dsh-ntr 0.1.5 → 0.2.0

package/lib/types/bridge.d.ts

@@ -9,7 +9,7 @@
 import { type InitializeResponse } from '@agentclientprotocol/sdk';
 import { EventHub, PermissionLedger, Transcript } from './impl.ts';
 import type { AcpToolCallSnapshot, PendingPermissionView, RosterPresetRow } from './impl.ts';
-import type { AcpAgentCatalog, AcpAgentDef, AcpApprovalDeadlines, AcpConversationChoice, AcpPresetStatus, AcpTagHalo, AgentCatalogResult, AgentProbeModelsResult, AgentTestResult, AgentView, ChatSessionView, ChatTranscriptView, DetectedAgentInfo, GenerateOptions, LlmAdapterLike, LlmModelInfo, LlmProviderInfo, LlmResolvedModelInfo, ApprovalDeadlineKey, PreparedAdapterCall, SessionView, StreamChunk } from './protocol.ts';
+import type { AcpAgentCatalog, AcpAgentDef, AcpApprovalDeadlines, AcpConversationChoice, AcpPresetStatus, AcpTagHalo, AgentCatalogResult, AgentProbeModelsResult, AgentTestResult, AgentView, ChatSessionView, ChatTranscriptView, DetectedAgentInfo, GenerateOptions, LlmAdapterLike, LlmModelInfo, LlmProviderInfo, LlmResolvedModelInfo, ApprovalDeadlineKey, ApprovalDeadlinePatch, PermissionTimeoutMode, PreparedAdapterCall, SessionView, StreamChunk } from './protocol.ts';
 interface LiveSession {
     /** Host-minted id (stable across an agent restart; the ACP id is per-connection). */
     sessionId: string;
@@ -39,9 +39,9 @@ interface LiveSession {
     released: boolean;
     /**
      * Owning DSH chat session id, when the session was opened through the LLM
-     * adapter (`AcpLlmAdapter`). `ctx.agents.get()` needs it to name the agent
-     * whose open turn carries the native approval question; sessions started
-     * over the `/acp` RPC have no chat session and stay on the ledger path.
+     * adapter (`AcpLlmAdapter`). It is what the conversation's permission card
+     * filters on (`permission/request.dshSessionId`); sessions started over the
+     * `/acp` RPC have no chat session, so their asks stay on the settings panel.
      */
     dshSessionId?: string;
     /**
@@ -95,50 +95,48 @@ interface LiveSession {
 /** Reliability tuning, threaded from `AcpPluginConfig` through the manager. */
 export interface BridgeTuning {
     startupTimeoutMs?: number;
+    /**
+     * How long a permission ask may sit unanswered before the deadline fires.
+     *
+     * ONE window for every ask. Every ask is broadcast as `permission/request`
+     * and answered from the conversation's dock card; an `/acp`-RPC ask has no
+     * conversation, so the settings page mirrors the same ask as its answer
+     * entry. One question, one window: "is anyone there?" gets the same answer
+     * wherever the card is rendered, and two numbers made the settings card look
+     * like two unrelated knobs.
+     *
+     * `0` means 不等待, not "wait forever": `auto` settles the ask on arrival,
+     * `abort` floors the window to the shortest real wait (refusing every ask on
+     * arrival is a brick wall, not a timeout), and `wait` ignores the window
+     * entirely.
+     *
+     * The deadline is what keeps a turn from hanging on a question nobody
+     * answers: the card stays visible, but an unattended session would otherwise
+     * wait indefinitely. Past the deadline the ask is settled IN PLACE — never
+     * relocated: `abort` refuses it, `auto` answers it with the option the
+     * agent's own kinds imply (broadest grant first), and `wait` never expires
+     * it at all.
+     *
+     * Default 300000 ms. OmniTerm's equivalent is its reaper's permission-timeout
+     * threshold (30 min default, 30 s steps, hot-updatable).
+     */
     permissionTimeoutMs?: number;
     /**
-     * Deadline for a permission ask whose native route DEGRADED to unavailable
-     * (see {@link LedgerFallbackReason}). Applies when `permissionTimeoutMs` is
-     * 0 — its "approvals belong to a person, wait forever" default — because a
-     * degraded ask has no visible answer entry in the conversation the user is
-     * looking at, and waiting forever would hang the turn on a question nobody
-     * can see there. The DESIGNED ledger paths (no approval service at all, a
-     * session with no chat identity) keep waiting: their answer entry is the
-     * settings panel, which is exactly where the chat line sends the user. `0`
-     * disables even this fallback.
-     */
-    permissionFallbackTimeoutMs?: number;
-    /**
-     * Deadline for the NATIVE approval route itself: how long
-     * {@link AgentBridge.askNativeApproval} waits for the host approval chain to
-     * answer before withdrawing the ask and handing it to the settings-panel
-     * ledger (`native-timeout`, see {@link LedgerFallbackReason}).
-     *
-     * A routed ask shows no card and broadcasts no frame — the composer takeover
-     * IS the answer entry — so a host that accepts the question and then never
-     * renders it (answerer absent from the browser scope, the conversation not
-     * mounted, a client that never received the remote event) leaves the turn
-     * hanging behind a question the user cannot see anywhere. The deadline is
-     * what makes that state bounded: past it the ask is withdrawn (the request
-     * signal is aborted, which settles the host ask `cancelled`) and re-asked on
-     * the ledger, where the chat line and the settings card are both visible.
-     *
-     * This is NOT an answer on the human's behalf: a human mid-decision simply
-     * finds the same question in the settings panel. `0` disables it (wait for
-     * the host forever).
-     *
-     * Default 300000 ms — the SAME window as
-     * {@link BridgeTuning.permissionFallbackTimeoutMs}, so "this route is not
-     * working" is one number instead of two arbitrary ones. A takeover that is
-     * going to render does so immediately, and the host replays a pending
-     * approval across reconnects (verified live on DSH web 0.2.1-rc.2), so the
-     * deadline only ever fires for a host that took the question and never showed
-     * it. OmniTerm's equivalent is its reaper's permission-timeout threshold
-     * (30 min default, 30 s steps, hot-updatable); this is the same knob without
-     * their `auto` tier, which this plugin does not have (every ask must reach a
-     * human).
-     */
-    nativeApprovalTimeoutMs?: number;
+     * What an EXPIRED approval deadline does. `wait` (default) never expires
+     * the ask at all; `abort` refuses it; `auto` answers it with the option the
+     * agent's own kinds imply and lets the agent continue.
+     *
+     * Three values, and only three: an unanswered ask is either answered for
+     * you, kept waiting, or refused. Same vocabulary as OmniTerm dev's
+     * `acp_perm_timeout_mode`.
+     *
+     * The default is `wait`: a permission ask is a question FOR A HUMAN, and
+     * refusing it because the human looked away from the tab is worse than
+     * waiting — the ask stays visible the whole time, so nobody is left
+     * wondering what happened to it. `abort` and `auto` are opt-in for the
+     * deployments that would rather have a bounded turn.
+     */
+    permissionTimeoutMode?: PermissionTimeoutMode;
     cancelFallbackMs?: number;
     /**
      * How long to wait before resending a prompt the agent answered `cancelled`
@@ -172,54 +170,6 @@ export interface BridgeTuning {
      */
     probeIdleTimeoutMs?: number;
 }
-/** One native approval question, as the host approval service defines it. */
-export interface ApprovalRequestContext {
-    /** DSH chat session that owns the open turn the question is asked in. */
-    dshSessionId?: string;
-    agentId: string;
-    /** Human-facing identity of the operation awaiting a decision. */
-    toolName: string;
-    reason?: string;
-    signal?: AbortSignal;
-}
-/** Outcome vocabulary of the host approval chain (`'unavailable'` = no answerer). */
-export type ApprovalOutcome = 'allowed-once' | 'rejected' | 'cancelled' | 'unavailable';
-/**
- * Why one permission ask rides the settings-panel ledger instead of the native
- * approval chain, recorded when the ask is broadcast.
- *
- * `no-requester` and `no-chat-session` are the DESIGNED ledger paths: a host
- * without the approval service, and an `/acp`-RPC session that has no chat
- * turn to route into. `unavailable` is a DEGRADATION — the service is wired
- * and this ask still failed, so the conversation the user is looking at will
- * never show the question. `native-timeout` is the other degradation: the host
- * TOOK the question and never answered it inside
- * {@link BridgeTuning.nativeApprovalTimeoutMs}, so it is withdrawn and re-asked
- * here. The last two decide both the chat line's wording (see
- * `BridgeManager.streamPrompt`) and whether a deadline is armed
- * ({@link AgentBridge.handlePermissionRequest}).
- */
-export type LedgerFallbackReason = 'no-requester' | 'no-chat-session' | 'unavailable' | 'native-timeout';
-/** One recorded ledger fallback: why the ask is here, and the deadline armed for it. */
-export interface LedgerFallback {
-    reason: LedgerFallbackReason;
-    /** Effective deadline in ms; `0` = no timer (wait for the human). */
-    timeoutMs: number;
-    /**
-     * How long the NATIVE route waited before withdrawing this ask, on the
-     * `native-timeout` path only. The chat line reports it as an observed fact
-     * ("no answer in the conversation within Ns") rather than guessing a cause:
-     * a slow human and a host that never rendered the question look identical
-     * from here.
-     */
-    waitedMs?: number;
-}
-/**
- * Asks the host approval service (`ctx.approval`) for one decision. Never
- * throws: any failure is reported as `'unavailable'` so the caller can fall
- * back to the settings-panel ledger.
- */
-export type ApprovalRequester = (request: ApprovalRequestContext) => Promise<ApprovalOutcome>;
 /**
  * Resolves the workspace root of one chat session (`dshSessionId` = DSH session
  * id) — the sidebar's selected workspace, which the host's sandbox policy keeps
@@ -256,13 +206,8 @@ export declare class AgentBridge {
     /** Observes `availableCommands` from any real session so the agent's slash menu survives its sessions. */
     private readonly onCommands?;
     /**
-     * Resolved per ask (not captured) so a requester wired after this bridge
-     * was built still applies. Absent → every ask rides the ledger.
-     */
-    private readonly approvalRequester?;
-    /**
-     * Resolved per turn, like {@link approvalRequester}: the host entry may
-     * wire the access-mode mapping after this bridge was built.
+     * Resolved per turn: the host entry may wire the workspace reader after
+     * this bridge was built.
      */
     private readonly sessionWorkspace?;
     state: BridgeState;
@@ -279,29 +224,18 @@ export declare class AgentBridge {
     /** Inflight `session/load` resumes, shared so concurrent prompts don't double-resume. */
     private readonly resuming;
     readonly permissions: PermissionLedger;
+    private readonly startupTimeoutMs;
     /**
-     * Why each outstanding ledger ask is on the ledger, keyed by request id and
-     * recorded before the `permission/request` broadcast (the hub is
-     * synchronous, so a subscriber can read it the moment the frame goes out).
-     * Entries live exactly as long as the ask: the ledger's resolve callback
-     * deletes them, and every terminal path (answer, timeout, session close,
-     * process death) resolves through it.
+     * The ONE approval deadline, and the mode it settles with. Neither is
+     * readonly, unlike their neighbors: the settings page rewrites them on a
+     * running bridge ({@link AgentBridge.applyApprovalDeadlines}), so a user
+     * editing the card does not have to kill every live session to see it take
+     * effect. Both are read per ask, so a reassignment reaches every ask from
+     * that moment on. An ask already holding an armed timer keeps the window it
+     * was started with.
      */
-    private readonly ledgerFallbacks;
-    private readonly startupTimeoutMs;
-    private readonly permissionTimeoutMs;
-    /**
-     * The two approval deadlines are NOT readonly, unlike their neighbors: the
-     * settings page rewrites them on a running bridge
-     * ({@link AgentBridge.applyApprovalDeadlines}), so a user editing the window
-     * does not have to kill every live session to see it take effect. Both are
-     * read per ask — `nativeApprovalTimeoutMs` when the native ask is armed,
-     * `permissionFallbackTimeoutMs` when the ledger ask's deadline is chosen — so
-     * a reassignment reaches every ask from that moment on. An ask already
-     * holding an armed timer keeps the window it was started with.
-     */
-    private permissionFallbackTimeoutMs;
-    private nativeApprovalTimeoutMs;
+    private permissionTimeoutMs;
+    private permissionTimeoutMode;
     private readonly cancelFallbackMs;
     private readonly staleCancelRetryDelayMs;
     private readonly staleCancelMaxRetries;
@@ -349,28 +283,23 @@ export declare class AgentBridge {
     /** Observes `availableCommands` from any real session so the agent's slash menu survives its sessions. */
     onCommands?: ((agentId: string, commands: NonNullable<SessionView["availableCommands"]>) => void) | undefined, tuning?: BridgeTuning, 
     /**
-     * Resolved per ask (not captured) so a requester wired after this bridge
-     * was built still applies. Absent → every ask rides the ledger.
-     */
-    approvalRequester?: (() => ApprovalRequester | undefined) | undefined, 
-    /**
-     * Resolved per turn, like {@link approvalRequester}: the host entry may
-     * wire the access-mode mapping after this bridge was built.
+     * Resolved per turn: the host entry may wire the workspace reader after
+     * this bridge was built.
      */
     sessionWorkspace?: (() => SessionWorkspaceResolver | undefined) | undefined);
     /**
-     * Adopt a rewritten approval deadline (the settings page's write). Only the
-     * two degraded-route windows live here; every other tuning value is fixed at
-     * construction, because a live bridge cannot meaningfully adopt a new startup
-     * or cancel window mid-flight.
+     * Adopt a rewritten approval deadline or mode (the settings page's write).
+     * Only the window and the mode live here; every other tuning value is
+     * fixed at construction, because a live bridge cannot meaningfully adopt a
+     * new startup or cancel window mid-flight.
      *
      * Deliberately does NOT re-arm anything: an ask that already holds a timer
      * keeps the window it was started with, and the next ask reads the new value.
      * Re-arming would move the goalposts under a human who is already deciding.
      */
     applyApprovalDeadlines(patch: {
-        nativeApprovalTimeoutMs?: number;
-        permissionFallbackTimeoutMs?: number;
+        permissionTimeoutMs?: number;
+        mode?: PermissionTimeoutMode;
     }): void;
     /**
      * The idle-release window this agent honors for its CHAT process: its own
@@ -585,43 +514,38 @@ export declare class AgentBridge {
     stop(reason?: 'closed' | 'agent-stopped' | 'agent-died'): Promise<void>;
     private killChild;
     /**
-     * Answer one ACP permission ask. Every ask reaches a human: the native
-     * approval chain first (answered in the chat composer), the settings-panel
-     * ledger otherwise.
+     * Answer one ACP permission ask.
+     *
+     * EVERY ask is answered by a human through the plugin's own ledger. The
+     * host's approval chain is deliberately not involved: it could accept an ask
+     * and render nothing, leaving the turn hanging behind something invisible
+     * with no deadline (issue #2). The ledger broadcasts `permission/request`,
+     * the browser renders the answerable card, and `permission/respond` settles
+     * it.
+     *
+     * The host answers on its own only when a deadline expires: `abort` refuses,
+     * `auto` picks the option the agent's own kinds imply, `wait` never expires.
+     * The ACP request's own `signal` (the agent withdrawing the ask, or the
+     * connection dying) settles the same entry cancelled, so a withdrawn ask can
+     * never leave a stale card behind.
      */
     private handlePermissionRequest;
     /**
-     * Why one ledger ask is on the ledger, as recorded by
-     * {@link handlePermissionRequest}. The manager's `streamPrompt` reads it to
-     * word the chat line by the path the ask took; `undefined` once the ask is
-     * answered, timed out, or settled.
-     */
-    ledgerFallbackOf(requestId: string): LedgerFallback | undefined;
-    /**
-     * Ask the host approval service for this permission (`ctx.approval` → the
-     * browser's composer takeover). Only sessions bound to a DSH chat session
-     * qualify: the service appends its audit pair to that session inside an
-     * open turn, so a session started over `/acp` (no chat turn) cannot be
-     * routed and must stay on the ledger path.
-     *
-     * The ask is raced against {@link BridgeTuning.nativeApprovalTimeoutMs}. A
-     * routed ask has exactly one answer entry — the composer takeover — and no
-     * broadcast at all, so a host that takes the question and never renders it
-     * would leave the turn hanging behind something invisible. Past the deadline
-     * the ask is WITHDRAWN (the signal handed to the host aborts, which settles
-     * its waterfall `cancelled` and drops the composer panel) and reported as
-     * `native-timeout`, sending the question to the ledger where the chat line
-     * and the settings card are both visible. Withdrawing is not answering: a
-     * human mid-decision finds the same question in the settings panel.
-     *
-     * No deadline is armed on the ledger paths (`no-requester`,
-     * `no-chat-session`): those never reach the host, and their answer entry is
-     * the settings panel the chat line already points at.
-     *
-     * @returns the agent-facing response, or the reason the ask must fall back
-     * to the ledger (see {@link LedgerFallbackReason}).
-     */
-    private askNativeApproval;
+     * Announce and compute one ask's expiry. Shared by the 不等待 arrival path
+     * and the ledger deadline, so an expiry can never broadcast two notices or
+     * skip the `permission/expired` line: once the card is gone that frame is
+     * the conversation's only trace of what happened to the question.
+     */
+    private announceExpiredAsk;
+    /**
+     * Settle the 不等待 (`auto` + zero window) ask on arrival: no ledger entry
+     * and no card — nothing asks a human, so there is nothing to show. `auto`
+     * answers with the option the agent's own kinds imply ({@link pickAutoOption})
+     * and the agent CONTINUES. A mode that cannot pick an option (no options, or
+     * none with a usable id) degrades to refusing: safer than guessing, and
+     * hanging is worse than either.
+     */
+    private settleExpiredAsk;
     private settlePermissions;
     /** `fs/read_text_file` for agents that fetch workspace content through the
      * client. Every path passes the same workspace guard as session cwds
@@ -638,7 +562,7 @@ export declare class AgentBridge {
      * cannot reach into the agent's own process, so a second gate here would only
      * be a fiction in front of a tool that can write without asking us at all.
      * What the agent chooses to ask about goes to the human unchanged
-     * (`askNativeApproval`). See docs/acp-convergence.md §2.3.
+     * (`handlePermissionRequest`). See docs/acp-convergence.md §2.3.
      */
     private handleFsWrite;
     private guardFsPath;
@@ -659,6 +583,16 @@ export declare class AgentBridge {
  * every step reads a key the agent itself declared.
  */
 export declare function permissionToolName(toolCall: unknown): string;
+/**
+ * One line saying WHAT the permission ask is about.
+ *
+ * WHY: without it the human only sees the tool's NAME ("Bash") and cannot
+ * judge the request; the ACP tool call already declares the missing half — its
+ * title and (for execute/edit tools) a short scalar in `rawInput`. Only ONE declared
+ * string is used, never a serialized object or a whole file, and the line is
+ * capped so a pathological input cannot fill the card or the audit log.
+ */
+export declare function permissionAskReason(toolCall: unknown): string;
 /**
  * This plugin's OWN state directory, `~/.dsh/dsh-ntr`.
  *
@@ -916,7 +850,6 @@ type TurnSettle = {
 declare class TurnStreamController {
     private readonly manager;
     private readonly hub;
-    private readonly bridge;
     readonly session: LiveSession;
     readonly turnId: string;
     /** Releases the agent-side turn slot (the `beginTurn` settler; idempotent). */
@@ -932,7 +865,7 @@ declare class TurnStreamController {
     private readonly pendingProse;
     sawVisibleBlock: boolean;
     private cursorSeq;
-    constructor(manager: BridgeManager, hub: EventHub, bridge: AgentBridge, session: LiveSession, turnId: string, 
+    constructor(manager: BridgeManager, hub: EventHub, session: LiveSession, turnId: string, 
     /** Releases the agent-side turn slot (the `beginTurn` settler; idempotent). */
     endTurn: () => void, rollbackFirstTurn: (session: LiveSession) => void);
     private readonly unsubscribe;
@@ -964,6 +897,15 @@ declare class TurnStreamController {
     /** A segment opened on an already-settled turn: replay, then close it out. */
     private finishAfterSettle;
     private onEvent;
+    /**
+     * Put one narrative line into the turn's prose stream.
+     *
+     * A card-bearing segment must stay the segment's LAST block, so a line that
+     * arrives while a card is open is parked for the next segment instead of
+     * streaming below the card. A line that arrives between segments waits for
+     * the next one to open.
+     */
+    private pushProse;
     /** Events that arrive between segments: recorded, replayed into the next one. */
     private recordWithoutSegment;
     private noteUsage;
@@ -985,6 +927,15 @@ declare class TurnStreamController {
      */
     private openToolCallBlock;
     private permissionLine;
+    /**
+     * The line for an ask the plugin settled itself when its deadline fired.
+     *
+     * The composer card is disappearing, so the conversation has to say what
+     * happened to the question — otherwise the user is left with a vanished
+     * card and no explanation. The wording follows the outcome: refused, or
+     * answered with the option the agent's own kinds implied.
+     */
+    private expiredLine;
 }
 /** Routes host session ids to their owning bridge. */
 export declare class BridgeManager {
@@ -1001,17 +952,23 @@ export declare class BridgeManager {
     /** The agent tag's halo preference (persisted; see `persistAgents`). */
     private tagHaloSetting;
     /**
-     * What `cordis.patch.yml` asked for, by key — ONLY the keys it actually
-     * names. This is the deployment baseline, kept apart from
+     * What `cordis.patch.yml` asked for — ONLY if it actually named the key.
+     * This is the deployment baseline, kept apart from
      * {@link deadlineOverride} so the settings card can tell the user which of
-     * the two is winning. Empty when the file says nothing about either window,
-     * in which case {@link baselineDeadlines} (the built-in default) applies.
+     * the two is winning. Empty when the file says nothing about the window, in
+     * which case {@link baselineDeadline} (the built-in default) applies.
      */
     private configuredDeadlines;
     /**
-     * The value each deadline had before any override — the tuning this manager
-     * was constructed with, which already carries the validated config file (the
-     * host entry passes `validateConfig`'s output) or the built-in default.
+     * The mode the config file named, if it named one. Kept apart from the
+     * override for the same reason the window is: the card has to be able
+     * to say "the file asks for `abort`, the value set here wins".
+     */
+    private configuredMode?;
+    /**
+     * The window before any override — the tuning this manager was constructed
+     * with, which already carries the validated config file (the host entry
+     * passes `validateConfig`'s output) or the built-in default.
      *
      * Held separately from {@link configuredDeadlines} because the two answer
      * different questions: this one is what RUNS when nothing is overridden, that
@@ -1019,17 +976,23 @@ export declare class BridgeManager {
      * and a bare default does not deserve). A manager built without tuning at all
      * — a direct consumer, a test — gets `DEFAULT_TUNING` here and stays correct.
      */
-    private baselineDeadlines;
+    private baselineDeadline;
+    /**
+     * The mode before any override — the tuning this manager was constructed
+     * with, which already carries the validated config file (the host entry
+     * passes `validateConfig`'s output) or the built-in default.
+     */
+    private baselineMode;
     /**
      * The settings page's own write, persisted with the agent registry. Merged
-     * OVER {@link baselineDeadlines}: once a user picks a window in the UI, that
+     * OVER {@link baselineDeadline}: once a user picks a window in the UI, that
      * pick is what runs, and the config file becomes the value the reset button
      * returns to. Without this split a hand-edited `cordis.patch.yml` and a UI
      * write would fight with no way to tell which one is live.
      */
     private deadlineOverride;
     /**
-     * Tuning in force, defaults applied. The two approval deadlines are rewritten
+     * Tuning in force, defaults applied. The approval deadline is rewritten
      * IN PLACE by {@link applyDeadlineTuning}, which is why this is a live object
      * rather than the constructor's parameter: every bridge built afterwards
      * inherits the rewrite instead of the boot-time value.
@@ -1058,20 +1021,10 @@ export declare class BridgeManager {
     probeModelsOnBoot?: boolean, tuning?: BridgeTuning);
     private makeBridge;
     /**
-     * Route ACP permission asks through the host approval service (answered in
-     * the chat composer). Absent → every ask stays on the settings-panel ledger.
-     * Setting it also flips {@link approvalRouting}, which the browser reads to
-     * stop rendering the settings-panel permission card.
-     */
-    setApprovalRequester(requester?: ApprovalRequester): void;
-    /** True when permission asks go to native approval instead of the settings panel. */
-    approvalRouting(): boolean;
-    /**
-     * Every outstanding ledger ask, across all agents, with the view the browser
-     * was shown it — the source of the reconnect replay (see
-     * `permissionReplayFrames`). Asks on the native route are deliberately
-     * absent: they broadcast nothing and their answer entry is the composer
-     * takeover the client already holds.
+     * Every outstanding ask, across all agents, with the view the browser was
+     * shown it — the source of the reconnect replay (see
+     * `permissionReplayFrames`). Every ACP ask is a ledger entry, so this is the
+     * whole live set.
      */
     pendingPermissionViews(): PendingPermissionView[];
     /**
@@ -1598,7 +1551,7 @@ export declare class BridgeManager {
     tagHalo(): AcpTagHalo;
     setTagHalo(halo: AcpTagHalo): Promise<void>;
     /**
-     * Declare the deployment baseline for the two approval deadlines — the values
+     * Declare the deployment baseline for the approval deadline — the values
      * `cordis.patch.yml` names, passed RAW (only the keys it actually contains).
      *
      * Kept separate from the validated tuning because "the file says 600000" and
@@ -1608,19 +1561,21 @@ export declare class BridgeManager {
      * also moves the baseline, so a manager built without tuning (a direct
      * consumer, a test) still runs what the deployment asked for.
      */
-    setConfiguredApprovalDeadlines(values: Partial<Record<ApprovalDeadlineKey, number>>): void;
+    setConfiguredApprovalDeadlines(values: Partial<Record<ApprovalDeadlineKey, number>>, mode?: PermissionTimeoutMode): void;
     /**
-     * The approval deadlines in force, plus the two facts that explain a value the
-     * user did not pick: the config-file baseline an override is outranking, and a
-     * `permissionTimeoutMs` that overrides BOTH windows when non-zero. Both are
-     * reported only when they are actually in play, so the card can stay silent
-     * about a plain default.
+     * The approval deadline in force, plus the facts that explain a value the
+     * user did not pick: the config-file baseline an override is outranking. The
+     * mode rides along with its own baseline, for the same reason: the card has
+     * to be able to say "the file asks for `abort`, the value set here wins".
+     *
+     * Everything is reported only when it is actually in play, so the card can
+     * stay silent about a plain default.
      */
     approvalDeadlines(): AcpApprovalDeadlines;
     /**
-     * Write one or both approval deadlines (omitted keys keep their value), or
-     * drop the persisted override with `reset` so the config-file baseline — or
-     * the built-in default — applies again.
+     * Write the approval deadline, or the mode (omitted keys keep their value),
+     * or drop the persisted override with `reset` so the config-file baseline —
+     * or the built-in default — applies again.
      *
      * HOT: the rewrite reaches every live bridge, so a user changing the window
      * never has to kill a running session to see it take effect (the one thing an
@@ -1628,10 +1583,10 @@ export declare class BridgeManager {
      * write see the new window; an ask already holding a timer keeps the one it
      * started with.
      */
-    setApprovalDeadlines(patch: Partial<Record<ApprovalDeadlineKey, number>>, reset?: boolean): Promise<void>;
+    setApprovalDeadlines(patch: ApprovalDeadlinePatch, reset?: boolean): Promise<void>;
     /**
-     * Recompute the two deadlines from override → deployment baseline, and push
-     * the result to every live bridge.
+     * Recompute the deadline and the mode from override → deployment baseline,
+     * and push the result to every live bridge.
      */
     private applyDeadlineTuning;
     private readonly dshSessionMap;
@@ -1645,11 +1600,6 @@ export declare class BridgeManager {
     private readonly chatAgentIntent;
     /** Drop every chat-keyed record pointing at one host session (close/stop paths). */
     private forgetDshSession;
-    /**
-     * Latest native-approval requester. Held as a field (read through a thunk by
-     * each bridge) so a requester wired after bridges were built still applies.
-     */
-    private approvalRequester?;
     private sessionWorkspaceResolver?;
     private acpModeResolver?;
     /** Cached `chatSessionAcpMode` answers, keyed by DSH chat session id. */