agentbox-app 0.1.6

package/main/analytics.mjs

@@ -0,0 +1,206 @@
+// THE ONLY PLACE ANYTHING WE RECEIVE LEAVES THIS MACHINE. One file, the main
+// process, and a list of seven counts it will refuse to grow past.
+//
+// IT IS NOT THE ONLY TRAFFIC ANY MORE, and the header said so until 2026-08-29.
+// `main/updater.mjs` asks github.com a few times a day whether a newer Agentbox
+// has been released, which reaches us not at all and is nothing to do with this
+// file. `legal/privacy.html` 5.5 is where that is written down.
+//
+// Her yes: "yes to posthog, go ahead", on the eight counts she approved the
+// same day and under her rule from 08-18: no code, no prompts, no keys, no
+// paths. `legal/privacy.html` sections 4, 5 and 10 are the promise this file
+// has to keep, so read them before changing anything here.
+//
+// FIVE THINGS ABOUT THE SHAPE, each of them load-bearing:
+//
+// 1. NEVER `posthog-js`, AND NEVER IN THE RENDERER. The browser SDK autocaptures
+//    the text of whatever was clicked, and in Agentbox that text is task titles
+//    and repo names. `posthog-node` takes only what it is handed. A test fails
+//    the build if `posthog-js` ever appears under `renderer/`.
+// 2. The renderer cannot send. It hands a NAME over IPC and this file decides
+//    whether that name is one of hers (`shared/analytics-events.mjs`).
+// 3. NOTHING IS SENT WITHOUT A DESTINATION AND THE SWITCH. No key configured
+//    means no client is ever constructed. The shipped app carries a key baked
+//    into its own package.json at build time; a copy run from source carries
+//    none and so sends nothing at all, which is still the honest default.
+// 4. THE SWITCH IS READ AT EVERY SEND, never captured at boot. Section 10 of
+//    the privacy page says turning it off "stops sending from that moment", and
+//    an `enabled` flag read once at startup would keep sending until the app
+//    was restarted, which is that sentence being false for as long as she left
+//    the window open.
+// 5. Crash reports come through the seam in `main/crash-report.mjs`, already
+//    scrubbed, and they are checked AGAIN here before they go. Two checks, on
+//    purpose: the first one runs while the process is dying.
+
+import os from 'node:os';
+import fs from 'node:fs';
+import { createRequire } from 'node:module';
+import { sanitize } from '../shared/analytics-events.mjs';
+import { findPrivate } from '../shared/crash-scrub.mjs';
+import { readInstallId } from '../shared/install-id.mjs';
+import { readEnv } from '../shared/product-name.mjs';
+
+// PostHog's own default host. Kept here rather than left to the config so a
+// typo cannot silently point a stranger's crashes somewhere else; `posthogHost`
+// exists only for a self-hosted instance.
+const DEFAULT_HOST = 'https://us.i.posthog.com';
+
+// ONE SETTING, ON WHEN YOU INSTALL AGENTBOX (privacy page, section 10). Stored as
+// an opt-OUT so that a config she has never touched means on, and so turning it
+// off is a real, visible key in her own file rather than an absence.
+export function diagnosticsOn(config) {
+  return config?.diagnostics !== false;
+}
+
+// THE KEY THE DOWNLOAD CARRIES. Baked into the packaged `package.json` by
+// `scripts/release.mjs` at build time (electron-builder's `extraMetadata`), so a
+// stranger's install has somewhere to send and a copy run from source still does
+// not. It is a PostHog project key, which is write-only by design: it can add an
+// event and it cannot read one back, which is why it may sit inside a file
+// anybody can unzip. The one that reads, `phx_`, never goes near a build.
+//
+// Measured 2026-08-21: before this, the key came only from the user's own
+// `zero.config.json`, which no download contains, so every install but hers
+// sent nothing and the north star could not be counted.
+function bakedKey() {
+  try {
+    const pkg = createRequire(import.meta.url)('../package.json');
+    return pkg?.bakedPosthogKey ?? null;
+  } catch {
+    return null;
+  }
+}
+
+const BAKED = bakedKey();
+
+// Where it would go, if it went anywhere. A missing key is not an error and not
+// a warning: it is a copy of Agentbox with nowhere to send to, which is a build
+// run from source.
+//
+// HER OWN FILE STILL WINS. A `posthogKey` in `zero.config.json` outranks the
+// baked one, so pointing a copy at a different project stays a one-line edit,
+// and `diagnostics: false` still turns all of it off at every send.
+export function analyticsKey(config, baked = BAKED) {
+  const key = config?.posthogKey ?? readEnv('POSTHOG_KEY') ?? baked ?? null;
+  return typeof key === 'string' && key.trim() ? key.trim() : null;
+}
+
+export function createAnalytics({ config, version, dir, client, env = process.env } = {}) {
+  const key = analyticsKey(config);
+  const hasDestination = !!key || !!client;
+  // BOTH HALVES, AT EVERY SEND. See note 4 above.
+  const on = () => hasDestination && diagnosticsOn(config);
+
+  // `env` is here for ONE reason: a copy launched into a throwaway home is a
+  // first-run test of hers and sends under a fixed id rather than a fresh
+  // random one. The decision lives in `shared/install-id.mjs` with the
+  // identifier itself, because two copies of it is how the counts and the
+  // crash reports start telling different stories.
+  const installId = dir ? readInstallId(dir, env) : null;
+  // The version pair from section 5.1, on every event, set here and never by a
+  // caller. `os.release` is the kernel release, which is what the page means by
+  // the version of macOS and carries nothing about the machine or its owner.
+  const base = {
+    app_version: version || '0.0.0',
+    os_platform: process.platform,
+    os_release: os.release(),
+    os_arch: process.arch,
+  };
+  // What the second scrub check is run against. Cheap, and it is the only thing
+  // standing between a bug in the first check and her promise.
+  const ctx = {
+    home: os.homedir(),
+    username: (() => { try { return os.userInfo().username; } catch { return null; } })(),
+  };
+
+  let posthog = client ?? null;
+  const load = () => {
+    if (posthog) return posthog;
+    try {
+      // Required lazily, so a machine with no key and every test in this repo
+      // never constructs a client and never opens a socket.
+      const { PostHog } = createRequire(import.meta.url)('posthog-node');
+      posthog = new PostHog(key, { host: config?.posthogHost || DEFAULT_HOST, flushAt: 20, flushInterval: 10000 });
+    } catch (err) {
+      console.warn('zero: analytics could not start:', err.message);
+      posthog = null;
+    }
+    return posthog;
+  };
+
+  const send = (event, properties) => {
+    if (!on()) return false;
+    const ph = load();
+    if (!ph) return false;
+    try {
+      ph.capture({ distinctId: installId, event, properties: { ...base, ...properties } });
+      return true;
+    } catch (err) {
+      // A failed send is never allowed to be a failed app.
+      console.warn('zero: analytics send failed:', err.message);
+      return false;
+    }
+  };
+
+  return {
+    get enabled() { return on(); },
+    get reason() {
+      if (!hasDestination) return 'has nowhere to send to';
+      return diagnosticsOn(config) ? 'on' : 'turned off';
+    },
+    hasDestination,
+    installId,
+
+    // ONE DOOR. `name` must be one of hers, and the properties are filtered to
+    // numbers, booleans and one closed enum. Anything else is dropped rather
+    // than sent, because the caller is often the renderer.
+    track(name, props) {
+      if (!on()) return false;
+      const clean = sanitize(name, props);
+      if (!clean) return false;
+      return send(name, clean);
+    },
+
+    // Handed to `setTransport` in `main/crash-report.mjs`. The payload arrives
+    // already scrubbed and already checked; it is checked once more here, and a
+    // report that fails is dropped whole rather than trimmed, which is the rule
+    // the scrub itself follows.
+    crashTransport(payload) {
+      if (!on()) return false;
+      if (!payload || typeof payload !== 'object') return false;
+      const leaks = findPrivate(payload, ctx);
+      if (leaks.length) {
+        return send('crash_report', { crash_kind: 'redacted', dropped_fields: leaks.length });
+      }
+      return send('crash_report', {
+        crash_kind: String(payload.kind ?? 'unknown'),
+        up_ms: Number(payload.upMs ?? 0),
+        report_version: Number(payload.v ?? 1),
+        error: payload.error ?? null,
+        happened_at: String(payload.ts ?? ''),
+      });
+    },
+
+    // A report is written while the process is dying, so delivery cannot be
+    // synchronous: the queue on disk is drained on the NEXT launch. A file is
+    // removed only once its send has been accepted, and a file that will not
+    // parse is removed rather than retried forever.
+    drainCrashes(files = []) {
+      if (!on()) return 0;
+      let sent = 0;
+      for (const file of files) {
+        let payload = null;
+        try { payload = JSON.parse(fs.readFileSync(file, 'utf8')); } catch { payload = null; }
+        if (!payload) { try { fs.unlinkSync(file); } catch {} continue; }
+        if (this.crashTransport(payload)) {
+          sent += 1;
+          try { fs.unlinkSync(file); } catch {}
+        }
+      }
+      return sent;
+    },
+
+    async flush() { try { await posthog?.flush?.(); } catch {} },
+    async shutdown() { try { await posthog?.shutdown?.(); } catch {} },
+  };
+}

package/main/answer-modes.mjs

@@ -0,0 +1,206 @@
+// WHAT ONE REPLY MAY DO, KEPT WHERE A WORKER DOES NOT WRITE.
+//
+// When the founder answers a card she can also say what that one run is allowed
+// to do on her Mac. That value becomes `--permission-mode` on a real process,
+// so it is a GRANT and not an opinion about the work.
+//
+// IT USED TO RIDE ON THE LEDGER. `work-items.jsonl` is append-only, every line
+// names its own author as a plain string, and nothing checks that string.
+// Workers append to that file all day through the MCP; on a product with no
+// code repo registered the file also sat in the worker's own cwd. The structured
+// path was closed (an agent line carrying the field was stripped), and the file
+// was not: one hand-written line saying `"source":"founder"` granted its own
+// next run bypassPermissions. Proved on a scratch ledger, 2026-08-24.
+//
+// So the grant is not on the ledger any more. It lives here, in the app's own
+// home, written by main and by nothing else. The MCP server has no code that
+// reaches this file and no tool that names it.
+//
+// WHAT THIS DOES AND WHAT IT DOES NOT DO, said plainly.
+//
+//   It does NOT make forging impossible. Anything that can run commands can
+//   write any file this user owns, and `~/.astral` is no exception. Claude Code
+//   has the identical property: its settings file is as writable as anything
+//   else in your home, and it relies on the sandbox and the prompt rather than
+//   on the folder.
+//
+//   What it changes is the COST. Before: one more line appended to a file the
+//   worker was appending to anyway, in a format it writes every few seconds,
+//   in its own working directory. After: a deliberate reach into the app's own
+//   storage, in a file nothing briefs it about and no tool it holds mentions.
+//   That is a real difference and it is the whole claim. It is not a wall.
+//
+// GRANTING IS THE FOUNDER'S, SPENDING ONE IS THE MACHINERY'S, AGENTS GET
+// NEITHER. That rule survives the move intact, and it is now structural rather
+// than enforced: there is no writer here except the app's own main process, so
+// there is no `source` to check and no line for anyone else to forge.
+
+import fs from 'node:fs';
+import path from 'node:path';
+import { appHome } from './store/home.mjs';
+import { CLAUDE_PERMISSION_MODES } from '../shared/work-items.mjs';
+import { CODEX_MODE_ORDER } from '../shared/codex-modes.mjs';
+
+const FILE = 'answer-modes.json';
+
+// HOW LONG A MODE LIVES, NOW THAT IT BELONGS TO A THREAD AND NOT TO ONE SEND.
+//
+// This was 24 hours, and 24 hours was right while the supervisor spent the
+// grant on the first spawn: anything still here the next day had been spent or
+// belonged to a row nobody ever ran. Neither is true any more. A mode she sets
+// on a thread governs every run on that thread until she moves it, so a sweep
+// measured from the moment she picked it would quietly hand a thread back to
+// the fleet's mode overnight, which is the bug this round exists to fix,
+// arriving a day late instead of a run late.
+//
+// So the clock is not "when she picked it" but "when this thread last used
+// it": `touchAnswerMode` below restamps `at` on every run that reads one, and
+// the window is a month. A thread she is working in keeps its mode for as long
+// as she works in it. A row that has been silent for a month loses its grant
+// rather than keeping a bypassPermissions she granted in another quarter, and
+// the file does not grow without limit. Swept on every write.
+const KEEP_MS = 30 * 24 * 60 * 60 * 1000;
+
+const file = (home = appHome()) => path.join(home, FILE);
+
+function readAll(home) {
+  try {
+    const raw = JSON.parse(fs.readFileSync(file(home), 'utf8'));
+    return raw && typeof raw === 'object' && !Array.isArray(raw) ? raw : {};
+  } catch {
+    return {};
+  }
+}
+
+// tmp + rename, so a reader never sees half a file and a crash mid-write leaves
+// the previous one intact.
+function writeAll(home, all) {
+  const target = file(home);
+  fs.mkdirSync(path.dirname(target), { recursive: true });
+  const tmp = `${target}.${process.pid}.tmp`;
+  fs.writeFileSync(tmp, `${JSON.stringify(all, null, 2)}\n`);
+  fs.renameSync(tmp, target);
+}
+
+const keyOf = (slug, id) => `${slug}/${id}`;
+
+function sweep(all, now) {
+  for (const [key, entry] of Object.entries(all)) {
+    if (!entry || typeof entry !== 'object' || !Number.isFinite(entry.at) || now - entry.at > KEEP_MS) {
+      delete all[key];
+    }
+  }
+  return all;
+}
+
+/**
+ * The mode set on one row's reply.
+ *
+ * `undefined` means she never touched the chip. `null` means she cleared it, or
+ * the run that spent it cleared it, and the project's own setting applies. The
+ * two are kept apart because the ledger kept them apart and every reader of the
+ * old field already knows the difference.
+ *
+ * A value that is not one of Claude Code's six is dropped rather than returned,
+ * so nothing that is not a mode can reach a command line even if this file were
+ * edited by hand.
+ */
+/**
+ * EVERY WORD THIS FILE WILL STORE: Claude Code's six and Codex's three.
+ *
+ *  ONE FIELD FOR BOTH ENGINES, because a row has one engine and the reply box
+ *  can only ever offer that engine's list. Each consumer then filters by its
+ *  own vocabulary and ignores the other's: `spawnPlan` keeps only a Claude mode
+ *  (`CLAUDE_MODES.includes`), `codexThreadParamsFor` keeps only a Codex one
+ *  (`isCodexMode`). A word meant for the other engine is therefore invisible
+ *  rather than wrong.
+ *
+ *  `auto` IS ON BOTH LISTS AND THAT IS THE ONE OVERLAP. It means the sensible
+ *  default on each engine, so the only way to be bitten is to set it on a Codex
+ *  row and then have the task picked up by Claude Code, which would run Claude
+ *  Code's auto. Both are the default that engine already wanted; the failure is
+ *  benign and is written here so nobody spends an afternoon proving it.
+ */
+const ALLOWED_MODES = [...CLAUDE_PERMISSION_MODES, ...CODEX_MODE_ORDER];
+
+export function answerMode(slug, id, { home = appHome(), now = Date.now() } = {}) {
+  const entry = readAll(home)[keyOf(slug, id)];
+  if (!entry || typeof entry !== 'object') return undefined;
+  if (Number.isFinite(entry.at) && now - entry.at > KEEP_MS) return undefined;
+  if (entry.mode === null) return null;
+  return ALLOWED_MODES.includes(entry.mode) ? entry.mode : undefined;
+}
+
+/** Every row that currently carries one, as `{ "<slug>/<id>": mode }`. */
+export function answerModes({ home = appHome(), now = Date.now() } = {}) {
+  const out = {};
+  for (const [key, entry] of Object.entries(readAll(home))) {
+    if (!entry || typeof entry !== 'object') continue;
+    if (Number.isFinite(entry.at) && now - entry.at > KEEP_MS) continue;
+    if (entry.mode === null) { out[key] = null; continue; }
+    if (ALLOWED_MODES.includes(entry.mode)) out[key] = entry.mode;
+  }
+  return out;
+}
+
+/**
+ * Set one, or clear it with null. Called only from the founder's own reply
+ * (main/store.mjs, answerItem), which is only reachable from the reply box.
+ *
+ * A mode that is not one of the six is refused outright rather than stored,
+ * which is what the ledger's own check used to do.
+ */
+export function setAnswerMode(slug, id, mode, { home = appHome(), now = Date.now() } = {}) {
+  if (mode !== null && !ALLOWED_MODES.includes(mode)) return answerMode(slug, id, { home, now });
+  const all = sweep(readAll(home), now);
+  all[keyOf(slug, id)] = { mode, at: now };
+  writeAll(home, all);
+  return mode;
+}
+
+/**
+ * Say that this thread just used its mode, so the sweep above measures from
+ * the last run rather than from the moment she picked it.
+ *
+ * IT RESTAMPS THE MODE THAT IS THERE, NEVER THE ONE THE RUN WAS BUILT WITH.
+ * The supervisor reads the mode when it builds the launch and touches on the
+ * child's own 'spawn' event, so there is a window in between, and a second
+ * answer landing inside it must survive untouched: `used` is compared and a
+ * mismatch is left exactly as it stands. Nothing here ever changes a mode, so
+ * the worst this call can do is keep a grant she already made alive one more
+ * month.
+ */
+export function touchAnswerMode(slug, id, used, { home = appHome(), now = Date.now() } = {}) {
+  const all = sweep(readAll(home), now);
+  const key = keyOf(slug, id);
+  const entry = all[key];
+  if (!entry || typeof entry !== 'object') return undefined;
+  if (used !== undefined && entry.mode !== used) return entry.mode;
+  all[key] = { mode: entry.mode, at: now };
+  writeAll(home, all);
+  return entry.mode;
+}
+
+/**
+ * Put a row back on the project's setting.
+ *
+ * THIS IS NO LONGER CALLED ON SPAWN. Until 2026-09-24 the supervisor called it
+ * the moment a run came up, which is what made a picked mode last exactly one
+ * send; `touchAnswerMode` stands in that place now. The only thing that clears
+ * a mode today is she does, through the reply box's own clear row.
+ *
+ * IT CLEARS THE MODE IT WAS TOLD ABOUT, NEVER WHATEVER HAPPENS TO BE THERE
+ * NOW, for the same reason as above. Clearing is not "less": it means back to
+ * the project's setting, which can be the wider one.
+ */
+export function clearAnswerMode(slug, id, spent, { home = appHome(), now = Date.now() } = {}) {
+  const all = sweep(readAll(home), now);
+  const key = keyOf(slug, id);
+  const current = all[key]?.mode;
+  if (spent !== undefined && current !== spent) return current === undefined ? undefined : current;
+  all[key] = { mode: null, at: now };
+  writeAll(home, all);
+  return null;
+}
+
+export const _internals = { file, KEEP_MS };

package/main/approval-prompt-server.mjs

@@ -0,0 +1,160 @@
+// The approvals channel: a tiny MCP server that Claude Code calls (via
+// --permission-prompt-tool) whenever a headless worker wants to do something
+// its standing grants do not cover. The request lands as a file in the spool,
+// the app shows the founder a card, her click writes the answer file, and the
+// worker unblocks in place. Before this, a gated command ended the story:
+// sessions wrote everything and bounced the actual run back to the founder
+// as a paste (2026-08-05).
+//
+// Deny is the default in every failure mode: timeout, spool error, malformed
+// answer. An approval can only come from the founder's explicit file.
+//
+// EVERY TOUCH OF THE SPOOL GOES THROUGH main/approvals.mjs, which is where the
+// rule that this directory is worker-writable is written down and enforced --
+// nothing opened through a link, nothing opened that is not a regular file,
+// every write landed by rename. It used to be bare `fs` here, and the audit
+// line was the worst of it: `log.jsonl` is a fixed name, so a worker that
+// symlinked it at `briefs/founder.md` had a repeatable append of its own
+// `command` string into the standing instructions every session is briefed
+// with. This process runs as the worker's own child, so it is the near half of
+// that attack (2026-09-04).
+
+import fs from 'node:fs';
+import crypto from 'node:crypto';
+import readline from 'node:readline';
+import { answerIsHers, appendSpoolLine, cardDigest, readSpoolJson, removeSpoolEntry, spoolEntryExists, writeSpoolFile } from './approvals.mjs';
+
+const SPOOL = process.env.ZERO_APPROVALS_DIR;
+
+// THE KEY THAT SAYS AN ANSWER IS HERS, AND IT IS SAFE TO HAND US.
+//
+// This process is the worker's own child, so its environment is the worker's to
+// read and anything secret given here is a secret the forger has. This is the
+// PUBLIC half of a pair whose private half never leaves Agentbox's process: it
+// verifies and it cannot sign, which is exactly why it can travel this way.
+// main/approvals.mjs holds the whole argument, including what it does not
+// close.
+const PUBLIC_KEY = process.env.ZERO_APPROVALS_PUBKEY;
+
+const TIMEOUT_MS = 15 * 60_000;
+const POLL_MS = 2_000;
+
+const send = (msg) => process.stdout.write(JSON.stringify(msg) + '\n');
+
+async function decide(args) {
+  try {
+    if (!SPOOL) return { behavior: 'deny', message: 'approvals spool is not configured' };
+    // NO KEY IS A CHANNEL THAT CANNOT TELL HER ANSWER FROM A WORKER'S, and a
+    // channel that cannot tell must not guess. It refuses here rather than
+    // asking and then denying in fifteen minutes, because nothing that arrives
+    // in that quarter of an hour could become an approval anyway.
+    if (!PUBLIC_KEY) return { behavior: 'deny', message: 'the approvals channel was given no key to check the founder\'s answer with, so nothing here can be approved' };
+    fs.mkdirSync(SPOOL, { recursive: true });
+    const id = crypto.randomUUID();
+    const request = {
+      id,
+      at: Date.now(),
+      product: process.env.ZERO_PRODUCT ?? null,
+      item: process.env.ZERO_ITEM ?? null,
+      tool: args.tool_name ?? 'unknown',
+      input: args.input ?? {},
+    };
+    // A question that could not be asked has already been answered.
+    if (!writeSpoolFile(SPOOL, `${id}.request.json`, JSON.stringify(request))) {
+      return { behavior: 'deny', message: 'the approvals spool would not take this request, so nothing was put in front of the founder' };
+    }
+    const answerName = `${id}.answer.json`;
+    const deadline = Date.now() + TIMEOUT_MS;
+    while (Date.now() < deadline) {
+      // `lstat` rather than `existsSync`, so this sees exactly what the app's
+      // own `listPending` sees: an entry by that name, whatever it is.
+      if (spoolEntryExists(SPOOL, answerName)) {
+        const answer = readSpoolJson(SPOOL, answerName);
+        // AN ANSWER THAT IS NOT HERS IS NOT A DECISION AT ALL, and this is the
+        // line the whole file turns on. It used to read `answer?.allow` off
+        // whatever was in the directory, so any process that could write here
+        // was approved -- another worker's card, or its own.
+        //
+        // AND IT IS NOT A DENY EITHER, which matters as much: denying on an
+        // unreadable answer would let one worker force a No onto another's
+        // card, losing her Allow in silence. The file goes and the question
+        // goes on waiting, exactly as main/codex-approvals.mjs's own sweep
+        // does, and her real answer still lands when she gives it.
+        if (!answerIsHers(id, answer, PUBLIC_KEY)) {
+          removeSpoolEntry(SPOOL, answerName);
+          console.warn(`zero: an answer for approval ${id} that the founder did not write has been deleted; the question is still waiting`);
+          await new Promise((r) => setTimeout(r, POLL_MS));
+          continue;
+        }
+        // AND HER DECISION IS ABOUT AN ACTION, NOT ABOUT AN ID. The request
+        // file is worker-writable and its name and id survive a rewrite of its
+        // contents, so a worker could raise one command, replace the body with
+        // a harmless one, and have her Allow on the harmless card honoured
+        // against the command THIS PROCESS is still holding. `request` here is
+        // that memory: it was built from the tool call and has never been read
+        // back off the disk, so comparing it against the digest she signed is
+        // the whole check. A mismatch is a deny -- she said yes to something
+        // else -- and it is loud, because only a rewrite can produce it.
+        const mine = cardDigest(request);
+        if (!mine || answer.card !== mine) {
+          finish(id, request, { allow: false, swapped: true });
+          console.warn(`zero: approval ${id} was answered for a different card than the one this run asked about; the request file was rewritten under it and nothing has been allowed`);
+          return {
+            behavior: 'deny',
+            message: 'The approval request changed between being asked and being answered, so the founder\'s decision was for a different action and nothing was allowed. Do not retry the same request this session: finish what your grants allow, and file the rest as a review with the exact commands.',
+          };
+        }
+        finish(id, request, answer);
+        if (answer.allow) return { behavior: 'allow', updatedInput: args.input ?? {} };
+        return { behavior: 'deny', message: answer.note || 'The founder declined this action. Work with what you are already allowed to do, or park the remainder as a review.' };
+      }
+      await new Promise((r) => setTimeout(r, POLL_MS));
+    }
+    finish(id, request, { allow: false, timeout: true });
+    return {
+      behavior: 'deny',
+      message: 'No answer from the founder within 15 minutes. Do not retry the same request this session: finish what your grants allow, and file the rest as a review with the exact commands.',
+    };
+  } catch (err) {
+    return { behavior: 'deny', message: `approvals channel error: ${err.message}` };
+  }
+}
+
+// One audit line per decision; the request/answer pair leaves the spool.
+function finish(id, request, answer) {
+  appendSpoolLine(SPOOL, 'log.jsonl', `${JSON.stringify({ ...request, answer, decidedAt: Date.now() })}\n`);
+  for (const f of [`${id}.request.json`, `${id}.answer.json`]) removeSpoolEntry(SPOOL, f);
+}
+
+const rl = readline.createInterface({ input: process.stdin });
+rl.on('line', async (line) => {
+  let msg;
+  try { msg = JSON.parse(line); } catch { return; }
+  const { id, method, params } = msg;
+  if (method === 'initialize') {
+    send({ jsonrpc: '2.0', id, result: {
+      protocolVersion: params?.protocolVersion ?? '2024-11-05',
+      capabilities: { tools: {} },
+      serverInfo: { name: 'zero-approvals', version: '1.0.0' },
+    } });
+  } else if (method === 'tools/list') {
+    send({ jsonrpc: '2.0', id, result: { tools: [{
+      name: 'approval_prompt',
+      description: 'Asks the founder, live in her inbox, to approve one gated action. She answers within minutes when present; a 15-minute silence is a deny. Use only when the work genuinely cannot proceed without it.',
+      inputSchema: {
+        type: 'object',
+        properties: {
+          tool_name: { type: 'string' },
+          input: { type: 'object' },
+          tool_use_id: { type: 'string' },
+        },
+        required: ['tool_name', 'input'],
+      },
+    }] } });
+  } else if (method === 'tools/call' && params?.name === 'approval_prompt') {
+    const result = await decide(params.arguments ?? {});
+    send({ jsonrpc: '2.0', id, result: { content: [{ type: 'text', text: JSON.stringify(result) }] } });
+  } else if (id !== undefined) {
+    send({ jsonrpc: '2.0', id, result: {} });
+  }
+});