elanous 0.2.9 → 0.2.11

package/skills/youtube-master/tsconfig.json

@@ -0,0 +1,13 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "outDir": "dist",
+    "rootDir": "."
+  },
+  "include": ["src/**/*.ts", "scripts/**/*.ts"]
+}

package/src/acp/codex-approval-adapter.ts

@@ -103,6 +103,12 @@ export interface CodexApprovalAdapter {
   onMcpToolCall(req: CodexMcpToolCallRequest): Promise<CodexApprovalDecision>;
 }
 
+/** The 3-way approval question's id and labels — exported so a surface that
+ *  answers approvals by yes/no (an ACP turn's client) can recognise it. */
+export const CODEX_APPROVAL_QUESTION_ID = 'codex_approval';
+export const CODEX_APPROVAL_OPT_ONCE = 'Allow once';
+export const CODEX_APPROVAL_OPT_REJECT = 'Reject';
+
 /** Build a CodexApprovalAdapter. Intentionally minimal in Phase 3.A —
  *  the handlers degrade gracefully when no approver is attached, and
  *  the Phase 3.B app-server client will hook these methods up with real
@@ -131,10 +137,10 @@ export function createCodexApprovalAdapter(
   // multi-option question path is used. "Allow for session" maps to codex
   // `acceptForSession` so the sub-agent stops re-prompting for the rest of
   // the run.
-  const OPT_ONCE = 'Allow once';
+  const OPT_ONCE = CODEX_APPROVAL_OPT_ONCE;
   const OPT_SESSION = 'Allow for session';
-  const OPT_REJECT = 'Reject';
-  const APPROVAL_QID = 'codex_approval';
+  const OPT_REJECT = CODEX_APPROVAL_OPT_REJECT;
+  const APPROVAL_QID = CODEX_APPROVAL_QUESTION_ID;
 
   /** Ask the user via the MULTI-OPTION question channel: Allow once /
    *  Allow for session / Reject. Returns the scoped decision. Only called

package/src/acp/core-turn-bridge.ts

@@ -46,7 +46,11 @@ import { getUserConfig } from '../user-config.js';
 import { getModelFamily } from '../models/prompts.js';
 import { resolveModelContextWindow } from '../models/context-window.js';
 import type { AcpServerOptions, AcpTurnContext } from './server.js';
+import { acpToolDenialResult } from './tool-approval.js';
 import { readOriginSessionMeta } from './origin-session-meta.js';
+import { isFactQuestion } from './fact-question.js';
+
+const FACT_QUESTION_INSTRUCTION = '사실·최신 정보 질문이다. WebSearch 를 1~2회 쓰고 검색 결과(제목·스니펫·URL)로 답하라. 출처 링크를 붙여라. 셸·브라우저·파일 도구는 검색 결과로 부족할 때만. 도구 예산에 닿으면 지금까지 근거로 답하고 끝에 «더 찾아볼까요?»를 붙여라.';
 
 export interface CoreTurnBridgeDeps {
   /** Build the seed message list for this ACP prompt. Implementations
@@ -112,6 +116,28 @@ export interface CoreTurnBridgeDeps {
  *  pegging the event loop. */
 export const DEFAULT_BRIDGE_ABORT_POLL_MS = 50;
 
+/** PCH-2b — ask the ACP client before a write/shell tool runs. A denied,
+ *  cancelled or timed-out tool is not run; the LLM gets a «not run» result. */
+export function acpApprovalGatedDispatch(
+  turnCtx: AcpTurnContext,
+  dispatchTool: CoreTurnDispatchTool,
+  signal: AbortSignal,
+): CoreTurnDispatchTool {
+  const approveTool = turnCtx.approveTool;
+  if (!approveTool) return dispatchTool;
+  return async (name, args, dispatchCtx) => {
+    if (signal.aborted || turnCtx.isAborted()) return acpToolDenialResult(name, 'cancelled');
+    const approval = await approveTool({
+      toolCallId: dispatchCtx?.callId ?? `${name}-${Date.now().toString(36)}`,
+      toolName: name,
+      toolArgs: args,
+    });
+    if (!approval.allowed) return acpToolDenialResult(name, approval.reason);
+    if (signal.aborted || turnCtx.isAborted()) return acpToolDenialResult(name, 'cancelled');
+    return dispatchTool(name, args, dispatchCtx);
+  };
+}
+
 /** Extract the trailing assistant message text from runCoreTurn's
  *  `newMessages` array. emitTurnComplete (src/llm.ts:3835) appends
  *  `{role:'assistant', content:[{type:'text', text:finalAssistantText}]}`
@@ -173,7 +199,23 @@ export function bridgeCoreTurnToAcp(
         }),
       );
       const modelOverride = deps.resolveModel?.({ sessionId: turnCtx.sessionId, userText: turnCtx.userText });
-      const maxToolTurns = deps.resolveMaxToolTurns?.({ sessionId: turnCtx.sessionId });
+      const factQuestion = isFactQuestion(turnCtx.userText);
+      const explicitMaxToolTurns = deps.resolveMaxToolTurns?.({ sessionId: turnCtx.sessionId });
+      const maxToolTurns = explicitMaxToolTurns ?? (factQuestion ? getUserConfig().chat.factQuestion.maxToolTurns : undefined);
+      const turnMessages: LLMMessage[] = factQuestion
+        ? [{ role: 'system', content: FACT_QUESTION_INSTRUCTION }, ...messages]
+        : messages;
+      let toolCallCount = 0;
+      const toolKinds = new Set<string>();
+      const observeToolBudget = () => {
+        try {
+          debug.log('chat.turn', 'tool-budget', {
+            factQuestion, maxToolTurns: maxToolTurns ?? null,
+            count: toolCallCount, kinds: [...toolKinds],
+          });
+        } catch { /* observation cannot interrupt a turn */ }
+      };
+      observeToolBudget();
 
       // 2026-05-03 PM++ — Track streamed text so onTurnComplete can
       // detect runtime-injected synthesis (W5-E/W5-F/W5-G) and surface
@@ -235,17 +277,29 @@ export function bridgeCoreTurnToAcp(
       } catch {
         // Observability must not prevent the turn from reaching its dispatcher.
       }
+      const approvedDispatch = acpApprovalGatedDispatch(turnCtx, deps.dispatchTool, ctrl.signal);
+      const dispatchTool: CoreTurnDispatchTool = factQuestion && maxToolTurns !== undefined && maxToolTurns > 0
+        ? async (name, args, dispatchCtx) => {
+            if (toolCallCount >= maxToolTurns) {
+              return { error: 'Tool budget reached. Answer using the evidence already collected.' };
+            }
+            toolCallCount += 1;
+            toolKinds.add(name);
+            observeToolBudget();
+            return approvedDispatch(name, args, dispatchCtx);
+          }
+        : approvedDispatch;
       await runTurnDispatch({
         sessionId: turnCtx.sessionId,
         ...(originSessionId ? { originSessionId } : {}),
         ...(turnCtx.userText ? { userText: turnCtx.userText } : {}),
-        messages,
+        messages: turnMessages,
         tools,
-        dispatchTool: deps.dispatchTool,
+        dispatchTool,
         signal: ctrl.signal,
         ...(modelOverride !== undefined ? { modelOverride } : {}),
         ...(maxToolTurns !== undefined ? { maxToolTurns } : {}),
-        ...(deps.budgetGrant !== undefined ? { budgetGrant: deps.budgetGrant } : {}),
+        ...((!factQuestion || explicitMaxToolTurns !== undefined) && deps.budgetGrant !== undefined ? { budgetGrant: deps.budgetGrant } : {}),
         callbacks: {
           onText: (delta) => {
             // Fire-and-forget: ACP `push` is async but the core-turn
@@ -262,7 +316,14 @@ export function bridgeCoreTurnToAcp(
           // callers see today. Fire-and-forget for the same reason
           // onText is: callbacks are synchronous, `turnCtx.push*` is
           // async, ordering is preserved by the SDK.
-          onToolCall: (call) => { void turnCtx.pushToolCall(call); },
+          onToolCall: (call) => {
+            if (!factQuestion || maxToolTurns === undefined || maxToolTurns <= 0) {
+              toolCallCount += 1;
+              toolKinds.add(call.name);
+              observeToolBudget();
+            }
+            void turnCtx.pushToolCall(call);
+          },
           onToolResult: (call) => { void turnCtx.pushToolResult(call); },
           onUsage: (usage) => { void turnCtx.pushUsage(usage); },
           // Codex Responses API reasoning summary stream. Currently
@@ -301,26 +362,64 @@ export function bridgeCoreTurnToAcp(
             // re-emit would cause the "displayed then deleted then
             // re-displayed" flicker the user reported.
             const finalAssistantText = extractLastAssistantText(newMessages);
-            const synthesisAlreadyStreamed =
-              finalAssistantText !== null
-              && finalAssistantText.length > 0
+            const budgetReached = factQuestion && maxToolTurns !== undefined
+              && maxToolTurns > 0 && toolCallCount >= maxToolTurns;
+            const followup = '더 찾아볼까요?';
+            const needsFollowup = budgetReached && finalAssistantText !== null
+              && finalAssistantText.trim().length > 0
+              && !finalAssistantText.trimEnd().endsWith(followup);
+            let lastAssistantIndex = -1;
+            for (let i = newMessages.length - 1; i >= 0; i--) {
+              if (newMessages[i]?.role === 'assistant') { lastAssistantIndex = i; break; }
+            }
+            const followupSuffix = `\n${followup}`;
+            const completedMessages: LLMMessage[] = needsFollowup
+              ? newMessages.map((message, index) => {
+                if (index !== lastAssistantIndex) return message;
+                if (typeof message.content === 'string') {
+                  return { ...message, content: message.content + followupSuffix };
+                }
+                if (Array.isArray(message.content)) {
+                  let lastTextIndex = -1;
+                  for (let blockIndex = message.content.length - 1; blockIndex >= 0; blockIndex--) {
+                    if (message.content[blockIndex]?.type === 'text') { lastTextIndex = blockIndex; break; }
+                  }
+                  if (lastTextIndex >= 0) {
+                    return { ...message, content: message.content.map((block, blockIndex) =>
+                      blockIndex === lastTextIndex && block.type === 'text'
+                        ? { ...block, text: block.text + followupSuffix }
+                        : block) };
+                  }
+                }
+                return message;
+              })
+              : newMessages;
+            const visibleFinalText = needsFollowup ? extractLastAssistantText(completedMessages) : finalAssistantText;
+            const originalFinalStreamed = needsFollowup && finalAssistantText !== null
               && streamedTextSum.endsWith(finalAssistantText);
+            const synthesisAlreadyStreamed =
+              visibleFinalText !== null
+              && visibleFinalText.length > 0
+              && streamedTextSum.endsWith(visibleFinalText);
             const needsReSurface =
-              finalAssistantText !== null
-              && finalAssistantText !== streamedTextSum
-              && !synthesisAlreadyStreamed;
-            if (debug.enabled && finalAssistantText !== null) {
+              visibleFinalText !== null
+              && visibleFinalText !== streamedTextSum
+              && !synthesisAlreadyStreamed
+              && !originalFinalStreamed;
+            if (debug.enabled && visibleFinalText !== null) {
               debug.log('llm.synthesis-surface', 'acp-bridge.surface-final-text', {
                 streamedChars: streamedTextSum.length,
-                finalChars: finalAssistantText.length,
-                delta: finalAssistantText.length - streamedTextSum.length,
+                finalChars: visibleFinalText.length,
+                delta: visibleFinalText.length - streamedTextSum.length,
                 startsWithStreamed: streamedTextSum.length > 0
-                  && finalAssistantText.startsWith(streamedTextSum),
+                  && visibleFinalText.startsWith(streamedTextSum),
                 endsWithStreamedTail: synthesisAlreadyStreamed,
                 needsReSurface,
               });
             }
-            if (needsReSurface) {
+            if (originalFinalStreamed) {
+              void turnCtx.push(followupSuffix);
+            } else if (needsReSurface) {
               // Emit a clear-then-replace pair so clients that follow
               // the empty-chunk-as-clear convention (dashboard plain
               // chat) reset their per-round buffer before receiving
@@ -329,12 +428,12 @@ export function bridgeCoreTurnToAcp(
               // would only have the new finalAssistantText delta to
               // work with anyway).
               void turnCtx.push('');
-              void turnCtx.push(finalAssistantText!);
+              void turnCtx.push(visibleFinalText!);
             }
             if (deps.onTurnComplete) {
               await deps.onTurnComplete({
                 sessionId: turnCtx.sessionId,
-                newMessages,
+                newMessages: completedMessages,
               });
             }
           },

package/src/acp/fact-question.ts

@@ -0,0 +1,11 @@
+export function isFactQuestion(userText: string): boolean {
+  const text = userText.trim();
+  if (!text || text.length > 120 || /[\r\n]/.test(text)) return false;
+  if (/`|\bsrc\/|(?:^|[\s/])[^\s/]+\.(?:ts|tsx|js|jsx|json|md|py|sh|yaml|yml)\b|고쳐|구현|실행|만들어|수정|디버그|파일|읽어|열어|저장|작성|삭제|편집|검색해|찾아줘|보여줘|\/cc\b|delegate_code_agent/i.test(text)) return false;
+  // A request («…해줘?», «재시작해», «restart …») is work, not a fact question — even with a «?» or «지금»(round 3: «지금 서버를 재시작해줘?»).
+  const request = text.replace(/알려\s*(?:줘|주세요|줄래|주실래요)[?？]?$/, '');
+  if (/(?:해|해\s*줘|해\s*주세요|하세요|해라|하자|줘|주세요|줄래|주실래요|봐|봐줘)[?？]?$/.test(request)) return false;
+  if (/재시작|시작|중지|멈춰|꺼|켜|설치|배포|돌려|보내|올려|지워|바꿔|추가|업데이트|재부팅|재실행|정리|등록|\b(?:restart|start|stop|run|install|deploy|delete|remove|create|update|fix|kill|reboot)\b/i.test(text)) return false;
+  if (!/[?？]$|(?:뭐야|무엇인가요|인가요|나요|입니까|얼마야|언제야|누구야|알려줘|알려주세요)$/.test(text)) return false;
+  return /최근|최신|지금|현재|몇|언제|누가|누구|얼마|가격|버전|출시|최저시급|\b(?:latest|current|when|who|how many|how much|price|version|release)\b/i.test(text);
+}

package/src/acp/server.ts

@@ -101,6 +101,8 @@ import { readOriginSessionMeta } from './origin-session-meta.js';
 import type { CodexPlugin } from './codex-plugins.js';
 import { flattenMcpServersToCodexConfig } from './codex-approval-adapter.js';
 import { runAcpTurn } from './turn-runner.js';
+import type { AcpPermissionApprovalRequest } from './client.js';
+import { createAcpSessionApprovalPolicy, type AcpToolApprovalResult } from './tool-approval.js';
 import { projectPwaToolResult, type ToolResultMeta } from '../nexus/api/meta-api.js';
 import type { LlmBrand } from '../llm-vision-capability.js';
 import {
@@ -233,9 +235,14 @@ export interface AcpServerOptions {
    *  receives the user message text and a push() for streaming back
    *  assistant chunks. When omitted, the server echoes the prompt. */
   runTurn?: (ctx: AcpTurnContext) => Promise<void>;
+  /** PCH-2b — ask the client before write/shell tools run ('ask', default).
+   *  'off' keeps the host's own approvals (the in-process TUI dashboard). */
+  toolApproval?: 'ask' | 'off';
   /** ACP standalone entry: require session cwd or an explicit boot default. */
   requireSessionToolCwd?: boolean;
   bootToolCwd?: string;
+  /** Optional PTY factory for the web terminal; production uses PreviewTerminal. */
+  createWebTerminal?: (opts: ConstructorParameters<typeof import('../preview/terminal.js').PreviewTerminal>[0]) => import('../preview/terminal.js').PreviewTerminal;
   /** Test seam for exercising stdio EOF with controlled byte streams. */
   stdioInput?: ReadableStream<Uint8Array>;
   stdioOutput?: WritableStream<Uint8Array>;
@@ -850,6 +857,8 @@ export interface AcpTurnContext {
     toolArgs?: Record<string, unknown>;
     timeoutMs?: number;
   }) => Promise<AcpApprovalDecision>;
+  /** The session-scoped gate used by core-turn tool dispatchers. */
+  approveTool?: (req: Parameters<AcpTurnContext['requestApproval']>[0]) => Promise<AcpToolApprovalResult>;
 }
 
 /** F1 — Phase 3 · resolved decision from `AcpTurnContext.requestApproval`.
@@ -866,6 +875,14 @@ export type AcpApprovalDecision =
  *  `_PERMISSION_DEFAULT_TIMEOUT_S`; overrideable per call. */
 export const DEFAULT_APPROVAL_TIMEOUT_MS = 60_000;
 
+export {
+  acpToolDenialResult,
+  createAcpSessionApprovalPolicy,
+  requiresAcpToolApproval,
+  type AcpToolApprovalResult,
+  type AcpToolDenialReason,
+} from './tool-approval.js';
+
 /** ACP streaming Phase E (PLAN-pwa-webterm-voice-control v1.2 · 2026-05-07) —
  *  module-level handle to the broadcaster owned by the active runAcpServer
  *  instance. The chat REST handler (`src/nexus/api/meta-api.ts handlePromptStreamPost`)
@@ -991,6 +1008,7 @@ interface AcpServerContext {
   /** One skip diagnostic per session, cleared when its last peer leaves. */
   plainEnvelopeLogged: Set<string>;
   dualRole: DualRoleManager;
+  approvalPolicy: ReturnType<typeof createAcpSessionApprovalPolicy>;
   /** Mints the unique suffix of a new session id. Injected so tests can
    *  pin it deterministically — production wires `mintAcpSessionToken`. */
   nextSessionToken: () => string;
@@ -1054,7 +1072,7 @@ function wireAcpConnection(
   stream: ReturnType<typeof ndJsonStream>,
   ctx: AcpServerContext,
 ): AgentSideConnection {
-  const { sessions, sessionPeers, awarePeers, plainEnvelopeLogged, dualRole, opts } = ctx;
+  const { sessions, sessionPeers, awarePeers, plainEnvelopeLogged, dualRole, approvalPolicy, opts } = ctx;
   // 2026-05-13 (M2 of AskUserQuestion cross-surface) — bound connection
   // widened to expose `extMethod` + `extNotification` (SDK's elanous
   // extension escape hatch). pushAskRequest / pushAskCancel route through
@@ -1771,7 +1789,9 @@ function wireAcpConnection(
         );
       };
       const requestApproval: AcpTurnContext['requestApproval'] = async (approvalReq) => {
-        const timeoutMs = approvalReq.timeoutMs ?? DEFAULT_APPROVAL_TIMEOUT_MS;
+        const timeoutMs = approvalReq.timeoutMs
+          ?? (await import('../user-config.js')).getUserConfig().acp.toolApproval?.timeoutMs
+          ?? DEFAULT_APPROVAL_TIMEOUT_MS;
         const optionBase = `${approvalReq.toolCallId}-`;
         const options = [
           { optionId: `${optionBase}allow-once`, name: 'Allow once', kind: 'allow_once' as const },
@@ -1787,6 +1807,8 @@ function wireAcpConnection(
           },
           options,
         });
+        // A late rejection after the timeout won the race must not go unhandled.
+        permissionPromise.catch(() => undefined);
         let timer: ReturnType<typeof setTimeout> | null = null;
         const timeoutPromise = new Promise<'timeout'>((resolve) => {
           timer = setTimeout(() => resolve('timeout'), timeoutMs);
@@ -1972,6 +1994,7 @@ function wireAcpConnection(
         }
       }
 
+      const rejectedThisTurn = new Set<string>();
       const turnCtx: AcpTurnContext = {
         sessionId: req.sessionId,
         cwd: s.cwd,
@@ -1987,6 +2010,10 @@ function wireAcpConnection(
         pushSessionUpdate,
         pushUsage,
         requestApproval,
+        ...(opts.toolApproval !== 'off'
+          ? { approveTool: (approvalReq: Parameters<AcpTurnContext['requestApproval']>[0]) =>
+              approvalPolicy.resolve(req.sessionId, approvalReq, requestApproval, rejectedThisTurn) }
+          : {}),
       };
 
       // RC — intercept hook runs first. Lets the host treat the
@@ -2020,6 +2047,20 @@ function wireAcpConnection(
             chatId: req.sessionId,
             cwd: s.cwd,
             codexArgs: s.codexArgs,
+            ...(turnCtx.approveTool ? {
+              // PCH-2b — codex asks this turn's ACP client instead of auto-approving.
+              permissionApprover: async (approvalReq: AcpPermissionApprovalRequest) => {
+                if (s.aborted) return false;
+                const decision = await turnCtx.approveTool!({
+                  toolCallId: `codex-${randomBytes(6).toString('hex')}`,
+                  // «codex exec» · «codex network» · «codex mcp» — allow-always is per kind.
+                  toolName: /^codex [a-z]+/.exec(approvalReq.title)?.[0] ?? `codex ${approvalReq.kind ?? 'action'}`,
+                  ...(approvalReq.rawInput && typeof approvalReq.rawInput === 'object' && !Array.isArray(approvalReq.rawInput)
+                    ? { toolArgs: approvalReq.rawInput as Record<string, unknown> } : {}),
+                });
+                return decision.allowed && !s.aborted;
+              },
+            } : {}),
             streamer: { edit: (text) => { void push(text); } },
           });
         } else if (opts.runTurn) {
@@ -2151,7 +2192,8 @@ function wireAcpConnection(
           throw new Error('terminal/spawn: sessionId required');
         }
         const tid = resolveAcpTerminalId(p.terminalId);
-        const cwd = typeof p.cwd === 'string' && p.cwd.length > 0 ? p.cwd : process.cwd();
+        const cwd = typeof p.cwd === 'string' && p.cwd.length > 0 ? p.cwd
+          : (await import('../project/session-context.js')).resolveSessionProjectContext(p.sessionId)?.cwd ?? process.cwd();
         const cols = typeof p.cols === 'number' && p.cols > 0 ? p.cols : 80;
         const rows = typeof p.rows === 'number' && p.rows > 0 ? p.rows : 24;
 
@@ -2169,8 +2211,8 @@ function wireAcpConnection(
         const adopted = matches.find((match) => match.pt.isAlive);
         const existing = sameSession?.isAlive ? sameSession : adopted?.pt;
         if (existing) {
+          registerPreviewTerminalForWebTap(existing, p.sessionId, tid, handle);
           if (existing !== sameSession && adopted) {
-            registerPreviewTerminalForWebTap(existing, p.sessionId, tid, handle);
             debug.log('webterm.acp', 'spawn.adopt', {
               terminalId: tid, fromSessions: adopted.sessionIds, toSession: p.sessionId,
             });
@@ -2195,7 +2237,7 @@ function wireAcpConnection(
         }
 
         const { PreviewTerminal } = await import('../preview/terminal.js');
-        const pt = new PreviewTerminal({
+        const pt = (opts.createWebTerminal ?? ((terminalOpts) => new PreviewTerminal(terminalOpts)))({
           cols, rows, cwd,
           // Web-terminal child shell renders inside the PWA's xterm.js,
           // which implements the xterm-256color terminfo. When the daemon
@@ -2207,10 +2249,10 @@ function wireAcpConnection(
           // appear duplicated. Pinning TERM to xterm-256color matches
           // the actual rendering surface and makes the redraws idempotent.
           termName: 'xterm-256color',
-          // ★ P0b-2 (실행 substrate 통합·기본 off) — 이 진짜 PWA/iOS 라이브 셸을 공유 registry 버스로
-          //   흡수(정체성·크로스서피스 goto·3-스택 통합). 라이브 렌더(yazi/마우스/커서/alt-screen) 검증이
-          //   기기 왕복을 요하므로 per-run env 로만 켠다(대표가 별도 부팅해 수습). 미설정=기존 dup-fd(무회귀).
-          useRegistry: process.env.ELANOUS_PREVIEW_TERMINAL_REGISTRY === '1',
+          // The shared PTY bus delivers output to PreviewTerminal's headless
+          // renderer and ACP taps. The direct /dev/fd duplicate can observe
+          // shell exit without ever reading its prompt (black web terminal).
+          useRegistry: true,
           ...(typeof p.shell === 'string' && p.shell.length > 0 ? { shell: p.shell } : {}),
           onExit: () => {
             void import('../web-terminal/preview-tap-registry.js')
@@ -3343,6 +3385,7 @@ function wireAcpConnection(
       if (remaining === 0) {
         sessionPeers.delete(sid);
         plainEnvelopeLogged.delete(sid);
+        approvalPolicy.clearSession(sid);
       }
       if (debug.enabled) {
         debug.log('acp.peer.unregister', sid, { remainingPeers: remaining });
@@ -3487,6 +3530,7 @@ export async function runAcpServer(opts: AcpServerOptions = {}): Promise<void> {
     awarePeers,
     plainEnvelopeLogged,
     dualRole,
+    approvalPolicy: createAcpSessionApprovalPolicy(),
     nextSessionToken: mintAcpSessionToken,
     agentName: opts.agentName ?? 'elanous-agent',
     agentVersion: opts.agentVersion ?? readPkgVersion(),

package/src/acp/tool-approval.ts

@@ -0,0 +1,126 @@
+// PCH-2b (0.2.10 · security D-20261002-08) — ACP turns ask the client before
+// write/shell tools run; «allow always» is remembered per session and tool.
+// Goal: 내부 문서 `ASK-pwa-chat-turns-run-write-and-shell-tools-without-approval-2026-10-02`
+import { debug } from '../debug/log.js';
+import type { AcpApprovalDecision, AcpTurnContext } from './server.js';
+
+/** PCH-2b — tools that write files or run shell commands. ACP turns (PWA·iOS·
+ * remote TUI) ask the client before these run; everything else runs as before.
+ * One list, here, because the daemon catalog has no read-only/mutating flag. */
+const ACP_APPROVAL_TOOLS = new Set([
+  'write', 'edit', 'multiedit', 'notebookedit', 'applypatch', 'apply_patch', 'patch',
+  'bash', 'shell', 'runshell', 'exec_command',
+  'ptyshellstart', 'ptyshellsend', 'webterminalinput',
+  'delegate_code_agent',
+]);
+export function requiresAcpToolApproval(toolName: string): boolean {
+  const name = toolName.startsWith('functions.') ? toolName.slice('functions.'.length) : toolName;
+  // Codex app-server only sends a permission request when it wants to act.
+  return ACP_APPROVAL_TOOLS.has(name.toLowerCase()) || name.startsWith('codex ');
+}
+
+export type AcpToolDenialReason = 'rejected' | 'cancelled' | 'timeout' | 'error';
+export type AcpToolApprovalResult =
+  | { allowed: true }
+  | { allowed: false; reason: AcpToolDenialReason };
+
+/** The tool result the LLM sees when a protected tool was not run. */
+export function acpToolDenialResult(toolName: string, reason: AcpToolDenialReason): { error: string } {
+  if (reason === 'rejected') {
+    return { error: `${toolName}: 사람이 이 호출을 거절했다. 같은 턴에서 같은 도구를 다시 요청하지 말고, 이유를 묻거나 다른 길을 제안하라 — 실행하지 않았다 (tool not run: approval ${reason})` };
+  }
+  if (reason === 'timeout') {
+    return { error: `${toolName}: 사람의 답이 없었다(시한 초과) — 실행하지 않았다. 사용자에게 한 줄로 알려라 (tool not run: approval ${reason})` };
+  }
+  const why = reason === 'cancelled' ? '승인 요청이 취소됐다' : '승인을 받지 못했다';
+  return { error: `${toolName}: ${why} — 실행하지 않았다 (tool not run: approval ${reason})` };
+}
+
+/** One policy per ACP server: grants are scoped to the session AND exact tool
+ * name, not to a turn, connection, argument set, or other session. */
+export function createAcpSessionApprovalPolicy(): {
+  resolve: (
+    sessionId: string,
+    request: Parameters<AcpTurnContext['requestApproval']>[0],
+    requestApproval: AcpTurnContext['requestApproval'],
+    rejectedThisTurn?: Set<string>,
+  ) => Promise<AcpToolApprovalResult>;
+  clearSession: (sessionId: string) => void;
+} {
+  const alwaysAllowed = new Map<string, Set<string>>();
+  const sessionGenerations = new Map<string, number>();
+  const observe = (event: 'requested' | 'decided' | 'timeout' | 'remembered', sessionId: string, tool: string, outcome?: string) => {
+    // Tool arguments are deliberately not logged.
+    debug.log('acp.approval', event, { sessionId, tool, ...(outcome !== undefined ? { outcome } : {}) });
+  };
+  // Same-turn calls to one tool are asked one at a time, so a concurrent second call sees the first's denial
+  // instead of opening a second sheet (round 1 should-fix).
+  const turnInflight = new WeakMap<Set<string>, Map<string, Promise<void>>>();
+  const decide = async (
+    sessionId: string,
+    request: Parameters<AcpTurnContext['requestApproval']>[0],
+    requestApproval: AcpTurnContext['requestApproval'],
+    rejectedThisTurn?: Set<string>,
+  ): Promise<AcpToolApprovalResult> => {
+      if (rejectedThisTurn?.has(request.toolName)) {
+        debug.log('acp.approval', 'repeat-denied', { sessionId, tool: request.toolName });
+        return { allowed: false, reason: 'rejected' };
+      }
+      if (alwaysAllowed.get(sessionId)?.has(request.toolName)) {
+        observe('remembered', sessionId, request.toolName, 'allow-always');
+        return { allowed: true };
+      }
+      const generation = sessionGenerations.get(sessionId) ?? 0;
+      observe('requested', sessionId, request.toolName);
+      let decision: AcpApprovalDecision;
+      try {
+        decision = await requestApproval(request);
+      } catch {
+        observe('decided', sessionId, request.toolName, 'error');
+        return { allowed: false, reason: 'error' };
+      }
+      observe(decision === 'timeout' ? 'timeout' : 'decided', sessionId, request.toolName, decision);
+      if (generation !== (sessionGenerations.get(sessionId) ?? 0)) return { allowed: false, reason: 'cancelled' };
+      if (decision === 'allow-always') {
+        let tools = alwaysAllowed.get(sessionId);
+        if (!tools) {
+          tools = new Set();
+          alwaysAllowed.set(sessionId, tools);
+        }
+        tools.add(request.toolName);
+      }
+      if (decision === 'allow-once' || decision === 'allow-always') return { allowed: true };
+      if (decision === 'deny-once' || decision === 'deny-always') rejectedThisTurn?.add(request.toolName);
+      return {
+        allowed: false,
+        reason: decision === 'timeout' ? 'timeout' : decision === 'cancelled' ? 'cancelled' : 'rejected',
+      };
+  };
+  return {
+    async resolve(sessionId, request, requestApproval, rejectedThisTurn) {
+      if (!requiresAcpToolApproval(request.toolName)) return { allowed: true };
+      if (!rejectedThisTurn) return decide(sessionId, request, requestApproval);
+      let inflight = turnInflight.get(rejectedThisTurn);
+      if (!inflight) {
+        inflight = new Map();
+        turnInflight.set(rejectedThisTurn, inflight);
+      }
+      const prior = inflight.get(request.toolName);
+      let release!: () => void;
+      const mine = new Promise<void>((done) => { release = done; });
+      const chained = (prior ?? Promise.resolve()).then(() => mine);
+      inflight.set(request.toolName, chained);
+      try {
+        if (prior) await prior;
+        return await decide(sessionId, request, requestApproval, rejectedThisTurn);
+      } finally {
+        release();
+        if (inflight.get(request.toolName) === chained) inflight.delete(request.toolName);
+      }
+    },
+    clearSession(sessionId) {
+      alwaysAllowed.delete(sessionId);
+      sessionGenerations.set(sessionId, (sessionGenerations.get(sessionId) ?? 0) + 1);
+    },
+  };
+}

package/src/acp/turn-runner.ts

@@ -40,6 +40,11 @@ import { unsafeBrandSessionUri } from '../mss/uri/brand.js';
 import { debug } from '../debug/log.js';
 import type { AgentStatusStore } from '../agent-status/store.js';
 import type { AcpPermissionApprover, AcpQuestionApprover } from './client.js';
+import {
+  CODEX_APPROVAL_OPT_ONCE,
+  CODEX_APPROVAL_OPT_REJECT,
+  CODEX_APPROVAL_QUESTION_ID,
+} from './codex-approval-adapter.js';
 import type { ConfirmChannel } from '../hitl/confirm.js';
 import type { QuestionChannel } from '../hitl/question.js';
 import {
@@ -69,6 +74,7 @@ import { getUserConfig } from '../user-config.js';
 // ACP `cancelled`), matching the pre-existing default-deny posture for
 // unattended turns — so nothing hangs when a surface opts out.
 const turnHitlChannels = new Map<string, ConfirmChannel[]>();
+const turnPermissionApprovers = new Map<string, AcpPermissionApprover>();
 /** Parallel registry for multi-option question channels (same keying
  *  as `turnHitlChannels`). Present ⇒ the question approver fans out
  *  real N-option prompts; absent ⇒ it falls back to yes/no collapse
@@ -81,6 +87,8 @@ const turnHitlQuestionChannels = new Map<string, QuestionChannel[]>();
 const HITL_TURN_TIMEOUT_MS = 120_000;
 
 const surfacePermissionApprover: AcpPermissionApprover = async (req) => {
+  const turnApprover = turnPermissionApprovers.get(req.sessionId);
+  if (turnApprover) return turnApprover(req);
   // Autonomous by default: edit/command PERMISSIONS auto-approve. Asking the
   // human to approve every write defeats delegation (the interactive-editor
   // paradigm ACP inherited doesn't fit autonomous telegram delegation).
@@ -102,7 +110,31 @@ const surfacePermissionApprover: AcpPermissionApprover = async (req) => {
   return answer;
 };
 
+/** PCH-2b — answer codex's 3-way approval question with a yes/no permission
+ *  approver. Returns null when the request is not that question. */
+export async function answerCodexApprovalQuestion(
+  req: Parameters<AcpQuestionApprover>[0],
+  approver: AcpPermissionApprover,
+): Promise<Awaited<ReturnType<AcpQuestionApprover>> | null> {
+  const q = req.questions[0];
+  if (req.questions.length !== 1 || q?.id !== CODEX_APPROVAL_QUESTION_ID) return null;
+  const approved = await approver({
+    backendId: req.backendId,
+    sessionId: req.sessionId,
+    title: q.question,
+    options: [],
+  });
+  return { answers: { [q.id]: approved ? CODEX_APPROVAL_OPT_ONCE : CODEX_APPROVAL_OPT_REJECT } };
+}
+
 const surfaceQuestionApprover: AcpQuestionApprover = async (req) => {
+  // PCH-2b — an ACP server turn answers codex's approval question through its
+  // own client (yes/no), not the messenger HITL channels.
+  const turnApprover = turnPermissionApprovers.get(req.sessionId);
+  if (turnApprover) {
+    const answered = await answerCodexApprovalQuestion(req, turnApprover);
+    if (answered) return answered;
+  }
   const channels = turnHitlChannels.get(req.sessionId);
   if (!channels || channels.length === 0) return { answers: {}, cancelled: true };
   // When the surface provided real multi-option QuestionChannels, fan
@@ -306,6 +338,8 @@ export interface RunAcpTurnOpts {
   cwd?: string;
   /** Session-scoped Codex app-server configuration arguments. */
   codexArgs?: readonly string[];
+  /** ACP server turn's permission request, routed through its client rather than the messenger HITL channel. */
+  permissionApprover?: AcpPermissionApprover;
   /** Soft focus budget (tool-turns) for a TARGETED slash invocation
    *  (`/cc`·/cdx·/gem). When set, a tight-budget directive is prepended
    *  to the prompt so the sub-agent stays focused (minimize re-reads /
@@ -663,6 +697,7 @@ export async function runAcpTurn(opts: RunAcpTurnOpts): Promise<RunAcpTurnResult
   // session id (== the `req.sessionId` seen in requestPermission).
   const hasHitl = !!opts.hitlConfirmChannels && opts.hitlConfirmChannels.length > 0;
   if (hasHitl) turnHitlChannels.set(sessionId, opts.hitlConfirmChannels!);
+  if (opts.permissionApprover) turnPermissionApprovers.set(sessionId, opts.permissionApprover);
   const hasHitlQuestions = !!opts.hitlQuestionChannels && opts.hitlQuestionChannels.length > 0;
   if (hasHitlQuestions) turnHitlQuestionChannels.set(sessionId, opts.hitlQuestionChannels!);
 
@@ -784,6 +819,7 @@ export async function runAcpTurn(opts: RunAcpTurnOpts): Promise<RunAcpTurnResult
   } finally {
     inFlightTurns.delete(key);
     if (hasHitl) turnHitlChannels.delete(sessionId);
+    if (opts.permissionApprover) turnPermissionApprovers.delete(sessionId);
     if (hasHitlQuestions) turnHitlQuestionChannels.delete(sessionId);
   }
 }