@wjarka/cezarion 0.16.0 → 0.17.0

package/dist/core/opencode-server-runner.js

@@ -1,3 +1,4 @@
+import { uiAskQuestions } from './ask.js';
 import { opencodeSkillWarning } from './opencode-session-error.js';
 import { summarizeRunnerStderr } from './runner-stderr.js';
 import { finished } from 'node:stream/promises';
@@ -8,6 +9,7 @@ import { parseEffort } from '../contract/index.js';
 import { request as httpRequest } from 'node:http';
 import { InputSubmissions } from './input-submissions.js';
 import { isSignalTerminationExit, prependSystemPrompt, trackChildExit } from './agent-runner.js';
+import { opencodeToolGrantFields } from './runner-tool-grants.js';
 import { signalSession, spawnSessionLeader } from './session-process.js';
 import { buildChildEnv } from './agent-env.js';
 import { ciOpenCodeEnv } from '../ci-wait/injection.js';
@@ -15,6 +17,7 @@ import { parseAskRequest } from './ask.js';
 import { boundOutputDrainAfterExit, AUTO_END_DELAY_MS, DEFAULT_RUN_TIMEOUT_MS } from './runner-runtime.js';
 import { formatModelIdentity, parseModelIdentity } from './model-identity.js';
 import { V1TextCoalescer } from './v1-text-coalescer.js';
+import { isOpencodeDefaultAsk, opencodePermissionAskSchema, opencodePermissionBridge, opencodeUserPermissionRules, } from './opencode-permissions.js';
 import { createOpencodeUiState, mapOpencodeEvent, opencodeSessionStarted, opencodeTurnStarted, } from './opencode-ui-mapper.js';
 const SERVER_START_TIMEOUT_MS = 30_000;
 /**
@@ -42,18 +45,19 @@ export const KILL_GRACE_MS = 4_000;
  * Continue and restart recovery GET /session/{id} and prompt that session; a 404
  * falls back to one fresh session with the full system prompt.
  *
- * Auth = the host's opencode config/logins. The agent runs autonomously
- * (auto-approved permissions); this adapter does not map `spec.allowedTools`.
- * Governed delegation adds only a supported session-level task deny rule.
+ * Auth = the host's opencode config/logins. OpenCode's own permission config
+ * governs tools: cezar answers OpenCode's built-in default asks once and routes
+ * asks the user configured to the cockpit (hearsay-tools/cezarion#1266); this
+ * adapter does not map `spec.toolGrant`. Governed delegation adds only a
+ * supported session-level task deny rule.
  * `spec.model` is `provider/model`.
  */
 /**
- * What `opencode serve` receives from each `AgentRunSpec` field (#284). The
- * server auto-approves permissions and this adapter maps no per-tool
- * allowlist, so `allowedTools`/`bashAllowlist` are declared dropped rather than
- * mapped (spec 2026-07-17-permission-modes). Resume GETs `/session/{id}` and
- * prompts it; a 404 opens one fresh session. Held against the recorded HTTP
- * requests by the harness parity matrix.
+ * What `opencode serve` receives from each `AgentRunSpec` field (#284).
+ * OpenCode's own permission config governs tool access and this adapter maps no
+ * per-tool allowlist, so `toolGrant` is declared dropped rather than mapped (spec
+ * 2026-07-17-permission-modes). Resume GETs `/session/{id}` and prompts it; a 404 opens one
+ * fresh session. Held against the recorded HTTP requests by the harness parity matrix.
  */
 export const OPENCODE_SPEC_SUPPORT = {
     cezarTools: { honored: true, via: 'merged OPENCODE_CONFIG_CONTENT local mcp entry' },
@@ -61,9 +65,8 @@ export const OPENCODE_SPEC_SUPPORT = {
     userPrompt: { honored: true, via: 'prompt_async text part' },
     images: { honored: false, reason: 'the adapter posts text parts only; image blocks are dropped' },
     cwd: { honored: true, via: 'opencode serve spawn cwd; the session is bound to it' },
-    allowedTools: { honored: false, reason: 'permissions are auto-approved server-side and no per-tool allowlist is mapped' },
+    toolGrant: { honored: false, reason: 'OpenCode permission config governs tool access and bash; cezar answers its built-in default asks and routes configured asks to the cockpit, but maps no per-tool allowlist, so no command-prefix restriction either' },
     restrictNativeDelegation: { honored: true, via: 'POST /session permission rule denying task (D1); PATCH /session/{id} permission on resume when the deny is absent — the deny persists on the session once added (a later unrestricted Continue cannot remove it; fails closed)' },
-    bashAllowlist: { honored: false, reason: 'no per-tool allowlist is mapped, so no command-prefix restriction either' },
     additionalDirectories: { honored: false, reason: 'the server works from cwd; no extra-root mapping' },
     env: { honored: true, via: 'merged over the child env through buildChildEnv' },
     model: { honored: true, via: 'prompt_async model { providerID, modelID }, split from provider/model' },
@@ -154,6 +157,11 @@ class OpencodeSession {
     refusedBeforeOpening = false;
     turnErrored = false;
     lostWakeTimer;
+    /** Steered input an idle left unanswered: the server may still start a follow-on run for it.
+     *  Settles when that run starts, or when the lost-wake grace or a teardown ends the wait. */
+    followOn;
+    followOnResolve = () => { };
+    refusedForFollowOn = false;
     tokensUsed = 0;
     /** OpenCode reports a cumulative cost for each message, not the session. */
     costByMessage = new Map();
@@ -193,6 +201,15 @@ class OpencodeSession {
     queuedPromptGeneration = 0;
     /** Human `prompt()` waiters in the current generation that have not posted yet (#486). */
     humanPromptWaiters = 0;
+    /** Native ask id → its live state, entered on receipt (hearsay-tools/cezarion#1266). Any
+     * entry holds agent input and auto-end, like a pending question, until OpenCode settles it. */
+    pendingPermissions = new Map();
+    /** Native ask ids already taken. Outlives retirement, so a duplicated frame is handled once. */
+    handledPermissionIds = new Set();
+    /** Asks are classified one at a time, in arrival order, after the one config read. */
+    permissionQueue = Promise.resolve();
+    permissionRules;
+    answeredDefaultAsk = false;
     autoEndTimer;
     timedOut = false;
     openingPromptFailed = false;
@@ -237,7 +254,9 @@ class OpencodeSession {
                     clearTimeout(this.autoEndTimer);
                 this.sse.abort();
                 this.serverOpen = false;
+                this.clearLostWakeTimer();
                 this.agentRequest?.abort();
+                this.expirePermissions('session ended');
                 this.terminate();
             }
             const serve = this.serve;
@@ -250,7 +269,9 @@ class OpencodeSession {
             // SSE closure can precede the process exit event. Choose one authoritative
             // error after settlement, before the synthetic turn-end, retaining the code.
             const code = serve.child.exitCode;
-            const crashed = code !== null && code !== 0 && !(serve.signalled && isSignalTerminationExit(code));
+            const signal = serve.child.signalCode;
+            const crashed = (signal !== null && !serve.signalled)
+                || (code !== null && code !== 0 && !(serve.signalled && isSignalTerminationExit(code)));
             if (!this.timedOut && (crashed || this.exitFailure)) {
                 const stderr = serve.stderrChunks.join('');
                 const detail = summarizeRunnerStderr(stderr);
@@ -278,7 +299,7 @@ class OpencodeSession {
                     if (stderr.trim())
                         this.emit({ type: 'note', message: `opencode serve stderr:\n${stderr}` });
                     const message = crashed
-                        ? `opencode serve exited with code ${code}${detail ? ` — ${detail}` : ''}`
+                        ? `opencode serve exited with ${describeExit(serve)}${detail ? ` — ${detail}` : ''}`
                         : this.exitFailure;
                     this.emit({ type: 'error', message });
                 }
@@ -312,16 +333,23 @@ class OpencodeSession {
         return this.serve.child.pid;
     }
     sendAgentMessage(content, inputIds = []) {
-        // #505: a busy session is steered with prompt_async; only a pending native question,
-        // a queued human prompt or an in-flight agent POST refuses.
+        // #505: a busy session is steered with prompt_async; only a pending native question or
+        // permission ask, a queued human prompt or an in-flight agent POST refuses.
         // Nothing may run ahead of the task: refuse until the opening prompt has started,
         // then hint once so the refused input steers the opening turn.
         if (this.serverOpen && this.turnSerial === 0) {
             this.refusedBeforeOpening = true;
             return false;
         }
-        if (!this.serverOpen || !this.sessionId || this.pendingQuestion || this.questionReply || this.pendingPromptRequests > 0 || this.agentRequest)
+        if (!this.serverOpen || !this.sessionId || this.pendingQuestion || this.questionReply || this.pendingPermissions.size > 0 ||
+            this.pendingPromptRequests > 0 || this.agentRequest)
             return false;
+        // A prompt posted before a due follow-on run would have that run's idle close its turn, and
+        // its own run would then surface nothing (PR #1291 CI): it waits for that run, as for a turn.
+        if (this.followOn) {
+            this.refusedForFollowOn = true;
+            return false;
+        }
         this.agentInputReady = false;
         const request = new AbortController();
         this.agentRequest = request;
@@ -339,7 +367,8 @@ class OpencodeSession {
         }).finally(() => {
             if (this.agentRequest === request)
                 this.agentRequest = undefined;
-            if (this.serverOpen && !this.providerErrorPending && !this.turnActive && !this.pendingQuestion && !this.questionReply) {
+            if (this.serverOpen && !this.providerErrorPending && !this.turnActive && !this.pendingQuestion && !this.questionReply &&
+                this.pendingPermissions.size === 0) {
                 this.agentInputReady = true;
                 this.opts.onAgentInputReady?.();
                 this.scheduleAutoEnd();
@@ -400,12 +429,12 @@ class OpencodeSession {
     }
     notifyAgentInputReady() {
         if (this.serverOpen && this.turnEnded && !this.turnActive && !this.pendingQuestion &&
-            !this.questionReply && this.pendingPromptRequests === 0) {
+            !this.questionReply && this.pendingPermissions.size === 0 && this.pendingPromptRequests === 0) {
             this.agentInputReady = true;
             this.opts.onAgentInputReady?.();
         }
         else if (this.serverOpen && this.turnActive && !this.pendingQuestion && !this.questionReply &&
-            this.pendingPromptRequests === 0 && !this.agentRequest) {
+            this.pendingPermissions.size === 0 && this.pendingPromptRequests === 0 && !this.agentRequest) {
             // A reply or prompt acknowledgement cleared the last barrier mid-turn: held agent
             // input can steer the running turn now, not after it (#505 local review).
             this.opts.onAgentInputReady?.();
@@ -418,7 +447,7 @@ class OpencodeSession {
         this.autoEndTimer = undefined;
     }
     scheduleAutoEnd() {
-        if (!this.opts.autoEndAfterFirstTurn || !this.serverOpen || this.autoEndTimer || this.agentRequest)
+        if (!this.opts.autoEndAfterFirstTurn || !this.serverOpen || this.autoEndTimer || this.agentRequest || this.pendingPermissions.size)
             return;
         this.autoEndTimer = setTimeout(() => {
             this.autoEndTimer = undefined;
@@ -431,13 +460,17 @@ class OpencodeSession {
         if (!this.serverOpen)
             return;
         this.serverOpen = false;
+        this.clearLostWakeTimer();
         this.agentRequest?.abort();
+        this.expirePermissions('session ended');
         this.sse.abort();
         this.terminate();
     }
     interrupt() {
         this.serverOpen = false;
+        this.clearLostWakeTimer();
         this.agentRequest?.abort();
+        this.expirePermissions('session ended');
         if (this.baseUrl && this.sessionId) {
             void this.http('POST', `/session/${this.sessionId}/abort`, undefined).catch(() => undefined);
         }
@@ -500,7 +533,7 @@ class OpencodeSession {
         }
         const hasExited = trackChildExit(child);
         boundOutputDrainAfterExit(child);
-        // `exit` settles process liveness, not its pipes. The shared 250ms drain
+        // `exit` settles process liveness, not its pipes. The shared post-exit drain
         // bound prevents an inherited descendant pipe from retaining this session.
         const outputDrained = Promise.all([child.stdout, child.stderr].map(stream => finished(stream, { cleanup: true }).catch(() => undefined)));
         const exited = new Promise((resolve) => {
@@ -661,6 +694,7 @@ class OpencodeSession {
         if (!resumed) {
             const created = await this.http('POST', '/session', {
                 title: 'cezar task',
+                ...opencodeToolGrantFields(this.spec.toolGrant),
                 // OpenCode 1.18.33 /doc: session.create permission rules. The native task
                 // tool checks this permission; other agent/project permissions stay intact.
                 ...(this.spec.restrictNativeDelegation ? this.nativeDelegationPermission() : {}),
@@ -685,8 +719,9 @@ class OpencodeSession {
         if (this.refusedBeforeOpening)
             queueMicrotask(() => {
                 this.refusedBeforeOpening = false;
-                if (this.serverOpen && !this.pendingQuestion && !this.questionReply && !this.agentRequest)
+                if (this.serverOpen && !this.pendingQuestion && !this.questionReply && this.pendingPermissions.size === 0 && !this.agentRequest) {
                     this.opts.onAgentInputReady?.();
+                }
             });
     }
     async prompt(text, origin = 'human', signal) {
@@ -700,8 +735,8 @@ class OpencodeSession {
         const humanWaiter = origin === 'human';
         if (humanWaiter)
             this.humanPromptWaiters += 1;
-        while (this.turnActive)
-            await this.turnFinished;
+        while (this.turnActive || this.followOn)
+            await (this.turnActive ? this.turnFinished : this.followOn);
         if (humanWaiter && generation === this.queuedPromptGeneration) {
             this.humanPromptWaiters = Math.max(0, this.humanPromptWaiters - 1);
         }
@@ -806,6 +841,20 @@ class OpencodeSession {
         if (this.lostWakeTimer)
             clearTimeout(this.lostWakeTimer);
         this.lostWakeTimer = undefined;
+        this.settleFollowOn();
+    }
+    /** The follow-on wait is over. Input it refused is offered again unless a turn took over. */
+    settleFollowOn() {
+        if (!this.followOn)
+            return;
+        this.followOn = undefined;
+        this.followOnResolve();
+        if (!this.refusedForFollowOn)
+            return;
+        this.refusedForFollowOn = false;
+        if (this.turnActive)
+            return;
+        queueMicrotask(() => this.notifyAgentInputReady());
     }
     finishTurn() {
         if (!this.turnActive || this.turnEnded)
@@ -817,6 +866,8 @@ class OpencodeSession {
         // owns pending-question cleanup; without one, the pending ask is stale.
         if (!this.questionReply)
             this.pendingQuestion = undefined;
+        // OpenCode settles its own pending permission requests when the run stops.
+        this.expirePermissions('turn ended');
         this.turnFinishedResolve();
         // A part that never saw `time.end` (abort, server quirk) still surfaces
         // its prose before the turn boundary (run.ts reads markers there).
@@ -837,14 +888,18 @@ class OpencodeSession {
         // them apart; then report it so cezar submits it as a new prompt.
         if (this.submissions.pending > 0) {
             this.clearLostWakeTimer();
+            this.followOn = new Promise((resolve) => { this.followOnResolve = resolve; });
             this.lostWakeTimer = setTimeout(() => {
                 this.lostWakeTimer = undefined;
-                if (!this.serverOpen || this.turnActive)
+                if (!this.serverOpen || this.turnActive) {
+                    this.settleFollowOn();
                     return;
+                }
                 const inputIds = this.submissions.takeUnconsumed();
                 this.userMessageSubmission.clear();
                 if (inputIds.length)
                     this.emit({ type: 'input-unconsumed', inputIds });
+                this.settleFollowOn();
             }, OPENCODE_LOST_WAKE_GRACE_MS);
             this.lostWakeTimer.unref?.();
         }
@@ -1007,6 +1062,20 @@ class OpencodeSession {
         else if (type === 'message.part.updated' || type === 'message.part.created') {
             this.handlePart(props.part ?? props);
         }
+        else if (type === 'permission.asked') {
+            this.handlePermissionAsked(props);
+        }
+        else if (type === 'permission.replied') {
+            // OpenCode settled the request, in any phase: our own reply, another client's, or its own.
+            const nativeId = stringField(props, 'requestID');
+            const pending = nativeId === undefined ? undefined : this.pendingPermissions.get(nativeId);
+            // OpenCode publishes this before it answers the reply route, so a human reply in flight
+            // that it echoes is that human's answer.
+            if (pending) {
+                const answered = pending.phase === 'answering' && pending.answer?.reply === stringField(props, 'reply');
+                this.settlePermission(pending, answered ? { optionId: pending.answer.optionId } : { reason: 'resolved by OpenCode' });
+            }
+        }
         else if (type === 'session.idle') {
             // THE turn-end signal. The SSE bus is server-wide, so a child session's
             // (sub-agent's) idle must not close the main turn; an idle with no
@@ -1189,7 +1258,7 @@ class OpencodeSession {
                 {
                     type: 'ask.requested',
                     requestId: pending.askRequestId,
-                    questions: pending.questions,
+                    questions: uiAskQuestions(pending.questions),
                 },
             ],
         }));
@@ -1231,6 +1300,195 @@ class OpencodeSession {
                 this.emitQuestion(pending);
         }
     }
+    // ---- permissions (hearsay-tools/cezarion#1266) --------------------------
+    /** Any session on this private server may ask, child sessions included. The ask holds agent
+     *  input and auto-end from receipt until OpenCode settles it, the turn ends or the session does. */
+    handlePermissionAsked(props) {
+        if (!this.serverOpen)
+            return;
+        const parsed = opencodePermissionAskSchema.safeParse(props);
+        const nativeId = parsed.success ? parsed.data.id : typeof props.id === 'string' && props.id ? props.id : undefined;
+        if (nativeId === undefined) {
+            // OpenCode blocks the asking tool until a reply names this request: fail closed.
+            this.emit({ type: 'error', message: 'opencode: unsupported permission request could not be rejected: no request id' });
+            this.finishTurn();
+            this.end();
+            return;
+        }
+        if (this.handledPermissionIds.has(nativeId))
+            return;
+        this.handledPermissionIds.add(nativeId);
+        // OpenCode asks only from inside a running session loop, so a main-session ask after the idle
+        // means the server started a run: reopen the turn, as a steered follow-on run does. That run's
+        // own idle closes it. A child session's ask leaves the main turn alone.
+        if (!this.turnActive && this.sessionId !== undefined && stringField(props, 'sessionID') === this.sessionId) {
+            this.openTurn();
+            this.emitUi(opencodeTurnStarted);
+        }
+        const pending = parsed.success
+            ? { nativeId, ask: parsed.data, phase: 'classifying' }
+            : { nativeId, phase: 'rejecting' };
+        this.pendingPermissions.set(nativeId, pending);
+        this.agentInputReady = false;
+        this.cancelAutoEnd();
+        if (!parsed.success) {
+            this.emit({ type: 'note', message: 'opencode: rejected an OpenCode permission request cezar could not read' });
+            void this.rejectPermission(pending, 'cezar could not read this permission request');
+            return;
+        }
+        this.permissionQueue = this.permissionQueue.then(() => this.answerPermission(pending)).catch(() => undefined);
+    }
+    /** Still the ask OpenCode is waiting on: not settled, expired or torn down since an await. */
+    permissionLive(pending) {
+        return this.serverOpen && this.pendingPermissions.get(pending.nativeId) === pending;
+    }
+    async answerPermission(pending) {
+        const rules = await this.userPermissionRules();
+        if (!this.permissionLive(pending))
+            return;
+        if (isOpencodeDefaultAsk(pending.ask, rules)) {
+            pending.phase = 'auto-replying';
+            try {
+                // Never `always`: that can persist an approval beyond this run.
+                await this.replyPermission(pending.nativeId, { reply: 'once' });
+            }
+            catch {
+                // OpenCode is still waiting: a failed automatic reply asks the human instead.
+                if (this.permissionLive(pending))
+                    this.bridgePermission(pending);
+                return;
+            }
+            if (this.serverOpen && !this.answeredDefaultAsk) {
+                this.answeredDefaultAsk = true;
+                this.emit({
+                    type: 'note',
+                    message: "opencode: answered OpenCode's built-in permission asks (outside-worktree reads, .env reads, repeated-call guard) with allow-once; your own OpenCode permission rules still ask",
+                });
+            }
+            this.settlePermission(pending);
+            return;
+        }
+        this.bridgePermission(pending);
+    }
+    /** One lazy `GET /config` per session. An unreadable config is unknown provenance: every ask goes to the cockpit. */
+    userPermissionRules() {
+        this.permissionRules ??= this.readConfig().then(opencodeUserPermissionRules, () => undefined).then((rules) => {
+            if (!rules)
+                this.emit({ type: 'note', message: 'opencode: could not read the OpenCode config, so every permission prompt goes to the cockpit' });
+            return rules;
+        });
+        return this.permissionRules;
+    }
+    /** Unlike `http`, an empty or unparsable body is a failure, never an empty config. */
+    async readConfig() {
+        if (!this.baseUrl)
+            throw new Error('opencode server not ready');
+        const res = await fetch(`${this.baseUrl}/config`, { method: 'GET' });
+        if (!res.ok)
+            throw new Error(`GET /config → ${res.status}`);
+        return JSON.parse(await res.text());
+    }
+    bridgePermission(pending) {
+        if (!this.opts.onUiEvent) {
+            const message = 'no permission UI is attached to this cezar session';
+            this.emit({ type: 'note', message: `opencode: rejected the OpenCode ${pending.ask.permission} permission prompt: ${message}` });
+            void this.rejectPermission(pending, message);
+            return;
+        }
+        if (!this.showPermissionCard(pending))
+            void this.rejectPermission(pending, 'permission UI unavailable');
+    }
+    /** Emits a fresh cockpit card, with new ids, for the ask. False when the UI threw: that card is resolved again. */
+    showPermissionCard(pending) {
+        const bridge = opencodePermissionBridge(pending.ask);
+        pending.bridge = bridge;
+        pending.phase = 'card';
+        pending.answer = undefined;
+        try {
+            this.opts.onUiEvent(bridge.event);
+            return true;
+        }
+        catch {
+            // A throwing consumer cannot leave OpenCode waiting on a card nobody sees.
+            pending.bridge = undefined;
+            this.emitPermissionResolved(bridge.event.requestId, { reason: 'permission UI unavailable' });
+            return false;
+        }
+    }
+    /** A reject OpenCode never receives leaves the asking tool blocked: fail closed. */
+    async rejectPermission(pending, message) {
+        pending.phase = 'rejecting';
+        try {
+            await this.replyPermission(pending.nativeId, { reply: 'reject', message });
+        }
+        catch (err) {
+            if (!this.permissionLive(pending))
+                return;
+            this.emit({ type: 'error', message: `opencode: permission rejection failed: ${err instanceof Error ? err.message : String(err)}` });
+            this.finishTurn();
+            this.end();
+            return;
+        }
+        this.settlePermission(pending);
+    }
+    /** The card and the input barrier stay until OpenCode accepts the reply; a failed reply shows a fresh card. */
+    respondPermission(requestId, optionId) {
+        if (!this.serverOpen)
+            return false;
+        const pending = [...this.pendingPermissions.values()].find((entry) => entry.bridge?.event.requestId === requestId);
+        const reply = pending?.bridge?.replies.get(optionId);
+        if (!pending || pending.phase !== 'card' || !reply)
+            return false;
+        const bridge = pending.bridge;
+        pending.phase = 'answering';
+        pending.answer = { optionId, reply };
+        void this.replyPermission(pending.nativeId, { reply }).then(() => {
+            if (this.permissionLive(pending) && pending.bridge === bridge)
+                this.settlePermission(pending, { optionId });
+        }, (err) => {
+            if (!this.permissionLive(pending) || pending.bridge !== bridge)
+                return;
+            this.emit({ type: 'note', message: `opencode: permission reply failed: ${err instanceof Error ? err.message : String(err)}` });
+            // The fresh card first, so the run's pending set never empties and it stays parked.
+            const shown = this.showPermissionCard(pending);
+            this.emitPermissionResolved(bridge.event.requestId, { reason: 'permission reply failed' });
+            if (!shown)
+                void this.rejectPermission(pending, 'permission UI unavailable');
+        });
+        return true;
+    }
+    async replyPermission(nativeId, body) {
+        await this.http('POST', `/permission/${encodeURIComponent(nativeId)}/reply`, body);
+    }
+    /** OpenCode no longer waits on the ask: retire it, resolve its card, and release the barrier. */
+    settlePermission(pending, resolution = {}) {
+        if (this.pendingPermissions.get(pending.nativeId) !== pending)
+            return;
+        this.pendingPermissions.delete(pending.nativeId);
+        if (pending.bridge)
+            this.emitPermissionResolved(pending.bridge.event.requestId, resolution);
+        if (this.pendingPermissions.size)
+            return;
+        this.notifyAgentInputReady();
+        // A card that arrived after the turn ended cancelled its auto-end: re-arm it.
+        if (this.turnEnded && !this.turnActive && !this.questionReply)
+            this.scheduleAutoEnd();
+    }
+    /** Retires every ask without HTTP: OpenCode settles its own request on idle or abort. The
+     *  caller owns what follows (turn end or teardown), so the barrier release is not run here. */
+    expirePermissions(reason) {
+        for (const pending of [...this.pendingPermissions.values()]) {
+            this.pendingPermissions.delete(pending.nativeId);
+            if (pending.bridge)
+                this.emitPermissionResolved(pending.bridge.event.requestId, { reason });
+        }
+    }
+    emitPermissionResolved(requestId, resolution) {
+        try {
+            this.opts.onUiEvent?.({ type: 'permission.resolved', requestId, ...resolution });
+        }
+        catch { /* A failed consumer must not strand other pending requests. */ }
+    }
     // ---- http ---------------------------------------------------------------
     async http(method, path, body, signal) {
         if (!this.baseUrl)
@@ -1239,9 +1497,9 @@ class OpencodeSession {
         // prompts go through `prompt_async` — nothing long-polls anymore.
         const res = await fetch(`${this.baseUrl}${path}`, {
             method,
-            signal,
+            ...(signal !== undefined ? { signal } : {}),
             headers: body !== undefined ? { 'content-type': 'application/json' } : {},
-            body: body !== undefined ? JSON.stringify(body) : undefined,
+            ...(body !== undefined ? { body: JSON.stringify(body) } : {}),
         });
         if (!res.ok) {
             const detail = await res.text().catch(() => '');