Chief: no permission request waits on an answer nobody can give

Native/OptChat/optchat-chief/src/agents.rs

@@ -436,7 +436,17 @@ pub fn run(flags: &Flags) -> Result<String, String> {
             }
             client
                 .request("_acpmux/permission_respond", params)
-                .map_err(|e| e.to_string())?;
+                .map_err(|e| {
+                    if verb == "allow" {
+                        // acpmux takes an allow only from the person's app,
+                        // and a child has no tab there: say what still works.
+                        format!(
+                            "{e}\nOnly the person's cmux app can allow, and {name} has no tab there: `chief agents deny {name}` denies it, or tell it what to do instead with `chief agents prompt {name} \"...\"`."
+                        )
+                    } else {
+                        e.to_string()
+                    }
+                })?;
             client.close();
             Ok(format!(
                 "{}: {}",

Native/OptChat/optchat-chief/src/approval.rs

@@ -203,14 +203,23 @@ fn code_span(text: &str) -> String {
 /// A request's identity within one turn: the tool and its input. A
 /// repeat of a refused request counts toward stopping the turn.
 pub fn signature(pending: &Pending) -> String {
-    let input = pending
-        .request
-        .pointer("/toolCall/rawInput")
-        .map(Value::to_string)
-        .unwrap_or_default();
-    format!("{}\u{0}{input}", pending.tool)
+    signature_of(&pending.tool, pending.request.pointer("/toolCall/rawInput"))
 }
 
+/// [`signature`] of a call of `tool` with `input` (a permission request's
+/// `rawInput`, or the arguments a Chief tool runs with).
+pub fn signature_of(tool: &str, input: Option<&Value>) -> String {
+    let input = input.map(Value::to_string).unwrap_or_default();
+    format!("{tool}\u{0}{input}")
+}
+
+/// The longest a permission request of the Chief's turn session or of one
+/// of its children may wait with no answer before the host denies it
+/// (`Brain::deny_overdue_permissions_at`): a request nobody sees never holds
+/// a turn forever. A subagent's prompt that the person's app shows with an
+/// approval button waits for the person instead.
+pub const PERMISSION_WAIT: std::time::Duration = std::time::Duration::from_secs(120);
+
 /// Appends one `approval` event to the trace in `dir`
 /// (`traces/YYYY-MM-DD.jsonl`, the monitoring trace's layout:
 /// `{"ts", "ev", ...}`, 0600). A failed write is reported, never fatal.