zelari-code 1.47.1 → 1.48.0

package/dist/cli/hooks/usePermissionBroker.js

@@ -20,6 +20,7 @@ import { startPermissionBroker, } from "../mcp/permissionBroker.js";
 import { createBrokerPermissionHandler, createBrokerQuestionHandler, } from "../mcp/brokerHandlers.js";
 import { createPermissionAskHandler } from "./permissionPicker.js";
 import { appendSystem } from "./messageHelpers.js";
+import { armPickerTimeout, askUserTimeoutMs } from "./askUserTimeout.js";
 export function usePermissionBroker(opts) {
     const { setPicker, setMessages } = opts;
     const handleRef = useRef(null);
@@ -42,13 +43,22 @@ export function usePermissionBroker(opts) {
                 return;
             }
             let settled = false;
+            let cancelWaitTimeout;
             const finish = (value) => {
                 if (settled)
                     return;
                 settled = true;
+                cancelWaitTimeout?.();
                 setPicker(null);
                 resolve(value);
             };
+            // v1.47.x: timeout so an unseen external-agent question cannot block
+            // the broker client forever. Knob: ZELARI_ASK_USER_TIMEOUT_MS.
+            const waitTimeoutMs = askUserTimeoutMs();
+            cancelWaitTimeout = armPickerTimeout(() => {
+                appendSystem(setMessages, `[external agent] nessuna risposta entro ${Math.round(waitTimeoutMs / 1000)}s — richiesta annullata.`, Date.now());
+                finish(null);
+            }, waitTimeoutMs);
             appendSystem(setMessages, `[external agent] ${req.question}\n→ ${choices.join(" · ")}`, Date.now());
             setPicker({
                 kind: "clarification",

package/dist/cli/hooks/usePermissionBroker.js.map

@@ -1 +1 @@
-{"version":3,"file":"usePermissionBroker.js","sourceRoot":"","sources":["../../../src/cli/hooks/usePermissionBroker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC;AAG1C,OAAO,EACL,qBAAqB,GAEtB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,6BAA6B,EAC7B,2BAA2B,GAC5B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,0BAA0B,EAAkB,MAAM,uBAAuB,CAAC;AACnF,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,MAAM,UAAU,mBAAmB,CAAC,IAGnC;IACC,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;IACxC,MAAM,SAAS,GAAG,MAAM,CAAgC,IAAI,CAAC,CAAC;IAE9D,SAAS,CAAC,GAAG,EAAE;QACb,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAC;QAC1D,IAAI,CAAC,UAAU;YAAE,OAAO;QAExB,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,MAAM,GAAkC,IAAI,CAAC;QAEjD,MAAM,eAAe,GAAG,0BAA0B,CAAC;YACjD,SAAS;YACT,YAAY,EAAE,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;SAC5E,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,CAAC,GAInB,EAA0B,EAAE,CAC3B,IAAI,OAAO,CAAgB,CAAC,OAAO,EAAE,EAAE;YACrC,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;iBAChC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;iBAC5B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAC/B,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,OAAO,CAAC,IAAI,CAAC,CAAC;gBACd,OAAO;YACT,CAAC;YACD,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,MAAM,MAAM,GAAG,CAAC,KAAoB,EAAE,EAAE;gBACtC,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,SAAS,CAAC,IAAI,CAAC,CAAC;gBAChB,OAAO,CAAC,KAAK,CAAC,CAAC;YACjB,CAAC,CAAC;YACF,YAAY,CACV,WAAW,EACX,oBAAoB,GAAG,CAAC,QAAQ,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAC5D,IAAI,CAAC,GAAG,EAAE,CACX,CAAC;YACF,SAAS,CAAC;gBACR,IAAI,EAAE,eAAe;gBACrB,KAAK,EAAE,GAAG,CAAC,QAAQ;gBACnB,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;gBACnD,QAAQ,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC1C,QAAQ,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC;aAC7B,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEL,KAAK,qBAAqB,CAAC,UAAU,EAAE;YACrC,YAAY,EAAE,6BAA6B,CAAC,EAAE,eAAe,EAAE,CAAC;YAChE,UAAU,EAAE,2BAA2B,CAAC,EAAE,UAAU,EAAE,CAAC;SACxD,CAAC;aACC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;YACV,IAAI,QAAQ,EAAE,CAAC;gBACb,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;gBACd,OAAO;YACT,CAAC;YACD,MAAM,GAAG,CAAC,CAAC;YACX,SAAS,CAAC,OAAO,GAAG,CAAC,CAAC;YACtB,YAAY,CACV,WAAW,EACX,oCAAoC,UAAU,2CAA2C,EACzF,IAAI,CAAC,GAAG,EAAE,CACX,CAAC;YACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,gDAAgD,UAAU,IAAI,CAC/D,CAAC;QACJ,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,oDACE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,IAAI,CACL,CAAC;QACJ,CAAC,CAAC,CAAC;QAEL,OAAO,GAAG,EAAE;YACV,QAAQ,GAAG,IAAI,CAAC;YAChB,IAAI,MAAM;gBAAE,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;YAC/B,SAAS,CAAC,OAAO,GAAG,IAAI,CAAC;QAC3B,CAAC,CAAC;IACJ,CAAC,EAAE,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;IAE7B,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,IAAI,SAAS,EAAE,CAAC;AAC7E,CAAC"}
+{"version":3,"file":"usePermissionBroker.js","sourceRoot":"","sources":["../../../src/cli/hooks/usePermissionBroker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC;AAG1C,OAAO,EACL,qBAAqB,GAEtB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,6BAA6B,EAC7B,2BAA2B,GAC5B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,0BAA0B,EAAkB,MAAM,uBAAuB,CAAC;AACnF,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEzE,MAAM,UAAU,mBAAmB,CAAC,IAGnC;IACC,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;IACxC,MAAM,SAAS,GAAG,MAAM,CAAgC,IAAI,CAAC,CAAC;IAE9D,SAAS,CAAC,GAAG,EAAE;QACb,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAC;QAC1D,IAAI,CAAC,UAAU;YAAE,OAAO;QAExB,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,MAAM,GAAkC,IAAI,CAAC;QAEjD,MAAM,eAAe,GAAG,0BAA0B,CAAC;YACjD,SAAS;YACT,YAAY,EAAE,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;SAC5E,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,CAAC,GAInB,EAA0B,EAAE,CAC3B,IAAI,OAAO,CAAgB,CAAC,OAAO,EAAE,EAAE;YACrC,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;iBAChC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;iBAC5B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAC/B,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,OAAO,CAAC,IAAI,CAAC,CAAC;gBACd,OAAO;YACT,CAAC;YACD,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,IAAI,iBAA2C,CAAC;YAChD,MAAM,MAAM,GAAG,CAAC,KAAoB,EAAE,EAAE;gBACtC,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,iBAAiB,EAAE,EAAE,CAAC;gBACtB,SAAS,CAAC,IAAI,CAAC,CAAC;gBAChB,OAAO,CAAC,KAAK,CAAC,CAAC;YACjB,CAAC,CAAC;YACF,qEAAqE;YACrE,+DAA+D;YAC/D,MAAM,aAAa,GAAG,gBAAgB,EAAE,CAAC;YACzC,iBAAiB,GAAG,gBAAgB,CAAC,GAAG,EAAE;gBACxC,YAAY,CACV,WAAW,EACX,2CAA2C,IAAI,CAAC,KAAK,CACnD,aAAa,GAAG,IAAI,CACrB,0BAA0B,EAC3B,IAAI,CAAC,GAAG,EAAE,CACX,CAAC;gBACF,MAAM,CAAC,IAAI,CAAC,CAAC;YACf,CAAC,EAAE,aAAa,CAAC,CAAC;YAClB,YAAY,CACV,WAAW,EACX,oBAAoB,GAAG,CAAC,QAAQ,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAC5D,IAAI,CAAC,GAAG,EAAE,CACX,CAAC;YACF,SAAS,CAAC;gBACR,IAAI,EAAE,eAAe;gBACrB,KAAK,EAAE,GAAG,CAAC,QAAQ;gBACnB,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;gBACnD,QAAQ,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC1C,QAAQ,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC;aAC7B,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEL,KAAK,qBAAqB,CAAC,UAAU,EAAE;YACrC,YAAY,EAAE,6BAA6B,CAAC,EAAE,eAAe,EAAE,CAAC;YAChE,UAAU,EAAE,2BAA2B,CAAC,EAAE,UAAU,EAAE,CAAC;SACxD,CAAC;aACC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;YACV,IAAI,QAAQ,EAAE,CAAC;gBACb,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;gBACd,OAAO;YACT,CAAC;YACD,MAAM,GAAG,CAAC,CAAC;YACX,SAAS,CAAC,OAAO,GAAG,CAAC,CAAC;YACtB,YAAY,CACV,WAAW,EACX,oCAAoC,UAAU,2CAA2C,EACzF,IAAI,CAAC,GAAG,EAAE,CACX,CAAC;YACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,gDAAgD,UAAU,IAAI,CAC/D,CAAC;QACJ,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,oDACE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,IAAI,CACL,CAAC;QACJ,CAAC,CAAC,CAAC;QAEL,OAAO,GAAG,EAAE;YACV,QAAQ,GAAG,IAAI,CAAC;YAChB,IAAI,MAAM;gBAAE,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;YAC/B,SAAS,CAAC,OAAO,GAAG,IAAI,CAAC;QAC3B,CAAC,CAAC;IACJ,CAAC,EAAE,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;IAE7B,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,IAAI,SAAS,EAAE,CAAC;AAC7E,CAAC"}

package/dist/cli/main.bundled.js

@@ -628,7 +628,12 @@ async function refreshGrokToken(options) {
         grant_type: "refresh_token",
         client_id: options.clientId,
         refresh_token: options.refreshToken
-      }).toString()
+      }).toString(),
+      // v1.47.x: hard 30s cap. A hung auth socket used to freeze the whole
+      // turn on "working" forever with no error (the refresh promise never
+      // settled). A visible failure is strictly better: callers fall back
+      // to the current token and surface the error.
+      signal: AbortSignal.timeout(3e4)
     });
   } catch (err) {
     throw new GrokOAuthError(
@@ -2873,15 +2878,90 @@ var init_advancedTools = __esm({
 
 // packages/core/dist/core/tools/zodBridge.js
 function zodToJsonSchema(schema) {
+  let out;
   if (typeof schema.toJSONSchema === "function") {
     const res = schema.toJSONSchema();
     if (res && typeof res === "object") {
       const copy = { ...res };
       delete copy["$schema"];
-      return copy;
+      out = copy;
+    } else {
+      out = _convert(schema);
+    }
+  } else {
+    out = _convert(schema);
+  }
+  return ensureRootObjectType(out);
+}
+function ensureRootObjectType(schema) {
+  if (schema.type === "object")
+    return schema;
+  const variants = schema.anyOf ?? schema.oneOf;
+  if (!Array.isArray(variants) || variants.length === 0)
+    return schema;
+  const branches = [];
+  for (const v of variants) {
+    if (!v || typeof v !== "object" || Array.isArray(v) || v.type !== "object") {
+      return schema;
+    }
+    branches.push(v);
+  }
+  const distinct = /* @__PURE__ */ new Map();
+  for (const b of branches) {
+    const props = b.properties ?? {};
+    for (const [key, val] of Object.entries(props)) {
+      const list = distinct.get(key) ?? [];
+      if (!list.some((s) => JSON.stringify(s) === JSON.stringify(val)))
+        list.push(val);
+      distinct.set(key, list);
+    }
+  }
+  const properties = {};
+  for (const [key, schemas] of distinct) {
+    if (schemas.length === 1) {
+      properties[key] = schemas[0];
+      continue;
+    }
+    const consts = [];
+    let allConst = true;
+    for (const s of schemas) {
+      if (s && typeof s === "object" && "const" in s) {
+        consts.push(s.const);
+      } else {
+        allConst = false;
+        break;
+      }
+    }
+    if (allConst) {
+      const merged2 = { enum: consts };
+      const t = typeof consts[0];
+      if (consts.every((c) => typeof c === t)) {
+        if (t === "string")
+          merged2.type = "string";
+        else if (t === "boolean")
+          merged2.type = "boolean";
+        else if (t === "number")
+          merged2.type = Number.isInteger(consts[0]) ? "integer" : "number";
+      }
+      properties[key] = merged2;
+    } else {
+      properties[key] = { anyOf: schemas };
     }
   }
-  return _convert(schema);
+  let required2;
+  for (const b of branches) {
+    const req = Array.isArray(b.required) ? b.required.filter((k) => typeof k === "string") : [];
+    required2 = required2 === void 0 ? [...req] : required2.filter((k) => req.includes(k));
+  }
+  const merged = {
+    type: "object",
+    properties,
+    required: required2 ?? []
+  };
+  if (branches.every((b) => b.additionalProperties === false)) {
+    merged.additionalProperties = false;
+  }
+  return merged;
 }
 function _convert(schema) {
   const def = schema._def;
@@ -19444,7 +19524,7 @@ var init_web = __esm({
 
 // packages/core/dist/agents/harnessToolBridge.js
 function toEnhanced(tool) {
-  const schema = zodToJsonSchema(tool.inputSchema);
+  const schema = tool.jsonSchema ?? zodToJsonSchema(tool.inputSchema);
   return {
     name: tool.name,
     description: tool.description,
@@ -32815,6 +32895,7 @@ function createInspectCommandTool(rootOrDeps) {
     permissions: ["read"],
     timeoutMs: 9e4,
     inputSchema: inspectInputSchema,
+    jsonSchema: inspectJsonSchema,
     execute: async (input, ctx) => {
       const op = input;
       const cwd = ctx?.cwd ?? deps.root;
@@ -32847,7 +32928,7 @@ function createInspectCommandTool(rootOrDeps) {
   };
   return tool;
 }
-var MAX_OUTPUT_CHARS, SPAWN_TIMEOUT_MS, TYPECHECK_TIMEOUT_MS, inspectInputSchema;
+var MAX_OUTPUT_CHARS, SPAWN_TIMEOUT_MS, TYPECHECK_TIMEOUT_MS, inspectInputSchema, INSPECT_OPERATIONS, inspectJsonSchema;
 var init_inspectCommand = __esm({
   "src/cli/tools/inspectCommand.ts"() {
     "use strict";
@@ -32878,6 +32959,29 @@ var init_inspectCommand = __esm({
       external_exports.object({ operation: external_exports.literal("npm_outdated") }),
       external_exports.object({ operation: external_exports.literal("npm_view"), package: external_exports.string().min(1) })
     ]);
+    INSPECT_OPERATIONS = inspectInputSchema.options.map(
+      (variant) => variant.shape.operation.value
+    );
+    inspectJsonSchema = {
+      type: "object",
+      properties: {
+        operation: {
+          type: "string",
+          enum: INSPECT_OPERATIONS,
+          description: "Inspection to run \u2014 pick from the menu instead of writing a command."
+        },
+        short: { type: "boolean", description: "git_status only: --short form." },
+        limit: { type: "integer", minimum: 1, maximum: 200, description: "git_log only: max commits (default 20)." },
+        oneline: { type: "boolean", description: "git_log only: one line per commit." },
+        staged: { type: "boolean", description: "git_diff only: staged changes." },
+        path: { type: "string", description: "git_diff only: limit the diff to this path." },
+        ref: { type: "string", description: "git_show only (required there): commit or ref to show." },
+        project: { type: "string", description: "typecheck only: subdirectory containing tsconfig.json." },
+        package: { type: "string", description: "npm_view only (required there): package name." }
+      },
+      required: ["operation"],
+      additionalProperties: false
+    };
   }
 });
 
@@ -48296,9 +48400,17 @@ function WorkingIndicator({
 // src/cli/components/LiveRegion.tsx
 var LIVE_STREAM_TAIL_LINES = 10;
 var MAX_LIVE_TOOLS = 4;
-function LiveRegion({ live, busy, elapsedMs = null }) {
+function LiveRegion({
+  live,
+  busy,
+  elapsedMs = null,
+  waitingForUser = false,
+  waitingSinceMs = 0
+}) {
   const { streaming, runningTools } = live;
-  if (!streaming && runningTools.length === 0 && !busy) return null;
+  if (!streaming && runningTools.length === 0 && !busy && !waitingForUser) {
+    return null;
+  }
   const visibleTools = runningTools.slice(0, MAX_LIVE_TOOLS);
   const hiddenTools = runningTools.length - visibleTools.length;
   return /* @__PURE__ */ React5.createElement(Box4, { flexDirection: "column", paddingX: 1 }, streaming && streaming.role === "assistant" && /* @__PURE__ */ React5.createElement(
@@ -48310,7 +48422,7 @@ function LiveRegion({ live, busy, elapsedMs = null }) {
       memberName: streaming.memberName,
       memberId: streaming.memberId
     }
-  ), visibleTools.map((t) => /* @__PURE__ */ React5.createElement(Box4, { key: t.id, flexDirection: "column" }, renderMessage(t, true))), hiddenTools > 0 ? /* @__PURE__ */ React5.createElement(Text5, { dimColor: true }, "  \u2026 +", hiddenTools, " more tools") : null, busy && runningTools.length === 0 && !streaming && /* @__PURE__ */ React5.createElement(WorkingIndicator, { elapsedMs }));
+  ), visibleTools.map((t) => /* @__PURE__ */ React5.createElement(Box4, { key: t.id, flexDirection: "column" }, renderMessage(t, true))), hiddenTools > 0 ? /* @__PURE__ */ React5.createElement(Text5, { dimColor: true }, "  \u2026 +", hiddenTools, " more tools") : null, waitingForUser && /* @__PURE__ */ React5.createElement(Text5, { color: "yellow", bold: true }, "\u23F8 In attesa della TUA risposta", waitingSinceMs > 0 ? ` (${Math.floor(Math.max(0, Date.now() - waitingSinceMs) / 1e3)}s)` : "", " \u2014 \u2191/\u2193 + Invio \xB7 Esc = annulla"), busy && runningTools.length === 0 && !streaming && !waitingForUser && /* @__PURE__ */ React5.createElement(WorkingIndicator, { elapsedMs }));
 }
 function StreamingTail(m) {
   const lines = m.content.split("\n");
@@ -51160,6 +51272,22 @@ init_taskTool();
 
 // src/cli/hooks/permissionPicker.ts
 init_toolPermissions();
+
+// src/cli/hooks/askUserTimeout.ts
+function askUserTimeoutMs() {
+  const raw = process.env.ZELARI_ASK_USER_TIMEOUT_MS?.trim();
+  if (!raw) return 3e5;
+  const n = Number.parseInt(raw, 10);
+  if (!Number.isFinite(n) || n < 0) return 3e5;
+  return n;
+}
+function armPickerTimeout(onFire, ms) {
+  if (ms <= 0) return () => void 0;
+  const id = setTimeout(onFire, ms);
+  return () => clearTimeout(id);
+}
+
+// src/cli/hooks/permissionPicker.ts
 function createPermissionAskHandler(opts) {
   const { setPicker: setPicker2, appendSystem: appendSystem2 } = opts;
   return (req) => new Promise((resolve3) => {
@@ -51174,13 +51302,25 @@ ${detail}
       Date.now()
     );
     let settled = false;
+    const askTimeoutMs = askUserTimeoutMs();
+    let cancelAskTimeout = () => void 0;
     const finish = (ok, note) => {
       if (settled) return;
       settled = true;
+      cancelAskTimeout();
       setPicker2(null);
       if (note) appendSystem2?.(note, Date.now());
       resolve3(ok);
     };
+    cancelAskTimeout = armPickerTimeout(
+      () => finish(
+        false,
+        `[permission] ask for "${req.toolName}" timed out after ${Math.round(
+          askTimeoutMs / 1e3
+        )}s \u2014 denied (tool can be re-run). Knob: ZELARI_ASK_USER_TIMEOUT_MS.`
+      ),
+      askTimeoutMs
+    );
     const items = [
       { value: "allow", label: "Allow once" },
       {
@@ -51530,12 +51670,28 @@ _(${req.context})_` : "") + "\n\u2192 scegli dalla lista (il turno continua dopo
             Date.now()
           );
           let settled = false;
+          const askTimeoutMs = askUserTimeoutMs();
+          let cancelAskTimeout = () => void 0;
           const finish = (value) => {
             if (settled) return;
             settled = true;
+            cancelAskTimeout();
             setPicker2(null);
             resolve3(value);
           };
+          cancelAskTimeout = armPickerTimeout(
+            () => {
+              appendSystem(
+                setMessages,
+                `[ask_user] nessuna risposta entro ${Math.round(
+                  askTimeoutMs / 1e3
+                )}s \u2014 proseguo con assunzione documentata (ZELARI_ASK_USER_TIMEOUT_MS).`,
+                Date.now()
+              );
+              finish(null);
+            },
+            askTimeoutMs
+          );
           setPicker2({
             kind: "clarification",
             title: req.question,
@@ -52245,12 +52401,28 @@ _(${req.context})_` : "") + "\n\u2192 scegli dalla lista (il membro riprende dop
       Date.now()
     );
     let settled = false;
+    const askTimeoutMs = askUserTimeoutMs();
+    let cancelAskTimeout = () => void 0;
     const finish = (value) => {
       if (settled) return;
       settled = true;
+      cancelAskTimeout();
       setPicker2(null);
       resolve3(value);
     };
+    cancelAskTimeout = armPickerTimeout(
+      () => {
+        appendSystem(
+          setMessages,
+          `[council ask_user] nessuna risposta entro ${Math.round(
+            askTimeoutMs / 1e3
+          )}s \u2014 il membro prosegue con assunzione documentata (ZELARI_ASK_USER_TIMEOUT_MS).`,
+          Date.now()
+        );
+        finish(null);
+      },
+      askTimeoutMs
+    );
     setPicker2({
       kind: "clarification",
       title: req.question,
@@ -53015,12 +53187,25 @@ function usePermissionBroker(opts) {
         return;
       }
       let settled = false;
+      let cancelWaitTimeout;
       const finish = (value) => {
         if (settled) return;
         settled = true;
+        cancelWaitTimeout?.();
         setPicker2(null);
         resolve3(value);
       };
+      const waitTimeoutMs = askUserTimeoutMs();
+      cancelWaitTimeout = armPickerTimeout(() => {
+        appendSystem(
+          setMessages,
+          `[external agent] nessuna risposta entro ${Math.round(
+            waitTimeoutMs / 1e3
+          )}s \u2014 richiesta annullata.`,
+          Date.now()
+        );
+        finish(null);
+      }, waitTimeoutMs);
       appendSystem(
         setMessages,
         `[external agent] ${req.question}
@@ -56296,6 +56481,11 @@ function App() {
   const [mode, setMode] = useState8("kraken");
   const [phase2, setPhaseUi] = useState8("build");
   const [picker, setPicker2] = useState8(null);
+  const [pickerSince, setPickerSince] = useState8(0);
+  useEffect8(() => {
+    if (picker) setPickerSince((s) => s > 0 ? s : Date.now());
+    else setPickerSince(0);
+  }, [picker]);
   const activeProviderSpec = getActiveProvider();
   const activeModel = providerConfig.modelByProvider[activeProviderSpec.id];
   const session = useSession();
@@ -56420,7 +56610,16 @@ function App() {
       columns: size.columns || 80,
       rows: size.rows || 24
     }
-  ) : renderMessage(item)), /* @__PURE__ */ React10.createElement(Box9, { flexDirection: "row" }, /* @__PURE__ */ React10.createElement(Box9, { flexDirection: "column", flexGrow: 1, paddingX: 1 }, /* @__PURE__ */ React10.createElement(LiveRegion, { live: session.live, busy, elapsedMs: timer.elapsedMs }), picker ? /* @__PURE__ */ React10.createElement(
+  ) : renderMessage(item)), /* @__PURE__ */ React10.createElement(Box9, { flexDirection: "row" }, /* @__PURE__ */ React10.createElement(Box9, { flexDirection: "column", flexGrow: 1, paddingX: 1 }, /* @__PURE__ */ React10.createElement(
+    LiveRegion,
+    {
+      live: session.live,
+      busy,
+      elapsedMs: timer.elapsedMs,
+      waitingForUser: picker !== null,
+      waitingSinceMs: pickerSince
+    }
+  ), picker ? /* @__PURE__ */ React10.createElement(
     SelectList,
     {
       title: picker.title,