agentbox-app 0.1.12 → 0.1.16

package/main/message-priority.mjs

@@ -48,8 +48,8 @@ export function wantsPriority(item, product, me) {
   // AND NEVER OVER THE LEVEL THE SENDER PICKED (w-7ba439c883). A message now
   // crosses carrying how urgent the person who wrote it thought it was, and a
   // guess from here would overwrite it: the sender's line is composeItem's, so
-  // it claims no authority the fold would defend, and a level written from here
-  // counts for nothing anyway (an agent's tag, shared/rank.mjs itemPriority).
+  // it claims no authority the fold would defend, and a guess from here is not
+  // what the sender said.
   // A row nobody chose a level for is composeItem's 0, so a number above it is
   // exactly "somebody picked one", and `by` says it was not this Mac.
   if (set?.by && set.by !== me && Number.isFinite(item.priority) && item.priority > 0) return false;

package/main/mic.mjs

@@ -0,0 +1,38 @@
+// Getting the microphone with one press, for a voice note.
+//
+// macOS asks on behalf of the app that opened Agentbox (Terminal, when it is
+// run from a checkout), and once that app has been refused it never shows its
+// Allow box again: asking just answers no. So the press clears that one
+// refusal, for that one app and the microphone only, and asks again, which
+// brings the Allow box back. Only ever on the press, never on its own.
+import { execFile } from 'node:child_process';
+
+export const SETTINGS_URL = 'x-apple.systempreferences:com.apple.preference.security?Privacy_Microphone';
+
+const NAMES = {
+  'com.apple.Terminal': 'Terminal',
+  'com.googlecode.iterm2': 'iTerm',
+  'com.microsoft.VSCode': 'VS Code',
+  'dev.warp.Warp-Stable': 'Warp',
+  'com.mitchellh.ghostty': 'Ghostty',
+};
+
+/** The app macOS asks about, from the bundle id macOS gave this process. */
+export function micOwner(env = process.env) {
+  const id = env.__CFBundleIdentifier;
+  if (typeof id !== 'string' || !/^[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)+$/.test(id)) return { id: null, name: null };
+  return { id, name: NAMES[id] ?? id.split('.').at(-1) };
+}
+
+/** 'granted', or 'settings' once the Settings page has been opened instead. */
+export async function getMic({ systemPreferences, openExternal, owner = micOwner(), run = execFile }) {
+  const status = systemPreferences.getMediaAccessStatus('microphone');
+  if (status === 'granted') return 'granted';
+  if (status === 'denied' && owner.id) {
+    await new Promise((resolve) => run('tccutil', ['reset', 'Microphone', owner.id], { timeout: 10_000 }, () => resolve()));
+  }
+  const granted = await systemPreferences.askForMediaAccess('microphone').catch(() => false);
+  if (granted) return 'granted';
+  openExternal(SETTINGS_URL);
+  return 'settings';
+}

package/main/new-chats-watch.mjs

@@ -0,0 +1,110 @@
+// NEW CHATS COME IN ON THEIR OWN, when somebody ticked "Keep bringing in new
+// chats from Claude Code and Codex" on setup's last screen or turned it on in
+// Settings (`importNew`, from the moment `importNewSince`).
+//
+// A chat comes in when it was started after that moment, in a folder one of
+// the projects points at, and has gone quiet. Claude Code may still have it
+// open: people leave it open for hours, and a reply here to an open chat
+// carries on a copy (Supervisor#importedThreadFor). It is filed the way setup
+// files one: waiting on you to Needs you, finished to Done. Nothing asks about
+// a chat first; asking rows are what the old Codex watch was removed for.
+import { productsForThread } from '../shared/codex-import.mjs';
+import { isShared } from '../shared/team-rules.mjs';
+import { appSessionFolders } from './agent-homes.mjs';
+import { outsideAgentsMode } from './settings.mjs';
+import { claudeSessionOpen } from './claude-session-open.mjs';
+import { readCodexThreadsOffThread } from './codex-threads.mjs';
+import { readRecentThreads } from './importable-threads.mjs';
+
+export const NEW_CHATS_POLL_MS = 60_000;
+/** How long a chat has to have been still before it comes in. */
+export const QUIET_MS = 10 * 60_000;
+const PASS_DEADLINE_MS = 90_000;
+
+function idsWithRows(items) {
+  const ids = new Set();
+  for (const item of items ?? []) {
+    for (const label of item?.labels ?? []) {
+      if (typeof label !== 'string') continue;
+      if (label.startsWith('thread:')) ids.add(label.slice(7));
+      else if (label.startsWith('codex:')) ids.add(label.slice(6));
+    }
+  }
+  return ids;
+}
+
+/** Which of `threads` come in now, grouped by the project each lands in. */
+export function newChatsToBring(threads, { products, items, since, now, isOpen = () => false, openShownLive = false }) {
+  const had = idsWithRows(items);
+  const bySlug = new Map();
+  for (const t of threads ?? []) {
+    const id = String(t?.id ?? '').trim();
+    if (!id || had.has(id)) continue;
+    if (!(Number(t.startedAt) > since)) continue;
+    if (now - Number(t.when ?? 0) < QUIET_MS) continue;
+    if (t.source === 'codex' ? t.live : openShownLive && isOpen(t)) continue;
+    const slug = productsForThread(t, products)[0]?.slug;
+    if (!slug) continue;
+    if (!bySlug.has(slug)) bySlug.set(slug, []);
+    bySlug.get(slug).push(t);
+    had.add(id);
+  }
+  return bySlug;
+}
+
+export async function scanNewChats({ store, config, readThreads, isOpen, now = Date.now() }) {
+  if (config?.importNew !== true) return { brought: 0 };
+  const since = Number(config.importNewSince) || now;
+  // Only as far back as the switch, and never further than the import card reads.
+  const days = Math.min(10, Math.max(1, Math.ceil((now - since) / 86400e3) + 1));
+  // Never a project shared with a team: teammates would read chats nobody chose to share.
+  const products = store.listProducts().filter((p) => !isShared(p));
+  const folders = products.map((p) => p.repoPath).filter(Boolean);
+  const threads = await readThreads({ days, since, folders, now });
+  // An open session already has its own row when "Show while they run" is on.
+  const openShownLive = outsideAgentsMode(config) !== 'off';
+  const picks = newChatsToBring(threads, { products, items: store.listItems(), since, now, isOpen, openShownLive });
+  let brought = 0;
+  for (const [slug, list] of picks) {
+    brought += store.importThreadRows(slug, list, { now, land: 'sorted' }).added;
+    brought += store.importCodexThreads(slug, list, { now, land: 'sorted' }).added;
+  }
+  return { brought };
+}
+
+export function startNewChatsWatch({
+  store, config, readThreads, isOpen,
+  everyMs = NEW_CHATS_POLL_MS, firstDelayMs = 30_000, deadlineMs = PASS_DEADLINE_MS, log = console.warn,
+}) {
+  // One pass at a time, and a pass that never answers is given up on so the
+  // next one still runs.
+  let running = null;
+  const run = () => {
+    if (running) return running;
+    let timer = null;
+    const deadline = new Promise((_, reject) => {
+      timer = setTimeout(() => reject(new Error(`no answer in ${Math.round(deadlineMs / 1000)}s`)), deadlineMs);
+    });
+    running = Promise.race([scanNewChats({ store, config, readThreads, isOpen }), deadline])
+      .catch((e) => log('new chats watch:', e?.message ?? e))
+      .finally(() => { clearTimeout(timer); running = null; });
+    return running;
+  };
+  const first = setTimeout(run, firstDelayMs);
+  const timer = setInterval(run, everyMs);
+  return {
+    scanNow: run,
+    stop: () => { clearTimeout(first); clearInterval(timer); },
+  };
+}
+
+/** The watch as the app runs it, on the desktop (main/main.mjs) and in the browser copy (bin/agentbox.mjs). */
+export function watchNewChatsFor({ store, config, supervisor, ...timing }) {
+  return startNewChatsWatch({
+    store,
+    config,
+    readThreads: (opts) => readRecentThreads({ ...opts, config, supervisor, readCodex: readCodexThreadsOffThread }),
+    isOpen: (t) => claudeSessionOpen(t.id, appSessionFolders({ config, supervisor }).dirs),
+    ...timing,
+  });
+}

package/main/new-user-window.mjs

@@ -0,0 +1,25 @@
+// A throwaway copy's window says so, and stands where you can see both.
+//
+// "Open Agentbox as a new user" (main/fresh-user.mjs) launches the app again
+// inside a throwaway home, beside the one it was opened from. The offset is a
+// window's shoulder rather than a tile: the point is to see there are two, with
+// the real one still readable behind. A copy that cannot fit the offset is left
+// centred rather than pushed half off the screen, which a 1440-wide laptop is.
+
+/** How far down and across a second copy stands. */
+export const OFFSET = 48;
+
+/** The window options a copy adds, given whether it is a throwaway one. */
+export function newUserWindow({ fresh, name, screen, width = 1440, height = 900 } = {}) {
+  if (!fresh) return { title: name };
+  const title = `${name} (new user)`;
+  if (!screen) return { title };
+  const centred = {
+    x: Math.round(screen.x + (screen.width - width) / 2),
+    y: Math.round(screen.y + (screen.height - height) / 2),
+  };
+  const x = centred.x + OFFSET;
+  const y = centred.y + OFFSET;
+  if (x + width > screen.x + screen.width || y + height > screen.y + screen.height) return { title };
+  return { title, x, y };
+}

package/main/notify.mjs

@@ -13,19 +13,54 @@
 // AND ONCE, NOT TWENTY TIMES. One at a time is not once. `spoke` below is the
 // fix, and shared/notify-rules.mjs carries the rule.
 
+import path from 'node:path';
 import { atTheApp, banner, shouldSpeak } from '../shared/notify-rules.mjs';
 import { NAME } from '../shared/product-name.mjs';
 
+// THE MARK THE BANNER WEARS, and why it is a png and not the .icns every other
+// part of this repo uses.
+//
+// macOS draws the app's OWN bundle icon down the left of a banner, and no app
+// can override that. From a source checkout the bundle being asked is the
+// Electron.app in node_modules, which scripts/brand-electron.mjs renames and
+// re-icons, and macOS still drew a generic grey square: "it shows a plain
+// placeholder", looking at a real one, 2026-10-07.
+//
+// An image handed to the notification is the half we DO control; macOS attaches
+// it to the banner. Measured the same day in the Electron the app runs from:
+// nativeImage.createFromPath on build/icon.icns comes back empty, 0x0, so the
+// icns is not a candidate however convenient it would be. The png beside it,
+// drawn from the same art, reads 256x256.
+//
+// AN EMPTY IMAGE IS NOT A MARK. createFromPath answers a missing or unreadable
+// file with an empty image rather than an error, so "it returned something" is
+// the wrong question, and handing that something to macOS is how this goes
+// quietly back to a grey square. Returns null when there is nothing to show,
+// and the banner then looks exactly as it did before any of this.
+export const MARK_FILE = path.join('build', 'notification-icon.png');
+
+export function markFor({ root, createFromPath }) {
+  try {
+    const img = createFromPath(path.join(root, MARK_FILE));
+    return img && !img.isEmpty() ? img : null;
+  } catch { return null; }
+}
+
 // A BURST IS ONE PIECE OF NEWS. Four workers finishing inside the same
 // supervisor tick is the ordinary case, and it arrives as four pushes over a
 // second or two. Waiting a beat before speaking turns that into one banner
 // with one sound instead of four rewrites and four chimes.
 const COALESCE_MS = 1500;
 
-export function createNotifier({ window, Notification, powerMonitor, coalesceMs = COALESCE_MS }) {
+// `onChange` hears that what it has told you about changed: the tray counts
+// all of it (main/corner-tag.mjs), so a banner never speaks for a thread the
+// tray leaves out.
+export function createNotifier({ window, Notification, powerMonitor, icon = null, coalesceMs = COALESCE_MS, onChange = () => {} }) {
   // Everything she has not seen since she last had the window, keyed by id so
   // a repeated push is idempotent. Insertion order is arrival order.
   const unseen = new Map();
+  const toldAt = new Map();
+  const changed = () => { try { onChange(); } catch { /* the tray catches up on its next look */ } };
   let live = null;      // the one notification currently on screen, if any
   let timer = null;
   // HOW MANY TIMES SHE HAS BEEN INTERRUPTED SINCE SHE LAST HAD THE WINDOW.
@@ -53,11 +88,14 @@ export function createNotifier({ window, Notification, powerMonitor, coalesceMs
   // dropped rather than banked: showing them later, when she steps away, would
   // be telling her about work she already watched arrive.
   const seen = () => {
+    const had = unseen.size > 0;
     unseen.clear();
+    toldAt.clear();
     if (timer) { clearTimeout(timer); timer = null; }
     spoke = false;
     spokeAsk = false;
     takeDown();
+    if (had) changed();
   };
 
   const speak = () => {
@@ -81,6 +119,9 @@ export function createNotifier({ window, Notification, powerMonitor, coalesceMs
         title: say.title,
         body: say.body,
         silent: false,
+        // Omitted rather than passed empty when there is nothing to show, so a
+        // banner with no mark is byte for byte the banner that shipped before.
+        ...(icon ? { icon } : {}),
       });
     } catch { return; }
     // A banner she can act on. Clicking it brings Agentbox forward and opens the
@@ -123,33 +164,51 @@ export function createNotifier({ window, Notification, powerMonitor, coalesceMs
       // Asked before banking anything, so that a burst arriving while she is
       // at the app is dropped rather than saved up for when she leaves.
       if (atTheApp({ focused: focused(), idleMs: idleMs() })) return seen();
+      let banked = false;
       for (const a of arrivals) {
         if (!a || !a.id || unseen.has(a.id)) continue;
         unseen.set(a.id, a);
+        toldAt.set(a.id, Date.now());
+        banked = true;
       }
+      if (banked) changed();
       if (!unseen.size || timer) return;
       timer = setTimeout(speak, coalesceMs);
     },
     // The window came forward. Whatever was on screen is now behind her.
     seen,
+    // What it has told you about, or is about to, since you were last at the
+    // app, and when each arrived.
+    told: () => [...toldAt].map(([id, at]) => ({ id, at })),
     // Tests, and nothing else.
     _pending: () => [...unseen.values()],
     _spoken: () => ({ spoke, spokeAsk }),
   };
 }
 
-export function installNotifier({ app, window, Notification, powerMonitor, ipcMain }) {
+// `onArrivals` hears every arrival too, with the inbox they arrived in, for
+// the phone's alerts (main/phone-alerts.mjs), which make their own call.
+const needsYouOf = (payload) => (Array.isArray(payload.needsYou) ? payload.needsYou : []);
+export function installNotifier({ app, window, Notification, powerMonitor, ipcMain, nativeImage, onArrivals = () => {}, onChange = () => {} }) {
   if (Notification.isSupported && !Notification.isSupported()) {
-    return { add() {}, seen() {} };
+    ipcMain.handle('zero:notify', (_e, payload = {}) => { try { onArrivals(Array.isArray(payload.arrivals) ? payload.arrivals : [], needsYouOf(payload)); } catch {} });
+    return { add() {}, seen() {}, told: () => [] };
   }
-  const notifier = createNotifier({ window, Notification, powerMonitor });
+  // app.getAppPath() is the repo from source and the asar inside the bundle
+  // when it is packaged, and the mark sits at the same place in both.
+  const icon = nativeImage
+    ? markFor({ root: app.getAppPath(), createFromPath: (p) => nativeImage.createFromPath(p) })
+    : null;
+  const notifier = createNotifier({ window, Notification, powerMonitor, icon, onChange });
   window.on('focus', () => notifier.seen());
   // Unlocking with Agentbox already the front app never fires 'focus' (it never
   // lost it), so without this the banner that fired while the screen was
   // locked would sit in Notification Center after she is back at the row.
   try { powerMonitor.on('unlock-screen', () => { if (window.isFocused()) notifier.seen(); }); } catch {}
   ipcMain.handle('zero:notify', (_e, payload = {}) => {
-    notifier.add(Array.isArray(payload.arrivals) ? payload.arrivals : []);
+    const arrivals = Array.isArray(payload.arrivals) ? payload.arrivals : [];
+    try { onArrivals(arrivals, needsYouOf(payload)); } catch {}
+    notifier.add(arrivals);
   });
   return notifier;
 }

package/main/opencode-server.mjs

@@ -0,0 +1,271 @@
+// OPENCODE'S OWN TRANSPORT, AND WHY IT IS THE SERVER AND NOT THE CLI.
+//
+// Measured against a real OpenCode 1.18.35 on 2026-10-07. `opencode run` is
+// the obvious road -- it is non-interactive, `--format json` prints one JSON
+// object per line, and that is nearly the shape main/harnesses/claude-stream
+// already reads. It is also the wrong road, and the measurement says so in one
+// line. Run with `permission: { bash: "ask" }` in config, the CLI printed:
+//
+//   ! permission requested: bash (echo probe-run-mode); auto-rejecting
+//
+// and handed the model "The user rejected permission to use this specific tool
+// call." With no permission config at all it ran the command with no card.
+// `--auto` approves everything not explicitly denied. So the CLI offers
+// approve-everything or refuse-everything, and an Agentbox card is neither.
+//
+// The HTTP server does carry a real approval. `opencode serve` raises
+// `permission.asked` on its `/event` stream with the command in
+// `metadata.command`, and `POST /session/:id/permissions/:id` with
+// `{ response: "once" }` releases it while `{ response: "reject" }` refuses it.
+// Both measured end to end against the real binary, both answers, 200 each
+// time, the tool running in the first case and coming back
+// "The user rejected permission to use this specific tool call." in the second.
+// That is the same card contract main/codex-approvals.mjs already fills, which
+// is why this file exists and a second stream parser does not.
+//
+// AND IT IS WHY WE DO NOT PASS `--auto` ANYWHERE. A grep for it is a test
+// (tests/opencode-asks-before-it-runs-a-command), because the flag would make
+// every run quietly approve its own file writes and shell commands.
+import { EventEmitter } from 'node:events';
+import { Name } from '../shared/product-name.mjs';
+
+/** How long a single HTTP call to the local server may take. */
+const CALL_MS = 60_000;
+
+/**
+ * A client for one `opencode serve`.
+ *
+ * `password` is the server's own basic-auth secret, which Agentbox generates
+ * per server and which OpenCode reads from `OPENCODE_SERVER_PASSWORD`. It is
+ * NOT a provider credential: OpenCode loads those itself, from its own
+ * `~/.local/share/opencode/auth.json`. Agentbox never has one to pass, which
+ * is the rule in CLAUDE.md and the reason this harness can exist at all.
+ */
+export function openCodeClient({ baseUrl, password = null, username = 'opencode', fetchImpl = globalThis.fetch } = {}) {
+  if (!baseUrl) throw Error('openCodeClient needs the address of a running OpenCode server');
+  const root = String(baseUrl).replace(/\/+$/, '');
+  const authorization = password ? `Basic ${Buffer.from(`${username}:${password}`).toString('base64')}` : null;
+
+  const request = async (path, { method = 'GET', body, signal, stream = false } = {}) => {
+    const response = await fetchImpl(root + path, {
+      method,
+      headers: {
+        ...(authorization ? { authorization } : {}),
+        ...(body === undefined ? {} : { 'content-type': 'application/json' }),
+        ...(stream ? { accept: 'text/event-stream' } : {}),
+      },
+      ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+      signal: signal ?? AbortSignal.timeout(CALL_MS),
+    });
+    if (!response.ok) throw Error(`OpenCode answered ${response.status} for ${method} ${path}`);
+    if (stream) return response;
+    const text = await response.text();
+    if (!text) return null;
+    try { return JSON.parse(text); } catch { return text; }
+  };
+
+  return {
+    url: root,
+    request,
+    createSession: (body = {}) => request('/session', { method: 'POST', body }),
+    prompt: (sessionId, body) => request(`/session/${encodeURIComponent(sessionId)}/prompt_async`, { method: 'POST', body }),
+    abort: sessionId => request(`/session/${encodeURIComponent(sessionId)}/abort`, { method: 'POST', body: {} }),
+    // `{ response }` and not `{ action }`: the field name is off the real
+    // OpenAPI document the running server serves at /doc.
+    replyPermission: (sessionId, permissionId, response) =>
+      request(`/session/${encodeURIComponent(sessionId)}/permissions/${encodeURIComponent(permissionId)}`, { method: 'POST', body: { response } }),
+    summarize: (sessionId, model) =>
+      request(`/session/${encodeURIComponent(sessionId)}/summarize`, { method: 'POST', body: splitModel(model) }),
+    runCommand: (sessionId, body) => request(`/session/${encodeURIComponent(sessionId)}/command`, { method: 'POST', body }),
+    providers: () => request('/config/providers'),
+    commands: () => request('/command'),
+    config: () => request('/config'),
+    health: () => request('/global/health'),
+    events: ({ signal } = {}) => eventStream(request, signal),
+  };
+}
+
+/**
+ * `provider/model` as the two fields OpenCode's API wants.
+ *
+ * Its model ids are provider-qualified and the slash is part of the id people
+ * see (`opencode/big-pickle`, `anthropic/claude-sonnet-4-5`), but every server
+ * endpoint takes `providerID` and `modelID` apart. A model with no slash is not
+ * guessed at: it is left for the server's own default to answer, because
+ * inventing a provider here is how a run dies on a model nobody chose.
+ */
+export function splitModel(model) {
+  const text = typeof model === 'string' ? model.trim() : '';
+  const at = text.indexOf('/');
+  if (at <= 0 || at === text.length - 1) return {};
+  return { providerID: text.slice(0, at), modelID: text.slice(at + 1) };
+}
+
+/** The `/event` stream, as an async iterable of `{ type, properties }`. */
+function eventStream(request, outerSignal) {
+  const controller = new AbortController();
+  outerSignal?.addEventListener('abort', () => controller.abort(), { once: true });
+  const opened = request('/event', { stream: true, signal: controller.signal });
+
+  return {
+    close: () => controller.abort(),
+    async *[Symbol.asyncIterator]() {
+      const response = await opened;
+      const reader = response.body.getReader();
+      const decoder = new TextDecoder();
+      let buffer = '';
+      try {
+        while (true) {
+          const { value, done } = await reader.read();
+          if (done) return;
+          buffer += decoder.decode(value, { stream: true });
+          let index;
+          while ((index = buffer.indexOf('\n')) >= 0) {
+            const line = buffer.slice(0, index).trim();
+            buffer = buffer.slice(index + 1);
+            if (!line.startsWith('data:')) continue;
+            const payload = line.slice(5).trim();
+            if (!payload) continue;
+            try { yield JSON.parse(payload); } catch { /* a half-written frame is not news */ }
+          }
+        }
+      } finally {
+        try { await reader.cancel(); } catch { /* already gone */ }
+      }
+    },
+  };
+}
+
+/** The permission events, old and new, that mean "a card is wanted". */
+const ASKED = new Set(['permission.asked', 'permission.v2.asked']);
+/** What the reply endpoint calls yes and no. */
+const ALLOW = 'once';
+const DENY = 'reject';
+
+/**
+ * ONE OPENCODE RUN, SHAPED LIKE A CHILD PROCESS.
+ *
+ * The supervisor's spawn path wants something with `stderr`, `on('event')` and
+ * one `exit`, because that is what a Claude Code child and a Codex worker both
+ * look like from there (main/supervisor.mjs, `_spawnWorker`). This is the third
+ * one, and it owns nothing the other two own: its events are OpenCode's own
+ * names, passed through untranslated, exactly as the Codex adapter passes its
+ * notifications through rather than pretending to be Claude's JSON lines.
+ *
+ * DENY IS THE ANSWER NOBODY HAS TO CHOOSE. A card that is never answered, a
+ * handler that throws, a spool that has gone away, a worker killed mid-question
+ * -- every one of those refuses the tool call. The opposite default would mean
+ * a crashed inbox silently approves shell commands, which is the one failure
+ * here that cannot be taken back.
+ */
+export function createOpenCodeWorker({
+  client,
+  plan = {},
+  cwd = null,
+  resumeSessionId = null,
+  onApproval = null,
+  title = null,
+} = {}) {
+  if (!client) throw Error('createOpenCodeWorker needs a client for a running OpenCode server');
+
+  const worker = new EventEmitter();
+  worker.stderr = new EventEmitter();
+  worker.stdout = new EventEmitter();
+  worker.sessionId = resumeSessionId ?? null;
+
+  const say = text => {
+    const line = String(text ?? '').trim();
+    if (line) worker.stderr.emit('data', line);
+  };
+
+  let ended = false;
+  let stream = null;
+  const answered = new Set();
+
+  const stop = async () => {
+    if (ended) return;
+    ended = true;
+    try { stream?.close(); } catch { /* already closed */ }
+    if (worker.sessionId) { try { await client.abort(worker.sessionId); } catch { /* the run is over either way */ } }
+  };
+
+  /**
+   * One card, and the reply that releases or refuses the tool.
+   *
+   * The id is remembered BEFORE the card is raised, so a request the stream
+   * repeats -- which it does, `permission.asked` can arrive again for a request
+   * still open -- costs one card and not two.
+   */
+  const decide = async (type, properties) => {
+    const id = properties?.id;
+    const session = properties?.sessionID;
+    if (!id || session !== worker.sessionId || answered.has(id)) return;
+    answered.add(id);
+
+    let allowed = false;
+    try {
+      allowed = onApproval ? await onApproval(type, properties) === true : false;
+    } catch (error) {
+      say(`${Name} could not ask about ${String(properties?.metadata?.command ?? 'a tool call')}: ${error?.message ?? error}`);
+      allowed = false;
+    }
+    if (ended) allowed = false;
+
+    try {
+      await client.replyPermission(session, id, allowed ? ALLOW : DENY);
+    } catch (error) {
+      say(`OpenCode did not take the answer to that question: ${error?.message ?? error}`);
+    }
+  };
+
+  const run = async () => {
+    try {
+      if (!worker.sessionId) {
+        const session = await client.createSession({ ...(title ? { title } : {}), ...(cwd ? { directory: cwd } : {}) });
+        worker.sessionId = session?.id ?? null;
+        if (!worker.sessionId) throw Error('OpenCode did not name the session it opened');
+      }
+
+      // The stream is opened BEFORE the prompt. Opening it after is a race the
+      // fast answers win: `permission.asked` for the first tool call can beat
+      // our own subscription, and nothing would ever answer that card.
+      stream = client.events();
+      const reading = (async () => {
+        for await (const event of stream) {
+          if (ended) return;
+          const type = String(event?.type ?? '');
+          const properties = event?.properties ?? {};
+          worker.emit('event', type, properties);
+          if (ASKED.has(type)) { await decide(type, properties); continue; }
+          if (properties?.sessionID && properties.sessionID !== worker.sessionId) continue;
+          if (type === 'session.error') {
+            worker.error = properties?.error ?? 'OpenCode reported an error';
+            return;
+          }
+          if (type === 'session.idle') return;
+        }
+      })();
+
+      await client.prompt(worker.sessionId, {
+        ...splitModel(plan.model),
+        ...(plan.agent ? { agent: plan.agent } : {}),
+        parts: [{ type: 'text', text: String(plan.prompt ?? '') }],
+      });
+
+      await reading;
+    } catch (error) {
+      worker.error = error?.message ?? String(error);
+      say(worker.error);
+    } finally {
+      const already = ended;
+      ended = true;
+      try { stream?.close(); } catch { /* already closed */ }
+      if (!already && worker.sessionId) { try { await client.abort(worker.sessionId); } catch { /* nothing left to stop */ } }
+      worker.emit('exit', worker.error ? 1 : 0, null);
+    }
+  };
+
+  worker.kill = () => { void stop(); };
+  worker.done = run();
+  return worker;
+}