@staix/agent-hub 0.12.20 → 0.12.22

package/docs/verified.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "documents": {
     "README.md": {
-      "verifiedAgainst": "f18ba89fe7f41d3ff11c87ecdd02886386787227",
+      "verifiedAgainst": "146db2d192b3dfc129fd9fef2dd24452aa7f64ae",
       "paths": [
         "package.json",
         "src/",
@@ -11,14 +11,14 @@
       ]
     },
     "docs/security.md": {
-      "verifiedAgainst": "f18ba89fe7f41d3ff11c87ecdd02886386787227",
+      "verifiedAgainst": "48fc0eebcf24cb2bbb0a3a1abc17530ef49ed395",
       "paths": [
         "src/",
         "templates/"
       ]
     },
     "docs/operations.md": {
-      "verifiedAgainst": "f18ba89fe7f41d3ff11c87ecdd02886386787227",
+      "verifiedAgainst": "146db2d192b3dfc129fd9fef2dd24452aa7f64ae",
       "paths": [
         "package.json",
         "src/",
@@ -35,7 +35,7 @@
       ]
     },
     "docs/quickstart.md": {
-      "verifiedAgainst": "f18ba89fe7f41d3ff11c87ecdd02886386787227",
+      "verifiedAgainst": "146db2d192b3dfc129fd9fef2dd24452aa7f64ae",
       "paths": [
         "package.json",
         "src/",
@@ -43,7 +43,7 @@
       ]
     },
     "docs/agent-notes/adapters.md": {
-      "verifiedAgainst": "f18ba89fe7f41d3ff11c87ecdd02886386787227",
+      "verifiedAgainst": "48fc0eebcf24cb2bbb0a3a1abc17530ef49ed395",
       "paths": [
         "src/adapters/",
         "src/pi/",
@@ -52,11 +52,15 @@
         "src/hub/lifecycle.ts",
         "src/memory/capture.ts",
         "scripts/benchmarks/teardown.ts",
-        "src/hub/daemon.ts"
+        "src/hub/daemon.ts",
+        "src/hub/permission-mode.ts",
+        "src/hub/tool-refusal.ts",
+        "src/cli/identity.ts",
+        "src/local/tools.ts"
       ]
     },
     "docs/agent-notes/benchmarks.md": {
-      "verifiedAgainst": "84a3c404d3fe3e293495009cffa11b204d0d3523",
+      "verifiedAgainst": "48fc0eebcf24cb2bbb0a3a1abc17530ef49ed395",
       "paths": [
         "scripts/benchmarks/",
         "test/benchmarks/",
@@ -68,7 +72,7 @@
       ]
     },
     "docs/agent-notes/budget.md": {
-      "verifiedAgainst": "f18ba89fe7f41d3ff11c87ecdd02886386787227",
+      "verifiedAgainst": "48fc0eebcf24cb2bbb0a3a1abc17530ef49ed395",
       "paths": [
         "src/hub/budget.ts",
         "src/cli/statusline-tee.ts",
@@ -80,7 +84,7 @@
       ]
     },
     "docs/agent-notes/bus.md": {
-      "verifiedAgainst": "f18ba89fe7f41d3ff11c87ecdd02886386787227",
+      "verifiedAgainst": "48fc0eebcf24cb2bbb0a3a1abc17530ef49ed395",
       "paths": [
         "src/hub/bus.ts",
         "src/hub/envelope.ts",
@@ -92,7 +96,7 @@
       ]
     },
     "docs/agent-notes/daemon.md": {
-      "verifiedAgainst": "f18ba89fe7f41d3ff11c87ecdd02886386787227",
+      "verifiedAgainst": "48fc0eebcf24cb2bbb0a3a1abc17530ef49ed395",
       "paths": [
         "src/hub/daemon.ts",
         "src/hub/control-client.ts",
@@ -114,16 +118,22 @@
         "src/cli/console.ts",
         "src/cli/console-state.ts",
         "src/cli/identity.ts",
-        "src/cli/identity-audit.ts"
+        "src/cli/identity-audit.ts",
+        "src/hub/registry.ts",
+        "src/cli/main.ts",
+        "src/cli/launch.ts",
+        "src/hub/child-process.ts",
+        "src/hub/bus.ts"
       ]
     },
     "docs/agent-notes/local-worker.md": {
-      "verifiedAgainst": "84a3c404d3fe3e293495009cffa11b204d0d3523",
+      "verifiedAgainst": "48fc0eebcf24cb2bbb0a3a1abc17530ef49ed395",
       "paths": [
         "src/adapters/local-worker.ts",
         "src/local/",
         "src/memory/capture.ts",
-        "src/hub/facts.ts"
+        "src/hub/facts.ts",
+        "src/hub/permission-mode.ts"
       ]
     },
     "docs/agent-notes/models.md": {
@@ -136,7 +146,7 @@
       ]
     },
     "docs/agent-notes/tasks.md": {
-      "verifiedAgainst": "f18ba89fe7f41d3ff11c87ecdd02886386787227",
+      "verifiedAgainst": "48fc0eebcf24cb2bbb0a3a1abc17530ef49ed395",
       "paths": [
         "src/hub/tasks.ts",
         "src/hub/board.ts",
@@ -147,11 +157,13 @@
         "src/cli/main.ts",
         "src/cli/preview.ts",
         "src/hub/conductor.ts",
-        "src/hub/supervision.ts"
+        "src/hub/supervision.ts",
+        "src/hub/tool-refusal.ts",
+        "src/hub/daemon.ts"
       ]
     },
     "docs/agent-notes/tests.md": {
-      "verifiedAgainst": "f18ba89fe7f41d3ff11c87ecdd02886386787227",
+      "verifiedAgainst": "48fc0eebcf24cb2bbb0a3a1abc17530ef49ed395",
       "paths": [
         "test/",
         "scripts/check.sh",
@@ -161,7 +173,12 @@
         "scripts/ci-gates.mjs",
         "scripts/ci-reuse.mjs",
         ".github/workflows/check.yml",
-        ".github/workflows/release.yml"
+        ".github/workflows/release.yml",
+        "src/hub/child-process.ts",
+        "src/switchyard/sidecar.ts",
+        "src/local/sandbox.ts",
+        "src/models/mlx.ts",
+        "src/cli/upgrade-interactive.ts"
       ]
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@staix/agent-hub",
-  "version": "0.12.20",
+  "version": "0.12.22",
   "description": "Native multi-agent hub: Claude Code, Codex, Kimi Code, Pi and local inference as peers in one project",
   "license": "MIT",
   "type": "module",

package/plugins/agent-hub/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-hub",
-  "version": "0.12.20",
+  "version": "0.12.22",
   "description": "Channel between Claude Code and the agent-hub daemon: peer messages from Codex, Kimi and the local worker arrive as channel events; hub_send replies.",
   "author": {
     "name": "Young Joon Lee",

package/plugins/agent-hub/server.js

@@ -15306,7 +15306,8 @@ function readControl(stateDir) {
       instanceId: status.instanceId,
       cwd: status.cwd,
       protocol: status.protocol,
-      pid: status.pid
+      pid: status.pid,
+      ...typeof status.pidSignature === "string" && status.pidSignature ? { pidSignature: status.pidSignature } : {}
     };
   } catch {
     return;
@@ -15403,7 +15404,7 @@ class ControlClient {
 // package.json
 var package_default = {
   name: "@staix/agent-hub",
-  version: "0.12.20",
+  version: "0.12.22",
   description: "Native multi-agent hub: Claude Code, Codex, Kimi Code, Pi and local inference as peers in one project",
   license: "MIT",
   type: "module",

package/src/adapters/acp.ts

@@ -1,6 +1,7 @@
 import { spawn, type ChildProcessWithoutNullStreams } from "node:child_process";
 import { createInterface } from "node:readline";
 import { renderDigest, replyAudience, replyParent, type Envelope, type PeerId } from "../hub/envelope.ts";
+import { KIMI_MODE_IDS, type PermissionMode } from "../hub/permission-mode.ts";
 import { BasePeer } from "../hub/peers.ts";
 import { peerChildEnv, stopOwnedProcess, trackGroup } from "../hub/child-process.ts";
 
@@ -56,6 +57,9 @@ export interface AcpOptions {
   cmd: string[];
   /** Coordinator-visible selected model only; contains no prompts or command arguments. */
   launchModel?: string;
+  permissionMode?: PermissionMode;
+  /** Bound for native mode acknowledgement; defaults to the handshake deadline. */
+  permissionModeTimeoutMs?: number;
   /** Load this earlier session (ACP `session/load`) instead of starting a new one: crash recovery, issue #37. */
   resumeSessionId?: string;
   cwd: string;
@@ -94,6 +98,8 @@ export function canonicalMcpToolName(announcedTitle: string | undefined, serverN
   return m && serverNames?.some((name) => name === m[2]) ? `mcp__${m[2]}__${m[1]}` : undefined;
 }
 
+class RpcTimeoutError extends Error {}
+
 type Pending = { resolve: (v: any) => void; reject: (e: Error) => void };
 
 /** Streamed argument text as a payload: a complete JSON object, or nothing (a partial stream is not what will run). */
@@ -108,6 +114,10 @@ function jsonObject(text: string | undefined): object | undefined {
 
 /** ACP client (JSON-RPC 2.0, newline-delimited, over the child's stdio). One session, one prompt in flight. */
 export class AcpPeer extends BasePeer {
+  private permissionMode: PermissionMode;
+  private modeUnknown = false;
+  private kimiAgent = false;
+  private availableModes = new Set<string>();
   private proc: ChildProcessWithoutNullStreams | undefined;
   private sessionId = "";
   private nextId = 1;
@@ -118,6 +128,7 @@ export class AcpPeer extends BasePeer {
   private readonly toolTitles = new Map<string, string>(); // the title a call was announced with, per call id (#138)
   private primed = false;
   private turn = 0; // generation: a prompt cancelled by the watchdog must not touch the turn that followed it
+  private stopping = false;
   private activeDeliveryId: string | undefined;
   private deliveryAccepted = false;
 
@@ -126,6 +137,7 @@ export class AcpPeer extends BasePeer {
     private readonly opts: AcpOptions,
   ) {
     super(id, opts.watchdogMs);
+    this.permissionMode = opts.permissionMode ?? "ask";
   }
 
   recoveryMetadata(): Record<string, unknown> {
@@ -133,6 +145,7 @@ export class AcpPeer extends BasePeer {
   }
 
   async start(): Promise<void> {
+    this.stopping = false;
     const [bin, ...args] = this.opts.cmd;
     // Its own process group, stopped as a whole (#115, as Codex's in #113): an agent CLI may be a launcher with a native child.
     const proc = spawn(bin!, args, { cwd: this.opts.cwd, env: peerChildEnv(this.id, { ...process.env, ...(this.opts.env ?? {}) }), stdio: ["pipe", "pipe", "pipe"], detached: true });
@@ -149,38 +162,83 @@ export class AcpPeer extends BasePeer {
         protocolVersion: 1,
         clientCapabilities: { fs: { readTextFile: false, writeTextFile: false }, terminal: false },
       });
+      // The configured peer id and command are labels, not an agent-specific mode contract.
+      // Installed Kimi Code CLI's ACP initialize advertises this exact name.
+      this.kimiAgent = init?.agentInfo?.name === "Kimi Code CLI";
       const resume = this.opts.resumeSessionId;
       if (!resume) return this.request("session/new", { cwd: this.opts.cwd, mcpServers: this.opts.mcpServers ?? [] });
       // The agent replays the session as updates while it loads; they arrive before the peer is idle, so none of
       // them is taken for an answer.
       if (!init?.agentCapabilities?.loadSession) throw new Error(`${this.id} cannot load an earlier session (the agent offers no loadSession)`);
-      await this.request("session/load", { sessionId: resume, cwd: this.opts.cwd, mcpServers: this.opts.mcpServers ?? [] });
-      return { sessionId: resume };
+      const loaded = await this.request("session/load", { sessionId: resume, cwd: this.opts.cwd, mcpServers: this.opts.mcpServers ?? [] });
+      return { ...loaded, sessionId: resume };
     };
     const timeout = new Promise<never>((_, reject) => {
       setTimeout(() => reject(new Error(`${this.id} did not complete the ACP handshake within ${HANDSHAKE_MS / 1000} s`)), HANDSHAKE_MS).unref();
     });
     try {
-      this.sessionId = (await Promise.race([handshake(), timeout])).sessionId;
+      const session = await Promise.race([handshake(), timeout]);
+      this.sessionId = session.sessionId;
+      const modes: unknown = session.modes?.availableModes;
+      this.availableModes = new Set(Array.isArray(modes) ? modes.flatMap((mode) => typeof mode?.id === "string" ? [mode.id] : []) : []);
+      // A recovered session can retain a previous runtime opt-in. An advertised non-default mode
+      // must be reset for the configured ask default before any prompt; a fresh ask session stays untouched.
+      const resetResumed = this.opts.resumeSessionId && typeof session.modes?.currentModeId === "string" && session.modes.currentModeId !== KIMI_MODE_IDS.ask;
+      // Other ACP vendors retain their native policy, including reported non-default modes on resume.
+      if (this.kimiAgent && (this.permissionMode !== "ask" || resetResumed)) await this.setPermissionMode(this.permissionMode);
     } catch (e) {
-      await stopOwnedProcess(proc, { group: true }).catch((stop: Error) => this.opts.log?.(`[${this.id}] ${stop.message}`));
+      this.setState("offline");
+      if (this.proc === proc) {
+        await stopOwnedProcess(proc, { group: true }).then(() => { if (this.proc === proc) this.proc = undefined; }, (stop: Error) => this.opts.log?.(`[${this.id}] ${stop.message}`));
+      }
       throw e;
     }
     this.setState("idle");
   }
 
-  async stop(): Promise<void> {
-    if (this.activeDeliveryId) this.delivery({ id: this.activeDeliveryId, state: "needs_review", reason: "ACP session stopped before settlement" });
+  getPermissionMode(): PermissionMode { return this.permissionMode; }
+  get permissionModeState(): PermissionMode | "unknown" | "unmanaged" {
+    return !this.kimiAgent ? "unmanaged" : this.modeUnknown ? "unknown" : this.permissionMode;
+  }
+
+  async setPermissionMode(mode: PermissionMode): Promise<void> {
+    if (!this.kimiAgent) throw new Error(`${this.id} permission mode ${mode} unmanaged: this ACP agent has no verified mode mapping; use Kimi Code CLI or add an agent-specific mapping`);
+    if (this.modeUnknown) throw new Error(`${this.id} permission mode unknown after an unanswered change; restart the peer before changing modes`);
+    const id = KIMI_MODE_IDS[mode];
+    if (!this.sessionId || !this.proc || !this.availableModes.has(id)) throw new Error(`${this.id} permission mode ${mode} unavailable: session does not offer ${id}`);
+    try {
+      await this.request("session/set_mode", { sessionId: this.sessionId, modeId: id }, this.opts.permissionModeTimeoutMs ?? HANDSHAKE_MS);
+    } catch (error) {
+      if (error instanceof RpcTimeoutError) {
+        // No reply means the native mode may have changed. Invalidate the turn before stopping
+        // our verified process group; neither a late prompt result nor a late mode ack restores idle.
+        this.modeUnknown = true;
+        this.turn++;
+        this.setState("offline");
+        await this.stop().catch((stop: Error) => this.opts.log?.(`[${this.id}] ${stop.message}`));
+        throw new Error(`${this.id} permission mode ${mode} unknown: ${error.message}; peer is offline, restart it before sending work`);
+      }
+      throw new Error(`${this.id} permission mode ${mode} refused: ${(error as Error).message}`);
+    }
+    if (this.modeUnknown) throw new Error(`${this.id} permission mode unknown; restart the peer`);
+    this.permissionMode = mode;
+  }
+
+  async stop(reason?: string): Promise<void> {
+    this.stopping = true;
+    if (reason !== undefined) this.turn++; // a requested stop cannot escalate or complete the cancelled turn
+    if (this.activeDeliveryId) this.delivery({ id: this.activeDeliveryId, state: "needs_review", reason: reason ?? "ACP session stopped before settlement" });
     this.activeDeliveryId = undefined;
     const proc = this.proc;
-    if (!proc) return;
+    if (!proc) { this.setState("offline"); return; }
     await stopOwnedProcess(proc, { group: true }); // also when it exited: what it left in its group fails the stop
     if (this.proc === proc) this.proc = undefined;
+    this.setState("offline");
   }
 
   /** Resolves once the prompt is in flight; the turn result arrives on its own. */
   async deliver(envs: Envelope[], deliveryId?: string): Promise<void> {
-    if (this.state !== "idle") {
+    if (this.state !== "idle" || this.stopping) {
       if (deliveryId) this.delivery({ id: deliveryId, state: "failed_safe", reason: `${this.id} is ${this.state}` });
       throw new Error(`${this.id} is ${this.state}`);
     }
@@ -260,6 +318,7 @@ export class AcpPeer extends BasePeer {
   }
 
   private onLine(line: string): void {
+    if (this.stopping) return; // buffered native callbacks cannot recreate approvals after peer_stop
     let msg: any;
     try {
       msg = JSON.parse(line);
@@ -350,10 +409,18 @@ export class AcpPeer extends BasePeer {
     });
   }
 
-  private request(method: string, params: unknown): Promise<any> {
+  private request(method: string, params: unknown, timeoutMs?: number): Promise<any> {
     const id = this.nextId++;
     return new Promise((resolve, reject) => {
-      this.pending.set(id, { resolve, reject });
+      const timer = timeoutMs === undefined ? undefined : setTimeout(() => {
+        this.pending.delete(id);
+        reject(new RpcTimeoutError(`${method} did not answer within ${timeoutMs / 1000} s`));
+      }, timeoutMs);
+      timer?.unref();
+      this.pending.set(id, {
+        resolve: (value) => { clearTimeout(timer); resolve(value); },
+        reject: (error) => { clearTimeout(timer); reject(error); },
+      });
       this.send({ jsonrpc: "2.0", id, method, params });
     });
   }

package/src/adapters/codex-appserver.ts

@@ -1,6 +1,7 @@
 import { spawn, type ChildProcess } from "node:child_process";
 import type { Server, ServerWebSocket } from "bun";
 import { renderDigest, replyAudience, replyParent, type Envelope, type PeerId } from "../hub/envelope.ts";
+import type { PermissionMode } from "../hub/permission-mode.ts";
 import { BasePeer } from "../hub/peers.ts";
 import { codexContext, type ContextReading } from "../hub/context-window.ts";
 import { peerChildEnv, stopOwnedProcess, trackGroup } from "../hub/child-process.ts";
@@ -8,6 +9,7 @@ import { peerChildEnv, stopOwnedProcess, trackGroup } from "../hub/child-process
 export interface CodexOptions {
   /** Port the TUI attaches to: `codex --enable tui_app_server --remote ws://127.0.0.1:<proxyPort>`. */
   proxyPort: number;
+  permissionMode?: PermissionMode;
   /** Port for the spawned `codex app-server`. Ignored when `upstreamUrl` is set. */
   appPort: number;
   /** Attach to an already running app-server instead of spawning one (tests). */
@@ -60,6 +62,10 @@ const TRACKED = new Set(["thread/start", "thread/resume"]);
  * TUI's, and their responses are swallowed.
  */
 export class CodexPeer extends BasePeer {
+  private permissionMode: PermissionMode;
+  private readonly nativeApprovalPolicies = new Map<string, unknown>();
+  private readonly overriddenApprovals = new Set<string>();
+  private readonly restoringApprovals = new Map<string | number, string>();
   private proc: ChildProcess | undefined;
   private server: Server<Link> | undefined;
   private link: Link | undefined; // the connection that owns the current thread
@@ -96,6 +102,7 @@ export class CodexPeer extends BasePeer {
     private readonly opts: CodexOptions,
   ) {
     super(id, opts.watchdogMs);
+    this.permissionMode = opts.permissionMode ?? "ask";
   }
 
   recoveryMetadata(): Record<string, unknown> {
@@ -196,13 +203,14 @@ export class CodexPeer extends BasePeer {
           resolve();
         },
         reject: (e) => {
+          this.restoringApprovals.delete(id);
           if (!this.activeTurns.size) this.setState("idle");
           if (deliveryId) this.delivery({ id: deliveryId, state: this.knownRejection(e) ? "failed_safe" : "needs_review", reason: e.message });
           reject(e);
         },
       });
       link.up.send(
-        JSON.stringify({ method: "turn/start", id, params: { threadId: this.threadId, input: [{ type: "text", text }] } }),
+        JSON.stringify({ method: "turn/start", id, params: this.applyPermissionPolicy({ threadId: this.threadId, input: [{ type: "text", text }] }, id) }),
       );
     });
   }
@@ -350,6 +358,7 @@ export class CodexPeer extends BasePeer {
     if (this.link !== link) return;
     clearInterval(this.usageTimer);
     this.link = undefined;
+    this.restoringApprovals.clear();
     this.threadId = "";
     this.contextEpoch++;
     this.activeTurns.clear();
@@ -372,8 +381,61 @@ export class CodexPeer extends BasePeer {
     this.lastAnswer = "";
   }
 
+  get proxyAttached(): boolean { return !!this.link && this.link.up.readyState === WebSocket.OPEN; }
+
+  getPermissionMode(): PermissionMode { return this.permissionMode; }
+
+  /** Reconcile the daemon's current choice after startup, before the returned proxy URL has a TUI. */
+  setStartupPermissionMode(mode: PermissionMode): void {
+    if (this.link || this.state !== "offline" || this.overriddenApprovals.size) throw new Error("codex startup mode reconciliation requires a fresh unattached proxy");
+    this.permissionMode = mode;
+  }
+
+  /** Clear the overlay while detached, retaining each thread's restoration debt across a resume. */
+  clearPermissionMode(): boolean {
+    const restorable = [...this.overriddenApprovals].every(thread => this.nativeApprovalPolicies.has(thread));
+    this.permissionMode = "ask";
+    return restorable;
+  }
+
+  async setPermissionMode(mode: PermissionMode): Promise<void> {
+    if (!this.link || this.link.up.readyState !== WebSocket.OPEN) throw new Error("codex permission mode unavailable: attach the TUI through ahub codex first");
+    if (mode === "ask" && [...this.overriddenApprovals].some(thread => !this.nativeApprovalPolicies.has(thread))) throw new Error("codex cannot restore ask: native approval policy unavailable; close the TUI, then run ahub permission codex ask before you restart the Codex session with ahub codex");
+    this.permissionMode = mode;
+  }
+
+  private applyPermissionPolicy(params: Record<string, unknown>, id: string | number): Record<string, unknown> {
+    const thread = typeof params.threadId === "string" ? params.threadId : this.threadId;
+    if (this.permissionMode !== "ask") {
+      this.overriddenApprovals.add(thread);
+      return { ...params, approvalPolicy: this.permissionMode === "never-ask" ? "never" : "on-request" };
+    }
+    if (this.overriddenApprovals.has(thread) && this.nativeApprovalPolicies.has(thread)) {
+      this.restoringApprovals.set(id, thread);
+      return { ...params, approvalPolicy: this.nativeApprovalPolicies.get(thread) };
+    }
+    return params;
+  }
+
+  private settlePermissionRestore(id: string | number, failed: boolean): void {
+    const thread = this.restoringApprovals.get(id);
+    this.restoringApprovals.delete(id);
+    if (thread !== undefined && !failed && this.permissionMode === "ask") this.overriddenApprovals.delete(thread);
+  }
+
   private fromTui(link: Link, raw: string): void {
     const msg = parse(raw);
+    if (msg?.method === "turn/start" && msg.params && link === this.link) {
+      const thread = typeof msg.params.threadId === "string" ? msg.params.threadId : this.threadId;
+      // A resumed TUI can echo the sticky hub overlay. The restoring turn must use the kept baseline.
+      const restoring = this.overriddenApprovals.has(thread) && this.nativeApprovalPolicies.has(thread);
+      if (msg.params.approvalPolicy != null && !restoring) this.nativeApprovalPolicies.set(thread, msg.params.approvalPolicy);
+      if (this.permissionMode !== "ask" || this.overriddenApprovals.has(thread)) {
+        // Native turn overrides persist: ask restores the captured native policy once on successful admission.
+        msg.params = this.applyPermissionPolicy(msg.params, msg.id);
+        raw = JSON.stringify(msg);
+      }
+    }
     if (msg?.id !== undefined && TRACKED.has(msg.method)) link.tracked.set(msg.id, msg.method);
     if (link.up.readyState === WebSocket.OPEN) link.up.send(raw);
     else link.backlog.push(raw);
@@ -384,6 +446,7 @@ export class CodexPeer extends BasePeer {
     if (this.state === "busy") this.touch();
     if (!msg) return void link.tui.send(raw);
 
+    if (msg.id !== undefined && !msg.method) this.settlePermissionRestore(msg.id, !!msg.error);
     if (typeof msg.id === "number" && msg.id < 0 && !msg.method) {
       const p = this.pending.get(msg.id);
       this.pending.delete(msg.id);
@@ -393,7 +456,14 @@ export class CodexPeer extends BasePeer {
     }
     if (typeof msg.result?.userAgent === "string") this.version = /^[^/\s]+\/(\d+\.\d+\.\d+(?:-[\w.]+)?)/.exec(msg.result.userAgent)?.[1] ?? this.version;
     const tracked = msg.id !== undefined && !msg.method ? link.tracked.get(msg.id) : undefined;
-    if (tracked && link.tracked.delete(msg.id)) this.adopt(link, msg.result?.thread?.id, tracked === "thread/start");
+    if (tracked && link.tracked.delete(msg.id)) {
+      if (typeof msg.result?.thread?.id === "string") {
+        // A resumed response may report the sticky hub override, not the original native choice.
+        const thread = msg.result.thread.id;
+        if (!this.overriddenApprovals.has(thread) && msg.result.approvalPolicy != null) this.nativeApprovalPolicies.set(thread, msg.result.approvalPolicy);
+        this.adopt(link, msg.result.thread.id, tracked === "thread/start");
+      }
+    }
     else if (msg.method) this.onNotification(link, msg.method, msg.params ?? {});
     link.tui.send(raw);
   }

package/src/adapters/local-worker.ts

@@ -8,7 +8,7 @@ import { renderDigest, replyAudience, replyParent, STANDING_INSTRUCTION, USER, t
 import { CONDUCTOR_TOOL_NAMES, CONDUCTOR_TOOLS, TASK_TOOL_NAMES, TASK_TOOLS } from "../hub/hub-tools.ts";
 import { BasePeer } from "../hub/peers.ts";
 import { profile, proxyEnv, type SandboxNetwork } from "../local/sandbox.ts";
-import { runTool, toolResultFailed, TOOL_SCHEMAS, touchedPaths, type ToolContext } from "../local/tools.ts";
+import { runTool, toolResultFailed, TOOL_SCHEMAS, touchedPaths, ApprovalWaitStop, type ToolApproval, type ApprovalProvenance, type ToolContext } from "../local/tools.ts";
 import type { Capture } from "../memory/capture.ts";
 import type { ChatMessage, ChatResult, OmniRoute, ToolCall } from "../omniroute/client.ts";
 import { safeModelLabel } from "../omniroute/usage.ts";
@@ -32,6 +32,7 @@ export interface LocalOptions {
   onRouteOutcome?: (event: RouteLabelEvent) => void;
   /** The daemon turn id created synchronously on busy, shared with turn_start/end. */
   turnId?: () => string | undefined;
+  onApprovalStop?: (reason: string) => void;
   onTool?: (observation: ToolObservation, task?: string) => void;
   tools: { deny: string[]; permit: ToolContext["permit"]; bashNetwork?: SandboxNetwork; readAllow?: string[] };
   capture?: Capture;
@@ -85,6 +86,9 @@ export class LocalPeer extends BasePeer {
   private abort: AbortController | undefined;
   private budgetTimer?: ReturnType<typeof setTimeout>;
   private budgetStopReason = "";
+  private approvalExpiries = 0;
+  private approvalAnswerEpoch: number | undefined;
+  private approvalStopReason = "";
   private activeDeliveryId: string | undefined;
   private readonly sandboxProfile: string; // built once: profile() spawns git and must stay off the per-call path
   /** What served the last call, for `ahub status`. */
@@ -127,15 +131,15 @@ export class LocalPeer extends BasePeer {
     this.setState("idle");
   }
 
-  async stop(): Promise<void> {
+  async stop(reason?: string): Promise<void> {
     this.endRouteTurn(this.labelTurnId, "failed");
-    if (this.activeDeliveryId) this.delivery({ id: this.activeDeliveryId, state: "needs_review", reason: "turn stopped before settlement" });
+    if (this.activeDeliveryId) this.delivery({ id: this.activeDeliveryId, state: "needs_review", reason: reason ?? "turn stopped before settlement" });
     this.activeDeliveryId = undefined;
     this.turn++;
     clearTimeout(this.budgetTimer); this.budgetTimer = undefined;
     this.abort?.abort();
+    this.setState("offline"); // fence direct delivery before the bounded memory request awaits
     await this.opts.capture?.end();
-    this.setState("offline");
   }
 
   /** Resolves once the turn is claimed; a turn that cannot reach any model hands the envelopes back through onFailed. */
@@ -146,6 +150,7 @@ export class LocalPeer extends BasePeer {
     }
     const turn = ++this.turn;
     this.budgetStopReason = "";
+    this.approvalExpiries = 0; this.approvalAnswerEpoch = undefined; this.approvalStopReason = "";
     clearTimeout(this.budgetTimer); this.budgetTimer = undefined;
     this.activeDeliveryId = deliveryId;
     this.abort = new AbortController();
@@ -172,6 +177,14 @@ export class LocalPeer extends BasePeer {
       })
       .catch((e: Error) => {
         if (turn !== this.turn) return; // aborted by the watchdog or stop(): nothing to report, nothing was committed
+        if (e instanceof ApprovalWaitStop) {
+          this.completeMissingToolResults(msgs, "not run: turn ended after unanswered approvals");
+          msgs.push({ role: "assistant", content: e.message });
+          if (!policy?.pii) this.commit(msgs);
+          this.onMessage?.(e.message, reply);
+          if (deliveryId && this.activeDeliveryId === deliveryId) this.delivery({ id: deliveryId, state: "completed", reason: e.message });
+          return; // even without effects, an unanswered approval must not trigger safe replay
+        }
         if (this.budgetStopReason && !(e instanceof ExecutionBudgetStop)) e = new ExecutionBudgetStop(this.budgetStopReason);
         this.opts.log?.(`[${this.id}] turn failed: ${e.message}`);
         if (e instanceof ExecutionBudgetStop) {
@@ -263,8 +276,10 @@ export class LocalPeer extends BasePeer {
           if (SIDE_EFFECTS.has(call.function.name) && !output.startsWith("error:")) progress.sideEffects++;
           const result: ChatMessage = { role: "tool", tool_call_id: call.id, content: output, is_error: toolResultFailed(name, output) };
           msgs.push(result); results.push(result);
+          if (this.approvalStopReason) { this.abort?.abort(); throw new ApprovalWaitStop(this.approvalStopReason); }
           this.observeTool(call, output, policy, `${this.sessionId}.${turn}.${step}`);
-          capture?.observe({ tool: call.function.name, args: call.function.arguments, output, id: call.id, paths: touchedPaths(call.function.name, safeParse(call.function.arguments)) });
+          // Hub tool arguments/results are not capture evidence; Tasks owns its screened memory writes.
+          if (name !== "hub_send" && !TASK_TOOL_NAMES.has(name) && !CONDUCTOR_TOOL_NAMES.has(name)) capture?.observe({ tool: call.function.name, args: call.function.arguments, output, id: call.id, paths: touchedPaths(call.function.name, safeParse(call.function.arguments)) });
         }
       } finally { if (results.length) this.routes.observeResults(res.routeDecision, res.message, results); }
     }
@@ -276,14 +291,34 @@ export class LocalPeer extends BasePeer {
     return {
       cwd: this.opts.cwd,
       deny: this.opts.tools.deny,
-      permit: async (title) => {
-        if (turnSignal.aborted) return false;
-        return new Promise<boolean>((resolve, reject) => {
-          const finish = (allowed: boolean) => { turnSignal.removeEventListener("abort", onAbort); resolve(allowed); };
-          const onAbort = () => finish(false);
+      permit: async (title, tool, _signal, canonicalTarget) => {
+        if (turnSignal.aborted) return "aborted";
+        const generation = this.turn;
+        let observed = false;
+        const observe = (provenance: ApprovalProvenance) => {
+          observed = true;
+          if (generation !== this.turn || turnSignal.aborted || this.approvalStopReason) return;
+          if (this.approvalAnswerEpoch !== provenance.answerEpoch) {
+            this.approvalExpiries = 0; this.approvalAnswerEpoch = provenance.answerEpoch;
+          }
+          if (provenance.source === "person") this.approvalExpiries = 0;
+          if (provenance.source === "expired" && provenance.eligibleExpiry !== false && ++this.approvalExpiries >= 2) {
+            this.approvalStopReason = "Local turn stopped after two unanswered approvals; no person answered. Do not retry the calls; inspect prior work before handoff or stopping.";
+            try { this.opts.onApprovalStop?.(this.approvalStopReason); } catch { /* stop remains authoritative */ }
+          }
+        };
+        const picked = await new Promise<ToolApproval>((resolve, reject) => {
+          const finish = (decision: ToolApproval) => { turnSignal.removeEventListener("abort", onAbort); resolve(decision); };
+          const onAbort = () => finish("aborted");
           turnSignal.addEventListener("abort", onAbort, { once: true });
-          this.opts.tools.permit(title).then(finish, (error) => { turnSignal.removeEventListener("abort", onAbort); reject(error); });
+          this.opts.tools.permit(title, tool, turnSignal, canonicalTarget, observe).then(finish, (error) => { turnSignal.removeEventListener("abort", onAbort); reject(error); });
         });
+        if (generation !== this.turn || (turnSignal.aborted && picked !== "expired")) return "aborted";
+        // Legacy permit callbacks can represent a person's denial without provenance. A true
+        // result may be automatic, so it must never reset the unanswered-request streak.
+        if (!observed && picked === false) observe({ source: "person", answerEpoch: (this.approvalAnswerEpoch ?? 0) + 1 });
+        if (!observed && picked === "expired") observe({ source: "expired", answerEpoch: this.approvalAnswerEpoch ?? 0, eligibleExpiry: true });
+        return picked;
       },
       sandboxProfile: this.sandboxProfile,
       sandboxEnv: { ...proxyEnv(this.opts.tools.bashNetwork ?? false), AGENTHUB_PEER_ID: this.id },