenFingerprint;
@@ -3986,19 +4569,114 @@ async function runTerminalBridgeMonitor(options) {
             screenOptions: {
                 scrollbackLines: Number(options.scrollbackLines ?? 120),
                 requestText,
-                screenChangedSinceSend
+                screenChangedSinceSend,
+                runtime: terminalRuntime
             },
             durableRequest: {
-                sessionId: stringValue(nativeTakeover?.["native_session_id"]),
+                sessionId: terminalRuntime.sessionId,
                 cwd: stringValue(nativeTakeover?.["source_cwd"]),
                 requestText,
                 requestHash: stringValue(nativeTakeover?.["terminal_bridge_request_hash"]),
                 startedAt,
-                context: { conversation, nativeTakeover }
+                context: {
+                    conversation,
+                    nativeTakeover,
+                    ...terminalRuntime
+                }
             }
         });
         const terminalStatus = poll.status;
         const approval = terminalStatus.approval_state;
+        if (isRecord(approval) && approval.blocked === true && approval.approvable !== true) {
+            const approvalReason = stringValue(approval.reason) ??
+                "Claude Code permission state cannot be safely resolved through AKK";
+            appendEvent(logPath, {
+                ts: new Date().toISOString(),
+                conversation_id: conversation.conversation_id,
+                event: "terminal_bridge_approval_not_approvable",
+                terminal_control: terminalControl,
+                activity_state: terminalStatus.activity_state,
+                reason: approvalReason
+            });
+            if (/waiting for hook consumption/iu.test(approvalReason)) {
+                sleepSync(pollIntervalMs);
+                continue;
+            }
+            const fingerprint = terminalBridgeApprovalFingerprint({ terminalControl, terminalStatus });
+            const notification = recordTerminalBridgeApprovalNotification({
+                statePath,
+                logPath,
+                terminalControl,
+                terminalStatus,
+                fingerprint
+            });
+            if (notification.duplicate) {
+                printJson({
+                    conversation: notification.conversation,
+                    monitored: true,
+                    terminal_bridge: true,
+                    awaiting_approval: true,
+                    approvable: false,
+                    duplicate: true,
+                    reason: approvalReason,
+                    terminal_control: terminalControl,
+                    terminal_status: terminalStatus
+                });
+                return;
+            }
+            const callbackMessage = createMessage({
+                conversation: notification.conversation,
+                from: executor.actor,
+                to: "openclaw",
+                type: "blocked",
+                requiresResponse: true,
+                body: [
+                    `${executor.display_name} is waiting at a permission state that AKK cannot safely approve.`,
+                    approvalReason,
+                    "",
+                    `Conversation: ${notification.conversation.conversation_id}`,
+                    `Terminal: ${terminalControl.target}`,
+                    "Review and resolve this dialog in the terminal manually. AKK intentionally sends no key when the request identity cannot be revalidated."
+                ].join("\n"),
+                metadata: {
+                    source: "terminal_bridge",
+                    reason: "approval_not_approvable",
+                    terminal_control: terminalControl,
+                    terminal_status: terminalStatus,
+                    approval_fingerprint: fingerprint
+                }
+            });
+            if (notification.conversation.gateway_method) {
+                runLockedCallback({
+                    ...options,
+                    statePath,
+                    log: logPath,
+                    messageJson: JSON.stringify(callbackMessage),
+                    gatewayMethod: notification.conversation.gateway_method,
+                    gatewaySession: notification.conversation.gateway_session,
+                    openclawSession: notification.conversation.openclaw_session,
+                    openclawBin: notification.conversation.openclaw_bin,
+                    gatewayUrl: stringValue(notification.conversation.gateway_token)
+                        ? notification.conversation.gateway_url
+                        : undefined,
+                    token: stringValue(notification.conversation.gateway_token)
+                });
+                return;
+            }
+            printJson({
+                conversation: notification.conversation,
+                monitored: true,
+                terminal_bridge: true,
+                awaiting_approval: true,
+                approvable: false,
+                delivered: false,
+                message: callbackMessage,
+                reason: "gateway_method_missing",
+                terminal_control: terminalControl,
+                terminal_status: terminalStatus
+            });
+            return;
+        }
         if (isRecord(approval) && approval.blocked === true) {
             const fingerprint = terminalBridgeApprovalFingerprint({ terminalControl, terminalStatus });
             appendEvent(logPath, {
@@ -4150,55 +4828,98 @@ async function runTerminalBridgeMonitor(options) {
             : undefined;
         const completionStable = completionFingerprint !== undefined && completionFingerprint === idleCompletionFingerprint;
         idleCompletionFingerprint = completionFingerprint;
-        if (completion && completionStable) {
-            appendEvent(logPath, {
-                ts: new Date().toISOString(),
-                conversation_id: conversation.conversation_id,
-                event: "terminal_bridge_completion_detected",
-                terminal_control: terminalControl,
-                match: completionMatch,
-                completion_source: completion.source,
-                completion_id: completion.id,
-                terminal_session: completionMetadata.session,
-                context_match: completionMetadata.context_match,
-                assistant_timestamp: completion?.timestamp,
-                rollout_turn_id: completion.source === "durable" ? completion.id : undefined,
-                terminal_bridge_message_id: currentMessageId
+        if (completion && completionStable && completionFingerprint) {
+            const completionOutcome = completion.outcome === "failure" ? "failure" : "success";
+            const callbackMessageId = deterministicTerminalCallbackMessageId({
+                conversationId: conversation.conversation_id,
+                terminalMessageId: currentMessageId,
+                completionFingerprint,
+                outcome: completionOutcome
             });
-            const callbackMessage = createMessage({
-                conversation,
-                from: executor.actor,
-                to: "openclaw",
-                type: "done",
-                requiresResponse: false,
-                body: completion?.text ?? "",
-                metadata: {
-                    source: "terminal_bridge",
+            const claim = claimTerminalBridgeCompletion({
+                statePath,
+                logPath,
+                terminalMessageId: currentMessageId,
+                completionFingerprint,
+                completionId: completion.id,
+                callbackMessageId,
+                outcome: completionOutcome
+            });
+            if (!claim.claimed) {
+                printJson({
+                    conversation: claim.conversation,
+                    monitored: true,
+                    terminal_bridge: true,
+                    completed: false,
+                    duplicate: true,
+                    reason: claim.reason
+                });
+                return;
+            }
+            try {
+                conversation = claim.conversation;
+                appendEvent(logPath, {
+                    ts: new Date().toISOString(),
+                    conversation_id: conversation.conversation_id,
+                    event: "terminal_bridge_completion_detected",
                     terminal_control: terminalControl,
-                    ...completionMetadata,
+                    match: completionMatch,
                     completion_source: completion.source,
+                    completion_outcome: completionOutcome,
                     completion_id: completion.id,
                     terminal_session: completionMetadata.session,
-                    confidence: completion.confidence,
-                    match: completionMatch,
+                    context_match: completionMetadata.context_match,
                     assistant_timestamp: completion?.timestamp,
                     rollout_turn_id: completion.source === "durable" ? completion.id : undefined,
-                    terminal_bridge_message_id: currentMessageId
-                }
-            });
-            runLockedCallback({
-                ...options,
-                statePath,
-                log: logPath,
-                closeTerminalBridgeOnDone: true,
-                messageJson: JSON.stringify(callbackMessage),
-                gatewayMethod: conversation.gateway_method,
-                gatewaySession: conversation.gateway_session,
-                openclawSession: conversation.openclaw_session,
-                openclawBin: conversation.openclaw_bin,
-                gatewayUrl: stringValue(conversation.gateway_token) ? conversation.gateway_url : undefined,
-                token: stringValue(conversation.gateway_token)
-            });
+                    terminal_bridge_message_id: currentMessageId,
+                    callback_message_id: callbackMessageId
+                });
+                const callbackMessage = {
+                    ...createMessage({
+                        conversation,
+                        from: executor.actor,
+                        to: "openclaw",
+                        type: completionOutcome === "failure" ? "error" : "done",
+                        requiresResponse: false,
+                        body: completion.text,
+                        metadata: {
+                            source: "terminal_bridge",
+                            terminal_control: terminalControl,
+                            ...completionMetadata,
+                            completion_source: completion.source,
+                            completion_outcome: completionOutcome,
+                            completion_id: completion.id,
+                            terminal_session: completionMetadata.session,
+                            confidence: completion.confidence,
+                            match: completionMatch,
+                            assistant_timestamp: completion?.timestamp,
+                            rollout_turn_id: completion.source === "durable" ? completion.id : undefined,
+                            terminal_bridge_message_id: currentMessageId
+                        }
+                    }),
+                    id: callbackMessageId
+                };
+                runLockedCallback({
+                    ...options,
+                    statePath,
+                    log: logPath,
+                    closeTerminalBridgeOnDone: completionOutcome === "success",
+                    trackCallbackDelivery: true,
+                    recoverTerminalCompletion: claim.resumed === true,
+                    preserveMessageId: true,
+                    messageJson: JSON.stringify(callbackMessage),
+                    gatewayMethod: conversation.gateway_method,
+                    gatewaySession: conversation.gateway_session,
+                    openclawSession: conversation.openclaw_session,
+                    openclawBin: conversation.openclaw_bin,
+                    gatewayUrl: stringValue(conversation.gateway_token) ? conversation.gateway_url : undefined,
+                    token: stringValue(conversation.gateway_token)
+                });
+            }
+            finally {
+                releaseClaudeHookLease(conversation);
+                claim.release();
+            }
             return;
         }
         // A concrete approval or completion observed on this poll wins over a timeout boundary.
@@ -4302,6 +5023,111 @@ function terminalBridgeRequestFingerprint(value) {
     const text = String(value ?? "").replace(/\s+/gu, " ").trim();
     return text ? createHash("sha256").update(text).digest("hex") : undefined;
 }
+function deterministicTerminalCallbackMessageId({ conversationId, terminalMessageId, completionFingerprint, outcome }) {
+    const digest = createHash("sha256")
+        .update(JSON.stringify({
+        conversation_id: conversationId,
+        terminal_message_id: terminalMessageId,
+        completion_fingerprint: completionFingerprint,
+        outcome
+    }))
+        .digest("hex")
+        .slice(0, 32);
+    return `msg-terminal-${digest}`;
+}
+function claimTerminalBridgeCompletion({ statePath, logPath, terminalMessageId, completionFingerprint, completionId, callbackMessageId, outcome }) {
+    const release = acquireFileLock(`${statePath}.lock`);
+    try {
+        const conversation = loadState(statePath);
+        const nativeTakeover = isRecord(conversation.native_session_takeover)
+            ? conversation.native_session_takeover
+            : {};
+        if (!isWaitingForAgent(conversation.status)) {
+            release();
+            return {
+                claimed: false,
+                conversation,
+                reason: "conversation_no_longer_waiting"
+            };
+        }
+        if (stringValue(nativeTakeover.terminal_bridge_message_id) !== terminalMessageId) {
+            release();
+            return {
+                claimed: false,
+                conversation,
+                reason: "terminal_bridge_task_replaced"
+            };
+        }
+        const existing = isRecord(nativeTakeover.terminal_bridge_completion_claim)
+            ? nativeTakeover.terminal_bridge_completion_claim
+            : undefined;
+        if (existing) {
+            if (existing.callback_message_id === callbackMessageId &&
+                existing.terminal_bridge_message_id === terminalMessageId &&
+                existing.completion_fingerprint === completionFingerprint &&
+                existing.outcome === outcome) {
+                appendEvent(logPath, {
+                    ts: new Date().toISOString(),
+                    conversation_id: conversation.conversation_id,
+                    event: "terminal_bridge_completion_claim_resumed",
+                    terminal_bridge_message_id: terminalMessageId,
+                    completion_fingerprint: completionFingerprint,
+                    callback_message_id: callbackMessageId,
+                    outcome
+                });
+                return {
+                    claimed: true,
+                    resumed: true,
+                    conversation,
+                    release
+                };
+            }
+            release();
+            return {
+                claimed: false,
+                conversation,
+                reason: "terminal_bridge_completion_claim_conflict"
+            };
+        }
+        const claimedAt = new Date().toISOString();
+        const claimedConversation = {
+            ...conversation,
+            native_session_takeover: {
+                ...nativeTakeover,
+                terminal_bridge_completion_claim: {
+                    terminal_bridge_message_id: terminalMessageId,
+                    completion_fingerprint: completionFingerprint,
+                    completion_id: completionId,
+                    callback_message_id: callbackMessageId,
+                    outcome,
+                    claimed_at: claimedAt
+                }
+            },
+            updated_at: claimedAt
+        };
+        saveState(statePath, claimedConversation);
+        appendEvent(logPath, {
+            ts: claimedAt,
+            conversation_id: conversation.conversation_id,
+            event: "terminal_bridge_completion_claimed",
+            terminal_bridge_message_id: terminalMessageId,
+            completion_fingerprint: completionFingerprint,
+            completion_id: completionId,
+            callback_message_id: callbackMessageId,
+            outcome
+        });
+        return {
+            claimed: true,
+            resumed: false,
+            conversation: claimedConversation,
+            release
+        };
+    }
+    catch (error) {
+        release();
+        throw error;
+    }
+}
 function terminalBridgeActivityPersistIntervalMs(timeoutMinutes, pollIntervalMs) {
     if (!Number.isFinite(timeoutMinutes) || timeoutMinutes <= 0) {
         return 5 * 60 * 1000;
@@ -4330,6 +5156,13 @@ function persistTerminalBridgeActivity({ conversation, statePath, logPath, obser
         const inactivityDeadlineAt = Number.isFinite(timeoutMinutes) && timeoutMinutes > 0
             ? new Date(observedAtMs + timeoutMinutes * 60 * 1000).toISOString()
             : undefined;
+        const hardDeadlineAt = stringValue(nativeTakeover.terminal_bridge_hard_deadline_at);
+        const leaseDeadlineAt = inactivityDeadlineAt && hardDeadlineAt
+            ? new Date(Math.min(Date.parse(inactivityDeadlineAt), Date.parse(hardDeadlineAt))).toISOString()
+            : inactivityDeadlineAt ?? hardDeadlineAt;
+        const renewedLease = leaseDeadlineAt
+            ? renewClaudeHookLease(currentConversation, leaseDeadlineAt)
+            : undefined;
         const nextConversation = {
             ...currentConversation,
             native_session_takeover: {
@@ -4338,7 +5171,8 @@ function persistTerminalBridgeActivity({ conversation, statePath, logPath, obser
                 terminal_bridge_last_activity_reason: reason,
                 terminal_bridge_inactivity_deadline_at: inactivityDeadlineAt,
                 terminal_bridge_inactivity_timeout_minutes: timeoutMinutes,
-                terminal_bridge_hard_timeout_minutes: hardTimeoutMinutes
+                terminal_bridge_hard_timeout_minutes: hardTimeoutMinutes,
+                claude_hook_lease_id: renewedLease?.id ?? nativeTakeover.claude_hook_lease_id
             },
             updated_at: observedAt
         };
@@ -4380,9 +5214,12 @@ function terminalBridgeApprovalCandidate({ executor, terminalControl, terminalSt
         agent: executor.kind,
         kind: stringValue(approval.prompt_kind) ?? "unknown",
         command: stringValue(approval.command),
+        tool_name: stringValue(approval.tool_name),
+        request_detail: stringValue(approval.request_detail),
         cwd: terminalControl.currentPath,
         fingerprint,
-        terminal_target: terminalControl.target
+        terminal_target: terminalControl.target,
+        decision_mode: stringValue(approval.decision_mode)
     };
 }
 async function loadCodexTerminalContext({ conversation, nativeTakeover, options }) {
@@ -4595,7 +5432,7 @@ function runLockedCallback(options) {
     const logPath = expandHome(options.log ?? logPathForStatePath(options.statePath));
     const conversation = loadState(options.statePath);
     const executor = executorForConversation(conversation);
-    const message = options.retryPending === true
+    const message = options.retryPending === true || options.preserveMessageId === true
         ? parseMessageJson(messageInput)
         : extractStructuredMessage({
             conversation,
@@ -4614,7 +5451,11 @@ function runLockedCallback(options) {
         isRecord(callbackDelivery?.message) &&
         callbackDelivery.message.id === message.id &&
         ["pending", "failed"].includes(String(callbackDelivery.status ?? ""));
-    if (isDuplicateMessage(existingEvents, message) && !retryingPending) {
+    const duplicateMessage = isDuplicateMessage(existingEvents, message);
+    const recoveringTerminalCompletion = options.recoverTerminalCompletion === true &&
+        duplicateMessage &&
+        isWaitingForAgent(conversation.status);
+    if (duplicateMessage && !retryingPending && !recoveringTerminalCompletion) {
         runtimeLog("info", "callback_duplicate", {
             conversation_id: conversation.conversation_id,
             agent: executor.kind,
@@ -4636,15 +5477,23 @@ function runLockedCallback(options) {
     }
     const closeTerminalBridgeOnDone = message.type === "done" &&
         options.closeTerminalBridgeOnDone === true;
+    const trackCallbackDelivery = closeTerminalBridgeOnDone ||
+        options.trackCallbackDelivery === true ||
+        callbackDelivery?.track_delivery === true;
     const requiresDelivery = Boolean(options.gatewayMethod) || options.recordOnly !== true;
     const deliveryAttempt = Number(callbackDelivery?.attempts ?? 0) + 1;
     let nextConversation = retryingPending
         ? conversation
         : applyMessageToConversation(conversation, message);
-    if (!retryingPending) {
+    const storedFinalStatus = stringValue(callbackDelivery?.final_status);
+    const finalStatus = storedFinalStatus &&
+        CONVERSATION_STATUSES.has(storedFinalStatus)
+        ? storedFinalStatus
+        : nextConversation.status;
+    if (!retryingPending && !recoveringTerminalCompletion) {
         appendEvent(logPath, messageEvent(message));
     }
-    if (closeTerminalBridgeOnDone && requiresDelivery) {
+    if (trackCallbackDelivery && requiresDelivery) {
         const now = new Date().toISOString();
         nextConversation = {
             ...nextConversation,
@@ -4659,7 +5508,9 @@ function runLockedCallback(options) {
                 gateway_session: options.gatewaySession ?? options.openclawSession ?? conversation.openclaw_session,
                 gateway_url: options.gatewayUrl ?? conversation.gateway_url,
                 openclaw_bin: options.openclawBin ?? conversation.openclaw_bin,
-                close_terminal_bridge_on_done: true
+                close_terminal_bridge_on_done: closeTerminalBridgeOnDone,
+                track_delivery: true,
+                final_status: finalStatus
             },
             updated_at: now
         };
@@ -4712,12 +5563,17 @@ function runLockedCallback(options) {
         });
         const deliveredAt = new Date().toISOString();
         let deliveredConversation = nextConversation;
-        if (closeTerminalBridgeOnDone) {
+        if (trackCallbackDelivery) {
+            const deliveredStatus = closeTerminalBridgeOnDone ? "closed" : finalStatus;
             deliveredConversation = {
                 ...nextConversation,
-                status: "closed",
-                closed_at: deliveredAt,
-                close_reason: "terminal bridge task completed",
+                status: deliveredStatus,
+                ...(closeTerminalBridgeOnDone
+                    ? {
+                        closed_at: deliveredAt,
+                        close_reason: "terminal bridge task completed"
+                    }
+                    : {}),
                 callback_delivery: {
                     ...(isRecord(nextConversation.callback_delivery) ? nextConversation.callback_delivery : {}),
                     status: "delivered",
@@ -4734,7 +5590,7 @@ function runLockedCallback(options) {
                 event: "callback_delivery_succeeded",
                 message_id: message.id,
                 attempt: deliveryAttempt,
-                status: "closed"
+                status: deliveredStatus
             });
         }
         printJson({
@@ -4747,7 +5603,7 @@ function runLockedCallback(options) {
         });
     }
     catch (error) {
-        if (closeTerminalBridgeOnDone) {
+        if (trackCallbackDelivery) {
             const failedAt = new Date().toISOString();
             const failedConversation = {
                 ...nextConversation,
@@ -4919,6 +5775,8 @@ function acquireFileLock(lockPath, { timeoutMs = 5000, retryMs = 50 } = {}) {
     while (true) {
         try {
             const fd = fs.openSync(lockPath, "wx");
+            fs.writeFileSync(fd, `${process.pid}\n`, "utf8");
+            fs.fsyncSync(fd);
             fs.closeSync(fd);
             return () => {
                 fs.rmSync(lockPath, { force: true });
@@ -4928,6 +5786,10 @@ function acquireFileLock(lockPath, { timeoutMs = 5000, retryMs = 50 } = {}) {
             if (error.code !== "EEXIST") {
                 throw error;
             }
+            if (staleFileLock(lockPath)) {
+                fs.rmSync(lockPath, { force: true });
+                continue;
+            }
             if (Date.now() - started >= timeoutMs) {
                 throw new Error(`timed out waiting for file lock: ${lockPath}`);
             }
@@ -4935,6 +5797,26 @@ function acquireFileLock(lockPath, { timeoutMs = 5000, retryMs = 50 } = {}) {
         }
     }
 }
+function staleFileLock(lockPath) {
+    try {
+        const stat = fs.statSync(lockPath);
+        const ownerText = fs.readFileSync(lockPath, "utf8").trim();
+        const ownerPid = Number(ownerText);
+        if (Number.isSafeInteger(ownerPid) && ownerPid > 1) {
+            try {
+                process.kill(ownerPid, 0);
+                return false;
+            }
+            catch (error) {
+                return isRecord(error) && error.code === "ESRCH";
+            }
+        }
+        return Date.now() - stat.mtimeMs > 30_000;
+    }
+    catch (error) {
+        return isRecord(error) && error.code === "ENOENT";
+    }
+}
 function sleepSync(ms) {
     Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
 }
@@ -5497,6 +6379,7 @@ function markConversationStalled({ statePath, logPath, reason, detail = {} }) {
             updated_at: now
         };
         saveState(statePath, stalledConversation);
+        releaseClaudeHookLease(stalledConversation);
         appendEvent(logPath, {
             ts: now,
             conversation_id: conversation.conversation_id,
@@ -6209,6 +7092,7 @@ function usage() {
   agent-knock-knock recover --conversation <id> [--session <name>] [--all-proxy <url>]
   agent-knock-knock close --conversation <id> [--reason <text>]
   agent-knock-knock install-openclaw [--openclaw-bin <path>] [--skill-path <path>] [--skill-only] [--no-restart]
+  agent-knock-knock install-claude-hooks [--settings-path <path>] [--executable-path <path>] [--dry-run]
   agent-knock-knock doctor
   agent-knock-knock agent takeover --agent codex --session-id <id> --strategy terminate_then_resume|terminal_control|fork [--create-conversation]
   agent-knock-knock callback --state <file> --message-json <json> [--record-only]