agent-relay-runner 0.127.4 → 0.127.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-relay-runner",
-  "version": "0.127.4",
+  "version": "0.127.5",
   "description": "Unified provider lifecycle runner for Agent Relay",
   "type": "module",
   "bin": {
@@ -23,7 +23,7 @@
   },
   "dependencies": {
     "agent-relay-providers": "0.104.4",
-    "agent-relay-sdk": "0.2.119",
+    "agent-relay-sdk": "0.2.120",
     "callmux": "0.23.0"
   },
   "devDependencies": {

package/plugins/claude/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "agent-relay-runner",
   "description": "Thin Agent Relay runner bridge for Claude Code",
-  "version": "0.127.4",
+  "version": "0.127.5",
   "agentRelayContracts": {
     "providerPluginProtocol": 1
   }

package/src/adapter.ts

@@ -146,11 +146,17 @@ export interface ProviderPermissionDecisionInput {
   approvalId: string;
   decision: ProviderPermissionDecision;
   reason?: string;
+  decisionReason?: ProviderPermissionDecisionReason;
   // For "answer" decisions (Claude AskUserQuestion): maps each question's text
   // to the chosen option label(s). Multi-select labels are comma-joined.
   answers?: Record<string, string>;
 }
 
+export interface ProviderPermissionDecisionReason {
+  kind: "timeout" | "dismissed" | "answered";
+  message?: string;
+}
+
 export interface ProviderAdapter {
   provider: string;
   spawn(config: RunnerSpawnConfig): Promise<ManagedProcess>;

package/src/control-server.ts

@@ -1,11 +1,12 @@
 import type { Server, ServerWebSocket } from "bun";
 import type { InteractivePrompt, Message, ReplyObligation } from "agent-relay-sdk";
 import { errMessage, isRecord } from "agent-relay-sdk";
-import type { ProviderPermissionDecisionInput, ProviderStatusEvent, SemanticStatus, TerminalAttachSpec } from "./adapter";
+import type { ProviderPermissionDecisionInput, ProviderPermissionDecisionReason, ProviderStatusEvent, SemanticStatus, TerminalAttachSpec } from "./adapter";
 import { obligationRequiresExplicitReply } from "./reply-obligation-cache";
 import { relayReplyActionText } from "./relay-instructions";
 import { logger, parseLogLevel, LOG_LEVELS } from "./logger";
 import { buildRateLimitProviderState } from "./rate-limit";
+import { bestEffortDeletePendingPermissionRequest, bestEffortListPendingPermissionRequests, bestEffortUpsertPendingPermissionRequest, type PendingPermissionRequestRecord, type PendingPermissionStore } from "./pending-permission-store";
 
 // The AskUserQuestion / PermissionRequest hook (runner/plugins/claude/hooks/hooks.json)
 // has a 900s Claude-side timeout. Resolve the server-side wait with a margin UNDER that
@@ -16,6 +17,8 @@ const PERMISSION_WAIT_MS = 880_000;
 // agent can tell "nobody answered in time" (retriable) from "the human said no" (#693).
 const PERMISSION_TIMEOUT_REASON =
   "No response received within ~15 minutes (timeout, not a dismissal). Re-ask if you still need a decision.";
+const PERMISSION_STOP_REASON = "The runner restarted while this permission request was pending; the original hook is no longer connected.";
+const RESOLVED_APPROVAL_LIMIT = 1024;
 
 // A hook that failed in a way it could not handle itself reports here so the
 // failure is never silent (#198 item 5). Phase 1 logs it FATAL to the per-agent
@@ -57,6 +60,7 @@ interface ControlServerOptions {
   // stable, provider-native turn identifier used instead of a minted random UUID.
   onSessionTurn?(input: { transcriptPath: string; lastAssistantMessage?: unknown; promptId?: string; isPreFlush?: boolean; toolName?: string; toolInput?: unknown }): Promise<{ reasoningSettled: boolean } | void>;
   onPermissionResolved?(input: ResolvedPermissionPrompt): Promise<void> | void;
+  onPermissionAbandoned?(input: PendingPermissionRequestRecord & { reason: string; decisionReason: ProviderPermissionDecisionReason }): Promise<void> | void;
   // A provider UserPromptSubmit hook hands over the prompt the human typed
   // directly into the session (web terminal / TUI) so the runner can mirror it
   // into the dashboard chat and start tailing the turn transcript for reasoning.
@@ -75,6 +79,8 @@ interface ControlServerOptions {
   // Test seam: how long the permission hook waits for a dashboard decision before
   // resolving as a timeout. Defaults to PERMISSION_WAIT_MS (margin under the 900s hook).
   permissionWaitMs?: number;
+  instanceId?: string;
+  pendingPermissionStore?: PendingPermissionStore;
 }
 
 export interface ResolvedPermissionPrompt {
@@ -90,6 +96,7 @@ export interface ResolvedPermissionPrompt {
   decisionLabel: string;
   occurredAt: number;
   resolvedAt: number;
+  decisionReason: ProviderPermissionDecisionReason;
   questions?: unknown[];
   answers?: Record<string, string>;
 }
@@ -103,6 +110,7 @@ export function startControlServer(options: ControlServerOptions): ControlServer
   // is an idempotent no-op instead of a silent command failure (#693).
   const resolvedApprovals = new Set<string>();
   let server!: Server<MonitorSocketData>;
+  recoverStoredPermissionRequests(options);
 
   server = Bun.serve<MonitorSocketData>({
     hostname: "127.0.0.1",
@@ -194,6 +202,15 @@ export function startControlServer(options: ControlServerOptions): ControlServer
       for (const pending of pendingDeliveries.values()) clearTimeout(pending.timer);
       pendingDeliveries.clear();
       for (const pending of pendingPermissionRequests.values()) clearTimeout(pending.timer);
+      for (const [approvalId, pending] of pendingPermissionRequests.entries()) {
+        const decision = withDecisionReason({
+          approvalId,
+          decision: "deny",
+          reason: PERMISSION_STOP_REASON,
+        }, "dismissed");
+        bestEffortDeletePendingPermissionRequest(options.pendingPermissionStore, approvalId);
+        pending.resolve(decision);
+      }
       pendingPermissionRequests.clear();
       server.stop(true);
     },
@@ -219,9 +236,9 @@ export function startControlServer(options: ControlServerOptions): ControlServer
       }
       clearTimeout(pending.timer);
       pendingPermissionRequests.delete(input.approvalId);
-      resolvedApprovals.add(input.approvalId);
-      if (resolvedApprovals.size > 1024) resolvedApprovals.clear();
-      pending.resolve(input);
+      bestEffortDeletePendingPermissionRequest(options.pendingPermissionStore, input.approvalId);
+      recordResolvedApproval(resolvedApprovals, input.approvalId);
+      pending.resolve(withDecisionReason(input, input.decision === "deny" || input.decision === "abort" ? "dismissed" : "answered"));
       options.onStatus({
         status: "busy",
         reason: "provider-turn",
@@ -238,6 +255,16 @@ export function startControlServer(options: ControlServerOptions): ControlServer
   };
 }
 
+export function recordResolvedApproval(resolvedApprovals: Set<string>, approvalId: string, limit = RESOLVED_APPROVAL_LIMIT): void {
+  resolvedApprovals.delete(approvalId);
+  resolvedApprovals.add(approvalId);
+  while (resolvedApprovals.size > limit) {
+    const oldest = resolvedApprovals.values().next().value;
+    if (!oldest) break;
+    resolvedApprovals.delete(oldest);
+  }
+}
+
 function replyObligationSummary(obligations: ReplyObligation[]): Record<string, unknown> {
   const obligation = obligations[0];
   if (!obligation) return { pending: false, count: 0 };
@@ -265,10 +292,38 @@ function replyObligationStopDecision(obligations: ReplyObligation[]): Record<str
   };
 }
 
+function recoverStoredPermissionRequests(options: ControlServerOptions): void {
+  const store = options.pendingPermissionStore;
+  if (!store) return;
+  for (const record of bestEffortListPendingPermissionRequests(store)) {
+    bestEffortDeletePendingPermissionRequest(store, record.approvalId);
+    const decisionReason: ProviderPermissionDecisionReason = {
+      kind: Date.now() >= record.hookDeadlineAt ? "timeout" : "dismissed",
+      message: Date.now() >= record.hookDeadlineAt ? PERMISSION_TIMEOUT_REASON : PERMISSION_STOP_REASON,
+    };
+    options.onPermissionAbandoned?.({ ...record, reason: decisionReason.message ?? PERMISSION_STOP_REASON, decisionReason });
+  }
+}
+
+function withDecisionReason(input: ProviderPermissionDecisionInput, kind: ProviderPermissionDecisionReason["kind"]): ProviderPermissionDecisionInput {
+  if (input.decisionReason) return input;
+  return {
+    ...input,
+    decisionReason: {
+      kind,
+      ...(input.reason ? { message: input.reason } : {}),
+    },
+  };
+}
+
+function decisionReasonMessage(decision: ProviderPermissionDecisionInput, fallback: string): string {
+  return decision.reason || decision.decisionReason?.message || fallback;
+}
+
 async function handlePermissionRequest(
   req: Request,
-  options: ControlServerOptions,
-  pendingPermissionRequests: Map<string, { resolve(input: ProviderPermissionDecisionInput): void; timer: Timer }>,
+	  options: ControlServerOptions,
+	  pendingPermissionRequests: Map<string, { resolve(input: ProviderPermissionDecisionInput): void; timer: Timer }>,
 ): Promise<Response> {
   const occurredAt = Date.now();
   const body = await req.json().catch(() => null);
@@ -291,6 +346,15 @@ async function handlePermissionRequest(
   }
   const approvalId = crypto.randomUUID();
   const view = claudePermissionApprovalView(approvalId, body, reasoningSettled);
+  const waitMs = options.permissionWaitMs ?? PERMISSION_WAIT_MS;
+  const hookDeadlineAt = occurredAt + waitMs;
+  bestEffortUpsertPendingPermissionRequest(options.pendingPermissionStore, {
+    approvalId,
+    view,
+    hookDeadlineAt,
+    ownerInstanceId: options.instanceId ?? "",
+    occurredAt,
+  });
   options.onStatus({
     status: "busy",
     reason: "provider-turn",
@@ -308,12 +372,13 @@ async function handlePermissionRequest(
   const decision = await new Promise<ProviderPermissionDecisionInput>((resolve) => {
     const timer = setTimeout(() => {
       pendingPermissionRequests.delete(approvalId);
-      resolve({ approvalId, decision: "deny", reason: PERMISSION_TIMEOUT_REASON });
-    }, options.permissionWaitMs ?? PERMISSION_WAIT_MS);
+      bestEffortDeletePendingPermissionRequest(options.pendingPermissionStore, approvalId);
+      resolve(withDecisionReason({ approvalId, decision: "deny", reason: PERMISSION_TIMEOUT_REASON }, "timeout"));
+    }, waitMs);
     pendingPermissionRequests.set(approvalId, { resolve, timer });
   });
 
-  if (decision.reason !== PERMISSION_TIMEOUT_REASON && options.onPermissionResolved) {
+  if (decision.decisionReason?.kind !== "timeout" && options.onPermissionResolved) {
     await Promise.resolve(options.onPermissionResolved(claudeResolvedPermissionPrompt(view, decision, body, occurredAt))).catch(() => {});
   }
 
@@ -404,12 +469,12 @@ function claudePermissionHookResponse(decision: ProviderPermissionDecisionInput,
       };
     }
     return {
-      hookSpecificOutput: {
-        hookEventName: "PreToolUse",
-        permissionDecision: "deny",
-        permissionDecisionReason: decision.reason || "Dismissed from Agent Relay dashboard",
-      },
-    };
+	    hookSpecificOutput: {
+	        hookEventName: "PreToolUse",
+	        permissionDecision: "deny",
+	        permissionDecisionReason: decisionReasonMessage(decision, "Dismissed from Agent Relay dashboard"),
+	      },
+	    };
   }
   const hookEventName = "PermissionRequest";
   // AskUserQuestion can be gated by the PermissionRequest hook instead of PreToolUse
@@ -443,12 +508,12 @@ function claudePermissionHookResponse(decision: ProviderPermissionDecisionInput,
   return {
     hookSpecificOutput: {
       hookEventName,
-      decision: {
-        behavior: "deny",
-        message: decision.reason || "Denied from Agent Relay dashboard",
-        interrupt: decision.decision === "abort",
-      },
-    },
+	    decision: {
+	        behavior: "deny",
+	        message: decisionReasonMessage(decision, "Denied from Agent Relay dashboard"),
+	        interrupt: decision.decision === "abort",
+	      },
+	    },
   };
 }
 
@@ -474,6 +539,7 @@ function claudeResolvedPermissionPrompt(view: InteractivePrompt, decision: Provi
     approvalId: decision.approvalId,
     decision: decision.decision,
     decisionLabel,
+    decisionReason: decision.decisionReason ?? { kind: decision.decision === "deny" || decision.decision === "abort" ? "dismissed" : "answered", ...(decision.reason ? { message: decision.reason } : {}) },
     occurredAt,
     resolvedAt: Date.now(),
     ...(questions ? { questions } : {}),

package/src/mcp-outbox.ts

@@ -68,8 +68,15 @@ export async function deliverRunnerOutboxEvent(input: RunnerOutboxDelivery): Pro
     logger.warn("outbox", `dropping event with unknown kind: ${record.kind}`);
   } catch (error) {
     if (isHttpStatusError(error, 409)) {
+      const reason = errMessage(error);
       if (record.kind === "session-message-batch") {
-        logger.error("outbox", `relay reported duplicate session batch; acking row seq=${record.seq} batchKey=${record.idempotencyKey} itemKeys=${sessionBatchItemKeys(record).join(",")} error=${errMessage(error)}`);
+        const messages = sessionBatchMessages(record);
+        logger.error("outbox", `relay reported duplicate session batch; acking row seq=${record.seq} batchKey=${record.idempotencyKey} itemKeys=${sessionBatchItemKeys(record).join(",")} error=${reason}`);
+        await emitMirrorDropNotice(input, messages, messages.length, `duplicate idempotency key: ${reason}`, "duplicate-batch");
+      } else if (record.kind === "session-message") {
+        const message = record.payload as SendMessageInput;
+        logger.error("outbox", `relay reported duplicate session message; acking row seq=${record.seq} key=${record.idempotencyKey} error=${reason}`);
+        await emitMirrorDropNotice(input, [message], 1, `duplicate idempotency key: ${reason}`, "duplicate-message");
       }
       return;
     }
@@ -79,14 +86,20 @@ export async function deliverRunnerOutboxEvent(input: RunnerOutboxDelivery): Pro
 }
 
 async function deliverSessionBatchItems(input: RunnerOutboxDelivery, messages: SendMessageInput[]): Promise<void> {
+  const dropped: Array<{ message: SendMessageInput; reason: string }> = [];
   for (const message of messages) {
     try {
       await input.http.sendMessage(message);
     } catch (error) {
       if (!isDeterministicValidationError(error)) throw error;
-      logger.warn("outbox", `dropping invalid session batch item: ${errMessage(error)}`);
+      const reason = errMessage(error);
+      logger.error("outbox", `dropping invalid session batch item key=${message.idempotencyKey ?? "(none)"} error=${reason}`);
+      dropped.push({ message, reason });
     }
   }
+  for (const item of dropped) {
+    await emitMirrorDropNotice(input, [item.message], 1, item.reason, "invalid-item");
+  }
 }
 
 function isDeterministicValidationError(error: unknown): boolean {
@@ -95,10 +108,47 @@ function isDeterministicValidationError(error: unknown): boolean {
 }
 
 function sessionBatchItemKeys(record: OutboxRecord): string[] {
-  const messages = Array.isArray((record.payload as { messages?: unknown }).messages)
+  const messages = sessionBatchMessages(record);
+  return messages.map((message, index) => message.idempotencyKey ?? `${record.idempotencyKey}:${index}`);
+}
+
+function sessionBatchMessages(record: OutboxRecord): SendMessageInput[] {
+  return Array.isArray((record.payload as { messages?: unknown }).messages)
     ? (record.payload as { messages: SendMessageInput[] }).messages
     : [];
-  return messages.map((message, index) => message.idempotencyKey ?? `${record.idempotencyKey}:${index}`);
+}
+
+async function emitMirrorDropNotice(input: RunnerOutboxDelivery, messages: SendMessageInput[], count: number, reason: string, suffix: string): Promise<void> {
+  if (count <= 0) return;
+  const anchor = messages[0];
+  const from = typeof anchor?.from === "string" && anchor.from ? anchor.from : "system";
+  const to = typeof anchor?.to === "string" && anchor.to ? anchor.to : "user";
+  const occurredAt = typeof anchor?.occurredAt === "number" ? anchor.occurredAt : input.record.occurredAt;
+  const body = `${count} steps could not be mirrored: ${reason}`;
+  const idempotencyKey = `session-mirror-drop:${input.record.idempotencyKey}:${suffix}:${shortHash(body)}`;
+  logger.error("outbox", `session mirror drop notice seq=${input.record.seq} count=${count} reason=${reason} noticeKey=${idempotencyKey}`);
+  try {
+    await input.http.sendMessage({
+      from,
+      to,
+      kind: "session",
+      body,
+      idempotencyKey,
+      occurredAt,
+      payload: { session: { type: "notice", origin: "provider", label: "mirror-drop", stepId: idempotencyKey } },
+    });
+  } catch (error) {
+    logger.error("outbox", `failed to emit session mirror drop notice seq=${input.record.seq}; acking original row anyway: ${errMessage(error)}`);
+  }
+}
+
+function shortHash(value: string): string {
+  let h = 0x811c9dc5;
+  for (let i = 0; i < value.length; i++) {
+    h ^= value.charCodeAt(i);
+    h = Math.imul(h, 0x01000193);
+  }
+  return (h >>> 0).toString(36);
 }
 
 export async function deliverBufferedMcpCall(input: {

package/src/pending-permission-store.ts

@@ -0,0 +1,148 @@
+import { Database } from "bun:sqlite";
+import type { InteractivePrompt } from "agent-relay-sdk";
+import { mkdirSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { sanitizeFsName } from "agent-relay-sdk/fs-name";
+import { runnerOutboxDirFromEnv } from "./config";
+import { logger } from "./logger";
+import { errMessage } from "agent-relay-sdk";
+
+export interface PendingPermissionRequestRecord {
+  approvalId: string;
+  view: InteractivePrompt;
+  hookDeadlineAt: number;
+  ownerInstanceId: string;
+  occurredAt: number;
+}
+
+interface PendingPermissionRow {
+  approval_id: string;
+  view: string;
+  hook_deadline_at: number;
+  owner_instance_id: string;
+  occurred_at: number;
+}
+
+export class PendingPermissionStore {
+  private db?: Database;
+  readonly path: string;
+
+  constructor(options: { agentId: string; dir?: string }) {
+    const dir = options.dir ?? runnerOutboxDirFromEnv() ?? join(tmpdir(), "agent-relay-outbox");
+    this.path = options.dir === ":memory:" ? ":memory:" : join(dir, `pending-permissions-${safeName(options.agentId)}.sqlite`);
+    try {
+      if (this.path !== ":memory:") mkdirSync(dirname(this.path), { recursive: true });
+      const db = new Database(this.path, { create: true });
+      db.exec("PRAGMA journal_mode = WAL");
+      db.exec("PRAGMA busy_timeout = 2000");
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS pending_permission_requests (
+          approval_id TEXT PRIMARY KEY,
+          view TEXT NOT NULL,
+          hook_deadline_at INTEGER NOT NULL,
+          owner_instance_id TEXT NOT NULL,
+          occurred_at INTEGER NOT NULL,
+          created_at INTEGER NOT NULL
+        )
+      `);
+      this.db = db;
+    } catch (error) {
+      logger.error("pending-permission-store", `disabled after open failed path=${this.path}: ${errMessage(error)}`);
+      this.db = undefined;
+    }
+  }
+
+  upsert(record: PendingPermissionRequestRecord): void {
+    if (!this.db) return;
+    try {
+      this.db.query(`
+        INSERT INTO pending_permission_requests (approval_id, view, hook_deadline_at, owner_instance_id, occurred_at, created_at)
+        VALUES (?, ?, ?, ?, ?, ?)
+        ON CONFLICT(approval_id) DO UPDATE SET
+          view = excluded.view,
+          hook_deadline_at = excluded.hook_deadline_at,
+          owner_instance_id = excluded.owner_instance_id,
+          occurred_at = excluded.occurred_at
+      `).run(record.approvalId, JSON.stringify(record.view), record.hookDeadlineAt, record.ownerInstanceId, record.occurredAt, Date.now());
+    } catch (error) {
+      logger.error("pending-permission-store", `upsert failed approvalId=${record.approvalId}; continuing in-memory only: ${errMessage(error)}`);
+    }
+  }
+
+  delete(approvalId: string): void {
+    if (!this.db) return;
+    try {
+      this.db.query("DELETE FROM pending_permission_requests WHERE approval_id = ?").run(approvalId);
+    } catch (error) {
+      logger.error("pending-permission-store", `delete failed approvalId=${approvalId}; continuing in-memory only: ${errMessage(error)}`);
+    }
+  }
+
+  list(): PendingPermissionRequestRecord[] {
+    if (!this.db) return [];
+    try {
+      const rows = this.db.query("SELECT * FROM pending_permission_requests ORDER BY occurred_at ASC").all() as PendingPermissionRow[];
+      return rows.map((row) => ({
+        approvalId: row.approval_id,
+        view: safeParseView(row.view),
+        hookDeadlineAt: row.hook_deadline_at,
+        ownerInstanceId: row.owner_instance_id,
+        occurredAt: row.occurred_at,
+      }));
+    } catch (error) {
+      logger.error("pending-permission-store", `list failed; continuing without persisted approvals: ${errMessage(error)}`);
+      return [];
+    }
+  }
+
+  close(): void {
+    try { this.db?.close(); } catch { /* already closed */ }
+  }
+}
+
+export function bestEffortListPendingPermissionRequests(store: PendingPermissionStore | undefined): PendingPermissionRequestRecord[] {
+  try {
+    return store?.list() ?? [];
+  } catch (error) {
+    logger.error("pending-permission-store", `list failed; continuing without persisted approvals: ${errMessage(error)}`);
+    return [];
+  }
+}
+
+export function bestEffortUpsertPendingPermissionRequest(store: PendingPermissionStore | undefined, record: PendingPermissionRequestRecord): void {
+  try {
+    store?.upsert(record);
+  } catch (error) {
+    logger.error("pending-permission-store", `upsert failed approvalId=${record.approvalId}; continuing in-memory only: ${errMessage(error)}`);
+  }
+}
+
+export function bestEffortDeletePendingPermissionRequest(store: PendingPermissionStore | undefined, approvalId: string): void {
+  try {
+    store?.delete(approvalId);
+  } catch (error) {
+    logger.error("pending-permission-store", `delete failed approvalId=${approvalId}; continuing in-memory only: ${errMessage(error)}`);
+  }
+}
+
+function safeName(value: string): string {
+  return sanitizeFsName(value, { replacement: "_", maxLen: 180, fallback: "agent" });
+}
+
+function safeParseView(json: string): InteractivePrompt {
+  try {
+    const parsed = JSON.parse(json);
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) return parsed as InteractivePrompt;
+  } catch {
+    // Fall through to a valid placeholder so recovery can still emit a notice and clear the row.
+  }
+  return {
+    id: "unknown",
+    kind: "tool",
+    title: "Recovered permission request",
+    body: "The original permission request could not be decoded.",
+    choices: [],
+    reasoningSettled: false,
+  };
+}

package/src/runner-core.ts

@@ -29,6 +29,7 @@ import { deliverBufferedMcpCall as deliverBufferedMcpOutboxCall, deliverRunnerOu
 import { RunnerInsights } from "./runner-insights";
 import { BusyReconciler } from "./busy-reconciler";
 import { publishCapturedResponse } from "./response-capture-report";
+import { PendingPermissionStore, type PendingPermissionRequestRecord } from "./pending-permission-store";
 import { runnerLaunchInjectionSessionEvents, type RunnerRelayInjectionEvent } from "./relay-injection-events";
 import { providerTerminalSession, providerTerminalSocket } from "./process-meta";
 import { capsFromEnv, logLevelFromEnv, mcpProxyEnabledFromEnv, orchestratorBaseDirFromEnv, orchestratorUrlFromEnv, registrationTimeoutMsFromEnv, runnerInfoFileFromEnv, runnerLogFileFromEnv, runnerOutboxDirWithInfoFallback, sessionDebugEnabled, tagsFromEnv, workspaceModeFromEnv } from "./config";
@@ -191,6 +192,7 @@ export class AgentRunner {
   // their own FIFO queue stops one transient trace failure from head-of-line blocking real-message
   // delivery (and vice versa); its backoff is capped low since a stale live-mirror frame is cheap.
   private readonly sessionOutbox: Outbox;
+  private readonly pendingPermissionStore: PendingPermissionStore;
   private sessionBatchSeq = 0;
   private readonly insights: RunnerInsights;
   private readonly busyReconciler: BusyReconciler;
@@ -333,6 +335,7 @@ export class AgentRunner {
       maxBackoffMs: 5_000,
       maxAttempts: 6,
     });
+    this.pendingPermissionStore = new PendingPermissionStore({ agentId: this.agentId, dir: outboxDir });
     this.insights = new RunnerInsights({
       agentId: this.agentId,
       cwd: options.cwd,
@@ -436,9 +439,12 @@ export class AgentRunner {
       // round-trip. The snapshot is kept warm by the background refresh below (#196).
       onReplyObligations: () => Promise.resolve(this.obligationCache.get()),
       onSessionTurn: (input) => this.publishSessionTurn(input), onPermissionResolved: (input) => this.publishSessionEvent({ from: this.agentId, to: "user", body: input.body, occurredAt: input.occurredAt, session: { type: "prompt-resolution", origin: "provider", label: input.decisionLabel, ...(this.currentTurnId ? { turnId: this.currentTurnId } : {}), stepId: `prompt-resolution:${input.approvalId}`, promptResolution: input } }),
+      onPermissionAbandoned: (input) => this.publishPermissionAbandonedNotice(input),
       onUserPrompt: (input) => this.handleUserPrompt(input),
       onSessionBoundary: (input) => this.handleSessionBoundary(input),
       onHookFatal: (report) => this.reportHookFatal(report),
+      instanceId: this.options.instanceId,
+      pendingPermissionStore: this.pendingPermissionStore,
     });
     this.startMcpProxy();
     this.writeRunnerInfoFile();
@@ -507,7 +513,7 @@ export class AgentRunner {
     this.busyReconciler.disarm();
     this.stopReasoningTail();
     this.obligationCache.stop();
-    this.outbox.close(); this.sessionOutbox.close();
+    this.outbox.close(); this.sessionOutbox.close(); this.pendingPermissionStore.close();
     this.proxy?.stop();
     this.control?.stop();
     await this.bus.close();
@@ -2037,6 +2043,23 @@ export class AgentRunner {
     });
   }
 
+  private publishPermissionAbandonedNotice(input: PendingPermissionRequestRecord & { reason: string }): void {
+    const title = input.view.title || "permission request";
+    this.publishSessionEvent({
+      from: this.agentId,
+      to: "user",
+      body: `Permission request denied after runner restart: ${title}. ${input.reason}`,
+      occurredAt: Date.now(),
+      session: {
+        type: "notice",
+        origin: "provider",
+        label: "permission-denied",
+        stepId: `permission-abandoned:${input.approvalId}`,
+        ...(this.currentTurnId ? { turnId: this.currentTurnId } : {}),
+      },
+    });
+  }
+
   // #286: a discreet, durable chat marker when a usage/rate-limit hold begins, via
   // the same session-mirror lane as the compaction notice. Outbound session event
   // (NOT an inbound message) so it shows in the dashboard chat WITHOUT waking a turn