github-router 0.3.202 → 0.3.206

package/dist/browser-ext/manifest.json

@@ -2,7 +2,7 @@
   "manifest_version": 3,
   "name": "github-router browser bridge",
   "short_name": "gh-router-browser",
-  "version": "0.3.202",
+  "version": "0.3.206",
   "description": "Bridge between Claude (via github-router /mcp) and the browser. Implements tab control, navigation, clicks, form fill, downloads, screenshots, devtools eval. Blocks navigation to chrome://settings.",
   "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqJElxuBlonBS3TVW9FJN0mGTtShB3L1hoaYf6k39SOr1ogGYmF90EjRxy1i21k9wQQjPf26bcBu/9X67KrQjQV0uB38CaNukgiSeoLjfptN811u+PJHx6BP+jx3Qa6/3VenNPxHC8WEU0GXql8QSjIHEyCwKb6fMASXOK94JyB5Ywov2x8mt/+9ncqBBBMVzf6r5Sagy4PL1XnryLsuADD/vOEkPet8wXgH/Oj7v5tTsQQZ7U1JT51PoDs2BFnXc5v3TkVgZwd32k3ONh+nkDw1Hof+4zwUGOyJE6eMrlYzRlKM4Qxdf9JpavQvqfieAbTRWcyKeclnHeoIfE7cDBQIDAQAB",
   "background": {

package/dist/{engine-CIt6z9K3.js → engine-DZjN7BuD.js}

@@ -1,4 +1,4 @@
-import { B as runWorkerAgent, F as EXPLORE_DEFAULT_MODEL, I as IMPLEMENT_DEFAULT_MODEL, L as PLAN_DEFAULT_MODEL, N as BROWSE_DEFAULT_MODEL, P as DEFAULT_MODEL, R as REVIEW_DEFAULT_MODEL, V as withNoOutputRetry, z as appendPlanReminder } from "./peer-mcp-personas-rik0SIrg.js";
+import { B as runWorkerAgent, F as EXPLORE_DEFAULT_MODEL, I as IMPLEMENT_DEFAULT_MODEL, L as PLAN_DEFAULT_MODEL, N as BROWSE_DEFAULT_MODEL, P as DEFAULT_MODEL, R as REVIEW_DEFAULT_MODEL, V as withNoOutputRetry, z as appendPlanReminder } from "./peer-mcp-personas-C3ii7ZqP.js";
 import "./paths-BO22pMUb.js";
 import "./lifecycle-D-1CYr1Y.js";
 import "./lifecycle-bPdiXjYB.js";

package/dist/main.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { $ as buildAdvisorStream, $t as setupCopilotToken, A as trustRepo, At as readResponseBodyCapped, Bt as buildWorkspaceHeaderJson, C as fileLastPromptStore, Ct as getTokenCount, D as repoRoot, Dt as createResponses, E as repoFingerprint, Et as pickEndpoint, Ft as extractTarGzMember, G as toolbeltEnabled, Gt as DEFAULT_CODEX_MODEL_FALLBACKS, H as buildEnv, Ht as toolbeltPathOverride, It as extractZipMember, J as TOOLBELT_TOOLS, Jt as UPSTREAM_INACTIVITY_TIMEOUT_MS, K as toolbeltSkipSet, Kt as DEFAULT_PORT, Lt as shouldUseInsecureTls, M as resolveSealedGate, Mt as provisionBrowserAssets, Nt as hasSupportedBrowserInstalled, O as stopGateEnabledForRepo, Ot as createChatCompletions, Pt as provisionAndIndexColbert, Q as ADVISOR_TOOL_INSTRUCTIONS, Qt as withInstallLock, Rt as ArtifactClient, S as fileFindingsStore, St as createMessages, T as isSubagentContext, Tt as resolveMcpToolTimeoutMs, U as availableToolCommands, Ut as DEFAULT_CLAUDE_MODEL_FALLBACKS, Vt as collapsePathKeys, W as buildToolbeltAwareness, Wt as DEFAULT_CODEX_MODEL, X as searchWeb, Xt as pickClaudeDefault, Y as assetFor, Yt as generateRandomPort, Z as ADVISOR_INTERNAL_TOOL_NAME, Zt as getPackageVersion, _ as stopGateDisabled, _n as copilotBaseUrl, _t as nativeSubagentModel, a as buildPeerAwarenessSnippet, an as cacheVSCodeVersion, at as logStreamError, b as stopReviewEnabled, bn as state, bt as shimDefaultsToXhigh, c as personasFor, cn as resolveCodexModel, ct as handleMcpDelete, d as buildStopHookCommand, dn as getModels, dt as artifactToolsEnabled, en as setupGitHubAgentToken, et as injectAdvisorTool, f as captureLaunchBaseline, fn as getGitHubUser, ft as browseAgentEnabled, g as launchBaselineKey, gn as GITHUB_API_BASE_URL, gt as geminiAvailable, h as injectStopHookIntoSettingsFile, hn as forwardError, ht as fleetToolsEnabled, i as buildAgentPrompt, in as cacheModels, it as isControllerClosedError, j as liveExec, jt as parseJsonOrDiagnose, k as stopReviewStateDir, kt as MAX_RESPONSE_BODY_BYTES, l as buildArtifactOpenHookCommand, ln as resolveModel, lt as handleMcpPost, m as fileBlockBudget, mn as HTTPError, mt as browserToolsEnabled, n as MCP_GROUPS, nn as tryRefreshAndRetry, nt as buildAnthropicErrorEvent, o as buildPeerAwarenessSummary, on as filterBetaHeader, ot as readIteratorWithTimeout, p as decideStopHook, pn as fetchWithTransientRetry, pt as browserCompoundToolsEnabled, q as vscodeRipgrepPath, qt as UPSTREAM_FETCH_TIMEOUT_MS, r as assertMcpToolSurfaceConsistent, rn as cacheCopilotVersion, rt as buildOpenAIErrorEvent, s as enumerateInjectedMcpToolNames, sn as isNullish, st as relayAnthropicStream, t as GROUP_META, tn as setupGitHubToken, tt as isAdvisorRequested, u as buildSessionBindHookCommand, un as sleep$1, ut as agentToolsEnabled, v as stopGateId, vn as copilotHeaders, vt as standInToolEnabled, w as fileReviewDebounce, wt as assembleResponsesPayload, x as fileBaselineStore, xt as countTokens, y as stopGatePlanMode, yn as githubHeaders, yt as workerToolsEnabled, zt as buildWorkspaceHeaderHelperCommand } from "./peer-mcp-personas-rik0SIrg.js";
+import { $ as buildAdvisorStream, $t as setupCopilotToken, A as trustRepo, At as readResponseBodyCapped, Bt as buildWorkspaceHeaderJson, C as fileLastPromptStore, Ct as getTokenCount, D as repoRoot, Dt as createResponses, E as repoFingerprint, Et as pickEndpoint, Ft as extractTarGzMember, G as toolbeltEnabled, Gt as DEFAULT_CODEX_MODEL_FALLBACKS, H as buildEnv, Ht as toolbeltPathOverride, It as extractZipMember, J as TOOLBELT_TOOLS, Jt as UPSTREAM_INACTIVITY_TIMEOUT_MS, K as toolbeltSkipSet, Kt as DEFAULT_PORT, Lt as shouldUseInsecureTls, M as resolveSealedGate, Mt as provisionBrowserAssets, Nt as hasSupportedBrowserInstalled, O as stopGateEnabledForRepo, Ot as createChatCompletions, Pt as provisionAndIndexColbert, Q as ADVISOR_TOOL_INSTRUCTIONS, Qt as withInstallLock, Rt as ArtifactClient, S as fileFindingsStore, St as createMessages, T as isSubagentContext, Tt as resolveMcpToolTimeoutMs, U as availableToolCommands, Ut as DEFAULT_CLAUDE_MODEL_FALLBACKS, Vt as collapsePathKeys, W as buildToolbeltAwareness, Wt as DEFAULT_CODEX_MODEL, X as searchWeb, Xt as pickClaudeDefault, Y as assetFor, Yt as generateRandomPort, Z as ADVISOR_INTERNAL_TOOL_NAME, Zt as getPackageVersion, _ as stopGateDisabled, _n as copilotBaseUrl, _t as nativeSubagentModel, a as buildPeerAwarenessSnippet, an as cacheVSCodeVersion, at as logStreamError, b as stopReviewEnabled, bn as state, bt as shimDefaultsToXhigh, c as personasFor, cn as resolveCodexModel, ct as handleMcpDelete, d as buildStopHookCommand, dn as getModels, dt as artifactToolsEnabled, en as setupGitHubAgentToken, et as injectAdvisorTool, f as captureLaunchBaseline, fn as getGitHubUser, ft as browseAgentEnabled, g as launchBaselineKey, gn as GITHUB_API_BASE_URL, gt as geminiAvailable, h as injectStopHookIntoSettingsFile, hn as forwardError, ht as fleetToolsEnabled, i as buildAgentPrompt, in as cacheModels, it as isControllerClosedError, j as liveExec, jt as parseJsonOrDiagnose, k as stopReviewStateDir, kt as MAX_RESPONSE_BODY_BYTES, l as buildArtifactOpenHookCommand, ln as resolveModel, lt as handleMcpPost, m as fileBlockBudget, mn as HTTPError, mt as browserToolsEnabled, n as MCP_GROUPS, nn as tryRefreshAndRetry, nt as buildAnthropicErrorEvent, o as buildPeerAwarenessSummary, on as filterBetaHeader, ot as readIteratorWithTimeout, p as decideStopHook, pn as fetchWithTransientRetry, pt as browserCompoundToolsEnabled, q as vscodeRipgrepPath, qt as UPSTREAM_FETCH_TIMEOUT_MS, r as assertMcpToolSurfaceConsistent, rn as cacheCopilotVersion, rt as buildOpenAIErrorEvent, s as enumerateInjectedMcpToolNames, sn as isNullish, st as relayAnthropicStream, t as GROUP_META, tn as setupGitHubToken, tt as isAdvisorRequested, u as buildSessionBindHookCommand, un as sleep$1, ut as agentToolsEnabled, v as stopGateId, vn as copilotHeaders, vt as standInToolEnabled, w as fileReviewDebounce, wt as assembleResponsesPayload, x as fileBaselineStore, xt as countTokens, y as stopGatePlanMode, yn as githubHeaders, yt as workerToolsEnabled, zt as buildWorkspaceHeaderHelperCommand } from "./peer-mcp-personas-C3ii7ZqP.js";
 import { a as isUnderClaudeConfigMirror, d as writeRuntimeFileSecure, i as ensurePaths, o as removeOwnClaudeConfigMirror, r as ensureClaudeConfigMirror, t as PATHS, u as writeArtifactCredsToMirror } from "./paths-BO22pMUb.js";
 import { c as killManagedTree, d as runCommandCapture, f as runCommandVoid, l as parseBoolEnv, s as killChildProcessTree, u as resolveExecutable } from "./lifecycle-D-1CYr1Y.js";
 import { a as sweepRegistry } from "./lifecycle-bPdiXjYB.js";
@@ -978,10 +978,10 @@ function decideWorkerGuard(input) {
 function dispatcherDescription(mode) {
 	return `${{
 		explore: "Non-blocking `explore` worker: dispatches a read-only autonomous worker (its own context) in the background and delivers its summary as a completion notification.",
-		implement: "Non-blocking `implement` worker: dispatches an autonomous coding worker (read/write/bash, optional git worktree) in the background and delivers its result as a completion notification.",
+		implement: "Non-blocking `implement` worker: dispatches an autonomous coding worker (read/write/bash) that ALWAYS runs in an isolated git worktree and returns the diff (for in-place edits use the `implementer` subagent), in the background, and delivers its result as a completion notification.",
 		review: "Non-blocking `review` worker: dispatches a read-only reviewer that reads the code itself to verify a change or claim, in the background, and delivers findings as a completion notification.",
 		plan: "Non-blocking `plan` worker: dispatches a read-only planner that returns an ordered implementation plan, in the background, and delivers it as a completion notification.",
-		test: "Non-blocking `test` worker: dispatches an independent test author that writes tests trying to break the implementation, in the background, and delivers pass/fail as a completion notification.",
+		test: "Non-blocking `test` worker: dispatches an independent test author (in an isolated git worktree) that writes tests trying to break the implementation, in the background, and delivers pass/fail as a completion notification.",
 		browse: "Non-blocking `browse` worker: dispatches an autonomous browser agent in the background and delivers its result as a completion notification."
 	}[mode]} Use proactively for any ${mode}-mode worker task so a long run never blocks your turn: it returns immediately and notifies you when done.`;
 }
@@ -991,7 +991,7 @@ function dispatcherPrompt(mode, workersKey) {
 	const tool = workerToolName(workersKey, mode);
 	const briefField = mode === "browse" ? "task" : "prompt";
 	const briefDescription = mode === "browse" ? "the lead's browse task, copied verbatim" : "the lead's worker brief, copied verbatim";
-	const modeSpecificPassThrough = mode === "implement" || mode === "test" ? "\n  - `worktree` (optional): pass `true` if the lead asked for isolated-worktree execution" : mode === "browse" ? "\n  - `sessionId` (optional): pass through if the lead specified one" : "";
+	const modeSpecificPassThrough = mode === "browse" ? "\n  - `sessionId` (optional): pass through if the lead specified one" : "";
 	return [
 		`# Subagent: ${dispatcherAgentName(mode)}`,
 		"",
@@ -1089,6 +1089,27 @@ function resolveCodexCliBackend(opts) {
 	return "cli";
 }
 /**
+* Build one scoped HTTP `mcpServers` entry for a group: `type: http`, the
+* `/mcp/<urlSuffix>` URL, the Bearer-nonce Authorization header, and the
+* per-session workspace `headersHelper` when supplied. Shared by
+* `buildPeerMcpConfig` (the session `.claude.json` entries) AND
+* `buildPeerAgentDefinitions` (the per-subagent inline `mcpServers` frontmatter
+* that sidesteps Claude Code's Agent-tool MCP-inheritance bug, anthropics/
+* claude-code#30280 — a bare name-reference "shares the parent connection" and
+* re-triggers it, so subagents MUST inline the full HTTP config to connect
+* independently). One source of truth so the two can't drift.
+*/
+function httpEntryFor(serverUrl, group, nonce, workspaceHeaderCmd) {
+	const entry = {
+		type: "http",
+		url: `${serverUrl}/mcp/${GROUP_META[group].urlSuffix}`,
+		headers: { Authorization: `Bearer ${nonce}` }
+	};
+	const ws = workspaceHeaderCmd?.trim();
+	if (ws) entry.headersHelper = ws;
+	return entry;
+}
+/**
 * Build the JSON payload for `claude --mcp-config <path>` (and the same
 * entries that get merged into the mirrored `.claude.json`).
 *
@@ -1106,13 +1127,7 @@ function buildPeerMcpConfig(serverUrl, opts) {
 	for (const group of MCP_GROUPS) {
 		const key = opts.groupKeys[group];
 		if (!key) continue;
-		const entry = {
-			type: "http",
-			url: `${serverUrl}/mcp/${GROUP_META[group].urlSuffix}`,
-			headers: { Authorization: `Bearer ${opts.nonce}` }
-		};
-		if (workspaceHeaderCmd) entry.headersHelper = workspaceHeaderCmd;
-		mcpServers[key] = entry;
+		mcpServers[key] = httpEntryFor(serverUrl, group, opts.nonce, workspaceHeaderCmd);
 	}
 	if (opts.codexCli) mcpServers["codex-cli"] = {
 		command: "codex",
@@ -1244,17 +1259,22 @@ function buildPeerAgentDefinitions(opts) {
 		geminiAvailable: opts.geminiAvailable
 	});
 	const peersKey = peersKeyOf(opts.groupKeys);
+	const peersMcp = opts.serverUrl ? { mcpServers: { [peersKey]: httpEntryFor(opts.serverUrl, "peers", opts.nonce, opts.workspaceHeaderCmd) } } : {};
 	for (const persona of personas) out[persona.agentName] = {
 		description: persona.description,
 		prompt: buildAgentPrompt(persona, {
 			codexCli: opts.codexCli,
 			peersKey
-		})
+		}),
+		...peersMcp
+	};
+	out["peer-review-coordinator"] = {
+		...buildCoordinatorAgent({
+			codexCli: opts.codexCli,
+			geminiAvailable: opts.geminiAvailable
+		}),
+		...peersMcp
 	};
-	out["peer-review-coordinator"] = buildCoordinatorAgent({
-		codexCli: opts.codexCli,
-		geminiAvailable: opts.geminiAvailable
-	});
 	const nativeModel = opts.nativeSubagentModel && opts.nativeSubagentModel.length > 0 ? opts.nativeSubagentModel : void 0;
 	const modelField = nativeModel ? { model: nativeModel } : {};
 	out.implementer = {
@@ -1274,10 +1294,12 @@ function buildPeerAgentDefinitions(opts) {
 	};
 	if (opts.workerToolsAvailable) {
 		const workersKey = workersKeyOf(opts.groupKeys);
+		const workersMcp = opts.serverUrl ? { mcpServers: { [workersKey]: httpEntryFor(opts.serverUrl, "workers", opts.nonce, opts.workspaceHeaderCmd) } } : {};
 		for (const mode of activeDispatchModes({ browse: opts.browseAvailable === true })) out[dispatcherAgentName(mode)] = {
 			description: dispatcherDescription(mode),
 			prompt: dispatcherPrompt(mode, workersKey),
-			tools: dispatcherTools(mode, workersKey)
+			tools: dispatcherTools(mode, workersKey),
+			...workersMcp
 		};
 	}
 	return out;
@@ -1323,15 +1345,48 @@ function escapeYamlString(s) {
 * component.
 */
 const VALID_AGENT_NAME = /^[A-Za-z][A-Za-z0-9-]*$/;
+/**
+* Emit the subagent-frontmatter `mcpServers` block as a YAML sequence of
+* single-key maps (the INLINE form that connects on subagent start — a bare
+* name-reference would re-trigger claude-code#30280). Scalars are
+* JSON.stringify-quoted, which is valid YAML double-quoted syntax (handles the
+* Windows-path/backslash headersHelper command safely).
+*
+* ```yaml
+* mcpServers:
+*   - workers:
+*       type: http
+*       url: "http://127.0.0.1:PORT/mcp/workers"
+*       headers:
+*         Authorization: "Bearer <nonce>"
+*       headersHelper: "<cmd>"
+* ```
+*/
+function emitMcpServersYaml(mcpServers) {
+	const lines = ["mcpServers:"];
+	for (const [key, entry] of Object.entries(mcpServers)) {
+		lines.push(`  - ${JSON.stringify(key)}:`);
+		lines.push(`      type: ${JSON.stringify(entry.type)}`);
+		lines.push(`      url: ${JSON.stringify(entry.url)}`);
+		lines.push(`      headers:`);
+		for (const [hk, hv] of Object.entries(entry.headers)) lines.push(`        ${JSON.stringify(hk)}: ${JSON.stringify(hv)}`);
+		if (entry.headersHelper !== void 0) lines.push(`      headersHelper: ${JSON.stringify(entry.headersHelper)}`);
+	}
+	return lines;
+}
 /** Build a single subagent .md file body (frontmatter + system prompt).
 *
 * `tools` (optional) becomes a `tools:` frontmatter allowlist RESTRICTING the
 * subagent to exactly those tools (omission inherits the parent's full toolset,
 * per Claude Code semantics). Used by the `worker-*` dispatchers to pin each to
 * its single `mcp__<workersKey>__<mode>` tool — which physically prevents them
-* from spawning other agents or doing extra work. Names are validated by the
-* caller (`writePeerAgentMdFiles`) / are proxy-generated, so no escaping needed
-* beyond the comma-join Claude Code's frontmatter parser expects. */
+* from spawning other agents or doing extra work. `mcpServers` (optional) is
+* emitted as an inline `mcpServers` frontmatter list so the subagent connects
+* directly to its scoped MCP server(s) — a workaround for claude-code#30280
+* (Agent-tool subagents don't reliably inherit the session's HTTP MCP servers).
+* Names are validated by the caller (`writePeerAgentMdFiles`) / are
+* proxy-generated, so no escaping needed beyond the comma-join Claude Code's
+* frontmatter parser expects. */
 function buildAgentMd(spec) {
 	const lines = [
 		"---",
@@ -1340,6 +1395,7 @@ function buildAgentMd(spec) {
 	];
 	if (spec.model) lines.push(`model: ${escapeYamlString(spec.model)}`);
 	if (spec.tools && spec.tools.length > 0) lines.push(`tools: [${spec.tools.map((t) => JSON.stringify(t)).join(", ")}]`);
+	if (spec.mcpServers && Object.keys(spec.mcpServers).length > 0) lines.push(...emitMcpServersYaml(spec.mcpServers));
 	lines.push("---", "", spec.prompt, "");
 	return lines.join("\n");
 }
@@ -1374,7 +1430,8 @@ async function writePeerAgentMdFiles(agents, opts) {
 				description: def.description,
 				prompt: def.prompt,
 				model: def.model,
-				tools: def.tools
+				tools: def.tools,
+				mcpServers: def.mcpServers
 			}));
 			paths.push(filePath);
 		}
@@ -1572,7 +1629,9 @@ async function writePeerMcpRuntimeFiles(serverUrl, opts) {
 		browseAvailable: opts.browseAvailable,
 		nativeSubagentModel: opts.nativeSubagentModel,
 		nonce,
-		codexHome
+		codexHome,
+		serverUrl,
+		workspaceHeaderCmd: buildWorkspaceHeaderHelperCommand(process.execPath, process.argv[1])
 	});
 	await fs.unlink(mcpConfigPath).catch(() => {});
 	await fs.unlink(agentsPath).catch(() => {});
@@ -1852,6 +1911,44 @@ async function sanitizeServeSettingsEnv(settingsPath) {
 */
 const NATIVE_RESEARCH_ALLOW_RULES = ["WebSearch", "WebFetch"];
 /**
+* The routine native Claude Code tools serve auto-approves so ordinary agent
+* work stays seamless (no per-call prompt) — the exact surface a coding agent
+* uses turn to turn. Seeded into CloudCLI's `localStorage['claude-settings']`
+* `allowedTools` (feeds the Agent SDK `canUseTool` fast-path + `sdkOptions.allowedTools`).
+*
+* DELIBERATELY EXCLUDES the two interaction tools `AskUserQuestion` and
+* `ExitPlanMode`. CloudCLI hard-codes both into its `TOOLS_REQUIRING_INTERACTION`
+* set (claude-sdk.js) and renders a real question widget / plan Approve-Reject
+* card for them — but ONLY when `canUseTool` runs (non-bypass) AND they are NOT
+* pre-approved. Leaving them off this list is what routes them to the human
+* instead of letting the model auto-answer its own question. This is the same
+* line the interactive Claude CLI draws: routine tools seamless, decisions to
+* the user. Never add either name here.
+*
+* A tool omitted from this list degrades to a one-off Allow/Deny prompt in
+* CloudCLI — safe, not broken — so the list is a superset of the common surface
+* rather than an exact registry match (extra names for tools this Claude build
+* lacks are harmless no-ops).
+*/
+const SEAMLESS_BUILTIN_TOOLS = [
+	"Task",
+	"Bash",
+	"BashOutput",
+	"KillShell",
+	"Glob",
+	"Grep",
+	"Read",
+	"Edit",
+	"Write",
+	"NotebookEdit",
+	"WebFetch",
+	"WebSearch",
+	"TodoWrite",
+	"Skill",
+	"SlashCommand",
+	"EnterPlanMode"
+];
+/**
 * Merge arbitrary allow rules into a mirror `settings.json` `permissions.allow`
 * so the listed tools auto-run WITHOUT a permission prompt in every mode —
 * including plan mode, where a matched allow rule bypasses the prompt for any
@@ -1893,42 +1990,42 @@ function planModeAllowRules(serverKeys) {
 	return [...[...new Set(serverKeys.filter(Boolean))].map((k) => `mcp__${k}`), ...NATIVE_RESEARCH_ALLOW_RULES];
 }
 /**
-* Set the serve mirror's `settings.json` `permissions.defaultMode` to
-* `bypassPermissions` — the web-control-plane equivalent of `github-router
-* claude`'s default `--dangerously-skip-permissions`. Without it, CloudCLI's
-* Agent-SDK `canUseTool` callback posts a browser `permission_request` and AWAITS
-* approval for every not-yet-allowed tool, stalling the chat on each injected
-* `mcp__*` and native call.
+* Ensure the serve mirror's `settings.json` `permissions.defaultMode` is NOT
+* `bypassPermissions` — the load-bearing half of serve's "seamless routine +
+* decisions to the user" model.
 *
-* PRESERVES the user's `allow`/`deny`/`ask` posture verbatim — their curated
-* permission rules carry into serve unchanged, so a session switched off bypass
-* (plan / default mode via the composer) behaves exactly as their own Claude Code
-* would. We used to CLEAR `allow` on a since-debunked theory that a non-empty
-* allow narrows the toolset; empirically it does NOT (a 13-rule allow yields the
-* full 27-tool set incl Glob/Bash/Edit), and CloudCLI's `allowedTools` comes only
-* from the client `localStorage['claude-settings']` seed (`[]`), never from
-* `permissions.allow`. The real toolset-narrowing was `CLAUDE_CODE_COORDINATOR_MODE`,
-* stripped separately by {@link sanitizeServeSettingsEnv}. Not clearing `allow`
-* is what keeps serve at parity with the user's own Claude Code permission posture.
+* Under `bypassPermissions` the Agent SDK resolves approval at the permission-mode
+* step and SKIPS the `canUseTool` callback entirely (claude-sdk.js) — the only
+* channel CloudCLI's interactive widgets ride on, so `AskUserQuestion` and
+* `ExitPlanMode` auto-resolve on a model-generated answer and never reach the human.
+* CloudCLI leaves `sdkOptions.permissionMode` unset when the composer is in default
+* mode, so the binary falls back to THIS `defaultMode` — a stale `bypassPermissions`
+* here would silently re-defeat the fix through the settings vector.
+*
+* MINIMAL override: only rewrite when the mode is absent or an explicit
+* `bypassPermissions` (→ `"default"`, keeping `canUseTool` live). A user's
+* deliberate NON-bypass posture (`plan` / `acceptEdits` / `default`) is preserved
+* verbatim — all three already keep `canUseTool` live, so there is nothing to fix
+* and no reason to override their choice. `allow`/`deny`/`ask` are always untouched.
 *
 * Only ever rewrites the per-launch serve mirror, never the operator's real
 * `~/.claude/settings.json`. Atomic temp+rename, mode 0o600. A non-object
-* settings.json throws (never clobber a file we don't understand); the caller
-* wraps this in warn-and-continue so a hiccup never blocks launch.
+* settings.json throws; the caller wraps this in warn-and-continue.
 *
-* Opt out with `GH_ROUTER_SERVE_NO_AUTO_APPROVE=1` (the caller skips this) — the
-* mirrored `defaultMode` is then left exactly as snapshotted.
+* Opt out with `GH_ROUTER_SERVE_NO_AUTO_APPROVE=1` (the caller skips this AND the
+* allow-list/localStorage seed) — the mirrored `defaultMode` is then left exactly
+* as snapshotted and CloudCLI prompts on every not-yet-approved tool.
 */
-async function configureServePermissionsBypass(settingsPath) {
+async function configureServeDefaultPermissionMode(settingsPath) {
 	const existing = await readSettingsObject(settingsPath) ?? {};
 	const permsRaw = existing.permissions;
 	const perms = permsRaw && typeof permsRaw === "object" && !Array.isArray(permsRaw) ? { ...permsRaw } : {};
-	if (perms.defaultMode === "bypassPermissions") return { written: false };
-	perms.defaultMode = "bypassPermissions";
+	if (perms.defaultMode !== void 0 && perms.defaultMode !== "bypassPermissions") return { written: false };
+	perms.defaultMode = "default";
 	await writeSettingsObject(settingsPath, {
 		...existing,
 		permissions: perms
-	}, "servebypass");
+	}, "servemode");
 	return { written: true };
 }
 
@@ -2797,7 +2894,7 @@ async function discoverGateCommands(cwd, opts) {
 	if (files.length === 0) return null;
 	let result;
 	try {
-		const { runWorkerAgent } = await import("./engine-CIt6z9K3.js");
+		const { runWorkerAgent } = await import("./engine-DZjN7BuD.js");
 		result = await runWorkerAgent({
 			mode: "explore",
 			workspace: root,
@@ -4957,7 +5054,7 @@ function initProxyFromEnv() {
 //#endregion
 //#region package.json
 var name = "github-router";
-var version$1 = "0.3.202";
+var version$1 = "0.3.206";
 
 //#endregion
 //#region src/lib/approval.ts
@@ -10778,7 +10875,7 @@ async function provisionServeEnhancements(serverUrl, opts = {}) {
 			return { removed: [] };
 		});
 		if (strip.removed.length) consola.info(`Serve: removed ${strip.removed.join(", ")} from the mirror settings (single-agent surface).`);
-		if (process.env.GH_ROUTER_SERVE_NO_AUTO_APPROVE !== "1") await configureServePermissionsBypass(settingsPath).catch((err) => consola.warn(`Could not set serve permission defaults: ${String(err)}`));
+		if (process.env.GH_ROUTER_SERVE_NO_AUTO_APPROVE !== "1") await configureServeDefaultPermissionMode(settingsPath).catch((err) => consola.warn(`Could not set serve permission defaults: ${String(err)}`));
 		await injectAllowRules(settingsPath, planModeAllowRules(injected.ok ? injected.serversAdded : [...Object.values(groupKeys).filter((k) => Boolean(k)), ...opts.codexCli === true ? ["codex-cli"] : []])).catch((err) => consola.warn(`Could not auto-approve injected tools: ${String(err)}`));
 		if (workerToolsEnabled()) {
 			await injectStopHookIntoSettingsFile(settingsPath, buildPromptSubmitHookCommand(process.execPath, process.argv[1]), "UserPromptSubmit", 45).catch((err) => consola.warn(`Could not register the UserPromptSubmit hook: ${String(err)}`));
@@ -11093,27 +11190,35 @@ const HEAD_CLOSE = "</head>";
 /** CloudCLI's localStorage key for per-tool chat permission settings. */
 const CLAUDE_SETTINGS_KEY = "claude-settings";
 /**
+* The two interaction tools CloudCLI routes to the human (its
+* `TOOLS_REQUIRING_INTERACTION`). They must NEVER appear in the seeded
+* `allowedTools` — an exact-name match there would auto-approve them and defeat
+* the question widget / plan card. Stripped defensively at the seed chokepoint
+* so no upstream list (mcp names, a future caller) can reintroduce them.
+*/
+const NEVER_AUTO_APPROVE = new Set(["AskUserQuestion", "ExitPlanMode"]);
+/**
 * Embed the token as a JS string literal. JSON.stringify escapes quotes and
 * backslashes; we additionally neutralize `<` so the value can never break out
 * of the surrounding <script> element regardless of contents.
 *
 * When `seedToolSettings` is set, also seed CloudCLI's `claude-settings`
-* localStorage with `{allowedTools:[], disallowedTools:[], skipPermissions:true}`
-* so the SDK-spawned Claude gets the FULL built-in toolset with no permission
-* prompts. This is the server-side, zero-user-action fix for two CloudCLI
-* behaviors: (1) a non-empty `allowedTools` is an availability allow-list in the
-* Agent SDK (so any tool not in it is "not enabled"), and (2) `allowedTools`
-* accumulates client-side on every "allow & remember" click — so prior approvals
-* silently clamp the toolset. Forcing empty `allowedTools` + `skipPermissions`
-* gives `github-router claude`-parity (`--dangerously-skip-permissions`).
+* localStorage with `{allowedTools:<routine+mcp>, disallowedTools:[], skipPermissions:false}`.
+* This is serve's "seamless routine + decisions to the user" model: `canUseTool`
+* stays LIVE (skipPermissions:false, NOT bypass), routine tools in `allowedTools`
+* auto-run with no prompt, and `AskUserQuestion`/`ExitPlanMode` — deliberately
+* NOT in the list and hard-cased by CloudCLI into `TOOLS_REQUIRING_INTERACTION` —
+* always reach the human as a real question widget / plan Approve-Reject card.
+* `skipPermissions:true` (bypass) would skip `canUseTool` entirely and silently
+* auto-answer those two, which is exactly what we are fixing.
 */
 function buildInjection(token, seedToolSettings = false, seedAllowedTools = []) {
 	let body = `localStorage.setItem('auth-token',${JSON.stringify(token).replace(/</g, "\\u003c")});`;
 	if (seedToolSettings) {
 		const settings = JSON.stringify({
-			allowedTools: seedAllowedTools,
+			allowedTools: seedAllowedTools.filter((t) => !NEVER_AUTO_APPROVE.has(t)),
 			disallowedTools: [],
-			skipPermissions: true
+			skipPermissions: false
 		});
 		const safeSettings = JSON.stringify(settings).replace(/</g, "\\u003c");
 		body += `localStorage.setItem('${CLAUDE_SETTINGS_KEY}',${safeSettings});`;
@@ -11542,6 +11647,7 @@ const serve$1 = defineCommand({
 			fleetOverTunnel: args["fleet-over-tunnel"] === true
 		});
 		const anthropicVars = getClaudeCodeEnvVars(serverUrl, chosenSlug);
+		delete anthropicVars.CLAUDE_CODE_FORK_SUBAGENT;
 		if (enhancements.nonce) {
 			anthropicVars.GH_ROUTER_HOOK_MCP_URL = serverUrl;
 			anthropicVars.GH_ROUTER_HOOK_NONCE = enhancements.nonce;
@@ -11650,7 +11756,7 @@ const serve$1 = defineCommand({
 				bindPort: servePort,
 				authToken: token,
 				seedToolSettings: process.env.GH_ROUTER_SERVE_NO_AUTO_APPROVE !== "1",
-				seedAllowedTools: enhancements.mcpToolNames ?? [],
+				seedAllowedTools: [...SEAMLESS_BUILTIN_TOOLS, ...enhancements.mcpToolNames ?? []],
 				extraAllowedHosts,
 				extraAllowedOrigins,
 				allowDevtunnelHosts: tunnelMode,