@stratusagent/cli 0.3.0 → 0.4.0

package/dist/index.js

@@ -9,8 +9,8 @@ import { AgentRunner, AllowAllApprovalPolicy, EventBus, ToolRegistry, } from '@s
 import { createLocalCommandExecutor, } from '@stratusagent/executor-local';
 import { createPermissionPolicy } from '@stratusagent/permissions';
 import { DEFAULT_ANTHROPIC_MODEL, redactAnthropicRawTurns, } from '@stratusagent/provider-anthropic';
-import { createRememberTool, defineAgent, formatSoul, generateAgentName, parseSoul, } from '@stratusagent/agents';
-import { agentsDirPath, createDemoTool, createFileMemoryStore, createRuntimeProvider, credentialsPath, DEFAULT_ANTHROPIC_BASE_URL, DEFAULT_OPENAI_BASE_URL, DEFAULT_OPENAI_MODEL, DEFAULT_STRATUS_AGENT, discoverActiveConfig, globalConfigPath, loadChannelCredentials, loadCredentials, loadRosterSouls, loadSoulFile, memoryFilePath, migrateLegacyMemory, parseProviderName, readNonEmptyString, readProcessEnv, logsDirPath, readWorkingDirectory, DEFAULT_CONFIG_FILENAME, LEGACY_CONFIG_FILENAME, loadConfigFile, resolveConfigLocation, resolveRuntimeConfig as resolveStateRuntimeConfig, saveChannelCredentials, saveCredentials, withLegacyDefaultMemories, } from '@stratusagent/state';
+import { agentIdWithSuffix, createRememberTool, defineAgent, formatSoul, generateAgentName, parseSoul, } from '@stratusagent/agents';
+import { agentsDirPath, createDemoTool, createFileMemoryStore, createRuntimeProvider, credentialsPath, DEFAULT_ANTHROPIC_BASE_URL, DEFAULT_OPENAI_BASE_URL, DEFAULT_OPENAI_MODEL, DEFAULT_STRATUS_AGENT, discoverActiveConfig, globalConfigPath, loadChannelCredentials, loadCredentials, loadRosterSouls, loadSoulFile, memoryFilePath, migrateLegacyMemory, parseProviderName, readNonEmptyString, readProcessEnv, resolveConfiguredSoul, logsDirPath, readWorkingDirectory, resolveAgentApprovals, DEFAULT_CONFIG_FILENAME, LEGACY_CONFIG_FILENAME, loadConfigFile, resolveConfigLocation, resolveRuntimeConfig as resolveStateRuntimeConfig, saveChannelCredentials, saveCredentials, withLegacyDefaultMemories, } from '@stratusagent/state';
 import { installService, readServiceStatus, servicePlatform, serviceUnitPath, startService, stopService, uninstallService, } from "./service.js";
 export { installService, launchdPlist, readServiceStatus, servicePlatform, serviceUnitPath, startService, stopService, systemdUnit, uninstallService, SERVICE_LABEL, } from "./service.js";
 import { createLogWriter, currentLogPosition, truncateRedirectLogs, formatLogRecord, readRecentRecords, tailLog, } from "./logs.js";
@@ -23,7 +23,7 @@ export { createFileMemoryStore } from '@stratusagent/state';
 // second copy of a number nobody re-reads: it is drawn in the setup header
 // and served from the dashboard's /api/status, so drift here misreports the
 // running build rather than failing anything.
-export const CLI_VERSION = '0.3.0';
+export const CLI_VERSION = '0.4.0';
 const DEFAULT_DASHBOARD_HOST = '127.0.0.1';
 const DASHBOARD_TITLE = 'Stratus Agent Dashboard';
 /**
@@ -97,9 +97,10 @@ Commands:
   serve            Run stratusd, the always-on gateway: durable sessions, the
                    whole roster live at once (each agent on its own provider),
                    delegation, and a watchdog — Ctrl+C / SIGTERM drains cleanly
-                   (--idle-timeout <seconds>, --no-events, --no-log-file,
-                   --config <path>); everything it says is also written to
-                   ~/.stratus/logs, which "stratus logs" reads
+                   (--idle-timeout <seconds>, --approvals <headless|remote>,
+                   --no-events, --no-log-file, --config <path>); everything it
+                   says is also written to ~/.stratus/logs, which
+                   "stratus logs" reads
   service          Keep stratusd running under launchd (macOS) or systemd
                    (Linux): install, uninstall, status, start, stop.
                    Installing starts it now and at every login
@@ -132,7 +133,10 @@ Options:
   --config         Config file path (run: load settings from it, setup: write it)
   --format         Output format: text or json (default: text)
   --no-events      Hide event-by-event progress lines in text mode
-  --approvals      Tool approval mode: always, ask, or never (default: always)
+  --approvals      run/chat: tool approval mode — always, ask, or never (default: always)
+                   serve: how the daemon reaches a human — headless (refuse every
+                   gated call) or remote (ask in Slack). Default headless, or
+                   the config file's "approvals.mode"
   --max-turns      Maximum provider turns per run (default: 8)
   --port           Dashboard port, defaults to an open local port
   --host           Dashboard host (default: 127.0.0.1)
@@ -237,6 +241,15 @@ export const parseCommand = (argv, env = {}) => {
                 index += 1;
                 continue;
             }
+            if (token === '--approvals') {
+                const value = readOptionValue(rest, index, '--approvals');
+                if (value !== 'headless' && value !== 'remote') {
+                    throw new Error(`Unsupported approvals mode: ${value}. Use headless or remote.`);
+                }
+                parsed.approvals = value;
+                index += 1;
+                continue;
+            }
             if (token === '--no-events') {
                 parsed.events = false;
                 continue;
@@ -656,6 +669,10 @@ export const formatEvent = (event) => {
             return `• tool.completed ${event.result.toolName} ok=${String(event.result.ok)}`;
         case 'tool.denied':
             return `• tool.denied ${event.call.toolName}`;
+        case 'tool.approval-requested':
+            return `• tool.approval-requested ${event.call.toolName} (${event.risk}) for ${event.agentId}`;
+        case 'tool.approval-resolved':
+            return `• tool.approval-resolved ${event.answer} (${event.reason})${event.actor ? ` by ${event.actor}` : ''}`;
         case 'session.completed':
             return `• session.completed ${event.sessionId}`;
         case 'session.failed':
@@ -668,6 +685,14 @@ export const formatEvent = (event) => {
  * The fields worth keeping per event type. Tool inputs and message text
  * are deliberately excluded: the log is a trace of what happened, not a
  * second copy of the transcript.
+ *
+ * The approval pair is the one place the trace carries a person's id, and
+ * it earns it: `always` widens what an agent may do unattended for the rest
+ * of the session, and "who decided that" is unanswerable afterwards from
+ * anything else. The refusal path is warned about by `onDecision`, but an
+ * *approval* produces no warning at all — without these two records a
+ * granted permission leaves no trace whatsoever. Still no tool input: what
+ * was asked is here, what it was asked with is not.
  */
 const eventDetail = (event) => {
     switch (event.type) {
@@ -680,14 +705,30 @@ const eventDetail = (event) => {
             return { tool: event.call.toolName };
         case 'tool.completed':
             return { tool: event.result.toolName, ok: event.result.ok };
+        case 'tool.approval-requested':
+            return { tool: event.call.toolName, risk: event.risk, requestId: event.requestId };
+        case 'tool.approval-resolved':
+            return {
+                requestId: event.requestId,
+                answer: event.answer,
+                reason: event.reason,
+                ...(event.actor ? { actor: event.actor } : {}),
+            };
         case 'session.failed':
             return { error: event.error };
         default:
             return undefined;
     }
 };
-// Kept with its historical CLI signature: a parsed run command is a
-// RuntimeSelection plus CLI-only fields the resolver ignores.
+/**
+ * Kept with its historical CLI signature: a parsed run command is a
+ * RuntimeSelection plus CLI-only fields the resolver ignores.
+ *
+ * Those fields are *permitted*, not required. Demanding a whole
+ * `ParsedRunCommand` made the type claim the resolver cared about
+ * `approvals`, `format`, and `events` — it reads none of them — so every
+ * caller with a selection in hand had to invent values to get past it.
+ */
 export const resolveRuntimeConfig = (command, env = {}) => resolveStateRuntimeConfig(command, env);
 /**
  * A saved subscription sign-in silently demoted to per-token billing is the
@@ -1691,7 +1732,12 @@ export const slackAppManifest = (agentName) => JSON.stringify({
     oauth_config: { scopes: { bot: SLACK_BOT_SCOPES } },
     settings: {
         event_subscriptions: { bot_events: SLACK_BOT_EVENTS },
-        interactivity: { is_enabled: false },
+        // Required for remote approval: Allow / Always allow / Deny arrive as
+        // block_actions, and Slack delivers none of them to an app that has
+        // interactivity switched off. Enabled unconditionally rather than per
+        // mode — an app is created once, and discovering months later that the
+        // buttons do nothing means editing the manifest and reinstalling.
+        interactivity: { is_enabled: true },
         org_deploy_enabled: false,
         socket_mode_enabled: true,
         token_rotation_enabled: false,
@@ -1714,6 +1760,104 @@ const KNOWN_CLAUDE_MODELS = [
     'claude-opus-4-6',
     'claude-sonnet-4-6',
 ];
+/**
+ * The ids a newly created soul must not claim: every id the served roster
+ * holds, which is three things and not one directory.
+ *
+ * - **What the roster files declare.** A filename is not an id: a soul at
+ *   `renamed.md` may declare `id: ava`, so `ava.md` being free proves
+ *   nothing — and since a duplicate refuses the whole roster, writing one
+ *   would hand back an agent whose daemon cannot start.
+ * - **The configured default soul**, which the daemon registers whether or
+ *   not its file lives in the agents directory. It wins a same-id contest
+ *   with a roster file — `defaultAgentId` replaces the source when the
+ *   path differs — so a new agent sharing its id is not refused, it is
+ *   shadowed: created, then undispatchable by id or from Slack, with
+ *   nothing saying so.
+ * - **The reserved `stratus`**, since a roster soul claiming it is skipped
+ *   at load, so writing one creates an agent that silently never appears.
+ *
+ * The two readable sources fail **independently**, and what they return is
+ * what they know rather than all-or-nothing. A configured soul that is
+ * missing or mid-edit does not stop the daemon serving the roster, so it
+ * must not discard the roster's claims either: collapsing both to unknown
+ * would let this command write the very duplicate that refuses the roster
+ * it could have read. `unread` names what could not be answered, so the
+ * caller can say which check did not run instead of implying none did.
+ */
+const declaredAgentIds = async (env) => {
+    const [roster, configured] = await Promise.allSettled([
+        loadRosterSouls(env, () => { }),
+        // Empty selection: the soul a run started here would resolve, by the
+        // same precedence the daemon uses — never a second reading of it.
+        resolveConfiguredSoul({}, env),
+    ]);
+    const ids = new Set([DEFAULT_STRATUS_AGENT.id]);
+    const unread = [];
+    if (roster.status === 'fulfilled') {
+        for (const entry of roster.value) {
+            ids.add(entry.soul.agent.id);
+        }
+    }
+    else {
+        unread.push('the roster');
+    }
+    if (configured.status === 'fulfilled') {
+        if (configured.value) {
+            ids.add(configured.value.soul.agent.id);
+        }
+    }
+    else {
+        unread.push('the configured default soul');
+    }
+    return { ids, unread };
+};
+/**
+ * Write a new soul under an id nothing else holds, and return the agent
+ * that got written.
+ *
+ * The name stays theirs, but the id — the soul filename, the memory key,
+ * the credential scope — must be unique: the suggestion pool is small, so
+ * a repeat name would otherwise share an earlier agent's memory. Two
+ * claims have to fail here, and only one of them is a filename:
+ *
+ * - An id another soul declares, whatever that soul is called on disk.
+ *   Since a duplicate refuses the whole roster, writing one would leave a
+ *   daemon that will not start — created by the command meant to help.
+ * - The path itself, via `wx`, which makes the claim atomic against a
+ *   concurrent writer that the roster read above cannot see.
+ *
+ * On either, the id takes a fresh suffix and we try again — through the
+ * shared bound, since appending a suffix to a maxed-out base would build
+ * an id the validator refuses, turning a collision into a crash.
+ */
+const claimSoulFile = async (env, input, render, note) => {
+    const { ids: taken, unread } = await declaredAgentIds(env);
+    if (unread.length > 0) {
+        note(`Note: could not read ${unread.join(' or ')}, so this id was not checked against the ids it declares.`);
+    }
+    let agent = defineAgent({ ...(input.name ? { name: input.name } : {}), instructions: input.instructions });
+    const baseId = agent.id;
+    for (;;) {
+        const soulPath = path.join(agentsDirPath(env), `${agent.id}.md`);
+        if (!taken.has(agent.id)) {
+            try {
+                await writeFile(soulPath, render(agent), { flag: 'wx' });
+                return { agent, soulPath };
+            }
+            catch (error) {
+                if (error.code !== 'EEXIST') {
+                    throw error;
+                }
+            }
+        }
+        agent = defineAgent({
+            id: agentIdWithSuffix(baseId, randomUUID().slice(0, 4)),
+            ...(input.name ? { name: input.name } : { name: agent.name }),
+            instructions: input.instructions,
+        });
+    }
+};
 export const runSetup = async (command, streams, env = {}) => {
     const cwd = readWorkingDirectory(env);
     const processEnv = readProcessEnv(env);
@@ -2298,17 +2442,13 @@ export const runSetup = async (command, streams, env = {}) => {
         }
         const name = await prompter.ask('Name your agent (Enter to have one generated): ');
         const instructions = await prompter.ask('Describe their personality in a sentence or two (Enter for a starter you can edit later): ');
-        const agent = defineAgent({
-            ...(name ? { name } : {}),
-            instructions: instructions || DEFAULT_SOUL_STARTER,
-        });
-        const soul = formatSoul({
-            agent,
-            ...(state.provider !== 'demo' ? { provider: state.provider, model: state.model ?? defaultModelFor(state.provider) } : {}),
-        });
-        const soulPath = path.join(agentsDirPath(env), `${agent.id}.md`);
-        await mkdir(path.dirname(soulPath), { recursive: true });
-        await writeFile(soulPath, soul);
+        const persona = instructions || DEFAULT_SOUL_STARTER;
+        const pin = state.provider !== 'demo'
+            ? { provider: state.provider, model: state.model ?? defaultModelFor(state.provider) }
+            : {};
+        await mkdir(agentsDirPath(env), { recursive: true });
+        const claimed = await claimSoulFile(env, { ...(name ? { name } : {}), instructions: persona }, (agent) => formatSoul({ agent, ...pin }), (message) => writeLine(streams.stdout, message));
+        const { agent, soulPath } = claimed;
         state.soulPath = soulPath;
         writeLine(streams.stdout, `Say hello to ${agent.name}.`);
         writeLine(streams.stdout, `Their soul lives at ${soulPath} — edit it any time to change how they talk.`);
@@ -2500,19 +2640,31 @@ export const runSetup = async (command, streams, env = {}) => {
         // built-in's place — the gateway skips it, so offering it here would
         // name an app after an agent that never receives the messages.
         const entries = [{ soul: { agent: { ...DEFAULT_STRATUS_AGENT } } }];
-        // Mirror the gateway's loadRoster: two soul files declaring the same
-        // id are not two agents. Offering both would let someone create and
-        // name an app for the loser, which can never receive a message —
-        // Slack credentials are keyed by the shared id, and dispatch reaches
-        // the first sorted file.
-        for (const entry of await loadRosterSouls(env, warnOnce)) {
-            const clash = entries.find((seen) => seen.soul.agent.id === entry.soul.agent.id);
-            if (clash) {
-                warnOnce(`duplicate agent id ${entry.soul.agent.id} (${clash.path ?? 'built-in'} vs ${entry.path}); keeping the first`);
-                continue;
-            }
-            entries.push(entry);
+        // loadRosterSouls refuses a roster whose files collide, and drops the
+        // ones claiming the reserved built-in id, so what comes back here is
+        // already unambiguous.
+        let rosterSouls = [];
+        let rosterLoaded = true;
+        try {
+            rosterSouls = await loadRosterSouls(env, warnOnce);
         }
+        catch (error) {
+            // A roster that cannot say who its agents are cannot have channels
+            // configured for them — but the rest of setup (providers, models,
+            // sign-ins) still works, so this reports and moves on rather than
+            // taking the whole command down.
+            rosterLoaded = false;
+            warnOnce(error instanceof Error ? error.message : String(error));
+            // Nothing is offered, not merely the colliding pair. A roster that
+            // refuses to load fails `createGateway.start()` outright, so no
+            // agent is servable — not the built-in seeded above, and not the
+            // configured soul resolved below (which can itself BE one of the
+            // colliding files). Listing any of them invites connecting a Slack
+            // app to an agent the daemon cannot bring online, and connecting an
+            // app is the expensive half of that mistake.
+            return { entries: [], loaded: false };
+        }
+        entries.push(...rosterSouls);
         // The soul a run resolves to, in resolveSoulPath's own order: an env
         // override outranks the config value this setup session is editing.
         // Listing the config soul while `stratus serve` registers the env one
@@ -2525,11 +2677,11 @@ export const runSetup = async (command, streams, env = {}) => {
         }
         const effectiveSoul = typeof envSoul === 'string' ? envSoul : state.soulPath;
         if (!effectiveSoul) {
-            return entries;
+            return { entries, loaded: rosterLoaded };
         }
         const resolved = path.resolve(readWorkingDirectory(env), effectiveSoul);
         if (entries.some((entry) => entry.path === resolved)) {
-            return entries;
+            return { entries, loaded: rosterLoaded };
         }
         try {
             const soul = await loadSoulFile(resolved);
@@ -2548,7 +2700,7 @@ export const runSetup = async (command, streams, env = {}) => {
         catch (error) {
             warnOnce(`could not read the default soul ${resolved} (${error instanceof Error ? error.message : String(error)})`);
         }
-        return entries;
+        return { entries, loaded: rosterLoaded };
     };
     const serviceSummary = () => {
         if (!servicePlatform(serviceEnvFor(env))) {
@@ -2594,7 +2746,7 @@ export const runSetup = async (command, streams, env = {}) => {
     };
     const chooseChannels = async () => {
         while (true) {
-            const roster = await channelRoster();
+            const { entries: roster, loaded: rosterLoaded } = await channelRoster();
             const slack = state.channels.slack ?? {};
             // The roster always holds at least the built-in agent, so there is
             // no empty state to short-circuit on — and short-circuiting would
@@ -2606,7 +2758,19 @@ export const runSetup = async (command, streams, env = {}) => {
             });
             // Orphans: tokens whose agent left the roster would otherwise be
             // invisible here while still being loaded by `stratus serve`.
-            const orphans = Object.keys(slack).filter((id) => !roster.some((entry) => entry.soul.agent.id === id));
+            //
+            // Only when the roster actually loaded. "No agent has this id" is a
+            // claim about the roster, and a roster that refused to load cannot
+            // support it — every stored token would look orphaned, and this list
+            // offers to DELETE them. Losing a working agent's Slack credentials
+            // because a different pair of files collided is a far worse outcome
+            // than leaving a real orphan on screen for one run.
+            const orphans = rosterLoaded
+                ? Object.keys(slack).filter((id) => !roster.some((entry) => entry.soul.agent.id === id))
+                : [];
+            if (!rosterLoaded) {
+                writeLine(streams.stderr, 'Warning: no agents are offered while the roster is unreadable — the daemon cannot start either. Fix the roster first.');
+            }
             for (const id of orphans) {
                 options.push(`${id}`.padEnd(34) + '! tokens without a matching agent');
             }
@@ -3306,12 +3470,28 @@ export const collectDoctorReport = async (command, warn, env = {}) => {
     }
     // Tokens keyed to an agent the roster no longer has are loaded and
     // skipped on every start, silently.
-    const rosterIds = new Set((await loadRosterSouls(env, warn)).map((entry) => entry.soul.agent.id));
+    let rosterEntries = [];
+    let rosterLoaded = true;
+    try {
+        rosterEntries = await loadRosterSouls(env, warn);
+    }
+    catch (error) {
+        // Doctor exists to name problems, so a roster it cannot load is a
+        // finding to report — not an exception that replaces the report.
+        rosterLoaded = false;
+        problems.push(error instanceof Error ? error.message : String(error));
+    }
+    const rosterIds = new Set(rosterEntries.map((entry) => entry.soul.agent.id));
     rosterIds.add(DEFAULT_STRATUS_AGENT.id);
     if (soul) {
         rosterIds.add(soul.agent.id);
     }
-    const orphans = slackAgents.filter((id) => !rosterIds.has(id));
+    // Only against a roster that actually loaded. "No agent has this id" is
+    // a claim about the roster, and a refused one cannot support it — every
+    // stored token would be reported as orphaned, and this advises clearing
+    // them. Advice is not deletion, but an operator who follows it loses the
+    // same credentials by hand.
+    const orphans = rosterLoaded ? slackAgents.filter((id) => !rosterIds.has(id)) : [];
     if (orphans.length > 0) {
         problems.push(`Slack tokens are stored for ${orphans.join(', ')}, which no agent matches — \`stratus serve\` skips them. `
             + 'Clear them from `stratus setup` → Channels.');
@@ -3476,7 +3656,11 @@ const servedRuntimes = async (env, configPath) => {
         configPresent: location !== undefined,
     };
     const passes = [{ selection: {}, env }];
-    for (const entry of await loadRosterSouls(env, () => { })) {
+    // A roster that will not load is the gateway's to refuse, with a better
+    // message than this preflight could give — so it checks what it can and
+    // leaves the failing to start().
+    const rosterForRuntimes = await loadRosterSouls(env, () => { }).catch(() => []);
+    for (const entry of rosterForRuntimes) {
         const normalized = applySoulPins(entry.soul, {}, env, context);
         passes.push({ selection: normalized.selection, env: normalized.env });
     }
@@ -3491,6 +3675,77 @@ const servedRuntimes = async (env, configPath) => {
     }
     return resolved;
 };
+/**
+ * The daemon's `approvals` block, from the config file the daemon itself
+ * would load. Discovery goes through the shared resolver rather than
+ * reading ~/.stratus/config.json directly: `--config` and STRATUS_CONFIG
+ * both move it, and a second copy of that precedence would resolve the
+ * approver set from a file the gateway is not running on.
+ *
+ * **Only from a trusted location.** An auto-discovered project-local
+ * `stratus.config.json` outranks the global one and can be checked into any
+ * repository — which is why stored credentials are already never combined
+ * with an endpoint it selects. This block is the same kind of boundary and
+ * a sharper one: it names the people who may authorize an agent's gated
+ * tool calls, and it would do so through Slack tokens the user configured
+ * globally. A cloned repo must not be able to appoint its own approver, so
+ * an untrusted config's approvals are ignored — loudly, since silently
+ * dropping the block someone is looking at is its own kind of wrong.
+ *
+ * An unreadable config degrades to headless with a warning, matching how
+ * every other consumer treats one: refusing to start would take the whole
+ * fleet down over a policy block that may not even be present.
+ */
+const loadServeApprovals = async (env, configPath, warn) => {
+    try {
+        const location = await resolveConfigLocation(configPath ? { configPath } : {}, env);
+        if (!location) {
+            return {};
+        }
+        const approvals = (await loadConfigFile(location.path)).approvals;
+        if (!approvals) {
+            return {};
+        }
+        if (!location.trusted) {
+            warn(`ignoring the approvals config in ${location.path}: a project-local config cannot decide who may approve `
+                + 'this daemon\'s tool calls. Move it to ~/.stratus/config.json, or pass it with --config.');
+            return {};
+        }
+        return approvals;
+    }
+    catch (error) {
+        warn(`ignoring the approvals config (${error instanceof Error ? error.message : String(error)}); refusing gated calls`);
+        return {};
+    }
+};
+/**
+ * One line naming who can actually answer, so a remote daemon does not look
+ * configured when it is not. Two ways it can be hollow, and they fail
+ * differently, so they read differently:
+ *
+ * - No channel running at all (no Slack tokens, or the optional package is
+ *   not installed) — nothing renders the request, so the turn waits out the
+ *   whole timeout before being denied. That is the bad one, and the only
+ *   place it is visible is here, at startup.
+ * - A channel is running but an agent has no approvers — the adapter denies
+ *   that agent's requests on arrival, which is at least prompt.
+ *
+ * `agentIds` is therefore the agents that can actually be *asked*, not
+ * every agent with tokens on disk.
+ */
+const describeApprovers = (approvals, agentIds) => {
+    if (agentIds.length === 0) {
+        return 'but no channel is running to ask through, so gated calls will wait out the approval timeout and then be denied';
+    }
+    const covered = agentIds.filter((agentId) => (resolveAgentApprovals(approvals, agentId).slackApprovers ?? []).length > 0);
+    if (covered.length === 0) {
+        return 'but no approvers are configured, so every gated call is denied on arrival';
+    }
+    const uncovered = agentIds.filter((agentId) => !covered.includes(agentId));
+    return uncovered.length === 0
+        ? `approvers set for ${covered.join(', ')}`
+        : `approvers set for ${covered.join(', ')}; none for ${uncovered.join(', ')}, whose calls are denied on arrival`;
+};
 /**
  * `stratus service` — run the daemon under launchd or systemd, so it
  * survives logout, crashes, and reboots. `serve` itself stays a plain
@@ -3604,7 +3859,6 @@ export const runAgentNew = async (command, streams, env = {}) => {
             const name = (await prompter.ask('Choose your name: ', { prefill: suggested })) || suggested;
             const instructions = await prompter.ask('Describe their personality (Enter for a starter you can edit later): ', ...(command.instructions ? [{ prefill: command.instructions }] : []));
             const persona = instructions || DEFAULT_SOUL_STARTER;
-            let agent = defineAgent({ name, instructions: persona });
             // Frontmatter pins what a run from this directory would actually use:
             // env vars outrank the active config file (project-local or explicit
             // first, global otherwise), and no provider anywhere falls back to
@@ -3629,27 +3883,9 @@ export const runAgentNew = async (command, streams, env = {}) => {
                 ?? (configModelApplies ? activeConfig.model : undefined)
                 ?? (soulProvider === 'openai' ? DEFAULT_OPENAI_MODEL : DEFAULT_ANTHROPIC_MODEL);
             const soulPin = soulProvider !== 'demo' ? { provider: soulProvider, model: soulModel } : {};
-            // The name stays theirs, but the id — the soul filename and the
-            // memory key — must be unique: the suggestion pool is small, so a
-            // repeat name would otherwise silently overwrite an earlier agent's
-            // soul and share their memory. 'wx' makes each claim atomic; on a
-            // collision the id gets a fresh suffix and we try again.
             await mkdir(agentsDirPath(env), { recursive: true });
-            const baseId = agent.id;
-            let soulPath = path.join(agentsDirPath(env), `${agent.id}.md`);
-            for (;;) {
-                try {
-                    await writeFile(soulPath, formatSoul({ agent, ...soulPin }), { flag: 'wx' });
-                    break;
-                }
-                catch (error) {
-                    if (error.code !== 'EEXIST') {
-                        throw error;
-                    }
-                    agent = defineAgent({ id: `${baseId}-${randomUUID().slice(0, 4)}`, name, instructions: persona });
-                    soulPath = path.join(agentsDirPath(env), `${agent.id}.md`);
-                }
-            }
+            const claimed = await claimSoulFile(env, { name, instructions: persona }, (candidate) => formatSoul({ agent: candidate, ...soulPin }), (message) => writeLine(streams.stdout, message));
+            const { agent, soulPath } = claimed;
             const makeDefault = await prompter.select(`Make ${agent.name} your default agent?`, [
                 'Yes — every stratus run talks to them',
                 'Not now',
@@ -3812,6 +4048,11 @@ export const runServe = async (command, streams, env = {}) => {
     // tokens are gateway infrastructure secrets in the channels namespace of
     // ~/.stratus/credentials.json (see @stratusagent/channel-slack's README
     // for the 2-minute per-agent app setup).
+    // The approval policy and the Slack approver sets come from the same
+    // config block, resolved once here: the daemon must not answer "who can
+    // approve this" differently from "is anyone being asked at all".
+    const approvalsConfig = await loadServeApprovals(env, command.configPath, warn);
+    const approvalMode = command.approvals ?? approvalsConfig.mode ?? 'headless';
     const channelCredentials = await loadChannelCredentials(env);
     const slackAgents = Object.entries(channelCredentials.slack ?? {});
     const channels = [];
@@ -3824,11 +4065,16 @@ export const runServe = async (command, streams, env = {}) => {
         const adapter = await loadSlackAdapter();
         if (adapter) {
             channels.push(adapter({
-                agents: slackAgents.map(([agentId, tokens]) => ({
-                    agentId,
-                    appToken: tokens.appToken,
-                    botToken: tokens.botToken,
-                })),
+                agents: slackAgents.map(([agentId, tokens]) => {
+                    const route = resolveAgentApprovals(approvalsConfig, agentId);
+                    return {
+                        agentId,
+                        appToken: tokens.appToken,
+                        botToken: tokens.botToken,
+                        ...(route.slackApprovers ? { approvers: route.slackApprovers } : {}),
+                        ...(route.slackChannel ? { approvalChannel: route.slackChannel } : {}),
+                    };
+                }),
                 log,
                 warn,
             }));
@@ -3876,23 +4122,36 @@ export const runServe = async (command, streams, env = {}) => {
     // while `serve` was something you ran in a terminal you were sitting at;
     // it is not, now that setup installs it under launchd by default.
     //
-    // Headless is the only honest mode here until a turn can park and ask
-    // through a channel: there is no terminal behind a service manager, so
-    // `safe` runs and anything riskier is refused rather than waved through.
-    // Every refusal is logged — an unattended denial that appears nowhere
-    // reads like an agent that decided not to bother.
-    const approvals = createPermissionPolicy({
-        mode: 'headless',
-        onDecision: (decision) => {
-            if (decision.allowed) {
-                return;
-            }
-            warn(`${decision.agentId}: ${decision.reason} (session ${decision.sessionId})`);
-        },
-    });
+    // There is no terminal behind a service manager, so the choice is
+    // between refusing every gated call (`headless`) and parking the turn to
+    // ask through a channel (`remote`). Headless stays the default: a daemon
+    // that starts waiting on people who were never told they are on the hook
+    // hangs turns instead of refusing them. Every refusal is logged — an
+    // unattended denial that appears nowhere reads like an agent that decided
+    // not to bother.
+    const onDecision = (decision) => {
+        if (decision.allowed) {
+            return;
+        }
+        warn(`${decision.agentId}: ${decision.reason} (session ${decision.sessionId})`);
+    };
+    // A factory, not a policy: remote mode parks turns on a transport the
+    // gateway owns, so the policy cannot exist until the gateway is building
+    // it. Headless takes the same path so there is one construction site.
+    const approvals = (transport) => createPermissionPolicy(approvalMode === 'remote'
+        ? { mode: 'remote', request: transport.request, onDecision }
+        : { mode: 'headless', onDecision });
+    if (approvalMode === 'remote') {
+        // Only agents whose channel actually came up can be asked: tokens on
+        // disk with the Slack package missing means nothing renders the
+        // request, and the turn discovers that by hanging.
+        const askable = channels.length > 0 ? slackAgents.map(([agentId]) => agentId) : [];
+        log(`approvals: remote — gated calls are parked and asked in Slack (${describeApprovers(approvalsConfig, askable)})`);
+    }
     const gateway = createGateway({
         env,
         approvals,
+        ...(approvalsConfig.timeoutMs !== undefined ? { approvalTimeoutMs: approvalsConfig.timeoutMs } : {}),
         ...(command.configPath ? { selection: { configPath: command.configPath } } : {}),
         ...(command.idleTimeoutMs !== undefined ? { idleTimeoutMs: command.idleTimeoutMs } : {}),
         ...(channels.length > 0 ? { channels } : {}),
@@ -3959,6 +4218,21 @@ export const runServe = async (command, streams, env = {}) => {
         });
     }
     await gateway.start();
+    // The roster is only known once the gateway has loaded it, and in remote
+    // mode an agent no channel can ask for is the quietest failure this
+    // feature has: its gated calls park with nobody rendering them and wait
+    // out the whole timeout before being denied. No channel can detect this
+    // on its own — a request is a broadcast, and no adapter knows whether
+    // another one is about to answer — so it is reported here, where the
+    // roster and the channel list are both in view.
+    if (approvalMode === 'remote') {
+        const askable = new Set(channels.length > 0 ? slackAgents.map(([agentId]) => agentId) : []);
+        const unreachable = gateway.agents().map((agent) => agent.id).filter((id) => !askable.has(id));
+        if (unreachable.length > 0) {
+            warn(`no channel can ask for ${unreachable.join(', ')}, so their gated calls will wait out the `
+                + 'approval timeout and then be denied. Connect a Slack app for them, or run with --approvals headless.');
+        }
+    }
     writeLine(streams.stdout, 'Press Ctrl+C to stop.');
     // And periodically, for a long-running daemon that warns steadily
     // without ever writing enough records to rotate. Unref'd, so it never