elanous 0.2.9 → 0.2.10

package/src/acp/server.ts

@@ -101,6 +101,8 @@ import { readOriginSessionMeta } from './origin-session-meta.js';
 import type { CodexPlugin } from './codex-plugins.js';
 import { flattenMcpServersToCodexConfig } from './codex-approval-adapter.js';
 import { runAcpTurn } from './turn-runner.js';
+import type { AcpPermissionApprovalRequest } from './client.js';
+import { createAcpSessionApprovalPolicy, type AcpToolApprovalResult } from './tool-approval.js';
 import { projectPwaToolResult, type ToolResultMeta } from '../nexus/api/meta-api.js';
 import type { LlmBrand } from '../llm-vision-capability.js';
 import {
@@ -233,6 +235,9 @@ export interface AcpServerOptions {
    *  receives the user message text and a push() for streaming back
    *  assistant chunks. When omitted, the server echoes the prompt. */
   runTurn?: (ctx: AcpTurnContext) => Promise<void>;
+  /** PCH-2b — ask the client before write/shell tools run ('ask', default).
+   *  'off' keeps the host's own approvals (the in-process TUI dashboard). */
+  toolApproval?: 'ask' | 'off';
   /** ACP standalone entry: require session cwd or an explicit boot default. */
   requireSessionToolCwd?: boolean;
   bootToolCwd?: string;
@@ -850,6 +855,8 @@ export interface AcpTurnContext {
     toolArgs?: Record<string, unknown>;
     timeoutMs?: number;
   }) => Promise<AcpApprovalDecision>;
+  /** The session-scoped gate used by core-turn tool dispatchers. */
+  approveTool?: (req: Parameters<AcpTurnContext['requestApproval']>[0]) => Promise<AcpToolApprovalResult>;
 }
 
 /** F1 — Phase 3 · resolved decision from `AcpTurnContext.requestApproval`.
@@ -866,6 +873,14 @@ export type AcpApprovalDecision =
  *  `_PERMISSION_DEFAULT_TIMEOUT_S`; overrideable per call. */
 export const DEFAULT_APPROVAL_TIMEOUT_MS = 60_000;
 
+export {
+  acpToolDenialResult,
+  createAcpSessionApprovalPolicy,
+  requiresAcpToolApproval,
+  type AcpToolApprovalResult,
+  type AcpToolDenialReason,
+} from './tool-approval.js';
+
 /** ACP streaming Phase E (PLAN-pwa-webterm-voice-control v1.2 · 2026-05-07) —
  *  module-level handle to the broadcaster owned by the active runAcpServer
  *  instance. The chat REST handler (`src/nexus/api/meta-api.ts handlePromptStreamPost`)
@@ -991,6 +1006,7 @@ interface AcpServerContext {
   /** One skip diagnostic per session, cleared when its last peer leaves. */
   plainEnvelopeLogged: Set<string>;
   dualRole: DualRoleManager;
+  approvalPolicy: ReturnType<typeof createAcpSessionApprovalPolicy>;
   /** Mints the unique suffix of a new session id. Injected so tests can
    *  pin it deterministically — production wires `mintAcpSessionToken`. */
   nextSessionToken: () => string;
@@ -1054,7 +1070,7 @@ function wireAcpConnection(
   stream: ReturnType<typeof ndJsonStream>,
   ctx: AcpServerContext,
 ): AgentSideConnection {
-  const { sessions, sessionPeers, awarePeers, plainEnvelopeLogged, dualRole, opts } = ctx;
+  const { sessions, sessionPeers, awarePeers, plainEnvelopeLogged, dualRole, approvalPolicy, opts } = ctx;
   // 2026-05-13 (M2 of AskUserQuestion cross-surface) — bound connection
   // widened to expose `extMethod` + `extNotification` (SDK's elanous
   // extension escape hatch). pushAskRequest / pushAskCancel route through
@@ -1771,7 +1787,9 @@ function wireAcpConnection(
         );
       };
       const requestApproval: AcpTurnContext['requestApproval'] = async (approvalReq) => {
-        const timeoutMs = approvalReq.timeoutMs ?? DEFAULT_APPROVAL_TIMEOUT_MS;
+        const timeoutMs = approvalReq.timeoutMs
+          ?? (await import('../user-config.js')).getUserConfig().acp.toolApproval?.timeoutMs
+          ?? DEFAULT_APPROVAL_TIMEOUT_MS;
         const optionBase = `${approvalReq.toolCallId}-`;
         const options = [
           { optionId: `${optionBase}allow-once`, name: 'Allow once', kind: 'allow_once' as const },
@@ -1787,6 +1805,8 @@ function wireAcpConnection(
           },
           options,
         });
+        // A late rejection after the timeout won the race must not go unhandled.
+        permissionPromise.catch(() => undefined);
         let timer: ReturnType<typeof setTimeout> | null = null;
         const timeoutPromise = new Promise<'timeout'>((resolve) => {
           timer = setTimeout(() => resolve('timeout'), timeoutMs);
@@ -1972,6 +1992,7 @@ function wireAcpConnection(
         }
       }
 
+      const rejectedThisTurn = new Set<string>();
       const turnCtx: AcpTurnContext = {
         sessionId: req.sessionId,
         cwd: s.cwd,
@@ -1987,6 +2008,10 @@ function wireAcpConnection(
         pushSessionUpdate,
         pushUsage,
         requestApproval,
+        ...(opts.toolApproval !== 'off'
+          ? { approveTool: (approvalReq: Parameters<AcpTurnContext['requestApproval']>[0]) =>
+              approvalPolicy.resolve(req.sessionId, approvalReq, requestApproval, rejectedThisTurn) }
+          : {}),
       };
 
       // RC — intercept hook runs first. Lets the host treat the
@@ -2020,6 +2045,20 @@ function wireAcpConnection(
             chatId: req.sessionId,
             cwd: s.cwd,
             codexArgs: s.codexArgs,
+            ...(turnCtx.approveTool ? {
+              // PCH-2b — codex asks this turn's ACP client instead of auto-approving.
+              permissionApprover: async (approvalReq: AcpPermissionApprovalRequest) => {
+                if (s.aborted) return false;
+                const decision = await turnCtx.approveTool!({
+                  toolCallId: `codex-${randomBytes(6).toString('hex')}`,
+                  // «codex exec» · «codex network» · «codex mcp» — allow-always is per kind.
+                  toolName: /^codex [a-z]+/.exec(approvalReq.title)?.[0] ?? `codex ${approvalReq.kind ?? 'action'}`,
+                  ...(approvalReq.rawInput && typeof approvalReq.rawInput === 'object' && !Array.isArray(approvalReq.rawInput)
+                    ? { toolArgs: approvalReq.rawInput as Record<string, unknown> } : {}),
+                });
+                return decision.allowed && !s.aborted;
+              },
+            } : {}),
             streamer: { edit: (text) => { void push(text); } },
           });
         } else if (opts.runTurn) {
@@ -2169,8 +2208,8 @@ function wireAcpConnection(
         const adopted = matches.find((match) => match.pt.isAlive);
         const existing = sameSession?.isAlive ? sameSession : adopted?.pt;
         if (existing) {
+          registerPreviewTerminalForWebTap(existing, p.sessionId, tid, handle);
           if (existing !== sameSession && adopted) {
-            registerPreviewTerminalForWebTap(existing, p.sessionId, tid, handle);
             debug.log('webterm.acp', 'spawn.adopt', {
               terminalId: tid, fromSessions: adopted.sessionIds, toSession: p.sessionId,
             });
@@ -2207,10 +2246,10 @@ function wireAcpConnection(
           // appear duplicated. Pinning TERM to xterm-256color matches
           // the actual rendering surface and makes the redraws idempotent.
           termName: 'xterm-256color',
-          // ★ P0b-2 (실행 substrate 통합·기본 off) — 이 진짜 PWA/iOS 라이브 셸을 공유 registry 버스로
-          //   흡수(정체성·크로스서피스 goto·3-스택 통합). 라이브 렌더(yazi/마우스/커서/alt-screen) 검증이
-          //   기기 왕복을 요하므로 per-run env 로만 켠다(대표가 별도 부팅해 수습). 미설정=기존 dup-fd(무회귀).
-          useRegistry: process.env.ELANOUS_PREVIEW_TERMINAL_REGISTRY === '1',
+          // The shared PTY bus delivers output to PreviewTerminal's headless
+          // renderer and ACP taps. The direct /dev/fd duplicate can observe
+          // shell exit without ever reading its prompt (black web terminal).
+          useRegistry: true,
           ...(typeof p.shell === 'string' && p.shell.length > 0 ? { shell: p.shell } : {}),
           onExit: () => {
             void import('../web-terminal/preview-tap-registry.js')
@@ -3343,6 +3382,7 @@ function wireAcpConnection(
       if (remaining === 0) {
         sessionPeers.delete(sid);
         plainEnvelopeLogged.delete(sid);
+        approvalPolicy.clearSession(sid);
       }
       if (debug.enabled) {
         debug.log('acp.peer.unregister', sid, { remainingPeers: remaining });
@@ -3487,6 +3527,7 @@ export async function runAcpServer(opts: AcpServerOptions = {}): Promise<void> {
     awarePeers,
     plainEnvelopeLogged,
     dualRole,
+    approvalPolicy: createAcpSessionApprovalPolicy(),
     nextSessionToken: mintAcpSessionToken,
     agentName: opts.agentName ?? 'elanous-agent',
     agentVersion: opts.agentVersion ?? readPkgVersion(),

package/src/acp/tool-approval.ts

@@ -0,0 +1,126 @@
+// PCH-2b (0.2.10 · security D-20261002-08) — ACP turns ask the client before
+// write/shell tools run; «allow always» is remembered per session and tool.
+// Goal: 내부 문서 `ASK-pwa-chat-turns-run-write-and-shell-tools-without-approval-2026-10-02`
+import { debug } from '../debug/log.js';
+import type { AcpApprovalDecision, AcpTurnContext } from './server.js';
+
+/** PCH-2b — tools that write files or run shell commands. ACP turns (PWA·iOS·
+ * remote TUI) ask the client before these run; everything else runs as before.
+ * One list, here, because the daemon catalog has no read-only/mutating flag. */
+const ACP_APPROVAL_TOOLS = new Set([
+  'write', 'edit', 'multiedit', 'notebookedit', 'applypatch', 'apply_patch', 'patch',
+  'bash', 'shell', 'runshell', 'exec_command',
+  'ptyshellstart', 'ptyshellsend', 'webterminalinput',
+  'delegate_code_agent',
+]);
+export function requiresAcpToolApproval(toolName: string): boolean {
+  const name = toolName.startsWith('functions.') ? toolName.slice('functions.'.length) : toolName;
+  // Codex app-server only sends a permission request when it wants to act.
+  return ACP_APPROVAL_TOOLS.has(name.toLowerCase()) || name.startsWith('codex ');
+}
+
+export type AcpToolDenialReason = 'rejected' | 'cancelled' | 'timeout' | 'error';
+export type AcpToolApprovalResult =
+  | { allowed: true }
+  | { allowed: false; reason: AcpToolDenialReason };
+
+/** The tool result the LLM sees when a protected tool was not run. */
+export function acpToolDenialResult(toolName: string, reason: AcpToolDenialReason): { error: string } {
+  if (reason === 'rejected') {
+    return { error: `${toolName}: 사람이 이 호출을 거절했다. 같은 턴에서 같은 도구를 다시 요청하지 말고, 이유를 묻거나 다른 길을 제안하라 — 실행하지 않았다 (tool not run: approval ${reason})` };
+  }
+  if (reason === 'timeout') {
+    return { error: `${toolName}: 사람의 답이 없었다(시한 초과) — 실행하지 않았다. 사용자에게 한 줄로 알려라 (tool not run: approval ${reason})` };
+  }
+  const why = reason === 'cancelled' ? '승인 요청이 취소됐다' : '승인을 받지 못했다';
+  return { error: `${toolName}: ${why} — 실행하지 않았다 (tool not run: approval ${reason})` };
+}
+
+/** One policy per ACP server: grants are scoped to the session AND exact tool
+ * name, not to a turn, connection, argument set, or other session. */
+export function createAcpSessionApprovalPolicy(): {
+  resolve: (
+    sessionId: string,
+    request: Parameters<AcpTurnContext['requestApproval']>[0],
+    requestApproval: AcpTurnContext['requestApproval'],
+    rejectedThisTurn?: Set<string>,
+  ) => Promise<AcpToolApprovalResult>;
+  clearSession: (sessionId: string) => void;
+} {
+  const alwaysAllowed = new Map<string, Set<string>>();
+  const sessionGenerations = new Map<string, number>();
+  const observe = (event: 'requested' | 'decided' | 'timeout' | 'remembered', sessionId: string, tool: string, outcome?: string) => {
+    // Tool arguments are deliberately not logged.
+    debug.log('acp.approval', event, { sessionId, tool, ...(outcome !== undefined ? { outcome } : {}) });
+  };
+  // Same-turn calls to one tool are asked one at a time, so a concurrent second call sees the first's denial
+  // instead of opening a second sheet (round 1 should-fix).
+  const turnInflight = new WeakMap<Set<string>, Map<string, Promise<void>>>();
+  const decide = async (
+    sessionId: string,
+    request: Parameters<AcpTurnContext['requestApproval']>[0],
+    requestApproval: AcpTurnContext['requestApproval'],
+    rejectedThisTurn?: Set<string>,
+  ): Promise<AcpToolApprovalResult> => {
+      if (rejectedThisTurn?.has(request.toolName)) {
+        debug.log('acp.approval', 'repeat-denied', { sessionId, tool: request.toolName });
+        return { allowed: false, reason: 'rejected' };
+      }
+      if (alwaysAllowed.get(sessionId)?.has(request.toolName)) {
+        observe('remembered', sessionId, request.toolName, 'allow-always');
+        return { allowed: true };
+      }
+      const generation = sessionGenerations.get(sessionId) ?? 0;
+      observe('requested', sessionId, request.toolName);
+      let decision: AcpApprovalDecision;
+      try {
+        decision = await requestApproval(request);
+      } catch {
+        observe('decided', sessionId, request.toolName, 'error');
+        return { allowed: false, reason: 'error' };
+      }
+      observe(decision === 'timeout' ? 'timeout' : 'decided', sessionId, request.toolName, decision);
+      if (generation !== (sessionGenerations.get(sessionId) ?? 0)) return { allowed: false, reason: 'cancelled' };
+      if (decision === 'allow-always') {
+        let tools = alwaysAllowed.get(sessionId);
+        if (!tools) {
+          tools = new Set();
+          alwaysAllowed.set(sessionId, tools);
+        }
+        tools.add(request.toolName);
+      }
+      if (decision === 'allow-once' || decision === 'allow-always') return { allowed: true };
+      if (decision === 'deny-once' || decision === 'deny-always') rejectedThisTurn?.add(request.toolName);
+      return {
+        allowed: false,
+        reason: decision === 'timeout' ? 'timeout' : decision === 'cancelled' ? 'cancelled' : 'rejected',
+      };
+  };
+  return {
+    async resolve(sessionId, request, requestApproval, rejectedThisTurn) {
+      if (!requiresAcpToolApproval(request.toolName)) return { allowed: true };
+      if (!rejectedThisTurn) return decide(sessionId, request, requestApproval);
+      let inflight = turnInflight.get(rejectedThisTurn);
+      if (!inflight) {
+        inflight = new Map();
+        turnInflight.set(rejectedThisTurn, inflight);
+      }
+      const prior = inflight.get(request.toolName);
+      let release!: () => void;
+      const mine = new Promise<void>((done) => { release = done; });
+      const chained = (prior ?? Promise.resolve()).then(() => mine);
+      inflight.set(request.toolName, chained);
+      try {
+        if (prior) await prior;
+        return await decide(sessionId, request, requestApproval, rejectedThisTurn);
+      } finally {
+        release();
+        if (inflight.get(request.toolName) === chained) inflight.delete(request.toolName);
+      }
+    },
+    clearSession(sessionId) {
+      alwaysAllowed.delete(sessionId);
+      sessionGenerations.set(sessionId, (sessionGenerations.get(sessionId) ?? 0) + 1);
+    },
+  };
+}

package/src/acp/turn-runner.ts

@@ -40,6 +40,11 @@ import { unsafeBrandSessionUri } from '../mss/uri/brand.js';
 import { debug } from '../debug/log.js';
 import type { AgentStatusStore } from '../agent-status/store.js';
 import type { AcpPermissionApprover, AcpQuestionApprover } from './client.js';
+import {
+  CODEX_APPROVAL_OPT_ONCE,
+  CODEX_APPROVAL_OPT_REJECT,
+  CODEX_APPROVAL_QUESTION_ID,
+} from './codex-approval-adapter.js';
 import type { ConfirmChannel } from '../hitl/confirm.js';
 import type { QuestionChannel } from '../hitl/question.js';
 import {
@@ -69,6 +74,7 @@ import { getUserConfig } from '../user-config.js';
 // ACP `cancelled`), matching the pre-existing default-deny posture for
 // unattended turns — so nothing hangs when a surface opts out.
 const turnHitlChannels = new Map<string, ConfirmChannel[]>();
+const turnPermissionApprovers = new Map<string, AcpPermissionApprover>();
 /** Parallel registry for multi-option question channels (same keying
  *  as `turnHitlChannels`). Present ⇒ the question approver fans out
  *  real N-option prompts; absent ⇒ it falls back to yes/no collapse
@@ -81,6 +87,8 @@ const turnHitlQuestionChannels = new Map<string, QuestionChannel[]>();
 const HITL_TURN_TIMEOUT_MS = 120_000;
 
 const surfacePermissionApprover: AcpPermissionApprover = async (req) => {
+  const turnApprover = turnPermissionApprovers.get(req.sessionId);
+  if (turnApprover) return turnApprover(req);
   // Autonomous by default: edit/command PERMISSIONS auto-approve. Asking the
   // human to approve every write defeats delegation (the interactive-editor
   // paradigm ACP inherited doesn't fit autonomous telegram delegation).
@@ -102,7 +110,31 @@ const surfacePermissionApprover: AcpPermissionApprover = async (req) => {
   return answer;
 };
 
+/** PCH-2b — answer codex's 3-way approval question with a yes/no permission
+ *  approver. Returns null when the request is not that question. */
+export async function answerCodexApprovalQuestion(
+  req: Parameters<AcpQuestionApprover>[0],
+  approver: AcpPermissionApprover,
+): Promise<Awaited<ReturnType<AcpQuestionApprover>> | null> {
+  const q = req.questions[0];
+  if (req.questions.length !== 1 || q?.id !== CODEX_APPROVAL_QUESTION_ID) return null;
+  const approved = await approver({
+    backendId: req.backendId,
+    sessionId: req.sessionId,
+    title: q.question,
+    options: [],
+  });
+  return { answers: { [q.id]: approved ? CODEX_APPROVAL_OPT_ONCE : CODEX_APPROVAL_OPT_REJECT } };
+}
+
 const surfaceQuestionApprover: AcpQuestionApprover = async (req) => {
+  // PCH-2b — an ACP server turn answers codex's approval question through its
+  // own client (yes/no), not the messenger HITL channels.
+  const turnApprover = turnPermissionApprovers.get(req.sessionId);
+  if (turnApprover) {
+    const answered = await answerCodexApprovalQuestion(req, turnApprover);
+    if (answered) return answered;
+  }
   const channels = turnHitlChannels.get(req.sessionId);
   if (!channels || channels.length === 0) return { answers: {}, cancelled: true };
   // When the surface provided real multi-option QuestionChannels, fan
@@ -306,6 +338,8 @@ export interface RunAcpTurnOpts {
   cwd?: string;
   /** Session-scoped Codex app-server configuration arguments. */
   codexArgs?: readonly string[];
+  /** ACP server turn's permission request, routed through its client rather than the messenger HITL channel. */
+  permissionApprover?: AcpPermissionApprover;
   /** Soft focus budget (tool-turns) for a TARGETED slash invocation
    *  (`/cc`·/cdx·/gem). When set, a tight-budget directive is prepended
    *  to the prompt so the sub-agent stays focused (minimize re-reads /
@@ -663,6 +697,7 @@ export async function runAcpTurn(opts: RunAcpTurnOpts): Promise<RunAcpTurnResult
   // session id (== the `req.sessionId` seen in requestPermission).
   const hasHitl = !!opts.hitlConfirmChannels && opts.hitlConfirmChannels.length > 0;
   if (hasHitl) turnHitlChannels.set(sessionId, opts.hitlConfirmChannels!);
+  if (opts.permissionApprover) turnPermissionApprovers.set(sessionId, opts.permissionApprover);
   const hasHitlQuestions = !!opts.hitlQuestionChannels && opts.hitlQuestionChannels.length > 0;
   if (hasHitlQuestions) turnHitlQuestionChannels.set(sessionId, opts.hitlQuestionChannels!);
 
@@ -784,6 +819,7 @@ export async function runAcpTurn(opts: RunAcpTurnOpts): Promise<RunAcpTurnResult
   } finally {
     inFlightTurns.delete(key);
     if (hasHitl) turnHitlChannels.delete(sessionId);
+    if (opts.permissionApprover) turnPermissionApprovers.delete(sessionId);
     if (hasHitlQuestions) turnHitlQuestionChannels.delete(sessionId);
   }
 }

package/src/agent/monad-agent-turn.ts

@@ -26,6 +26,7 @@ import { buildAutonomousToolSpecs, dispatchAutonomousTool, isAutonomousTool, del
 import { isToolSearchCall, routeToolSearch } from '../skills/tools/tool-search-route.js';
 import { financeEnabled, financeAgentSystemPrompt, marketClock } from '../domains/finance.js';
 import { buildFinanceTools } from '../domains/finance-tools.js';
+import { dispatchReleaseChange } from '../domains/release-tool.js';
 import { surfaceEventsDbPath, openSurfaceEventsDb, recentSentDigest, recordInboundTurn } from '../domains/surface-events.js';
 import { elanousSelfAccessPrompt, elanousSelfAmbientParts } from './self-ambient.js';
 import { localRefGroundingAmbient } from './ref-grounding.js';
@@ -188,6 +189,13 @@ export function makeElanousAgentRunTurn(cfg: UserConfig, surface: SessionSource,
           },
         });
       }
+      if (name === 'release_change') {
+        return dispatchReleaseChange(args, {
+          surface: 'chat', sessionId: opts.sessionId,
+          ...(opts.verifiedOwner ? { verifiedOwner: opts.verifiedOwner } : {}),
+          ...(surfaceChannels ? { confirmChannels: surfaceChannels } : {}),
+        });
+      }
       // Thread the turn's abort signal so a long in-flight Bash is killed by
       // `/cancel` (dispatchBash SIGTERMs its child on abort).
       return baseDispatch(name, args, opts.signal);

package/src/ask-user-question/pending-questions.ts

@@ -3,16 +3,13 @@ import { join } from 'node:path';
 
 import { elanousStateRoot } from '../autopilot/state-paths.js';
 import { ASK_USER_QUESTION_DELIVERY_VALUES } from './types.js';
-import type { AskUserQuestionRequest, AskUserQuestionResult, HitlDelivery, QuestionOption } from './types.js';
+import type { AskUserQuestionRequest, AskUserQuestionResult, HitlDelivery, Question, QuestionOption } from './types.js';
 
-interface PendingQuestion {
+export interface PendingQuestion {
   id: string;
   sessionId?: string;
-  questions: Array<{
-    id: string;
-    question: string;
-    options: QuestionOption[];
-  }>;
+  runId?: string;
+  questions: Array<Pick<Question, 'id' | 'question' | 'options' | 'impact' | 'recommendedIndex'>>;
   startedAt: string;
   expiresAt?: string;
   surface: 'tui' | 'file';
@@ -86,6 +83,7 @@ function isPendingQuestion(value: unknown): value is PendingQuestion {
   const pending = value as Record<string, unknown>;
   return typeof pending.id === 'string'
     && (pending.sessionId === undefined || typeof pending.sessionId === 'string')
+    && (pending.runId === undefined || typeof pending.runId === 'string')
     && Array.isArray(pending.questions)
     && pending.questions.every((question) => {
       if (question === null || typeof question !== 'object' || Array.isArray(question)) return false;
@@ -93,7 +91,10 @@ function isPendingQuestion(value: unknown): value is PendingQuestion {
       return typeof record.id === 'string'
         && typeof record.question === 'string'
         && Array.isArray(record.options)
-        && record.options.every(isQuestionOption);
+        && record.options.every(isQuestionOption)
+        && (record.impact === undefined || record.impact === 'low' || record.impact === 'medium' || record.impact === 'high' || record.impact === 'critical')
+        && (record.recommendedIndex === undefined || (typeof record.recommendedIndex === 'number'
+          && Number.isInteger(record.recommendedIndex)));
     })
     && isIsoTimestamp(pending.startedAt)
     && (pending.surface === 'tui' || pending.surface === 'file')
@@ -111,7 +112,15 @@ function isPendingQuestion(value: unknown): value is PendingQuestion {
 function parsePendingQuestion(contents: string, file: string): PendingQuestion {
   const value: unknown = JSON.parse(contents);
   if (!isPendingQuestion(value)) throw new Error(`Invalid pending question record: ${file}`);
-  return value;
+  return {
+    ...value,
+    questions: value.questions.map((question) => ({
+      ...question,
+      ...(question.recommendedIndex !== undefined
+        && (question.recommendedIndex < 0 || question.recommendedIndex >= question.options.length)
+        ? { recommendedIndex: undefined } : {}),
+    })),
+  };
 }
 
 export function isAskUserQuestionResult(value: unknown): value is AskUserQuestionResult {
@@ -176,7 +185,13 @@ export function createPendingQuestion(
   return {
     id,
     ...(sessionId === undefined ? {} : { sessionId }),
-    questions: request.questions.map(({ id, question, options }) => ({ id, question, options })),
+    ...(request.runId === undefined ? {} : { runId: request.runId }),
+    questions: request.questions.map(({ id, question, options, impact, recommendedIndex }) => ({
+      id, question, options,
+      ...(impact === undefined ? {} : { impact }),
+      ...(recommendedIndex !== undefined && Number.isInteger(recommendedIndex) && recommendedIndex >= 0 && recommendedIndex < options.length
+        ? { recommendedIndex } : {}),
+    })),
     startedAt: (deps.now ?? (() => new Date()))().toISOString(),
     ...(presentation.expiresAt === undefined ? {} : { expiresAt: presentation.expiresAt }),
     surface: presentation.surface,

package/src/ask-user-question/types.ts

@@ -13,6 +13,7 @@
 // behaviour exactly.
 
 import type { HitlDelivery } from '../hitl/types.js';
+import type { ClarificationImpact } from '../hitl/clarification-policy.js';
 export type { HitlDelivery };
 
 export interface QuestionOption {
@@ -37,6 +38,9 @@ export interface Question {
   question: string;
   /** 2–4 pre-defined choices. */
   options: QuestionOption[];
+  impact?: ClarificationImpact;
+  /** Zero-based position in options; an out-of-range value is ignored. */
+  recommendedIndex?: number;
   /** When true, user can pick more than one option; Space toggles,
    *  Enter submits. Default false. */
   multiSelect?: boolean;
@@ -49,6 +53,7 @@ export interface Question {
 
 export interface AskUserQuestionRequest {
   questions: Question[];   // 1–3
+  runId?: string;
   /** AXON F4 — optional routing hint. When set, callers with HITL
    *  resolvers can fan the prompt out to Telegram/Discord/etc;
    *  omitted (or `'modal'` / `'terminal'`) keeps the existing TUI
@@ -165,6 +170,9 @@ export function parseQuestionRequest(
       header,
       question,
       options,
+      ...(item.impact === 'low' || item.impact === 'medium' || item.impact === 'high' || item.impact === 'critical' ? { impact: item.impact } : {}),
+      ...(typeof item.recommendedIndex === 'number' && Number.isInteger(item.recommendedIndex)
+        && item.recommendedIndex >= 0 && item.recommendedIndex < options.length ? { recommendedIndex: item.recommendedIndex } : {}),
       multiSelect: item.multiSelect === true,
       includeOther: item.includeOther !== false,  // default true
     });
@@ -186,5 +194,6 @@ export function parseQuestionRequest(
 
   const req: AskUserQuestionRequest = { questions: parsed };
   if (delivery !== undefined) req.delivery = delivery;
+  if (typeof raw.runId === 'string') req.runId = raw.runId;
   return { ok: true, req };
 }

package/src/auth/setup-link-tokens.ts

@@ -74,15 +74,26 @@ function writeStore(dir: string, tokens: SetupLinkEntry[]): void {
 
 // A persistent inode and an OS advisory lock avoid stale owner files after an abrupt process exit.
 // Never unlink this file: a replacement inode would let two processes hold different locks.
-const libc = dlopen(process.platform === 'darwin' ? '/usr/lib/libSystem.B.dylib' : 'libc.so.6', {
-  flock: { args: [FFIType.i32, FFIType.i32], returns: FFIType.i32 },
-});
+// Loaded on first use, not at import: libc.so.6 does not exist on Windows and this module sits on the CLI start path (WIN2 10-02).
+type Flock = (fd: number, op: number) => number;
+let flockFn: Flock | null | undefined;
+function osFlock(): Flock | null {
+  if (flockFn !== undefined) return flockFn;
+  if (process.platform === 'win32') return (flockFn = null);
+  const lib = dlopen(process.platform === 'darwin' ? '/usr/lib/libSystem.B.dylib' : 'libc.so.6', {
+    flock: { args: [FFIType.i32, FFIType.i32], returns: FFIType.i32 },
+  });
+  return (flockFn = lib.symbols.flock as Flock);
+}
 const LOCK_EX = 2;
 const LOCK_NB = 4;
 const LOCK_UN = 8;
 
 function withLock<T>(dir: string, fn: () => T): T {
   mkdirSync(dir, { recursive: true, mode: 0o700 });
+  const flock = osFlock();
+  // Windows: no advisory flock and no POSIX modes — the store still writes by atomic rename.
+  if (!flock) return fn();
   const lock = `${storePath(dir)}.lock`;
   const fd = openSync(lock, constants.O_CREAT | constants.O_RDWR | constants.O_NOFOLLOW, 0o600);
   try {
@@ -92,7 +103,7 @@ function withLock<T>(dir: string, fn: () => T): T {
       throw new Error('setup link lock must be a private regular file (0600)');
     }
     const until = Date.now() + 3000;
-    while (libc.symbols.flock(fd, LOCK_EX | LOCK_NB) !== 0) {
+    while (flock(fd, LOCK_EX | LOCK_NB) !== 0) {
       if (Date.now() > until) throw new Error('setup link store is locked — try again');
       Bun.sleepSync(20);
     }
@@ -101,7 +112,7 @@ function withLock<T>(dir: string, fn: () => T): T {
       if (stat.ino !== locked.ino || stat.dev !== locked.dev) throw new Error('setup link lock changed');
       return fn();
     } finally {
-      libc.symbols.flock(fd, LOCK_UN);
+      flock(fd, LOCK_UN);
     }
   } finally {
     closeSync(fd);

package/src/autopilot/build/integrity-gate.ts

@@ -255,6 +255,7 @@ const STEP_CMDS: Record<GateStepName, { cmd: string; args: string[]; timeoutMs:
   'cli-smoke': { cmd: 'bun', args: ['bin/elanous.mjs', '--help'], timeoutMs: 60_000 },
 };
 
+const DEPENDENCY_INSTALL_TIMEOUT_MS = 300_000;
 const MAX_LOGGED_TEST_FILTERS = 6;
 
 /** Platform runners own Kotlin/Swift execution; Bun must never receive their paths as test filters. */
@@ -289,6 +290,17 @@ export async function runIntegrityGate(
   const runCmd = opts.runCmd ?? createRunCmd();
   const results: GateStep[] = [];
   const logs: string[] = [];
+  // A Pod worktree has no node_modules unless the child happened to install them (the Pod clone has none to link), and Bun
+  // then auto-installs at import time — «Unexpected while resolving package 'commander'» failed cli-smoke as an
+  // «environment deficiency» three times on 10-02 (#22849 · #22919). Install from the lockfile before measuring instead.
+  if (steps.length > 0 && existsSync(join(cwd, 'bin', 'elanous.mjs')) && existsSync(join(cwd, 'bun.lock'))
+      && !existsSync(join(cwd, 'node_modules', 'commander', 'package.json'))) {
+    const install = await runCmd('bun', ['install', '--frozen-lockfile'], cwd, DEPENDENCY_INSTALL_TIMEOUT_MS);
+    const installed = install.code === 0 && !install.timedOut;
+    debug.log('gate.deps', 'install', { installed, code: install.code, timedOut: install.timedOut });
+    const tail = (install.stderr || install.stdout).split('\n').filter(Boolean).slice(-2).join(' | ').slice(0, 200);
+    logs.push(`[deps] ${installed ? 'INSTALLED' : 'FAIL'} bun install --frozen-lockfile — node_modules/commander was missing${installed ? '' : `: ${tail}`}`);
+  }
   let passed = true;
   let testPassCount: number | undefined;
   let sawPassCountRegression = false;

package/src/boot/daemon-prompt-turn.ts

@@ -107,6 +107,8 @@ export async function runDaemonPromptTurn(opts: {
   surfaceResolutionReason?: SurfaceKindResolutionReason;
   /** Optional confirm channels for the triggering chat surface. */
   surfaceHitlChannels?: ConfirmChannel[];
+  /** Server-authenticated human owner for this request; absent for delegated or unverified callers. */
+  verifiedOwner?: { id: string };
   /** Optional structured-question channels for the triggering chat surface. */
   surfaceQuestionChannels?: QuestionChannel[];
   /** CWD for fs-bound tool dispatch (Read / Grep). Defaults to
@@ -226,6 +228,7 @@ export async function runDaemonPromptTurn(opts: {
             ...(request.source?.kind === 'daemon-api' && request.source.route === '/a2a'
               ? { requestOrigin: 'external-agent' as const } : {}),
             ...(request.userText ? { userText: request.userText } : {}),
+            ...(opts.verifiedOwner ? { verifiedOwner: opts.verifiedOwner } : {}),
             ...(opts.surface !== undefined || sourceResolution.surface !== 'unknown' ? { surface } : {}),
             ...(opts.surfaceHitlChannels ? { surfaceHitlChannels: opts.surfaceHitlChannels } : {}),
             ...(opts.surfaceQuestionChannels ? { surfaceQuestionChannels: opts.surfaceQuestionChannels } : {}),

package/src/boot/daemon-tools/index.ts

@@ -16,6 +16,8 @@ import {
   dispatchBrowserRead,
 } from '../../tool-runtime/browser-runtime.js';
 import { askUserQuestionRuntime } from '../../tool-runtime/ask-user-question-runtime.js';
+import { buildElanousHoldTool, buildPtyControlTool, dispatchElanousHold, dispatchPtyControl } from '../../tool-runtime/elanous-control-runtimes.js';
+import { ptyAvailable } from '../../pty-shell/registry.js';
 import { dispatchToolByName, listToolRuntimes } from '../../tool-runtime/registry.js';
 import { ACP_SESSION_RUNTIMES } from '../../tool-runtime/acp-session-runtime.js';
 import { ClaudeSubscriptionNotAllowedError } from '../../policy/claude-subscription-guard.js';
@@ -340,6 +342,7 @@ export function toolSurface(kind: DaemonToolSurfaceKind, cfg?: import('../../use
     askUserQuestionRuntime.spec,
     ...ACP_SESSION_RUNTIMES.map((runtime) => runtime.spec),
     ...shared.specs, // L2 core + L3 finance(gated) — buildSharedAppTools 단일 출처(전 서피스 공용)
+    ...(ptyAvailable() ? [buildElanousHoldTool(), buildPtyControlTool()] : []),
   ];
 
   /** Shared dispatcher for chat-surface tools. Reused by 'chat' AND
@@ -392,11 +395,16 @@ export function toolSurface(kind: DaemonToolSurfaceKind, cfg?: import('../../use
       // L2 core + L3 finance(gated) — buildSharedAppTools 단일 dispatch · B5: 진행 한 줄(emitFeedback)·세션·호출 id 를 넘긴다.
       return shared.dispatch(name, args, {
         surface: 'tui',
+        ...(ctx.requestOrigin ? { requestOrigin: ctx.requestOrigin } : {}),
+        ...(ctx.verifiedOwner ? { verifiedOwner: ctx.verifiedOwner } : {}),
         ...(ctx.sessionId ? { sessionId: ctx.sessionId } : {}),
+        ...(ctx.surfaceHitlChannels ? { confirmChannels: ctx.surfaceHitlChannels } : {}),
         ...(ctx.toolCallId ? { toolCallId: ctx.toolCallId } : {}),
         ...(ctx.emitFeedback ? { emitFeedback: ctx.emitFeedback } : {}),
       });
     }
+    if (ptyAvailable() && name === 'ElanousHold') return dispatchElanousHold(args);
+    if (ptyAvailable() && name === 'PtyControl') return dispatchPtyControl(args);
     if (name === 'Bash') {
       // PLAN-ios-rich-dev-feedback-hydrate M3 (2026-05-13) — pass
       // sessionId + emitFeedback so dispatchBash emits tool.progress

package/src/boot/daemon-tools/types.ts

@@ -61,6 +61,8 @@ export interface DaemonToolDispatchCtx {
   sessionId?: string;
   /** Trusted server-side classification of the current turn, never supplied as a tool argument. */
   requestOrigin?: RequestOrigin;
+  /** Owner principal verified at the server request boundary, not from input source metadata. */
+  verifiedOwner?: { id: string };
   /** Ingestion entry class. Omit for conservative external-verbatim fallback. */
   entry?: IngestionEntry;
   /** M5 PR 2 (PLAN-rich-dev-feedback-multi-surface · 2026-05-13) —

package/src/boot/daemon-tools/web-search.ts

@@ -41,6 +41,7 @@ export function buildWebSearchTool(): LLMToolSpec {
       'Search the public web via the daemon\'s configured provider (Grok / ' +
       'Firecrawl / etc.). When no key is available, falls back to keyless DuckDuckGo. ' +
       'Returns a ranked list of URLs + titles + snippets. ' +
+      'For fact questions, answer directly from the snippets and URLs; read the full body only when insufficient. ' +
       'Pair with a follow-up Read or external WebFetch when the model needs ' +
       'the full article body.',
     parameters: {