claude-simple 0.1.0 → 0.2.1

package/public/sw.js

@@ -0,0 +1,104 @@
+/* Agent UI service worker — cache shell assets only.
+ * Never intercepts WebSocket or mutates API semantics beyond offline fallback.
+ * Bump CACHE when shipping UI that must invalidate old shells. */
+const CACHE = 'agent-ui-shell-v3';
+const PRECACHE = [
+  '/',
+  '/index.html',
+  '/manifest.webmanifest',
+  '/style.css?v=boot-2',
+  '/style.css',
+  '/app.js',
+  '/icons/icon-192.png',
+  '/icons/icon-512.png',
+  '/icons/icon-maskable-512.png',
+  '/icons/icon-180.png',
+  '/offline.html',
+];
+
+self.addEventListener('install', (event) => {
+  event.waitUntil(
+    caches.open(CACHE)
+      .then((cache) => cache.addAll(PRECACHE.map((u) => new Request(u, { cache: 'reload' }))))
+      .then(() => self.skipWaiting())
+      .catch(() => self.skipWaiting()),
+  );
+});
+
+self.addEventListener('activate', (event) => {
+  event.waitUntil(
+    caches.keys()
+      .then((keys) => Promise.all(keys.filter((k) => k !== CACHE).map((k) => caches.delete(k))))
+      .then(() => self.clients.claim()),
+  );
+});
+
+function isApiOrRealtime(url) {
+  const p = url.pathname;
+  return (
+    p.startsWith('/api/')
+    || p.startsWith('/ws/')
+    || p === '/machine-connect'
+    || p.startsWith('/machine/')
+    || p === '/healthz'
+  );
+}
+
+function isStaticAsset(url) {
+  if (url.origin !== self.location.origin) return false;
+  if (isApiOrRealtime(url)) return false;
+  return /\.(?:js|css|png|svg|webp|ico|woff2?|ttf|map|webmanifest)(?:$|\?)/i.test(url.pathname + url.search)
+    || url.pathname.startsWith('/icons/');
+}
+
+self.addEventListener('fetch', (event) => {
+  const req = event.request;
+  if (req.method !== 'GET') return;
+
+  const url = new URL(req.url);
+
+  // Let the browser handle API + anything that might upgrade to WebSocket.
+  if (isApiOrRealtime(url)) return;
+
+  // Cross-origin (CDN daisyui/tailwind/marked): network only — do not cache opaque forever.
+  if (url.origin !== self.location.origin) return;
+
+  // Navigations: network-first so deploys show up; offline → cached shell.
+  if (req.mode === 'navigate' || (req.headers.get('accept') || '').includes('text/html')) {
+    event.respondWith(
+      fetch(req)
+        .then((res) => {
+          const copy = res.clone();
+          if (res.ok) {
+            caches.open(CACHE).then((c) => c.put('/index.html', copy)).catch(() => {});
+          }
+          return res;
+        })
+        .catch(async () => {
+          const cached = await caches.match('/index.html') || await caches.match('/');
+          return cached || caches.match('/offline.html');
+        }),
+    );
+    return;
+  }
+
+  // Same-origin static modules: stale-while-revalidate.
+  if (isStaticAsset(url)) {
+    event.respondWith(
+      caches.open(CACHE).then(async (cache) => {
+        const cached = await cache.match(req);
+        const network = fetch(req)
+          .then((res) => {
+            if (res && res.ok) cache.put(req, res.clone()).catch(() => {});
+            return res;
+          })
+          .catch(() => cached);
+        return cached || network;
+      }),
+    );
+  }
+});
+
+self.addEventListener('message', (event) => {
+  if (event.data && event.data.type === 'SKIP_WAITING') self.skipWaiting();
+});

package/public/terminal.js

@@ -8,6 +8,9 @@ let fitAddon  = null;
 let connected = false;
 let lastCwd   = null;
 let lastMachine = null;
+let shellGen = 0;
+let shellReconnectTimer = null;
+let shellWanted = false;
 
 function initXterm() {
   if (term) return;
@@ -88,6 +91,9 @@ function activeMachine() {
 }
 
 function connect(cwd) {
+  if (shellReconnectTimer) { clearTimeout(shellReconnectTimer); shellReconnectTimer = null; }
+  shellWanted = true;
+  const gen = ++shellGen;
   if (ws) { try { ws.close(); } catch {} ws = null; }
   connected = false;
 
@@ -108,12 +114,14 @@ function connect(cwd) {
   ws = new WebSocket(`${proto}://${location.host}/ws/shell?${q}`);
 
   ws.addEventListener('open', () => {
+    if (gen !== shellGen) return;
     connected = true;
     term?.write('\x1b[32mConnected to interactive terminal\x1b[0m\r\n');
     sendResize();
   });
 
   ws.addEventListener('message', e => {
+    if (gen !== shellGen) return;
     let msg;
     try { msg = JSON.parse(e.data); } catch { return; }
     if (msg.type === 'output') {
@@ -126,11 +134,19 @@ function connect(cwd) {
   });
 
   ws.addEventListener('close', () => {
+    if (gen !== shellGen) return;
     connected = false;
     term?.write('\r\n\x1b[33m[disconnected]\x1b[0m\r\n');
+    if (!shellWanted || currentTab.peek() !== 'shell') return;
+    term?.write('\x1b[33m[reconnecting…]\x1b[0m\r\n');
+    shellReconnectTimer = setTimeout(() => {
+      shellReconnectTimer = null;
+      connect(lastCwd);
+    }, 1500);
   });
 
   ws.addEventListener('error', () => {
+    if (gen !== shellGen) return;
     term?.write('\r\n\x1b[31m[WebSocket error]\x1b[0m\r\n');
   });
 }
@@ -161,6 +177,12 @@ function activateShellTab() {
 }
 
 export function initTerminal() {
+  document.addEventListener('visibilitychange', () => {
+    if (document.visibilityState !== 'visible') return;
+    if (currentTab.peek() !== 'shell' || !shellWanted) return;
+    if (!connected) connect(lastCwd);
+  });
+
   // Defer xterm until first visit to shell (container must be measurable)
   watch(currentTab, tab => {
     if (tab === 'shell') activateShellTab();

package/public/wake-lock.js

@@ -0,0 +1,45 @@
+// wake-lock.js — keep screen awake during active chat / agent runs (macOS sleep fix)
+let wakeLock = null;
+let wantLock = false;
+
+async function acquire() {
+  if (!wantLock) return;
+  if (typeof navigator === 'undefined' || !navigator.wakeLock?.request) return;
+  if (document.visibilityState !== 'visible') return;
+  if (wakeLock) return;
+  try {
+    wakeLock = await navigator.wakeLock.request('screen');
+    wakeLock.addEventListener('release', () => {
+      wakeLock = null;
+      // System released (e.g. low battery) — try again if still wanted
+      if (wantLock && document.visibilityState === 'visible') {
+        setTimeout(() => { acquire().catch(() => {}); }, 500);
+      }
+    });
+  } catch {
+    // Not allowed / unsupported — ignore
+    wakeLock = null;
+  }
+}
+
+async function release() {
+  const lock = wakeLock;
+  wakeLock = null;
+  if (!lock) return;
+  try { await lock.release(); } catch { /* ignore */ }
+}
+
+/** Enable/disable preferred wake-lock state (still requires visible document). */
+export function setWakeLockDesired(on) {
+  wantLock = !!on;
+  if (wantLock) acquire().catch(() => {});
+  else release().catch(() => {});
+}
+
+export function initWakeLock() {
+  if (typeof document === 'undefined') return;
+  document.addEventListener('visibilitychange', () => {
+    if (document.visibilityState === 'visible' && wantLock) acquire().catch(() => {});
+    else if (document.visibilityState === 'hidden') release().catch(() => {});
+  });
+}

package/server.js

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
-import { createApp, init, PORT } from './src/app.js';
+import { createApp, init, PORT, hasBusyAgent } from './src/app.js';
+import { startAutoUpdate } from './src/auto-update.js';
 
 await init();
 
@@ -10,3 +11,6 @@ server.listen(PORT, () => {
   if (process.env.AUTH_USERNAME) console.log(`  Auth: env user "${process.env.AUTH_USERNAME}"`);
   console.log();
 });
+
+// Optional self-update (same as edge). AUTO_UPDATE=0 to disable.
+startAutoUpdate({ role: 'standalone', isBusy: hasBusyAgent });

package/src/agents/claude.js

@@ -1,19 +1,39 @@
 import { query } from '@anthropic-ai/claude-agent-sdk';
 import crypto from 'crypto';
+import { mapAgentEmit, compactToolInput } from '../runtime/protocol.js';
+import { waitForApproval, cancelApprovalsForSession } from '../runtime/approvals.js';
 
 /**
  * Run a Claude Code turn via the agent SDK.
- * Emits the same WS-facing messages as the original runClaude:
- * session-created, assistant, result, complete, error (+ raw SDK msgs).
+ * Emits filtered UI events only (no raw SDK dump) to cut wire traffic.
+ * Supports canUseTool → permission_request / approval.respond round-trip.
  */
 export async function runClaude(command, options, send, { cliPath, activeSessions }) {
   const sessionKey = options.sessionId || crypto.randomUUID();
   const controller = new AbortController();
-  activeSessions.set(sessionKey, { controller, kind: 'claude', startTime: Date.now() });
+  activeSessions.set(sessionKey, {
+    controller,
+    kind: 'claude',
+    startTime: Date.now(),
+    busy: true,
+    key: sessionKey,
+    sessionId: options.sessionId || null,
+  });
 
   const env = { ...process.env };
   if (options.configDir) env.CLAUDE_CONFIG_DIR = options.configDir;
 
+  const permissionMode = options.permissionMode || 'default';
+  const autoApprove = permissionMode === 'bypassPermissions'
+    || permissionMode === 'acceptEdits'
+    || permissionMode === 'auto'
+    || options.allowDangerouslySkipPermissions;
+
+  const emit = (raw) => {
+    const mapped = mapAgentEmit(raw, { agent: 'claude', compactTools: true });
+    if (mapped) send(mapped);
+  };
+
   const sdkOptions = {
     env,
     pathToClaudeCodeExecutable: cliPath,
@@ -23,17 +43,54 @@ export async function runClaude(command, options, send, { cliPath, activeSession
     model: options.model || 'claude-sonnet-4-5',
     abortSignal: controller.signal,
   };
-  if (options.cwd)       sdkOptions.cwd    = options.cwd;
+  if (options.cwd) sdkOptions.cwd = options.cwd;
   if (options.sessionId) sdkOptions.resume = options.sessionId;
-  if (options.effort)    sdkOptions.effort = options.effort;
-  if (options.permissionMode && options.permissionMode !== 'default') {
-    sdkOptions.permissionMode = options.permissionMode;
+  if (options.effort) sdkOptions.effort = options.effort;
+  if (permissionMode && permissionMode !== 'default') {
+    sdkOptions.permissionMode = permissionMode;
   }
   if (options.allowDangerouslySkipPermissions) {
     sdkOptions.allowDangerouslySkipPermissions = true;
   }
   if (options.allowedTools?.length) sdkOptions.allowedTools = options.allowedTools;
 
+  // Interactive permission bridge when not in auto modes
+  if (!autoApprove && permissionMode !== 'bypassPermissions') {
+    sdkOptions.canUseTool = async (toolName, input, toolOpts) => {
+      if (controller.signal.aborted || toolOpts?.signal?.aborted) {
+        return { behavior: 'deny', message: 'aborted', interrupt: true };
+      }
+      const requestId = toolOpts?.toolUseID || crypto.randomUUID();
+      const sid = activeSessions.get(sessionKey)?.sessionId || options.sessionId || sessionKey;
+      send({
+        type: 'permission_request',
+        request_id: requestId,
+        requestId,
+        tool_name: toolName,
+        tool_input: compactToolInput(input, 400),
+        title: toolOpts?.title || null,
+        displayName: toolOpts?.displayName || null,
+        description: toolOpts?.description || null,
+        sessionId: sid,
+        agent: 'claude',
+      });
+      const decision = await waitForApproval(requestId, sid);
+      if (decision.cancelled || decision.timeout || controller.signal.aborted) {
+        return { behavior: 'deny', message: decision.timeout ? 'permission timeout' : 'denied', interrupt: !!decision.cancelled };
+      }
+      if (decision.allow) {
+        const result = { behavior: 'allow', updatedInput: input };
+        if (decision.always && toolOpts?.suggestions?.length) {
+          result.updatedPermissions = toolOpts.suggestions;
+        }
+        send({ type: 'permission_resolved', requestId, allow: true, agent: 'claude' });
+        return result;
+      }
+      send({ type: 'permission_resolved', requestId, allow: false, agent: 'claude' });
+      return { behavior: 'deny', message: 'User denied permission' };
+    };
+  }
+
   let capturedSessionId = null;
 
   try {
@@ -41,18 +98,59 @@ export async function runClaude(command, options, send, { cliPath, activeSession
     for await (const msg of stream) {
       if (msg.type === 'system' && msg.session_id && !capturedSessionId) {
         capturedSessionId = msg.session_id;
+        const ent = activeSessions.get(sessionKey);
+        if (ent) {
+          ent.sessionId = capturedSessionId;
+          activeSessions.set(capturedSessionId, ent);
+        }
         send({ type: 'session-created', sessionId: capturedSessionId, agent: 'claude' });
+        continue;
+      }
+
+      // Map SDK assistant content (text + tool_use)
+      if (msg.type === 'assistant' && msg.message?.content) {
+        emit({ type: 'assistant', message: msg.message, ts: Date.now() });
+        continue;
       }
-      send(msg);
+
+      if (msg.type === 'result') {
+        emit({
+          type: 'result',
+          is_error: !!msg.is_error,
+          usage: msg.usage,
+          session_id: msg.session_id || capturedSessionId,
+          result: msg.result,
+          agent: 'claude',
+        });
+        continue;
+      }
+
+      // Drop stream_event / user / other noise via mapAgentEmit
+      emit(msg);
     }
-    send({ type: 'complete', exitCode: 0, sessionId: capturedSessionId || sessionKey, agent: 'claude' });
+    send({
+      type: 'complete',
+      exitCode: 0,
+      sessionId: capturedSessionId || sessionKey,
+      agent: 'claude',
+    });
   } catch (err) {
     if (err.name === 'AbortError') {
-      send({ type: 'complete', exitCode: 130, aborted: true, sessionId: capturedSessionId || sessionKey, agent: 'claude' });
+      cancelApprovalsForSession(capturedSessionId || sessionKey);
+      send({
+        type: 'complete',
+        exitCode: 130,
+        aborted: true,
+        sessionId: capturedSessionId || sessionKey,
+        agent: 'claude',
+      });
     } else {
       send({ type: 'error', message: err.message, agent: 'claude' });
     }
   } finally {
+    const ent = activeSessions.get(sessionKey);
+    if (ent) ent.busy = false;
     activeSessions.delete(sessionKey);
+    if (capturedSessionId) activeSessions.delete(capturedSessionId);
   }
 }

package/src/agents/codex.js

@@ -100,7 +100,7 @@ export function runCodex(command, options, send, { cliPath, activeSessions }) {
       return;
     }
 
-    const entry = { kind: 'codex', child, startTime: Date.now() };
+    const entry = { kind: 'codex', child, startTime: Date.now(), busy: true, key: sessionKey, sessionId: options.sessionId || null };
     activeSessions.set(sessionKey, entry);
     // Also register under thread id once known so abort-session works
     let threadId = options.sessionId || null;

package/src/agents/grok.js

@@ -1,6 +1,7 @@
 import { spawn } from 'child_process';
 import readline from 'readline';
 import crypto from 'crypto';
+import { createDeltaBatcher } from './stream-batch.js';
 
 /**
  * Run Grok CLI headlessly with streaming-json over WebSocket (not HTTP SSE).
@@ -89,7 +90,7 @@ export function runGrok(command, options, send, { cliPath, activeSessions }) {
     // Unbuffer stdout as much as possible
     if (child.stdout?.setEncoding) child.stdout.setEncoding('utf8');
 
-    const entry = { kind: 'grok', child, startTime: Date.now() };
+    const entry = { kind: 'grok', child, startTime: Date.now(), busy: true, key: sessionKey, sessionId: options.sessionId || null };
     activeSessions.set(sessionKey, entry);
 
     let sessionId = options.sessionId || null;
@@ -101,9 +102,8 @@ export function runGrok(command, options, send, { cliPath, activeSessions }) {
     let textChars = 0;
     let thoughtChars = 0;
 
-    // Throttle thought deltas a bit (they're very chatty) but keep text live
-    let thoughtBuf = '';
-    let thoughtTimer = null;
+    const textBatch = createDeltaBatcher(send, 'assistant_delta', { agent: 'grok' }, { maxWait: 48, maxSize: 480 });
+    const thoughtBatch = createDeltaBatcher(send, 'thought_delta', { agent: 'grok' }, { maxWait: 140, maxSize: 600 });
 
     child.stderr.on('data', d => { stderr += d.toString(); });
 
@@ -118,36 +118,27 @@ export function runGrok(command, options, send, { cliPath, activeSessions }) {
     }
 
     function endStream() {
+      textBatch.flush();
       if (streamOpen) {
         send({ type: 'assistant_stream_end', agent: 'grok' });
         streamOpen = false;
       }
     }
 
-    function flushThought(force = false) {
-      if (!thoughtBuf) return;
-      if (!force && thoughtBuf.length < 24) return;
+    function flushThought() {
+      if (!thoughtBatch.pending()) return;
       if (!thoughtOpen) {
         send({ type: 'thought_stream_start', agent: 'grok' });
         thoughtOpen = true;
       }
-      send({ type: 'thought_delta', data: thoughtBuf, agent: 'grok' });
-      thoughtChars += thoughtBuf.length;
-      thoughtBuf = '';
-    }
-
-    function scheduleThoughtFlush() {
-      if (thoughtTimer) return;
-      thoughtTimer = setTimeout(() => {
-        thoughtTimer = null;
-        flushThought(true);
-      }, 120);
+      const n = thoughtBatch.pending();
+      thoughtBatch.flush();
+      thoughtChars += n;
     }
 
     function emitTool(raw) {
       // Finalize any open text/thought before tool card
-      if (thoughtTimer) { clearTimeout(thoughtTimer); thoughtTimer = null; }
-      flushThought(true);
+      flushThought();
       if (thoughtOpen) {
         send({ type: 'thought_stream_end', agent: 'grok' });
         thoughtOpen = false;
@@ -179,10 +170,9 @@ export function runGrok(command, options, send, { cliPath, activeSessions }) {
 
       const t = String(raw.type || '').toLowerCase();
 
-      // ── Text tokens (stream immediately) ─────────────────────────────────
+      // ── Text tokens (batched ~50ms) ──────────────────────────────────────
       if ((t === 'text' || t === 'message' || t === 'output_text') && raw.data != null) {
-        if (thoughtTimer) { clearTimeout(thoughtTimer); thoughtTimer = null; }
-        flushThought(true);
+        flushThought();
         if (thoughtOpen) {
           send({ type: 'thought_stream_end', agent: 'grok' });
           thoughtOpen = false;
@@ -191,14 +181,17 @@ export function runGrok(command, options, send, { cliPath, activeSessions }) {
         if (!chunk) return;
         ensureStream();
         textChars += chunk.length;
-        send({ type: 'assistant_delta', data: chunk, agent: 'grok' });
+        textBatch.push(chunk);
         return;
       }
 
-      // ── Thinking tokens (throttled stream) ───────────────────────────────
+      // ── Thinking tokens (batched stream) ────────────────────────────────
       if ((t === 'thought' || t === 'thinking' || t === 'reasoning') && raw.data != null) {
-        thoughtBuf += String(raw.data);
-        scheduleThoughtFlush();
+        if (!thoughtOpen) {
+          send({ type: 'thought_stream_start', agent: 'grok' });
+          thoughtOpen = true;
+        }
+        thoughtBatch.push(String(raw.data));
         return;
       }
 
@@ -219,6 +212,7 @@ export function runGrok(command, options, send, { cliPath, activeSessions }) {
       // ── Session id early (some builds emit before end) ───────────────────
       if ((t === 'session' || t === 'session_started') && (raw.sessionId || raw.session_id)) {
         sessionId = raw.sessionId || raw.session_id;
+        entry.sessionId = sessionId;
         activeSessions.set(sessionId, entry);
         if (!options.sessionId) {
           send({ type: 'session-created', sessionId, agent: 'grok' });
@@ -229,8 +223,7 @@ export function runGrok(command, options, send, { cliPath, activeSessions }) {
       // ── End of turn ─────────────────────────────────────────────────────
       if (t === 'end' || t === 'result' || t === 'done') {
         gotEnd = true;
-        if (thoughtTimer) { clearTimeout(thoughtTimer); thoughtTimer = null; }
-        flushThought(true);
+        flushThought();
         if (thoughtOpen) {
           send({ type: 'thought_stream_end', agent: 'grok' });
           thoughtOpen = false;
@@ -239,17 +232,22 @@ export function runGrok(command, options, send, { cliPath, activeSessions }) {
 
         if (raw.sessionId || raw.session_id) {
           sessionId = raw.sessionId || raw.session_id;
+          entry.sessionId = sessionId;
           activeSessions.set(sessionId, entry);
           if (!options.sessionId) {
             send({ type: 'session-created', sessionId, agent: 'grok' });
           }
         }
 
+        // Unlock UI immediately — process may linger after the turn ends.
+        entry.busy = false;
+
         const u = raw.usage || {};
         const costTicks = raw.total_cost_usd_ticks ?? u.cost_usd_ticks ?? u.costUsdTicks;
         const costUSD = raw.total_cost_usd ?? u.cost_usd ?? u.costUSD
           ?? (typeof costTicks === 'number' ? costTicks / 1e10 : undefined);
 
+        const sid = sessionId || sessionKey;
         send({
           type: 'result',
           is_error: false,
@@ -262,27 +260,36 @@ export function runGrok(command, options, send, { cliPath, activeSessions }) {
             reasoningTokens: u.reasoning_tokens || u.reasoningTokens || 0,
             costUSD,
           },
-          sessionId: sessionId || sessionKey,
+          sessionId: sid,
           agent: 'grok',
           stats: { textChars, thoughtChars },
         });
+        // Early complete so client can send next turn without waiting for process exit.
+        send({ type: 'complete', exitCode: 0, sessionId: sid, agent: 'grok' });
         return;
       }
 
       if (t === 'error') {
+        entry.busy = false;
         send({ type: 'error', message: raw.message || raw.data || 'grok error', agent: 'grok' });
       }
     });
 
     child.on('close', (code) => {
-      if (thoughtTimer) { clearTimeout(thoughtTimer); thoughtTimer = null; }
-      flushThought(true);
+      flushThought();
       if (thoughtOpen) send({ type: 'thought_stream_end', agent: 'grok' });
       endStream();
       rl.close();
+      entry.busy = false;
       activeSessions.delete(sessionKey);
       if (sessionId) activeSessions.delete(sessionId);
 
+      // Skip duplicate complete if turn already finished via streaming-json "end".
+      if (gotEnd && !aborted) {
+        resolve();
+        return;
+      }
+
       if (aborted) {
         send({ type: 'complete', exitCode: 130, aborted: true, sessionId: sessionId || sessionKey, agent: 'grok' });
       } else if (code !== 0 && code != null && !gotEnd) {
@@ -300,6 +307,7 @@ export function runGrok(command, options, send, { cliPath, activeSessions }) {
     });
 
     child.on('error', (e) => {
+      entry.busy = false;
       activeSessions.delete(sessionKey);
       if (sessionId) activeSessions.delete(sessionId);
       send({ type: 'error', message: e.message, agent: 'grok' });

package/src/agents/meta-agent.js

@@ -427,6 +427,38 @@ export function createMetaAgent(deps) {
   const VLM_THREAD_TTL_MS = 7 * 24 * 60 * 60 * 1000; // 7d on disk
   const ANON_SESSION_ID = '_anonymous';
 
+  /** run_command approval gate: id → { resolve } (see requestApproval/resolveApproval) */
+  const pendingApprovals = new Map();
+  const APPROVAL_TIMEOUT_MS = 5 * 60 * 1000;
+
+  /** Ask the caller (via onApproval) to confirm a sensitive tool call; auto-denies if unattended or timed out. */
+  function requestApproval(onApproval, name, args) {
+    if (typeof onApproval !== 'function') return Promise.resolve(false);
+    const id = crypto.randomUUID();
+    return new Promise((resolve) => {
+      const timer = setTimeout(() => {
+        pendingApprovals.delete(id);
+        resolve(false);
+      }, APPROVAL_TIMEOUT_MS);
+      pendingApprovals.set(id, {
+        resolve: (approved) => {
+          clearTimeout(timer);
+          pendingApprovals.delete(id);
+          resolve(!!approved);
+        },
+      });
+      onApproval({ id, name, args });
+    });
+  }
+
+  /** Called from the /api/ai/approve endpoint when the user responds. */
+  function resolveApproval(id, approved) {
+    const pending = pendingApprovals.get(id);
+    if (!pending) return false;
+    pending.resolve(approved);
+    return true;
+  }
+
   let configCache = null;
   let reportsCache = null;
   /** @type {{ version: number, sessions: Array<{id,title,createdAt,updatedAt,messageCount}> } | null} */
@@ -1716,7 +1748,7 @@ export function createMetaAgent(deps) {
   /**
    * Tool-enabled agent loop with streaming content callbacks.
    */
-  async function runLoop(messages, { onContent, onTool, cfg, chatSessionId } = {}) {
+  async function runLoop(messages, { onContent, onTool, onApproval, cfg, chatSessionId } = {}) {
     const config = cfg || await loadConfig();
     if (!config.key) throw new Error('AI API Key 未配置，请在 ⚙️ → Meta Agent 中填写');
 
@@ -1785,6 +1817,12 @@ export function createMetaAgent(deps) {
         onTool?.(call.function.name, a, 'start', null, callId);
         let result;
         try {
+          if (call.function.name === 'run_command') {
+            const approved = await requestApproval(onApproval, call.function.name, a);
+            if (!approved) {
+              throw new Error('command rejected: user did not approve execution');
+            }
+          }
           result = await executeTool(call.function.name, a, toolCtx);
           if (MUTATING.has(call.function.name)) needsMutate = true;
           onTool?.(call.function.name, a, 'done', result, callId);
@@ -1939,6 +1977,7 @@ export function createMetaAgent(deps) {
     buildDigest,
     executeTool,
     runLoop,
+    resolveApproval,
     generateReport,
     listChatSessions,
     getChatSession,