dsh-ntr 0.1.5 → 0.2.0

package/src/impl.ts

@@ -8,7 +8,7 @@
 import { randomUUID } from './ids.ts'
 import type {
   AcpAgentCatalog, AcpAgentDef, AcpCatalogOption, AcpApprovalDeadlines, AcpConversationChoice, AcpEvent, AcpMcpServerDef, AcpPluginConfig, AcpPresetStatus, AcpTagHalo, AgentCatalogResult, AgentProbeModelsResult, AgentTestResult,
-  AgentView, ApprovalDeadlineKey, ChatSessionView, ChatTranscriptView, DetectedAgentInfo, PermissionOptionView, PermissionOutcome, RpcResult,
+  AgentView, ApprovalDeadlineKey, ApprovalDeadlinePatch, ChatSessionView, ChatTranscriptView, DetectedAgentInfo, PermissionOptionView, PermissionOutcome, PermissionTimeoutMode, RpcResult,
 } from './protocol.ts'
 import { DEFAULT_TAG_HALO } from './protocol.ts'
 
@@ -103,6 +103,41 @@ export function validateTagHalo(value: unknown): AcpTagHalo {
  */
 export const APPROVAL_DEADLINE_MAX_MS = 86_400_000
 
+/**
+ * The shortest REAL wait: the first rung of the card's ladder (30 seconds).
+ *
+ * The floor for a mode that must not wait zero — see
+ * {@link normalizeApprovalWindow}.
+ */
+export const APPROVAL_DEADLINE_MIN_WAIT_MS = 30_000
+
+/**
+ * Make a window legal for the mode it runs under.
+ *
+ * `0` means 不等待 — the ask is settled the moment it arrives instead of
+ * waiting. That is the **auto** mode's business: `auto` answers with the
+ * option the agent's own kinds imply, so the agent CONTINUES, and an
+ * unattended deployment gets a sane default instead of a hang.
+ *
+ * Under `abort` the same zero would refuse every ask the instant it arrived:
+ * the agent stops at every gate it meets, which is not a timeout, it is a
+ * brick wall. So `abort` never offers 不等待, and a window of `0` reaching it
+ * (a config file, a state file written by an older build, a mode switch that
+ * left the window behind) normalizes to the shortest real wait.
+ *
+ * `wait` ignores the window entirely — it never expires.
+ */
+export function normalizeApprovalWindow(mode: PermissionTimeoutMode, ms: number): number {
+  return mode === 'abort' && ms === 0 ? APPROVAL_DEADLINE_MIN_WAIT_MS : ms
+}
+
+/**
+ * The order `auto` mode picks an option in, by the kind the agent declared:
+ * the broadest grant first, then the narrow one, then the refusals, then
+ * whatever the agent offered instead. See {@link pickAutoOption}.
+ */
+export const AUTO_OPTION_KIND_PRIORITY = ['allow_always', 'allow_once', 'reject_once', 'reject_always'] as const
+
 /**
  * Validate ONE approval deadline, shared by every layer that accepts one.
  *
@@ -122,35 +157,62 @@ export function validateApprovalDeadlineMs(raw: unknown, label: string, code: 'b
 
 /**
  * Validate a settings-page deadline write. Omitted keys are simply absent from
- * the result — the manager merges, so a card that only touched one slider must
- * not reset the other. `reset` is not a deadline and is dropped here.
+ * the result — the manager merges, so a card that only moved the mode must not
+ * reset the number. `reset` is not a deadline and is dropped here.
  */
 export function validateApprovalDeadlines(value: unknown): Partial<Record<ApprovalDeadlineKey, number>> {
   if (value === null || typeof value !== 'object') throw new AcpError('bad_payload', 'acp: approval deadlines must be an object')
-  const { nativeApprovalTimeoutMs, permissionFallbackTimeoutMs } = value as {
-    nativeApprovalTimeoutMs?: unknown
-    permissionFallbackTimeoutMs?: unknown
-  }
+  const { permissionTimeoutMs } = value as { permissionTimeoutMs?: unknown }
   const out: Partial<Record<ApprovalDeadlineKey, number>> = {}
-  if (nativeApprovalTimeoutMs !== undefined) {
-    out.nativeApprovalTimeoutMs = validateApprovalDeadlineMs(
-      nativeApprovalTimeoutMs,
-      'nativeApprovalTimeoutMs',
+  if (permissionTimeoutMs !== undefined) {
+    out.permissionTimeoutMs = validateApprovalDeadlineMs(
+      permissionTimeoutMs,
+      'permissionTimeoutMs',
       'bad_payload',
-      '(0 = wait for the host approval chain forever)',
-    )
-  }
-  if (permissionFallbackTimeoutMs !== undefined) {
-    out.permissionFallbackTimeoutMs = validateApprovalDeadlineMs(
-      permissionFallbackTimeoutMs,
-      'permissionFallbackTimeoutMs',
-      'bad_payload',
-      '(0 = never answer a degraded ask on the human\'s behalf)',
+      '(0 = 不等待，仅自动推进档可用)',
     )
   }
   return out
 }
 
+/**
+ * Validate the mode a write asks for. Three values, and the list is the whole
+ * vocabulary: an unanswered ask is either answered for you, kept waiting, or
+ * refused. Anything else is a typo, not a new mode.
+ */
+export function validatePermissionTimeoutMode(raw: unknown, code: 'bad_config' | 'bad_payload'): PermissionTimeoutMode {
+  if (raw !== 'abort' && raw !== 'auto' && raw !== 'wait') {
+    throw new AcpError(code, 'acp: permissionTimeoutMode must be one of "abort", "auto", "wait"')
+  }
+  return raw
+}
+
+/**
+ * The option an expired deadline answers with in `auto` mode.
+ *
+ * The pick is by the option's KIND, because that is what the agent declared
+ * about the choice it is offering: `allow_always` first (one grant covers the
+ * rest of the run), then `allow_once` (the smaller grant), then the reject
+ * kinds (refuse but let the agent continue), and finally the first option
+ * whatever it is — an agent may offer only a custom kind, and refusing to
+ * answer at all would hang the turn.
+ *
+ * `undefined` means NO option could be read (no options, or none with a usable
+ * id). The caller then degrades to `abort`: guessing an option is worse than
+ * refusing, and hanging is worse than either. OmniTerm dev picks the same way
+ * (`pick_auto_option`, `src/acp/permission.rs`).
+ */
+export function pickAutoOption(options: readonly PermissionOptionView[]): PermissionOptionView | undefined {
+  const usable = (option: PermissionOptionView): PermissionOptionView | undefined =>
+    option.optionId === '' ? undefined : option
+  for (const kind of AUTO_OPTION_KIND_PRIORITY) {
+    const hit = options.find(option => option.kind === kind)
+    const picked = hit === undefined ? undefined : usable(hit)
+    if (picked !== undefined) return picked
+  }
+  return options.length === 0 ? undefined : usable(options[0] as PermissionOptionView)
+}
+
 /**
  * Bound on the number of MCP servers one agent may declare. An MCP server is
  * a process (stdio) or a remote endpoint the agent connects to at session
@@ -437,27 +499,30 @@ export function validateConfig(raw: unknown): AcpPluginConfig {
   if (typeof startupTimeoutMs !== 'number' || !Number.isFinite(startupTimeoutMs) || startupTimeoutMs < 1_000 || startupTimeoutMs > 600_000) {
     throw new AcpError('bad_config', 'acp: startupTimeoutMs must be a number in [1000, 600000]')
   }
-  const permissionTimeoutMs = value.permissionTimeoutMs ?? 0
-  if (typeof permissionTimeoutMs !== 'number' || !Number.isInteger(permissionTimeoutMs) || permissionTimeoutMs < 0 || permissionTimeoutMs > APPROVAL_DEADLINE_MAX_MS) {
-    throw new AcpError('bad_config', `acp: permissionTimeoutMs must be an integer in [0, ${String(APPROVAL_DEADLINE_MAX_MS)}] (0 = wait forever)`)
-  }
-  // Both degraded-route deadlines share the `permissionTimeoutMs` range: `0` is
-  // the meaningful value (never withdraw / never auto-cancel), and anything up
-  // to a day is a legitimate "ask again later" window. Same validator as the
-  // settings-page write, so a baseline the panel can display is a baseline the
-  // panel can also produce.
-  const nativeApprovalTimeoutMs = validateApprovalDeadlineMs(
-    value.nativeApprovalTimeoutMs ?? 300_000,
-    'nativeApprovalTimeoutMs',
-    'bad_config',
-    '(0 = wait for the host approval chain forever)',
-  )
-  const permissionFallbackTimeoutMs = validateApprovalDeadlineMs(
-    value.permissionFallbackTimeoutMs ?? 300_000,
-    'permissionFallbackTimeoutMs',
+  // ONE wait window for both routes. The two legacy keys are folded in when
+  // the new one is absent, so an existing `cordis.patch.yml` keeps meaning what
+  // it meant instead of silently falling back to the default.
+  const legacyWindow = value.nativeApprovalTimeoutMs ?? value.permissionFallbackTimeoutMs
+  // A legacy window of 0 meant "this window never fires". The only way to say
+  // that now is the `wait` MODE (0 is 不等待 today), so a legacy zero carries
+  // over as the mode — otherwise an unattended deployment would silently turn
+  // "wait forever" into "answer immediately".
+  const legacyNever = legacyWindow === 0
+  const permissionTimeoutMs = validateApprovalDeadlineMs(
+    legacyNever ? 300_000 : (value.permissionTimeoutMs ?? legacyWindow ?? 300_000),
+    'permissionTimeoutMs',
     'bad_config',
-    '(0 = never answer a degraded ask on the human\'s behalf)',
+    '(0 = 不等待，仅自动推进档可用)',
   )
+  // What an expired deadline DOES. Same validator as the settings-page write,
+  // so a mode the panel can offer is a mode the next boot accepts.
+  const permissionTimeoutMode = legacyNever
+    ? 'wait'
+    : validatePermissionTimeoutMode(value.permissionTimeoutMode ?? 'wait', 'bad_config')
+  // 不等待 belongs to `auto` (it answers, so the agent continues). Under
+  // `abort` a zero window would refuse every ask on arrival — the agent stops
+  // at every gate — so it becomes the shortest real wait.
+  const effectivePermissionTimeoutMs = normalizeApprovalWindow(permissionTimeoutMode, permissionTimeoutMs)
   const cancelFallbackMs = value.cancelFallbackMs ?? 15_000
   if (typeof cancelFallbackMs !== 'number' || !Number.isInteger(cancelFallbackMs) || cancelFallbackMs < 0 || cancelFallbackMs > 600_000) {
     throw new AcpError('bad_config', 'acp: cancelFallbackMs must be an integer in [0, 600000] (0 = disable the fallback)')
@@ -475,9 +540,8 @@ export function validateConfig(raw: unknown): AcpPluginConfig {
     transcriptMaxEntries: max,
     probeModelsOnBoot,
     startupTimeoutMs,
-    permissionTimeoutMs,
-    nativeApprovalTimeoutMs,
-    permissionFallbackTimeoutMs,
+    permissionTimeoutMs: effectivePermissionTimeoutMs,
+    permissionTimeoutMode,
     cancelFallbackMs,
     staleCancelRetryDelayMs,
     staleCancelMaxRetries,
@@ -1515,6 +1579,22 @@ export class EventHub {
 
 // ---- Permission ledger ----
 
+/** Everything a `permission/request` frame carries besides the ids the ledger owns. */
+export interface PendingPermissionFields {
+  /** DSH chat session id; absent for `/acp` RPC-only sessions. */
+  dshSessionId?: string
+  toolCall: unknown
+  /** Host-derived human name (`permissionToolName`). */
+  toolName: string
+  /** One-line detail from the agent's declared input, when it has any. */
+  reason?: string
+  options: PermissionOptionView[]
+  /** What an unanswered ask does when its deadline fires. */
+  timeoutMode: PermissionTimeoutMode
+  /** Epoch ms of the deadline; absent in `wait` mode (no deadline). */
+  deadlineAt?: number
+}
+
 export interface PendingPermission {
   requestId: string
   sessionId: string
@@ -1524,15 +1604,13 @@ export interface PendingPermission {
    * client receives (see `permissionReplayFrames`). Absent on entries created
    * without a view — those still answer, they just cannot be re-shown.
    */
-  view?: { toolCall: unknown; options: PermissionOptionView[] }
+  view?: PendingPermissionFields
 }
 
 /** One outstanding ask as a reconnecting client must be re-shown it. */
-export interface PendingPermissionView {
+export interface PendingPermissionView extends PendingPermissionFields {
   requestId: string
   sessionId: string
-  toolCall: unknown
-  options: PermissionOptionView[]
 }
 
 export class PermissionLedger {
@@ -1584,14 +1662,37 @@ export class PermissionLedger {
       views.push({
         requestId: entry.requestId,
         sessionId: entry.sessionId,
-        toolCall: entry.view.toolCall,
-        options: entry.view.options,
+        ...entry.view,
       })
     }
     return views
   }
 }
 
+/**
+ * The `permission/request` frame for one ask.
+ *
+ * ONE builder for both the live broadcast and the reconnect replay, so the two
+ * can never drift: a client that reconnects must receive exactly the frame the
+ * live one carried (its conversation card filters on `dshSessionId` and shows
+ * `toolName` / `deadlineAt`, so a replay missing them would silently drop the
+ * ask).
+ */
+export function permissionRequestFrame(view: PendingPermissionView): AcpEvent {
+  return {
+    type: 'permission/request',
+    requestId: view.requestId,
+    sessionId: view.sessionId,
+    ...(view.dshSessionId === undefined ? {} : { dshSessionId: view.dshSessionId }),
+    toolCall: view.toolCall,
+    toolName: view.toolName,
+    ...(view.reason === undefined ? {} : { reason: view.reason }),
+    options: view.options,
+    timeoutMode: view.timeoutMode,
+    ...(view.deadlineAt === undefined ? {} : { deadlineAt: view.deadlineAt }),
+  }
+}
+
 /**
  * Frames that re-establish a freshly connected client's view of the pending
  * permission asks: every outstanding ask re-sent as its original
@@ -1599,10 +1700,10 @@ export class PermissionLedger {
  *
  * Why a replay at all: a `permission/request` is broadcast ONCE, when the ask is
  * created. A client that connects later — page reload, second tab, stream
- * outage — never receives it, and for a ledger ask (the `/acp` RPC path, or a
- * native route that degraded) that card is the ONLY answer entry, so the ask is
- * invisible to exactly the client that needs it. OmniTerm closes the same hole
- * with `PermissionManager::pending_events()` + a `PermissionsSynced` marker on
+ * outage — never receives it, and that card (conversation or settings ledger)
+ * is the ONLY answer entry for the ask, so the ask is invisible to exactly the
+ * client that needs it. OmniTerm closes the same hole with
+ * `PermissionManager::pending_events()` + a `PermissionsSynced` marker on
  * every WS connect.
  *
  * Why the terminator is mandatory: the replay is a snapshot, so an ask resolved
@@ -1611,13 +1712,7 @@ export class PermissionLedger {
  * `respond` would answer `unknown_request`.
  */
 export function permissionReplayFrames(pending: readonly PendingPermissionView[]): AcpEvent[] {
-  const requests: AcpEvent[] = pending.map(p => ({
-    type: 'permission/request' as const,
-    requestId: p.requestId,
-    sessionId: p.sessionId,
-    toolCall: p.toolCall,
-    options: p.options,
-  }))
+  const requests: AcpEvent[] = pending.map(permissionRequestFrame)
   return [...requests, { type: 'permission/synced', requestIds: pending.map(p => p.requestId) }]
 }
 
@@ -1650,18 +1745,18 @@ export interface AcpManager {
   /** Write the halo preference (persisted with the agent registry). */
   setTagHalo?(halo: AcpTagHalo): Promise<void>
   /**
-   * The approval deadlines in force, with the facts that explain an override
-   * (the `cordis.patch.yml` baseline it outranks, and a `permissionTimeoutMs`
-   * that overrides both). `undefined` on a host half from before the card
-   * existed, which hides the settings card instead of guessing a value.
+   * The approval deadline in force, with the facts that explain an override
+   * (the `cordis.patch.yml` baseline it outranks). `undefined` on a host half
+   * from before the card existed, which hides the settings card instead of
+   * guessing a value.
    */
   approvalDeadlines?(): AcpApprovalDeadlines | undefined
   /**
-   * Write one or both approval deadlines (omitted keys keep their value), or
-   * drop the persisted override with `reset` so the config-file baseline
+   * Write the approval deadline, or the mode (omitted keys keep their value),
+   * or drop the persisted override with `reset` so the config-file baseline
    * applies again. Applies to the running bridges without a restart.
    */
-  setApprovalDeadlines?(patch: Partial<Record<ApprovalDeadlineKey, number>>, reset?: boolean): Promise<void>
+  setApprovalDeadlines?(patch: ApprovalDeadlinePatch, reset?: boolean): Promise<void>
   detectAgents?(): Promise<DetectedAgentInfo[]>
   saveAgent?(def: AcpAgentDef): Promise<void>
   deleteAgent?(agentId: string): Promise<void>
@@ -1697,12 +1792,6 @@ export interface AcpManager {
    * cache (newly published models appear, withdrawn ones drop out).
    */
   cachedAgentModels?(agentId: string): AgentProbeModelsResult | undefined
-  /**
-   * True when ACP permission asks are routed to the host's native approval
-   * service (answered in the chat composer) instead of the settings-panel
-   * ledger. Read-only capability report for `agents/list`.
-   */
-  approvalRouting?(): boolean
   /**
    * ACP agent sessions backing one DSH chat session (looked up by chat session
    * id), so the composer can offer the agent's OWN mode list. Empty when no
@@ -1817,12 +1906,7 @@ export async function dispatchRpc(manager: AcpManager, endpoint: string, payload
   try {
     switch (endpoint) {
       case 'agents/list':
-        // `approvalRouted` is a capability report, not a command: the browser
-        // uses it to decide whether the settings panel still owns approvals.
-        return ok({
-          agents: manager.agentViews(),
-          approvalRouted: manager.approvalRouting?.() ?? false,
-        })
+        return ok({ agents: manager.agentViews() })
       case 'agents/detect':
         return ok({ agents: await (manager.detectAgents?.() ?? Promise.resolve([])) })
       case 'agent/save': {
@@ -1985,10 +2069,10 @@ export async function dispatchRpc(manager: AcpManager, endpoint: string, payload
         // renders nothing rather than a number it cannot trust.
         return ok({ deadlines: manager.approvalDeadlines?.() })
       case 'ui/approval-deadlines-set': {
-        const patch = validateApprovalDeadlines({
-          nativeApprovalTimeoutMs: body.nativeApprovalTimeoutMs,
-          permissionFallbackTimeoutMs: body.permissionFallbackTimeoutMs,
-        })
+        const patch: ApprovalDeadlinePatch = {
+          ...validateApprovalDeadlines({ permissionTimeoutMs: body.permissionTimeoutMs }),
+          ...(body.mode === undefined ? {} : { mode: validatePermissionTimeoutMode(body.mode, 'bad_payload') }),
+        }
         await manager.setApprovalDeadlines?.(patch, body.reset === true)
         return ok({ deadlines: manager.approvalDeadlines?.() })
       }

package/src/index.ts

@@ -11,32 +11,15 @@ import type { ConnectionRpcHandler, HostConnectionHandle } from '@deepseek-ai/ds
 import { ACP_PRESET_ID, AcpLlmAdapter, BridgeManager } from './bridge.ts'
 import { EventHub, dispatchRpc, permissionReplayFrames, sessionAgentPreset, sessionAgentPresetFromLog, validateConfig } from './impl.ts'
 import type { AcpEvent, ApprovalDeadlineKey } from './protocol.ts'
-import type { ApprovalOutcome } from './bridge.ts'
 import type { RosterPresetRow, SessionLogLike } from './impl.ts'
 
 export const name = 'dsh-ntr'
-// `approval` / `agents` are deliberately NOT listed here: they are optional
-// collaborators probed structurally below. A hard dependency would make the
-// whole plugin fail to load on a deployment without them (see the LLM service
-// probe, which follows the same shape).
+// Deliberately minimal: every other host service is probed structurally
+// (`ctx.get` + a late `ctx.inject`) so a deployment without one still loads
+// this plugin. ACP permission asks are answered through this plugin's own
+// ledger, so the host approval service is not a collaborator at all.
 export const inject = ['webServer', 'connection']
 
-/** Structural view of the host approval service (`@deepseek-ai/dsh-user-approval`). */
-interface ApprovalServiceLike {
-  request(req: { agent: unknown; toolName: string; reason?: string; signal?: AbortSignal }): Promise<ApprovalOutcome>
-  /**
-   * Present on the host service, but NEVER read by this plugin: the only call
-   * made here is `request` (see `wireApproval`). A deployment-wide default
-   * policy is the host's own business.
-   */
-  config?: { policy?: string }
-}
-
-/** Structural view of the host agent registry (`ctx.agents`), keyed by chat session id. */
-interface AgentsServiceLike {
-  get(sessionId: string): unknown | undefined
-}
-
 /** Structural view of the host sandbox policy service (`@deepseek-ai/dsh-sandbox-policy`). */
 interface SandboxPolicyLike {
   resolve(request: { session?: unknown }): { mode?: unknown; workspaceRoot?: unknown }
@@ -99,8 +82,7 @@ export function apply(ctx: Context, config?: unknown): void {
     {
       startupTimeoutMs: resolved.startupTimeoutMs,
       permissionTimeoutMs: resolved.permissionTimeoutMs,
-      nativeApprovalTimeoutMs: resolved.nativeApprovalTimeoutMs,
-      permissionFallbackTimeoutMs: resolved.permissionFallbackTimeoutMs,
+      permissionTimeoutMode: resolved.permissionTimeoutMode,
       cancelFallbackMs: resolved.cancelFallbackMs,
       staleCancelRetryDelayMs: resolved.staleCancelRetryDelayMs,
       staleCancelMaxRetries: resolved.staleCancelMaxRetries,
@@ -115,11 +97,20 @@ export function apply(ctx: Context, config?: unknown): void {
   // returns to). Only the keys the file actually names are declared.
   const rawConfig = (config ?? {}) as Record<string, unknown>
   const configuredDeadlines: Partial<Record<ApprovalDeadlineKey, number>> = {}
-  for (const key of ['nativeApprovalTimeoutMs', 'permissionFallbackTimeoutMs'] as const) {
-    const value = rawConfig[key]
-    if (typeof value === 'number' && Number.isFinite(value)) configuredDeadlines[key] = value
+  // The window the file actually named — the new key, or the legacy one it
+  // folded into (same order `validateConfig` resolves them in, so the card's
+  // baseline and the running value never disagree).
+  const rawWindow = rawConfig.permissionTimeoutMs
+    ?? rawConfig.nativeApprovalTimeoutMs
+    ?? rawConfig.permissionFallbackTimeoutMs
+  if (typeof rawWindow === 'number' && Number.isFinite(rawWindow)) {
+    configuredDeadlines.permissionTimeoutMs = rawWindow
   }
-  manager.setConfiguredApprovalDeadlines(configuredDeadlines)
+  // The mode is declared the same way: only when the file actually names it.
+  const configuredMode = rawConfig.permissionTimeoutMode === 'abort' || rawConfig.permissionTimeoutMode === 'auto' || rawConfig.permissionTimeoutMode === 'wait'
+    ? rawConfig.permissionTimeoutMode
+    : undefined
+  manager.setConfiguredApprovalDeadlines(configuredDeadlines, configuredMode)
   // Boot hook kept only so this entry point's shape does not change:
   // `bootstrapCatalogs` is intentionally empty — boot never spawns an agent,
   // in any environment and for any `probeModelsOnBoot` value. Catalogs fill
@@ -158,34 +149,6 @@ export function apply(ctx: Context, config?: unknown): void {
     ctx.inject(['agentPresets'], () => { wirePresetRoster() })
   }
 
-  /**
-   * Native approval routing: answer ACP `session/request_permission` through
-   * the host approval chain so the question takes over the chat composer
-   * (`ApprovalPanel`) instead of the settings panel.
-   *
-   * `approval.request` needs the live agent object (its session carries the
-   * audit pair, and the ask must land inside an open turn) and the chat
-   * session id our adapter already knows. Any missing piece — service absent,
-   * unknown session, a rejecting service — degrades to `'unavailable'`, which
-   * sends the ask back to the ledger/panel path rather than losing it.
-   */
-  const wireApproval = (): void => {
-    const approval = (typeof ctx.get === 'function' ? ctx.get('approval') : (ctx as unknown as { approval?: ApprovalServiceLike }).approval) as ApprovalServiceLike | undefined
-    const agents = (typeof ctx.get === 'function' ? ctx.get('agents') : (ctx as unknown as { agents?: AgentsServiceLike }).agents) as AgentsServiceLike | undefined
-    if (approval === undefined || agents === undefined) return
-    manager.setApprovalRequester(async ({ dshSessionId, toolName, signal }) => {
-      if (dshSessionId === undefined) return 'unavailable'
-      const agent = agents.get(dshSessionId)
-      if (agent === undefined) return 'unavailable'
-      try {
-        return await approval.request({ agent, toolName, ...(signal === undefined ? {} : { signal }) })
-      } catch {
-        // Never propagate: a failed ask must fall back, not break the turn.
-        return 'unavailable'
-      }
-    })
-  }
-
   /**
    * Workspace routing: the sidebar's selected workspace IS the chat session's
    * workspace, so the agent's session and its process both run there (see
@@ -274,11 +237,10 @@ export function apply(ctx: Context, config?: unknown): void {
     }
   }
 
-  wireApproval()
   wireWorkspace()
   if (typeof ctx.inject === 'function') {
-    // Late arrival for the workspace collaborators; kept separate from the
-    // approval probe so a deployment missing one service still wires the other.
+    // Late arrival for the workspace collaborators: a deployment missing one
+    // service must not fail this plugin's activation.
     ctx.inject(['sandboxPolicy', 'sessions'], () => {
       wireWorkspace()
     })
@@ -291,13 +253,6 @@ export function apply(ctx: Context, config?: unknown): void {
       wireAcpMode()
     })
   }
-  if (typeof ctx.inject === 'function') {
-    // Late arrival: both services may still be loading when this plugin
-    // applies (profile order is not ours to control).
-    ctx.inject(['approval', 'agents'], () => {
-      wireApproval()
-    })
-  }
 
   /** Registration handle: callable disposer, plus `replace` to re-announce routes. */
   interface LlmAdapterHandle {