agentbox-app 0.1.13 → 0.1.16

package/main/analytics.mjs

@@ -144,9 +144,12 @@ export function createAnalytics({ config, version, dir, client, env = process.en
 
   return {
     get enabled() { return on(); },
+    // A whole phrase, verb and all: the line that prints it reads
+    // `diagnostics ${reason}`, and a reason with no verb of its own made that
+    // "diagnostics is has nowhere to send to".
     get reason() {
       if (!hasDestination) return 'has nowhere to send to';
-      return diagnosticsOn(config) ? 'on' : 'turned off';
+      return diagnosticsOn(config) ? 'is on' : 'is turned off';
     },
     hasDestination,
     installId,
@@ -230,7 +233,14 @@ export function createAnalytics({ config, version, dir, client, env = process.en
       return sent;
     },
 
-    async flush() { try { await posthog?.flush?.(); } catch {} },
+    // AND THE SWITCH IS READ HERE TOO (w-60c8ddbab6). This is a send like any
+    // other, which is note 4 at the top of this file, and until the quit
+    // started waiting for it the point was moot: a fire-and-forget flush on the
+    // way out mostly never left the machine. Now that it lands, a flush asked
+    // for after the switch went off would carry events captured before it did,
+    // and section 10 of the privacy page says turning it off "stops sending from
+    // that moment".
+    async flush() { if (!on()) return; try { await posthog?.flush?.(); } catch {} },
     async shutdown() { try { await posthog?.shutdown?.(); } catch {} },
   };
 }

package/main/answer-modes.mjs

@@ -12,23 +12,15 @@
 // was not: one hand-written line saying `"source":"founder"` granted its own
 // next run bypassPermissions. Proved on a scratch ledger, 2026-08-24.
 //
-// So the grant is not on the ledger any more. It lives here, in the app's own
-// home, written by main and by nothing else. The MCP server has no code that
-// reaches this file and no tool that names it.
+// So the grant is not on the ledger any more. It lives in her own folder (the
+// desktop's user data folder), written by main and by nothing else.
 //
-// WHAT THIS DOES AND WHAT IT DOES NOT DO, said plainly.
-//
-//   It does NOT make forging impossible. Anything that can run commands can
-//   write any file this user owns, and `~/.astral` is no exception. Claude Code
-//   has the identical property: its settings file is as writable as anything
-//   else in your home, and it relies on the sandbox and the prompt rather than
-//   on the folder.
-//
-//   What it changes is the COST. Before: one more line appended to a file the
-//   worker was appending to anyway, in a format it writes every few seconds,
-//   in its own working directory. After: a deliberate reach into the app's own
-//   storage, in a file nothing briefs it about and no tool it holds mentions.
-//   That is a real difference and it is the whole claim. It is not a wall.
+// NEVER UNDER THE STORE ROOT. The app makes its own home the store root, and
+// every Claude worker is granted that folder, so a file edit there needs no
+// card. Outside the granted folders a write meets the same card or auto-mode
+// check as any other reach into her home. That is the whole claim and it is
+// not a wall: anything that can run commands can write any file this user owns
+// (tests/a-worker-cannot-set-its-own-permission-mode).
 //
 // GRANTING IS THE FOUNDER'S, SPENDING ONE IS THE MACHINERY'S, AGENTS GET
 // NEITHER. That rule survives the move intact, and it is now structural rather
@@ -36,13 +28,73 @@
 // there is no `source` to check and no line for anyone else to forge.
 
 import fs from 'node:fs';
+import os from 'node:os';
 import path from 'node:path';
-import { appHome } from './store/home.mjs';
+import crypto from 'node:crypto';
+import { nameSlug } from '../shared/product-name.mjs';
 import { CLAUDE_PERMISSION_MODES } from '../shared/work-items.mjs';
 import { CODEX_MODE_ORDER } from '../shared/codex-modes.mjs';
 
 const FILE = 'answer-modes.json';
 
+// Set once at start by `keepAnswerModesIn`. Until then nothing is read or kept:
+// a process that never said where must not fall back to the store root.
+let where = null;
+let saidNowhere = false;
+
+const inside = (file, dir) => {
+  const f = path.resolve(file);
+  const d = path.resolve(dir);
+  return f === d || f.startsWith(d + path.sep);
+};
+
+function configHome(home, env) {
+  const given = typeof env?.XDG_CONFIG_HOME === 'string' ? env.XDG_CONFIG_HOME.trim() : '';
+  return given && path.isAbsolute(given) ? given : path.join(home, '.config');
+}
+
+/**
+ * Where the app keeps these, said once at start (main/main.mjs, main/serve.mjs).
+ *
+ * In `userDir`, unless that is inside the store root, as the headless copy's
+ * is: then in a per-store folder under the config home, the way the team
+ * sign-in moves (main/team/session.mjs). If that is inside the store root too,
+ * nowhere: every thread runs on its project's mode, which is the safe side.
+ * Returns the file, or null.
+ */
+export function keepAnswerModesIn({ userDir, storeRoot, home = os.homedir(), env = process.env }) {
+  let target = userDir ? path.join(userDir, FILE) : null;
+  if (target && storeRoot && inside(target, storeRoot)) {
+    const tag = crypto.createHash('sha256').update(path.resolve(storeRoot)).digest('hex').slice(0, 16);
+    target = path.join(configHome(home, env), nameSlug, 'grants', tag, FILE);
+  }
+  if (!target || (storeRoot && inside(target, storeRoot))) {
+    console.warn(`zero: nowhere outside the store root (${storeRoot}) to keep what a reply may do, so every thread runs on its project's mode`);
+    target = null;
+  }
+  where = target;
+  if (storeRoot) carryFromTheStore(path.join(storeRoot, FILE));
+  return where;
+}
+
+export const answerModesFile = () => where;
+
+// AN OLDER VERSION KEPT THIS IN THE STORE ROOT. Its file is carried across the
+// first time and removed every time. The new file is created even when there is
+// nothing to carry, because that is what makes the carry happen once: without
+// it, a file a worker wrote into the store later would be carried at the next
+// start.
+function carryFromTheStore(old) {
+  let found = null;
+  try { found = fs.lstatSync(old); } catch { /* nothing there */ }
+  if (where && !fs.existsSync(where)) {
+    writeAll(where, sweep(found?.isFile() ? readAll(old) : {}, Date.now()));
+  }
+  if (found) {
+    try { fs.rmSync(old, { force: true }); } catch (err) { console.warn(`zero: could not remove ${old}: ${err.message}`); }
+  }
+}
+
 // HOW LONG A MODE LIVES, NOW THAT IT BELONGS TO A THREAD AND NOT TO ONE SEND.
 //
 // This was 24 hours, and 24 hours was right while the supervisor spent the
@@ -61,21 +113,35 @@ const FILE = 'answer-modes.json';
 // the file does not grow without limit. Swept on every write.
 const KEEP_MS = 30 * 24 * 60 * 60 * 1000;
 
-const file = (home = appHome()) => path.join(home, FILE);
+const fileFor = (home) => (home === undefined ? where : path.join(home, FILE));
 
-function readAll(home) {
+// Never through a link, and never anything but a regular file, so a link left
+// in place of one cannot point the read at a file somebody else writes.
+const READ_FLAGS = fs.constants.O_RDONLY | fs.constants.O_NONBLOCK | (fs.constants.O_NOFOLLOW ?? 0);
+
+function readAll(target) {
+  if (!target) return {};
+  let fd = null;
   try {
-    const raw = JSON.parse(fs.readFileSync(file(home), 'utf8'));
+    fd = fs.openSync(target, READ_FLAGS);
+    if (!fs.fstatSync(fd).isFile()) return {};
+    const raw = JSON.parse(fs.readFileSync(fd, 'utf8'));
     return raw && typeof raw === 'object' && !Array.isArray(raw) ? raw : {};
   } catch {
     return {};
+  } finally {
+    if (fd !== null) { try { fs.closeSync(fd); } catch { /* already closed */ } }
   }
 }
 
 // tmp + rename, so a reader never sees half a file and a crash mid-write leaves
 // the previous one intact.
-function writeAll(home, all) {
-  const target = file(home);
+function writeAll(target, all) {
+  if (!target) {
+    if (!saidNowhere) console.warn('zero: a mode was picked with nowhere to keep it, so the thread runs on its project\'s mode');
+    saidNowhere = true;
+    return;
+  }
   fs.mkdirSync(path.dirname(target), { recursive: true });
   const tmp = `${target}.${process.pid}.tmp`;
   fs.writeFileSync(tmp, `${JSON.stringify(all, null, 2)}\n`);
@@ -123,8 +189,8 @@ function sweep(all, now) {
  */
 const ALLOWED_MODES = [...CLAUDE_PERMISSION_MODES, ...CODEX_MODE_ORDER];
 
-export function answerMode(slug, id, { home = appHome(), now = Date.now() } = {}) {
-  const entry = readAll(home)[keyOf(slug, id)];
+export function answerMode(slug, id, { home, now = Date.now() } = {}) {
+  const entry = readAll(fileFor(home))[keyOf(slug, id)];
   if (!entry || typeof entry !== 'object') return undefined;
   if (Number.isFinite(entry.at) && now - entry.at > KEEP_MS) return undefined;
   if (entry.mode === null) return null;
@@ -132,9 +198,9 @@ export function answerMode(slug, id, { home = appHome(), now = Date.now() } = {}
 }
 
 /** Every row that currently carries one, as `{ "<slug>/<id>": mode }`. */
-export function answerModes({ home = appHome(), now = Date.now() } = {}) {
+export function answerModes({ home, now = Date.now() } = {}) {
   const out = {};
-  for (const [key, entry] of Object.entries(readAll(home))) {
+  for (const [key, entry] of Object.entries(readAll(fileFor(home)))) {
     if (!entry || typeof entry !== 'object') continue;
     if (Number.isFinite(entry.at) && now - entry.at > KEEP_MS) continue;
     if (entry.mode === null) { out[key] = null; continue; }
@@ -150,12 +216,12 @@ export function answerModes({ home = appHome(), now = Date.now() } = {}) {
  * A mode that is not one of the six is refused outright rather than stored,
  * which is what the ledger's own check used to do.
  */
-export function setAnswerMode(slug, id, mode, { home = appHome(), now = Date.now() } = {}) {
+export function setAnswerMode(slug, id, mode, { home, now = Date.now() } = {}) {
   if (mode !== null && !ALLOWED_MODES.includes(mode)) return answerMode(slug, id, { home, now });
-  const all = sweep(readAll(home), now);
+  const all = sweep(readAll(fileFor(home)), now);
   all[keyOf(slug, id)] = { mode, at: now };
-  writeAll(home, all);
-  return mode;
+  writeAll(fileFor(home), all);
+  return fileFor(home) ? mode : undefined;
 }
 
 /**
@@ -170,14 +236,14 @@ export function setAnswerMode(slug, id, mode, { home = appHome(), now = Date.now
  * the worst this call can do is keep a grant she already made alive one more
  * month.
  */
-export function touchAnswerMode(slug, id, used, { home = appHome(), now = Date.now() } = {}) {
-  const all = sweep(readAll(home), now);
+export function touchAnswerMode(slug, id, used, { home, now = Date.now() } = {}) {
+  const all = sweep(readAll(fileFor(home)), now);
   const key = keyOf(slug, id);
   const entry = all[key];
   if (!entry || typeof entry !== 'object') return undefined;
   if (used !== undefined && entry.mode !== used) return entry.mode;
   all[key] = { mode: entry.mode, at: now };
-  writeAll(home, all);
+  writeAll(fileFor(home), all);
   return entry.mode;
 }
 
@@ -193,14 +259,14 @@ export function touchAnswerMode(slug, id, used, { home = appHome(), now = Date.n
  * NOW, for the same reason as above. Clearing is not "less": it means back to
  * the project's setting, which can be the wider one.
  */
-export function clearAnswerMode(slug, id, spent, { home = appHome(), now = Date.now() } = {}) {
-  const all = sweep(readAll(home), now);
+export function clearAnswerMode(slug, id, spent, { home, now = Date.now() } = {}) {
+  const all = sweep(readAll(fileFor(home)), now);
   const key = keyOf(slug, id);
   const current = all[key]?.mode;
   if (spent !== undefined && current !== spent) return current === undefined ? undefined : current;
   all[key] = { mode: null, at: now };
-  writeAll(home, all);
+  writeAll(fileFor(home), all);
   return null;
 }
 
-export const _internals = { file, KEEP_MS };
+export const _internals = { file: fileFor, KEEP_MS, useFile: (f) => { where = f ?? null; } };

package/main/approval-prompt-core.mjs

@@ -0,0 +1,197 @@
+// The approvals channel: a tiny MCP server that Claude Code calls (via
+// --permission-prompt-tool) whenever a headless worker wants to do something
+// its standing grants do not cover. The request lands as a file in the spool,
+// the app shows the founder a card, her click writes the answer file, and the
+// worker unblocks in place. Before this, a gated command ended the story:
+// sessions wrote everything and bounced the actual run back to the founder
+// as a paste (2026-08-05).
+//
+// Deny is the default in every failure mode: the run ending, a spool error, a
+// malformed answer. An approval can only come from the founder's explicit file,
+// and a silence is not one: the question waits for her rather than being
+// answered by a clock.
+//
+// EVERY TOUCH OF THE SPOOL GOES THROUGH main/approvals.mjs, which is where the
+// rule that this directory is worker-writable is written down and enforced --
+// nothing opened through a link, nothing opened that is not a regular file,
+// every write landed by rename. It used to be bare `fs` here, and the audit
+// line was the worst of it: `log.jsonl` is a fixed name, so a worker that
+// symlinked it at `briefs/founder.md` had a repeatable append of its own
+// `command` string into the standing instructions every session is briefed
+// with. This process runs as the worker's own child, so it is the near half of
+// that attack (2026-09-04).
+
+import fs from 'node:fs';
+import crypto from 'node:crypto';
+import readline from 'node:readline';
+import { answerIsHers, appendSpoolLine, cardDigest, readSpoolJson, removeSpoolEntry, spoolEntryExists, writeSpoolFile } from './approvals.mjs';
+
+const POLL_MS = 2_000;
+
+// A QUESTION IS NOT AN APPROVAL. Workers launch without AskUserQuestion
+// (Supervisor.prepareClaudePermissions); one that arrives here anyway is
+// turned back to the thread before any card exists, because the card has
+// nowhere to put an answer (w-ab1f2f1d82).
+const ASK_IN_THE_THREAD = 'Questions are not asked here. Finish what you can without the answer, then end your turn with the question as your last message and its choices listed under Options. Their reply comes back to this session.';
+
+/**
+ * One approvals channel, over `input` and `output` (a process's own stdio, or
+ * a cloud run's connection when many share one process: main/cloud/run.mjs).
+ * `env` is that worker's: the spool, the public key, and which row it is.
+ */
+export function serveApprovals({ env = process.env, input = process.stdin, output = process.stdout, warn = console.warn } = {}) {
+  const SPOOL = env.ZERO_APPROVALS_DIR;
+  // THE KEY THAT SAYS AN ANSWER IS THE USER'S, AND IT IS SAFE TO HAND US.
+  //
+  // This channel is the worker's own, so its environment is the worker's to
+  // read and anything secret given here is a secret the forger has. This is the
+  // PUBLIC half of a pair whose private half never leaves Agentbox's process: it
+  // verifies and it cannot sign, which is exactly why it can travel this way.
+  // main/approvals.mjs holds the whole argument, including what it does not
+  // close.
+  const PUBLIC_KEY = env.ZERO_APPROVALS_PUBKEY;
+  // Closed when its run has gone: a question still waiting stops at once.
+  let closed = false;
+  const sleepers = new Set();
+  const nap = () => new Promise((resolve) => {
+    const wake = () => { clearTimeout(timer); sleepers.delete(wake); resolve(); };
+    const timer = setTimeout(wake, POLL_MS);
+    sleepers.add(wake);
+  });
+  const send = (msg) => { if (!output.writableEnded && !output.destroyed) output.write(JSON.stringify(msg) + '\n'); };
+  async function decide(args) {
+    try {
+      if (args?.tool_name === 'AskUserQuestion') return { behavior: 'deny', message: ASK_IN_THE_THREAD };
+      if (!SPOOL) return { behavior: 'deny', message: 'approvals spool is not configured' };
+      // NO KEY IS A CHANNEL THAT CANNOT TELL HER ANSWER FROM A WORKER'S, and a
+      // channel that cannot tell must not guess. It refuses here rather than
+      // asking and then denying in fifteen minutes, because nothing that arrives
+      // in that quarter of an hour could become an approval anyway.
+      if (!PUBLIC_KEY) return { behavior: 'deny', message: 'the approvals channel was given no key to check the founder\'s answer with, so nothing here can be approved' };
+      fs.mkdirSync(SPOOL, { recursive: true });
+      const id = crypto.randomUUID();
+      const request = {
+        id,
+        at: Date.now(),
+        product: env.ZERO_PRODUCT ?? null,
+        item: env.ZERO_ITEM ?? null,
+        tool: args.tool_name ?? 'unknown',
+        input: args.input ?? {},
+      };
+      // A question that could not be asked has already been answered.
+      if (!writeSpoolFile(SPOOL, `${id}.request.json`, JSON.stringify(request))) {
+        return { behavior: 'deny', message: 'the approvals spool would not take this request, so nothing was put in front of the founder' };
+      }
+      const answerName = `${id}.answer.json`;
+      let saidItCouldNotGoBack = false;
+      // A QUESTION WAITS FOR ITS ANSWER (w-4b00022acb). This gave up after
+      // fifteen minutes and told the run it had been refused, which is not
+      // what a silence means. The thread reads Asking and sits in Needs you
+      // while this waits (w-fe48447cab), and the run that asked is the bound:
+      // its end closes this channel and the loop stops with it.
+      while (!closed) {
+        // `lstat` rather than `existsSync`, so this sees exactly what the app's
+        // own `listPending` sees: an entry by that name, whatever it is.
+        if (spoolEntryExists(SPOOL, answerName)) {
+          const answer = readSpoolJson(SPOOL, answerName);
+          // AN ANSWER THAT IS NOT HERS IS NOT A DECISION AT ALL, and this is the
+          // line the whole file turns on. It used to read `answer?.allow` off
+          // whatever was in the directory, so any process that could write here
+          // was approved -- another worker's card, or its own.
+          //
+          // AND IT IS NOT A DENY EITHER, which matters as much: denying on an
+          // unreadable answer would let one worker force a No onto another's
+          // card, losing her Allow in silence. The file goes and the question
+          // goes on waiting, exactly as main/codex-approvals.mjs's own sweep
+          // does, and her real answer still lands when she gives it.
+          if (!answerIsHers(id, answer, PUBLIC_KEY)) {
+            removeSpoolEntry(SPOOL, answerName);
+            warn(`zero: an answer for approval ${id} that the founder did not write has been deleted; the question is still waiting`);
+            await nap();
+            continue;
+          }
+          // AND HER DECISION IS ABOUT AN ACTION, NOT ABOUT AN ID. The request
+          // file is worker-writable and its name and id survive a rewrite of its
+          // contents, so a worker could raise one command, replace the body with
+          // a harmless one, and have her Allow on the harmless card honoured
+          // against the command THIS PROCESS is still holding. `request` here is
+          // that memory: it was built from the tool call and has never been read
+          // back off the disk, so comparing it against the digest she signed is
+          // the whole check. A mismatch is a deny -- the user said yes to something
+          // else -- and it is loud, because only a rewrite can produce it.
+          const mine = cardDigest(request);
+          if (!mine || answer.card !== mine) {
+            finish(id, request, { allow: false, swapped: true });
+            warn(`zero: approval ${id} was answered for a different card than the one this run asked about; the request file was rewritten under it and nothing has been allowed`);
+            return {
+              behavior: 'deny',
+              message: 'The approval request changed between being asked and being answered, so the founder\'s decision was for a different action and nothing was allowed. Do not retry the same request this session: finish what your grants allow, and file the rest as a review with the exact commands.',
+            };
+          }
+          finish(id, request, answer);
+          if (answer.allow) return { behavior: 'allow', updatedInput: args.input ?? {} };
+          return { behavior: 'deny', message: answer.note || 'The founder declined this action. Work with what you are already allowed to do, or park the remainder as a review.' };
+        }
+        // THE SPOOL REAPS WHAT NOBODY IS WAITING ON, AND THIS IS HOW IT KNOWS.
+        // The app's `listPending` cannot see this loop, and this loop outlives
+        // its REQUEST_TTL_MS, so whoever waits keeps their own request there.
+        // Written from the `request` this process has held all along, never
+        // read back off the disk, so what comes back is the card that went.
+        if (!spoolEntryExists(SPOOL, `${id}.request.json`)
+          && !writeSpoolFile(SPOOL, `${id}.request.json`, JSON.stringify(request))
+          && !saidItCouldNotGoBack) {
+          // Failing here leaves this run parked with nothing on screen, which
+          // is the one way the wait goes bad, so it is said out loud. Once:
+          // this loop comes round every two seconds.
+          saidItCouldNotGoBack = true;
+          warn(`zero: approval ${id} left the spool and could not be put back, so this run is waiting with no card on screen`);
+        }
+        await nap();
+      }
+      finish(id, request, { allow: false, gone: true });
+      return { behavior: 'deny', message: 'the run that asked has ended' };
+    } catch (err) {
+      return { behavior: 'deny', message: `approvals channel error: ${err.message}` };
+    }
+  }
+
+  // One audit line per decision; the request/answer pair leaves the spool.
+  function finish(id, request, answer) {
+    appendSpoolLine(SPOOL, 'log.jsonl', `${JSON.stringify({ ...request, answer, decidedAt: Date.now() })}\n`);
+    for (const f of [`${id}.request.json`, `${id}.answer.json`]) removeSpoolEntry(SPOOL, f);
+  }
+
+  const rl = readline.createInterface({ input });
+  rl.on('line', async (line) => {
+    let msg;
+    try { msg = JSON.parse(line); } catch { return; }
+    const { id, method, params } = msg;
+    if (method === 'initialize') {
+      send({ jsonrpc: '2.0', id, result: {
+        protocolVersion: params?.protocolVersion ?? '2024-11-05',
+        capabilities: { tools: {} },
+        serverInfo: { name: 'zero-approvals', version: '1.0.0' },
+      } });
+    } else if (method === 'tools/list') {
+      send({ jsonrpc: '2.0', id, result: { tools: [{
+        name: 'approval_prompt',
+        description: 'Asks the founder, live in her inbox, to approve one gated action. The run stops here until she answers, however long that takes. Use only when the work genuinely cannot proceed without it.',
+        inputSchema: {
+          type: 'object',
+          properties: {
+            tool_name: { type: 'string' },
+            input: { type: 'object' },
+            tool_use_id: { type: 'string' },
+          },
+          required: ['tool_name', 'input'],
+        },
+      }] } });
+    } else if (method === 'tools/call' && params?.name === 'approval_prompt') {
+      const result = await decide(params.arguments ?? {});
+      send({ jsonrpc: '2.0', id, result: { content: [{ type: 'text', text: JSON.stringify(result) }] } });
+    } else if (id !== undefined) {
+      send({ jsonrpc: '2.0', id, result: {} });
+    }
+  });
+  return { close: () => { closed = true; for (const wake of [...sleepers]) wake(); rl.close(); } };
+}

package/main/approval-prompt-server.mjs

@@ -19,142 +19,8 @@
 // with. This process runs as the worker's own child, so it is the near half of
 // that attack (2026-09-04).
 
-import fs from 'node:fs';
-import crypto from 'node:crypto';
-import readline from 'node:readline';
-import { answerIsHers, appendSpoolLine, cardDigest, readSpoolJson, removeSpoolEntry, spoolEntryExists, writeSpoolFile } from './approvals.mjs';
+import { serveApprovals } from './approval-prompt-core.mjs';
 
-const SPOOL = process.env.ZERO_APPROVALS_DIR;
-
-// THE KEY THAT SAYS AN ANSWER IS THE USER'S, AND IT IS SAFE TO HAND US.
-//
-// This process is the worker's own child, so its environment is the worker's to
-// read and anything secret given here is a secret the forger has. This is the
-// PUBLIC half of a pair whose private half never leaves Agentbox's process: it
-// verifies and it cannot sign, which is exactly why it can travel this way.
-// main/approvals.mjs holds the whole argument, including what it does not
-// close.
-const PUBLIC_KEY = process.env.ZERO_APPROVALS_PUBKEY;
-
-const TIMEOUT_MS = 15 * 60_000;
-const POLL_MS = 2_000;
-
-const send = (msg) => process.stdout.write(JSON.stringify(msg) + '\n');
-
-async function decide(args) {
-  try {
-    if (!SPOOL) return { behavior: 'deny', message: 'approvals spool is not configured' };
-    // NO KEY IS A CHANNEL THAT CANNOT TELL HER ANSWER FROM A WORKER'S, and a
-    // channel that cannot tell must not guess. It refuses here rather than
-    // asking and then denying in fifteen minutes, because nothing that arrives
-    // in that quarter of an hour could become an approval anyway.
-    if (!PUBLIC_KEY) return { behavior: 'deny', message: 'the approvals channel was given no key to check the founder\'s answer with, so nothing here can be approved' };
-    fs.mkdirSync(SPOOL, { recursive: true });
-    const id = crypto.randomUUID();
-    const request = {
-      id,
-      at: Date.now(),
-      product: process.env.ZERO_PRODUCT ?? null,
-      item: process.env.ZERO_ITEM ?? null,
-      tool: args.tool_name ?? 'unknown',
-      input: args.input ?? {},
-    };
-    // A question that could not be asked has already been answered.
-    if (!writeSpoolFile(SPOOL, `${id}.request.json`, JSON.stringify(request))) {
-      return { behavior: 'deny', message: 'the approvals spool would not take this request, so nothing was put in front of the founder' };
-    }
-    const answerName = `${id}.answer.json`;
-    const deadline = Date.now() + TIMEOUT_MS;
-    while (Date.now() < deadline) {
-      // `lstat` rather than `existsSync`, so this sees exactly what the app's
-      // own `listPending` sees: an entry by that name, whatever it is.
-      if (spoolEntryExists(SPOOL, answerName)) {
-        const answer = readSpoolJson(SPOOL, answerName);
-        // AN ANSWER THAT IS NOT HERS IS NOT A DECISION AT ALL, and this is the
-        // line the whole file turns on. It used to read `answer?.allow` off
-        // whatever was in the directory, so any process that could write here
-        // was approved -- another worker's card, or its own.
-        //
-        // AND IT IS NOT A DENY EITHER, which matters as much: denying on an
-        // unreadable answer would let one worker force a No onto another's
-        // card, losing her Allow in silence. The file goes and the question
-        // goes on waiting, exactly as main/codex-approvals.mjs's own sweep
-        // does, and her real answer still lands when she gives it.
-        if (!answerIsHers(id, answer, PUBLIC_KEY)) {
-          removeSpoolEntry(SPOOL, answerName);
-          console.warn(`zero: an answer for approval ${id} that the founder did not write has been deleted; the question is still waiting`);
-          await new Promise((r) => setTimeout(r, POLL_MS));
-          continue;
-        }
-        // AND HER DECISION IS ABOUT AN ACTION, NOT ABOUT AN ID. The request
-        // file is worker-writable and its name and id survive a rewrite of its
-        // contents, so a worker could raise one command, replace the body with
-        // a harmless one, and have her Allow on the harmless card honoured
-        // against the command THIS PROCESS is still holding. `request` here is
-        // that memory: it was built from the tool call and has never been read
-        // back off the disk, so comparing it against the digest she signed is
-        // the whole check. A mismatch is a deny -- the user said yes to something
-        // else -- and it is loud, because only a rewrite can produce it.
-        const mine = cardDigest(request);
-        if (!mine || answer.card !== mine) {
-          finish(id, request, { allow: false, swapped: true });
-          console.warn(`zero: approval ${id} was answered for a different card than the one this run asked about; the request file was rewritten under it and nothing has been allowed`);
-          return {
-            behavior: 'deny',
-            message: 'The approval request changed between being asked and being answered, so the founder\'s decision was for a different action and nothing was allowed. Do not retry the same request this session: finish what your grants allow, and file the rest as a review with the exact commands.',
-          };
-        }
-        finish(id, request, answer);
-        if (answer.allow) return { behavior: 'allow', updatedInput: args.input ?? {} };
-        return { behavior: 'deny', message: answer.note || 'The founder declined this action. Work with what you are already allowed to do, or park the remainder as a review.' };
-      }
-      await new Promise((r) => setTimeout(r, POLL_MS));
-    }
-    finish(id, request, { allow: false, timeout: true });
-    return {
-      behavior: 'deny',
-      message: 'No answer from the founder within 15 minutes. Do not retry the same request this session: finish what your grants allow, and file the rest as a review with the exact commands.',
-    };
-  } catch (err) {
-    return { behavior: 'deny', message: `approvals channel error: ${err.message}` };
-  }
-}
-
-// One audit line per decision; the request/answer pair leaves the spool.
-function finish(id, request, answer) {
-  appendSpoolLine(SPOOL, 'log.jsonl', `${JSON.stringify({ ...request, answer, decidedAt: Date.now() })}\n`);
-  for (const f of [`${id}.request.json`, `${id}.answer.json`]) removeSpoolEntry(SPOOL, f);
-}
-
-const rl = readline.createInterface({ input: process.stdin });
-rl.on('line', async (line) => {
-  let msg;
-  try { msg = JSON.parse(line); } catch { return; }
-  const { id, method, params } = msg;
-  if (method === 'initialize') {
-    send({ jsonrpc: '2.0', id, result: {
-      protocolVersion: params?.protocolVersion ?? '2024-11-05',
-      capabilities: { tools: {} },
-      serverInfo: { name: 'zero-approvals', version: '1.0.0' },
-    } });
-  } else if (method === 'tools/list') {
-    send({ jsonrpc: '2.0', id, result: { tools: [{
-      name: 'approval_prompt',
-      description: 'Asks the founder, live in her inbox, to approve one gated action. She answers within minutes when present; a 15-minute silence is a deny. Use only when the work genuinely cannot proceed without it.',
-      inputSchema: {
-        type: 'object',
-        properties: {
-          tool_name: { type: 'string' },
-          input: { type: 'object' },
-          tool_use_id: { type: 'string' },
-        },
-        required: ['tool_name', 'input'],
-      },
-    }] } });
-  } else if (method === 'tools/call' && params?.name === 'approval_prompt') {
-    const result = await decide(params.arguments ?? {});
-    send({ jsonrpc: '2.0', id, result: { content: [{ type: 'text', text: JSON.stringify(result) }] } });
-  } else if (id !== undefined) {
-    send({ jsonrpc: '2.0', id, result: {} });
-  }
-});
+// Run as its own process by Claude Code for a run on this Mac; a cloud run's
+// relay serves the same channel in-process (main/cloud/run.mjs).
+serveApprovals();