fix(mobile): route phone APIs to selected profile and unblock runtime readiness

ci(gitea): run the approval-gate tests on the Windows runner
This fork had no CI on Gitea (Actions was off; the upstream .github workflows do not run here). Add one job that runs the protected instruction-file gate tests and the file-write safety tests on the Windows runner. Seven upstream tests that cannot pass on Windows (POSIX paths, symlink privilege, POSIX stat) are deselected by name and listed in the job log. Kart: turkservis-20261007-1421-2 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwSpve9HuXMy7dHf4RDMzX
2026-10-07 20:10:36 +03:00 · 2026-10-07 18:12:14 +03:00 · 2026-10-07 17:17:05 +03:00
26 changed files with 1942 additions and 190 deletions
@@ -0,0 +1,107 @@
+# AITURK IDE ajan CI (kart turkservis-20261007-1421-2).
+#
+# Bu depo bir yukari akis catalidir; .github/workflows altindaki GitHub is akislari Gitea'da kosmaz. .gitea/workflows
+# klasoru var oldugu surece Gitea yalniz buradaki is akislarini okur.
+#
+# Ne kosar: korumali talimat dosyasi onay kapisinin testleri (insana sorulamayan kosuda aninda BLOCKED, gec onayin
+# uygulanmamasi, yolo ile kapinin acilmamasi) ve dosya yazma guvenligi testleri. Kosucu Windows'tur (etiket
+# windows-latest; 7 Ekim 2026'da cevrimici kosucu hermes-laptop-windows): urunun hedefi Windows x64'tur ve hata
+# Windows asama kosusunda gorulmustur.
+#
+# Ne sayilmaz (durustluk notu): tests/tools/test_file_write_safety.py icindeki 7 test Windows'ta bu degisiklikten
+# bagimsiz olarak gecemez; yukari akis bunlari POSIX icin yazmistir (/etc, /private/etc, /boot yollari; yonetici
+# ayricaligi isteyen symlink; POSIX stat alanlari). Asagida adlariyla deselect edilir; degismemis 58dbb4523b
+# commit'inde de ayni 7 test kaliyordu (7 Ekim 2026 olcumu). Tam yukari akis test takimi burada KOSMAZ.
+name: ci
+
+on:
+  push:
+    branches:
+      - aiturk/main
+      - fix/ide-windows-vcruntime
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  mobile-link-windows:
+    runs-on: windows-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          github-server-url: https://gitea.twinpay.one
+      - name: Mobil TLS, profil ve baslatma regresyonlari
+        shell: powershell
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $deps = Join-Path $env:RUNNER_TEMP "mobile-tests-$env:GITHUB_RUN_ID"
+          New-Item -ItemType Directory -Force -Path $deps | Out-Null
+          npm install --prefix $deps --no-save --ignore-scripts --no-audit --no-fund --legacy-peer-deps vitest@4.1.10 ws@8.21.1
+          if ($LASTEXITCODE -ne 0) { throw 'Test bagimliliklari kurulamadi' }
+          New-Item -ItemType Junction -Path node_modules -Target (Join-Path $deps 'node_modules') | Out-Null
+          node node_modules/vitest/vitest.mjs run --root apps/desktop --config vitest.mobile.config.ts
+          exit $LASTEXITCODE
+
+  approval-gate-windows:
+    runs-on: windows-latest
+    timeout-minutes: 40
+    steps:
+      - name: Kaynagi al
+        uses: actions/checkout@v4
+        with:
+          github-server-url: https://gitea.twinpay.one
+
+      - name: Ortami kur
+        shell: powershell
+        run: |
+          $ErrorActionPreference = 'Stop'
+          "kosucu: $env:COMPUTERNAME / $env:USERNAME"
+          "checkout SHA: $(git rev-parse HEAD) / beklenen: $env:GITHUB_SHA"
+          $py = $null
+          $launcher = Get-Command py -ErrorAction SilentlyContinue
+          if ($launcher) { $py = (& $launcher.Source -3 -c 'import sys; print(sys.executable)').Trim() }
+          if (-not $py) {
+            $cmd = Get-Command python -ErrorAction SilentlyContinue
+            if ($cmd -and $cmd.Source -notlike '*\WindowsApps\*') { $py = $cmd.Source }
+          }
+          if (-not $py) { throw 'Python bulunamadi' }
+          "onyukleme python: $py"
+          & $py -m pip install --quiet --disable-pip-version-check --target "$env:RUNNER_TEMP\uvboot" uv
+          if ($LASTEXITCODE -ne 0) { throw 'uv kurulamadi' }
+          $env:PYTHONPATH = "$env:RUNNER_TEMP\uvboot"
+          & $py -m uv venv --python 3.11 "$env:RUNNER_TEMP\ci-venv"
+          if ($LASTEXITCODE -ne 0) { throw 'venv olusturulamadi' }
+          & $py -m uv pip install --python "$env:RUNNER_TEMP\ci-venv\Scripts\python.exe" -e . pytest
+          if ($LASTEXITCODE -ne 0) { throw 'bagimliliklar kurulamadi' }
+          $env:PYTHONPATH = ''
+          & "$env:RUNNER_TEMP\ci-venv\Scripts\python.exe" --version
+
+      - name: Onay kapisi testleri
+        shell: powershell
+        run: |
+          $ErrorActionPreference = 'Continue'
+          $env:PYTHONDONTWRITEBYTECODE = '1'
+          $env:PYTHONUTF8 = '1'
+          $venv = "$env:RUNNER_TEMP\ci-venv\Scripts\python.exe"
+          $f = 'tests/tools/test_file_write_safety.py'
+          $sayilmayan = @(
+            "${f}::TestCheckSensitivePathMacOSBypass::test_etc_hosts_blocked",
+            "${f}::TestCheckSensitivePathMacOSBypass::test_private_etc_hosts_blocked",
+            "${f}::TestCheckSensitivePathMacOSBypass::test_private_etc_ssh_config_blocked",
+            "${f}::TestCheckSensitivePathMacOSBypass::test_private_var_blocked",
+            "${f}::TestCheckSensitivePathMacOSBypass::test_boot_still_blocked",
+            "${f}::TestAtomicWrite::test_patch_routes_through_atomic_write",
+            "${f}::TestProtectedInstructionFiles::test_symlink_to_protected_file_is_gated"
+          )
+          $deselect = @()
+          foreach ($t in $sayilmayan) { $deselect += '--deselect'; $deselect += $t }
+          "CI OZETI: Windows'ta sayilmayan (deselect) test sayisi: $($sayilmayan.Count)"
+          $sayilmayan | ForEach-Object { "  sayilmadi: $_" }
+          & $venv -m pytest tests/tools/test_protected_instruction_unattended.py $f `
+            tests/tools/test_computer_use_approval_isolation.py tests/cli/test_cli_approval_ui.py `
+            tests/cli/test_single_query_session_finalize.py @deselect -q -p no:cacheprovider -rf
+          $kod = $LASTEXITCODE
+          "pytest cikis kodu: $kod"
+          exit $kod
@@ -0,0 +1,32 @@
+# Mobile connection repair — beta.19
+
+The paired phone previously resolved the desktop's active profile. If that
+profile's startup promise was waiting for first-run setup, every phone API
+request waited too, even while the default backend was already serving.
+
+REST and WebSocket requests now resolve the phone's explicit `profile` query
+(default when absent). Aggregate `profile=all` reaches the default process
+without rewriting the downstream query. Invalid profile identifiers, remote
+backends and a missing local runtime are refused; phone requests do not install
+software or silently fall back to a different profile. Resolution has an eight
+second deadline; this is not an agent, tool or scheduled-job execution deadline.
+
+Shared-runtime completion wakes only a waiting setup for the same runtime root.
+Primary startup then resolves its own profile again. This does not grant
+installation consent or substitute a sibling profile's backend connection.
+
+## Evidence
+
+- 94 mobile transport, certificate, relay, profile and startup regression tests.
+- Electron TypeScript type check.
+- Opt-in `mobile-live.test.ts`, with `AITURK_TEST_BACKEND_PORT`: real local
+  backend behind the production TLS proxy, pinned certificate, screen reads,
+  cron create/update/pause/resume/delete and chat WebSocket ping. Test-created
+  job is deleted; existing jobs are untouched. This test does not trigger an
+  agent job or claim physical-phone/cellular acceptance.
+- Public relay hello was separately exercised using Android's production
+  OkHttp/Conscrypt stack. A successful hello alone does not prove API readiness.
+
+Publication, installed beta.19 and physical-phone acceptance are separate gates.
+Existing phone security exclusions are unchanged. Unsupported methods and
+features are not claimed to be implemented by this connection repair.
@@ -131,3 +131,37 @@ test('remote apply without a waiter has no first-run side effects', async () =>
  assert.equal(hidden, 0)
  assert.equal(gate.isLocalBootstrapConfirmed(), true)
 })
+
+test('a completed shared runtime wakes only its own pending setup, without granting installation consent', async () => {
+  let hidden = 0
+  const gate = createFirstRunSetupGate({ hideChoice: () => hidden++, stuckAfterMs: 0 })
+  const pending = gate.wait(bootstrapBackend)
+  assert.equal(gate.runtimeAvailable('/tmp/unrelated-runtime'), false)
+  assert.equal(await settledState(pending), 'pending')
+  assert.equal(gate.runtimeAvailable(bootstrapBackend.activeRoot), true)
+  assert.equal(await pending, 'runtime-ready')
+  assert.equal(gate.isLocalBootstrapConfirmed(), false)
+  assert.equal(hidden, 1)
+  assert.equal(gate.runtimeAvailable(bootstrapBackend.activeRoot), false)
+})
+
+test('late runtime readiness does not revive a reset or remotely resolved waiter', async () => {
+  const gate = createFirstRunSetupGate({ stuckAfterMs: 0 })
+  const pending = gate.wait(bootstrapBackend)
+  gate.resetForRetry()
+  assert.equal(await pending, 'reset')
+  assert.equal(gate.runtimeAvailable(bootstrapBackend.activeRoot), false)
+})
+
+test('runtime completed before wait does not leave a stale setup prompt pending', async () => {
+  let prompts = 0
+  const gate = createFirstRunSetupGate({
+    isRuntimeAvailable: backend => backend.activeRoot === bootstrapBackend.activeRoot,
+    promptChoice: () => prompts++,
+    stuckAfterMs: 0
+  })
+  assert.equal(await gate.wait(bootstrapBackend), 'runtime-ready')
+  assert.equal(gate.hasWaiter(), false)
+  assert.equal(gate.isLocalBootstrapConfirmed(), false)
+  assert.equal(prompts, 0)
+})
@@ -1,3 +1,5 @@
+import path from 'node:path'
+
 interface FirstRunSetupBackend {
  activeRoot?: string
  kind?: string
@@ -5,6 +7,7 @@ interface FirstRunSetupBackend {
 }

 interface FirstRunSetupGateOptions {
+  isRuntimeAvailable?: (backend: FirstRunSetupBackend) => boolean
  hideChoice?: () => void
  log?: (message: string) => void
  onStuck?: (backend: FirstRunSetupBackend, stuckAfterMs: number) => void
@@ -12,9 +15,10 @@ interface FirstRunSetupGateOptions {
  stuckAfterMs?: number
 }

-export type FirstRunSetupDecision = 'continue-local' | 'remote-applied' | 'reset'
+export type FirstRunSetupDecision = 'continue-local' | 'remote-applied' | 'reset' | 'runtime-ready'

 export function createFirstRunSetupGate({
+  isRuntimeAvailable,
  hideChoice,
  log,
  onStuck,
@@ -24,6 +28,7 @@ export function createFirstRunSetupGate({
  let localBootstrapConfirmed = false

  let waiter: {
+    activeRoot?: string
    promise: Promise<FirstRunSetupDecision>
    resolve: (decision: FirstRunSetupDecision) => void
  } | null = null
@@ -65,6 +70,13 @@ export function createFirstRunSetupGate({
      return 'continue-local' as const
    }

+    // Recheck synchronously before registering the waiter: another profile
+    // may have completed installation before this stale descriptor arrived.
+    if (backend && isRuntimeAvailable?.(backend)) {
+      if (backend.activeRoot) runtimeAvailable(backend.activeRoot)
+      return 'runtime-ready' as const
+    }
+
    if (waiter) {
      return waiter.promise
    }
@@ -78,7 +90,7 @@ export function createFirstRunSetupGate({
      resolveWaiter = resolve
    })

-    waiter = { promise, resolve: resolveWaiter }
+    waiter = { activeRoot: backend?.activeRoot, promise, resolve: resolveWaiter }

    return promise
  }
@@ -102,6 +114,21 @@ export function createFirstRunSetupGate({
    settleWaiter('continue-local')
  }

+  // A sibling profile may finish installing the SAME shared runtime while the
+  // primary boot is awaiting a setup choice. Re-resolve it; do not interpret
+  // this as permission for another installation, or reuse the sibling's
+  // profile/backend descriptor.
+  const runtimeAvailable = (root: string) => {
+    const canonical = (value: string) => {
+      const absolute = path.resolve(value)
+      return process.platform === 'win32' ? absolute.toLowerCase() : absolute
+    }
+    if (!waiter?.activeRoot || canonical(waiter.activeRoot) !== canonical(root)) return false
+    settleWaiter('runtime-ready')
+    hideChoice?.()
+    return true
+  }
+
  const resetForRetry = () => {
    // Reset paths are followed by a renderer reload / fresh startHermes() call.
    // Settle the old boot explicitly so it cannot fall through into local
@@ -140,6 +167,7 @@ export function createFirstRunSetupGate({
    isLocalBootstrapConfirmed,
    resetForRepair,
    resetForRetry,
+    runtimeAvailable,
    shouldGate,
    wait
  }
@@ -36,6 +36,7 @@ import { WebSocket as RelayWebSocket } from 'ws'

 import { classifyActiveRuntime, needsPackagedRuntimeUpgrade } from './active-runtime-state'
 import { createAiturkCliRunner, createAiturkLogin } from './aiturk-login'
+import { createMobileBackendResolver } from './mobile-backend'
 import {
  createMobileLink,
  createMobileLinkFileStore,
@@ -2075,6 +2076,10 @@ function hideFirstRunSetupChoice() {
 function getFirstRunSetupGate() {
  if (!firstRunSetupGate) {
    firstRunSetupGate = createFirstRunSetupGate({
+      isRuntimeAvailable: backend =>
+        backend.activeRoot === ACTIVE_HERMES_ROOT &&
+        resolveHermesBackend(['--profile', primaryProfileKey(), 'serve', '--host', '127.0.0.1', '--port', '0']).kind !==
+          'bootstrap-needed',
      hideChoice: hideFirstRunSetupChoice,
      log: rememberLog,
      onStuck: (_backend, stuckAfterMs) => {
@@ -5259,6 +5264,11 @@ async function ensureRuntime(backend) {
    error: null
  })

+  // Runtime installation is shared; profile processes and their data are not.
+  // Wake only a setup waiter for this exact installed root, then let primary
+  // startup resolve its own profile again (never adopt a pool connection).
+  firstRunSetupGate?.runtimeAvailable(ACTIVE_HERMES_ROOT)
+
  return backend
 }

@@ -6795,7 +6805,7 @@ function buildApplicationMenu() {

  const checkForUpdatesItem = {
    label: 'Check for Updates…',
-    click: () => IS_PACKAGED ? void shell.openExternal(AITURK_PRODUCT.downloads) : sendOpenUpdatesRequested()
+    click: () => (IS_PACKAGED ? void shell.openExternal(AITURK_PRODUCT.downloads) : sendOpenUpdatesRequested())
  }

  if (IS_MAC) {
@@ -17646,8 +17656,11 @@ async function getUninstallSummary() {
 async function runDesktopUninstall(_mode) {
  // The upstream cleanup script removes Hermes-specific shortcuts, registry
  // entries and global launchers. AITURK is owned by its OS package manager.
-  return { ok: false, error: 'aiturk-os-uninstaller',
-    message: 'AITURK IDE işletim sisteminin uygulama yöneticisinden kaldırılır.' }
+  return {
+    ok: false,
+    error: 'aiturk-os-uninstaller',
+    message: 'AITURK IDE işletim sisteminin uygulama yöneticisinden kaldırılır.'
+  }
 }

 ipcMain.handle('hermes:uninstall:summary', async () => getUninstallSummary())
@@ -17853,19 +17866,13 @@ function getMobileLink(): MobileLink {
    // Same vault file as before (mobile-secrets.bin, safeStorage); older fields are kept.
    vault: new MobileVault(directory, safeStorage),
    store: createMobileLinkFileStore(directory, path.join(directory, 'lan-link.json'), fs.promises),
-    resolveBackend: async () => {
-      if (mobileLinkRemoteMode()) {
-        throw new Error('aiturk-mobile:remote_mode')
-      }
-
-      const connection = await ensureBackend(primaryProfileKey())
-
-      if (connection.mode !== 'local') {
-        throw new Error('aiturk-mobile:remote_mode')
-      }
-
-      return { baseUrl: connection.baseUrl, token: connection.token }
-    },
+    resolveBackend: createMobileBackendResolver({
+      isRemote: profile => mobileLinkRemoteMode() || profileHasRemoteOverride(profile),
+      runtimeNeedsInstall: profile =>
+        resolveHermesBackend(['--profile', profile, 'serve', '--host', '127.0.0.1', '--port', '0']).kind ===
+        'bootstrap-needed',
+      ensureBackend
+    }),
    isRemoteMode: mobileLinkRemoteMode,
    firewall: createWindowsFirewall({
      spawn,
@@ -17875,11 +17882,20 @@ function getMobileLink(): MobileLink {
      // console code page; latin1 keeps every byte and the parser needs no translated word.
      run: (file, args) =>
        new Promise(resolve => {
-          execFile(file, args, { windowsHide: true, timeout: 8000, encoding: 'latin1', maxBuffer: 256 * 1024 }, (error, stdout) => {
-            const code = error ? (typeof (error as { code?: unknown }).code === 'number' ? ((error as { code?: unknown }).code as number) : null) : 0
+          execFile(
+            file,
+            args,
+            { windowsHide: true, timeout: 8000, encoding: 'latin1', maxBuffer: 256 * 1024 },
+            (error, stdout) => {
+              const code = error
+                ? typeof (error as { code?: unknown }).code === 'number'
+                  ? ((error as { code?: unknown }).code as number)
+                  : null
+                : 0

-            resolve({ code, stdout: String(stdout ?? '') })
-          })
+              resolve({ code, stdout: String(stdout ?? '') })
+            }
+          )
        })
    }),
    fetch: (url, init) => fetch(url, init as RequestInit),
@@ -17939,7 +17955,12 @@ app.whenReady().then(() => {
        }
        return ensureBackend(profile)
      }
-    }).then(stop => app.once('will-quit', () => { void stop() }))
+    })
+      .then(stop =>
+        app.once('will-quit', () => {
+          void stop()
+        })
+      )
      .catch(() => rememberLog('[chrome] Native bridge could not start.'))
  }
  // Warm the login-shell PATH resolution immediately so it usually completes
@@ -0,0 +1,48 @@
+import { expect, it, vi } from 'vitest'
+
+import { createMobileBackendResolver } from './mobile-backend'
+
+const local = { mode: 'local', baseUrl: 'http://127.0.0.1:12345', token: 'test-session' }
+
+it('uses the phone profile even while another desktop profile is awaiting setup', async () => {
+  const ensureBackend = vi.fn(async (profile: string) => {
+    if (profile === 'fusion-frontier') return new Promise<typeof local>(() => {})
+    return local
+  })
+  const resolve = createMobileBackendResolver({
+    isRemote: () => false,
+    runtimeNeedsInstall: () => false,
+    ensureBackend
+  })
+  expect(await resolve('default')).toEqual({ baseUrl: local.baseUrl, token: local.token })
+  expect(ensureBackend).toHaveBeenCalledExactlyOnceWith('default')
+})
+
+it('never bootstraps an absent runtime or silently replaces a remote profile with default', async () => {
+  const ensureBackend = vi.fn(async () => local)
+  const resolve = createMobileBackendResolver({
+    isRemote: profile => profile === 'remote',
+    runtimeNeedsInstall: () => true,
+    ensureBackend
+  })
+  await expect(resolve('default')).rejects.toThrow('runtime_not_ready')
+  await expect(resolve('remote')).rejects.toThrow('remote_mode')
+  expect(ensureBackend).not.toHaveBeenCalled()
+})
+
+it('preserves an explicitly selected local profile and rejects remote-mode changes during resolution', async () => {
+  let remote = false
+  const ensureBackend = vi.fn(async () => local)
+  const resolve = createMobileBackendResolver({
+    isRemote: () => remote,
+    runtimeNeedsInstall: () => false,
+    ensureBackend
+  })
+  await resolve('kodlama')
+  expect(ensureBackend).toHaveBeenCalledExactlyOnceWith('kodlama')
+  ensureBackend.mockImplementationOnce(async () => {
+    remote = true
+    return local
+  })
+  await expect(resolve('kodlama')).rejects.toThrow('remote_mode')
+})
@@ -0,0 +1,18 @@
+/** Mobile routing is explicit and cannot start a first-run installer. */
+export function createMobileBackendResolver<Connection extends { mode: string; baseUrl: string; token: string }>({
+  isRemote,
+  runtimeNeedsInstall,
+  ensureBackend
+}: {
+  isRemote: (profile: string) => boolean
+  runtimeNeedsInstall: (profile: string) => boolean
+  ensureBackend: (profile: string) => Promise<Connection>
+}) {
+  return async (profile: string) => {
+    if (isRemote(profile)) throw new Error('aiturk-mobile:remote_mode')
+    if (runtimeNeedsInstall(profile)) throw new Error('aiturk-mobile:runtime_not_ready')
+    const connection = await ensureBackend(profile)
+    if (connection.mode !== 'local' || isRemote(profile)) throw new Error('aiturk-mobile:remote_mode')
+    return { baseUrl: connection.baseUrl, token: connection.token }
+  }
+}
@@ -46,7 +46,10 @@ import {

 const SESSION = crypto.randomBytes(32).toString('base64url')
 const LOOPBACK = new Set(['localhost', '127.0.0.1', '::1'])
-const hostOnly = (value: unknown) => String(value || '').replace(/:\d+$/, '').toLowerCase()
+const hostOnly = (value: unknown) =>
+  String(value || '')
+    .replace(/:\d+$/, '')
+    .toLowerCase()
 const seen: { path: string; host: string; raw: string; method: string }[] = []
 const wrongCode = (code: string) => (code === 'ZZZZZZZZ' ? 'YYYYYYYY' : 'ZZZZZZZZ')

@@ -90,7 +93,12 @@ beforeAll(async () => {
      }
    }

-    seen.push({ path: req.url ?? '', host: String(req.headers.host), method: String(req.method), raw: JSON.stringify(req.headers) + req.url })
+    seen.push({
+      path: req.url ?? '',
+      host: String(req.headers.host),
+      method: String(req.method),
+      raw: JSON.stringify(req.headers) + req.url
+    })
    send(200, JSON.stringify({ ok: true, path: url.pathname }))
  })

@@ -143,48 +151,50 @@ interface CallOptions {
 }

 function call(port: number, method: string, path: string, options: CallOptions = {}) {
-  return new Promise<{ status: number; text: string; headers: http.IncomingHttpHeaders; json: any }>((resolve, reject) => {
-    const payload = options.rawBody ?? (options.body === undefined ? undefined : JSON.stringify(options.body))
+  return new Promise<{ status: number; text: string; headers: http.IncomingHttpHeaders; json: any }>(
+    (resolve, reject) => {
+      const payload = options.rawBody ?? (options.body === undefined ? undefined : JSON.stringify(options.body))

-    const req = https.request(
-      {
-        host: '127.0.0.1',
-        port,
-        method,
-        path,
-        agent: false,
-        ...(options.ca ? { ca: options.ca } : {}),
-        checkServerIdentity: () => undefined,
-        headers: {
-          ...(options.token ? { authorization: `Bearer ${options.token}` } : {}),
-          ...(options.headerToken ? { 'x-hermes-session-token': options.headerToken } : {}),
-          ...(payload ? { 'content-type': 'application/json' } : {}),
-          origin: 'http://evil.example',
-          cookie: 'session=evil',
-          ...options.headers
-        }
-      },
-      res => {
-        let text = ''
-
-        res.on('data', chunk => (text += chunk))
-        res.on('end', () => {
-          let json: any = null
-
-          try {
-            json = JSON.parse(text)
-          } catch {
-            json = null
+      const req = https.request(
+        {
+          host: '127.0.0.1',
+          port,
+          method,
+          path,
+          agent: false,
+          ...(options.ca ? { ca: options.ca } : {}),
+          checkServerIdentity: () => undefined,
+          headers: {
+            ...(options.token ? { authorization: `Bearer ${options.token}` } : {}),
+            ...(options.headerToken ? { 'x-hermes-session-token': options.headerToken } : {}),
+            ...(payload ? { 'content-type': 'application/json' } : {}),
+            origin: 'http://evil.example',
+            cookie: 'session=evil',
+            ...options.headers
          }
+        },
+        res => {
+          let text = ''

-          resolve({ status: res.statusCode ?? 0, text, headers: res.headers, json })
-        })
-      }
-    )
+          res.on('data', chunk => (text += chunk))
+          res.on('end', () => {
+            let json: any = null

-    req.on('error', reject)
-    req.end(payload)
-  })
+            try {
+              json = JSON.parse(text)
+            } catch {
+              json = null
+            }
+
+            resolve({ status: res.statusCode ?? 0, text, headers: res.headers, json })
+          })
+        }
+      )
+
+      req.on('error', reject)
+      req.end(payload)
+    }
+  )
 }

 function wsOpen(url: string, ca: string, extra: Record<string, unknown> = {}) {
@@ -277,7 +287,10 @@ describe('LAN proxy: pairing (hello / claim)', () => {

  it('claim is 410 pairing_closed while pairing is not open', async () => {
    const t = await startProxy()
-    const r = await call(t.port, 'POST', '/aiturk/pair/claim', { ca: t.ca, body: { code: 'AAAAAAAA', device_name: 'x' } })
+    const r = await call(t.port, 'POST', '/aiturk/pair/claim', {
+      ca: t.ca,
+      body: { code: 'AAAAAAAA', device_name: 'x' }
+    })

    expect([r.status, r.json]).toEqual([410, { error: 'pairing_closed' }])
    await t.proxy.stop()
@@ -288,13 +301,19 @@ describe('LAN proxy: pairing (hello / claim)', () => {
    const { code } = t.proxy.beginPairing()

    for (let i = 0; i < 4; i++) {
-      const r = await call(t.port, 'POST', '/aiturk/pair/claim', { ca: t.ca, body: { code: wrongCode(code), device_name: 'x' } })
+      const r = await call(t.port, 'POST', '/aiturk/pair/claim', {
+        ca: t.ca,
+        body: { code: wrongCode(code), device_name: 'x' }
+      })

      expect([r.status, r.json]).toEqual([401, { error: 'wrong_code' }])
    }

    const typed = `${code.slice(0, 4).toLowerCase()}-${code.slice(4).toLowerCase()} `
-    const ok = await call(t.port, 'POST', '/aiturk/pair/claim', { ca: t.ca, body: { code: typed, device_name: '  Pixel\u0000 <b>9</b> ' } })
+    const ok = await call(t.port, 'POST', '/aiturk/pair/claim', {
+      ca: t.ca,
+      body: { code: typed, device_name: '  Pixel\u0000 <b>9</b> ' }
+    })

    expect(ok.status).toBe(200)
    expect(Object.keys(ok.json).sort()).toEqual(['device_id', 'pc_name', 'token', 'version'])
@@ -326,10 +345,20 @@ describe('LAN proxy: pairing (hello / claim)', () => {
    const { code } = t.proxy.beginPairing()

    for (let i = 0; i < 4; i++) {
-      expect((await call(t.port, 'POST', '/aiturk/pair/claim', { ca: t.ca, body: { code: wrongCode(code), device_name: 'x' } })).status).toBe(401)
+      expect(
+        (
+          await call(t.port, 'POST', '/aiturk/pair/claim', {
+            ca: t.ca,
+            body: { code: wrongCode(code), device_name: 'x' }
+          })
+        ).status
+      ).toBe(401)
    }

-    const fifth = await call(t.port, 'POST', '/aiturk/pair/claim', { ca: t.ca, body: { code: wrongCode(code), device_name: 'x' } })
+    const fifth = await call(t.port, 'POST', '/aiturk/pair/claim', {
+      ca: t.ca,
+      body: { code: wrongCode(code), device_name: 'x' }
+    })

    expect([fifth.status, fifth.json]).toEqual([410, { error: 'pairing_locked' }])

@@ -358,16 +387,28 @@ describe('LAN proxy: pairing (hello / claim)', () => {
    const t = await startProxy()
    const { code } = t.proxy.beginPairing()

-    for (const rawBody of ['{not json', '[]', '{"code":12345678,"device_name":"x"}', `{"code":"${code}"}`, `{"code":"${code}","device_name":""}`, JSON.stringify({ code, device_name: 'n'.repeat(61) })]) {
+    for (const rawBody of [
+      '{not json',
+      '[]',
+      '{"code":12345678,"device_name":"x"}',
+      `{"code":"${code}"}`,
+      `{"code":"${code}","device_name":""}`,
+      JSON.stringify({ code, device_name: 'n'.repeat(61) })
+    ]) {
      const r = await call(t.port, 'POST', '/aiturk/pair/claim', { ca: t.ca, rawBody })

      expect([r.status, r.json]).toEqual([400, { error: 'invalid_request' }])
    }

-    const big = await call(t.port, 'POST', '/aiturk/pair/claim', { ca: t.ca, rawBody: JSON.stringify({ code, device_name: 'x', pad: 'p'.repeat(5000) }) })
+    const big = await call(t.port, 'POST', '/aiturk/pair/claim', {
+      ca: t.ca,
+      rawBody: JSON.stringify({ code, device_name: 'x', pad: 'p'.repeat(5000) })
+    })

    expect(big.status).toBe(413)
-    expect((await call(t.port, 'POST', '/aiturk/pair/claim', { ca: t.ca, body: { code, device_name: 'x' } })).status).toBe(200)
+    expect(
+      (await call(t.port, 'POST', '/aiturk/pair/claim', { ca: t.ca, body: { code, device_name: 'x' } })).status
+    ).toBe(200)
    await t.proxy.stop()
  })
 })
@@ -421,7 +462,11 @@ describe('LAN proxy: REST', () => {

    for (const options of [{ token }, { headerToken: token }]) {
      seen.length = 0
-      const r = await call(t.port, 'GET', '/api/sessions?limit=20', { ca: t.ca, ...options, headers: { 'x-forwarded-for': '10.0.0.9' } })
+      const r = await call(t.port, 'GET', '/api/sessions?limit=20', {
+        ca: t.ca,
+        ...options,
+        headers: { 'x-forwarded-for': '10.0.0.9' }
+      })

      expect(r.status).toBe(200)
      expect(r.json).toEqual({ ok: true, path: '/api/sessions' })
@@ -498,7 +543,11 @@ describe('LAN proxy: REST', () => {
    resolveCalls = 0

    for (const [method, path] of forbidden) {
-      const r = await call(t.port, method, path, { ca: t.ca, token, ...(method === 'GET' || method === 'DELETE' ? {} : { body: {} }) })
+      const r = await call(t.port, method, path, {
+        ca: t.ca,
+        token,
+        ...(method === 'GET' || method === 'DELETE' ? {} : { body: {} })
+      })

      expect([method, path, r.status, r.json]).toEqual([method, path, 403, { error: 'forbidden' }])
    }
@@ -527,6 +576,50 @@ describe('LAN proxy: REST', () => {
    await t.proxy.stop()
  })

+  it('routes REST and WebSocket by the phone profile, never the desktop selection', async () => {
+    const profiles: string[] = []
+    const t = await startProxy({
+      resolveBackend: async (profile: string) => {
+        profiles.push(profile)
+        return resolveBackend()
+      }
+    })
+    try {
+      const { token } = await t.pair()
+      for (const query of ['', '?profile=kodlama', '?profile=all']) {
+        expect((await call(t.port, 'GET', `/api/cron/jobs${query}`, { ca: t.ca, token })).status).toBe(200)
+      }
+      const opened = await wsOpen(`wss://127.0.0.1:${t.port}/api/ws?token=${token}&profile=seo`, t.ca)
+      expect(opened.open).toBe(true)
+      opened.ws?.close()
+      expect(profiles).toEqual(['default', 'kodlama', 'default', 'seo'])
+      expect(seen.some(row => row.path === '/api/cron/jobs?profile=all')).toBe(true)
+    } finally {
+      await t.proxy.stop()
+    }
+  })
+
+  it('bounds a pending setup/backend resolution for REST and WebSocket and never forwards the late result', async () => {
+    let finish: (value: { baseUrl: string; token: string }) => void = () => {}
+    const pending = new Promise<{ baseUrl: string; token: string }>(resolve => {
+      finish = resolve
+    })
+    const t = await startProxy({ resolveBackend: () => pending, backendResolveTimeoutMs: 40 })
+    try {
+      const { token } = await t.pair()
+      const before = seen.length
+      const rest = await call(t.port, 'GET', '/api/cron/jobs?profile=default', { ca: t.ca, token })
+      expect([rest.status, rest.json]).toEqual([503, { error: 'backend_unavailable' }])
+      expect((await wsOpen(`wss://127.0.0.1:${t.port}/api/ws?token=${token}`, t.ca)).status).toBe(503)
+      finish({ baseUrl: `http://127.0.0.1:${backendPort}`, token: SESSION })
+      await new Promise(resolve => setTimeout(resolve, 30))
+      expect(seen.length).toBe(before)
+      expect((await call(t.port, 'GET', '/api/cron/jobs?profile=default', { ca: t.ca, token })).status).toBe(200)
+    } finally {
+      await t.proxy.stop()
+    }
+  })
+
  it('refuses when the backend cannot be resolved locally (remote mode / not loopback) without leaking why', async () => {
    const remote = await startProxy({
      resolveBackend: async () => {
@@ -541,7 +634,9 @@ describe('LAN proxy: REST', () => {
    expect((await wsOpen(`wss://127.0.0.1:${remote.port}/api/ws?token=${a.token}`, remote.ca)).status).toBe(503)
    await remote.proxy.stop()

-    const elsewhere = await startProxy({ resolveBackend: async () => ({ baseUrl: 'https://gateway.example', token: SESSION }) })
+    const elsewhere = await startProxy({
+      resolveBackend: async () => ({ baseUrl: 'https://gateway.example', token: SESSION })
+    })
    const b = await elsewhere.pair()

    expect((await call(elsewhere.port, 'GET', '/api/sessions', { ca: elsewhere.ca, token: b.token })).status).toBe(503)
@@ -628,10 +723,18 @@ describe('LAN proxy: TLS, listening and logs', () => {
    const t = await startProxy()

    const peer = await new Promise<string>((resolve, reject) => {
-      const req = https.request({ host: '127.0.0.1', port: t.port, path: '/aiturk/pair/hello', rejectUnauthorized: false, agent: false }, res => {
-        resolve(crypto.createHash('sha256').update((res.socket as any).getPeerCertificate(true).raw).digest('base64url'))
-        res.resume()
-      })
+      const req = https.request(
+        { host: '127.0.0.1', port: t.port, path: '/aiturk/pair/hello', rejectUnauthorized: false, agent: false },
+        res => {
+          resolve(
+            crypto
+              .createHash('sha256')
+              .update((res.socket as any).getPeerCertificate(true).raw)
+              .digest('base64url')
+          )
+          res.resume()
+        }
+      )

      req.on('error', reject)
      req.end()
@@ -641,10 +744,14 @@ describe('LAN proxy: TLS, listening and logs', () => {
    expect(peer).not.toBe(createSelfSignedCertificate().fingerprint)

    // A phone pinned to ANOTHER certificate must refuse this server.
-    await expect(call(t.port, 'GET', '/aiturk/pair/hello', { ca: createSelfSignedCertificate().cert })).rejects.toThrow()
+    await expect(
+      call(t.port, 'GET', '/aiturk/pair/hello', { ca: createSelfSignedCertificate().cert })
+    ).rejects.toThrow()

    const systemCa = await new Promise<string>(resolve => {
-      const req = https.request({ host: '127.0.0.1', port: t.port, path: '/aiturk/pair/hello', agent: false }, () => resolve('accepted'))
+      const req = https.request({ host: '127.0.0.1', port: t.port, path: '/aiturk/pair/hello', agent: false }, () =>
+        resolve('accepted')
+      )

      req.on('error', (error: NodeJS.ErrnoException) => resolve(String(error.code)))
      req.end()
@@ -653,7 +760,9 @@ describe('LAN proxy: TLS, listening and logs', () => {
    expect(systemCa).toMatch(/SELF_SIGNED|UNABLE_TO_VERIFY|DEPTH_ZERO/)

    const plain = await new Promise<string>(resolve => {
-      const req = http.request({ host: '127.0.0.1', port: t.port, path: '/api/sessions' }, res => resolve(String(res.statusCode)))
+      const req = http.request({ host: '127.0.0.1', port: t.port, path: '/api/sessions' }, res =>
+        resolve(String(res.statusCode))
+      )

      req.on('error', (error: NodeJS.ErrnoException) => resolve(String(error.code || 'error')))
      req.end()
@@ -710,7 +819,11 @@ describe('LAN proxy: TLS, listening and logs', () => {
 // Stand-in for the LAN bind (production: 0.0.0.0). Still loopback, so no test socket leaves this machine,
 // but it is a DIFFERENT address from 127.0.0.1, which is what "listening on the LAN or not" needs.
 const LAN_HOST = '127.0.0.2'
-const RELAY_IDS = ['3f2b8c1e-5d47-4a90-8e21-6b0c9d7a1f55', '9a1d0c2b-7e63-4f18-b5a4-2c8e6f013d77', '5c7e9a13-2b46-4d80-9f3e-1a2b3c4d5e6f']
+const RELAY_IDS = [
+  '3f2b8c1e-5d47-4a90-8e21-6b0c9d7a1f55',
+  '9a1d0c2b-7e63-4f18-b5a4-2c8e6f013d77',
+  '5c7e9a13-2b46-4d80-9f3e-1a2b3c4d5e6f'
+]
 const HOST_TOKENS = RELAY_IDS.map((_id, index) => `tsmr_${String.fromCharCode(65 + index).repeat(43)}`)

 /** Host socket that opens at once and never carries traffic; enough for the controller tests. */
@@ -835,7 +948,11 @@ function linkHarness(over: Record<string, any> = {}) {
      if (isOffer) {
        return {
          status: offerOutcome,
-          json: async () => ({ offerId: '0f8fad5b-d9cb-469f-a165-70867728950e', cancelToken: `tsmp_${'c'.repeat(43)}`, expiresIn: 300 })
+          json: async () => ({
+            offerId: '0f8fad5b-d9cb-469f-a165-70867728950e',
+            cancelToken: `tsmp_${'c'.repeat(43)}`,
+            expiresIn: 300
+          })
        }
      }

@@ -886,14 +1003,35 @@ function linkHarness(over: Record<string, any> = {}) {
  const firewallWrites = () => firewallCalls.filter(entry => entry !== 'query')
  const offers = () => fetchCalls.filter(entry => entry.url.endsWith('/offers'))

-  return { link: make(), make, vault, store, firewallCalls, firewallWrites, fetchCalls, offers, events, logs, state, hostSockets, retrySleeps, heldRetries }
+  return {
+    link: make(),
+    make,
+    vault,
+    store,
+    firewallCalls,
+    firewallWrites,
+    fetchCalls,
+    offers,
+    events,
+    logs,
+    state,
+    hostSockets,
+    retrySleeps,
+    heldRetries
+  }
 }

 describe('mobile link controller', () => {
  it('nothing listens until the feature is on AND pairing runs or a phone is paired', async () => {
    const h = linkHarness()

-    expect(await h.link.state()).toMatchObject({ enabled: false, listening: false, port: null, pairing: null, devices: [] })
+    expect(await h.link.state()).toMatchObject({
+      enabled: false,
+      listening: false,
+      port: null,
+      pairing: null,
+      devices: []
+    })

    const enabled = await h.link.enable()
    const port = enabled.port as number
@@ -953,7 +1091,10 @@ describe('mobile link controller', () => {
    expect(JSON.stringify(offer.init.headers)).not.toContain(pairing.code)

    const ca = h.vault.value.lanTls.cert
-    const claim = await call(port, 'POST', '/aiturk/pair/claim', { ca, body: { code: pairing.code, device_name: 'Pixel 9' } })
+    const claim = await call(port, 'POST', '/aiturk/pair/claim', {
+      ca,
+      body: { code: pairing.code, device_name: 'Pixel 9' }
+    })

    expect(claim.status).toBe(200)
    await until(() => h.events.some(event => event.type === 'paired'))
@@ -1033,7 +1174,10 @@ describe('mobile link controller', () => {
    const state = await h.link.pairBegin()
    const port = state.port as number
    const ca = h.vault.value.lanTls.cert
-    const claim = await call(port, 'POST', '/aiturk/pair/claim', { ca, body: { code: state.pairing!.code, device_name: 'Pixel' } })
+    const claim = await call(port, 'POST', '/aiturk/pair/claim', {
+      ca,
+      body: { code: state.pairing!.code, device_name: 'Pixel' }
+    })

    await until(() => h.events.some(event => event.type === 'paired'))

@@ -1083,10 +1227,19 @@ describe('mobile link controller', () => {
  })

  it('"İzin ver" is the only thing that adds the firewall rule; a refused UAC prompt leaves direct access off', async () => {
-    const h = linkHarness({ firewallResults: [{ ok: false, reason: 'denied' }, { ok: false, reason: 'failed' }] })
+    const h = linkHarness({
+      firewallResults: [
+        { ok: false, reason: 'denied' },
+        { ok: false, reason: 'failed' }
+      ]
+    })
    const state = await h.link.enable()

-    expect(state).toMatchObject({ enabled: true, firewall: 'needed', lan: { direct: false, listening: false, firewall: 'missing' } })
+    expect(state).toMatchObject({
+      enabled: true,
+      firewall: 'needed',
+      lan: { direct: false, listening: false, firewall: 'missing' }
+    })
    expect(h.firewallWrites()).toEqual([])
    expect(await h.link.lanAllow()).toMatchObject({ firewall: 'denied', lan: { direct: false, firewall: 'missing' } })
    expect(await h.link.firewallRetry()).toMatchObject({ firewall: 'failed', lan: { direct: false } })
@@ -1095,7 +1248,10 @@ describe('mobile link controller', () => {
    // The rule is there (asked from Windows, not remembered): no second prompt.
    expect((await h.link.lanAllow()).firewall).toBe('ok')
    expect(h.firewallWrites()).toHaveLength(3)
-    expect(await h.link.firewallRemove()).toMatchObject({ firewall: 'needed', lan: { direct: false, firewall: 'missing' } })
+    expect(await h.link.firewallRemove()).toMatchObject({
+      firewall: 'needed',
+      lan: { direct: false, firewall: 'missing' }
+    })
    expect(h.firewallWrites().at(-1)).toBe('remove')
    await expect(linkHarness().link.lanAllow()).rejects.toThrow('aiturk-mobile:not_enabled')
    await h.link.stop()
@@ -1113,7 +1269,10 @@ describe('mobile link controller', () => {
    const port = first.port as number

    // Listening, but only on loopback: the stand-in LAN address refuses the connection.
-    expect(first).toMatchObject({ listening: true, lan: { direct: false, listening: false, port, firewall: 'missing' } })
+    expect(first).toMatchObject({
+      listening: true,
+      lan: { direct: false, listening: false, port, firewall: 'missing' }
+    })
    expect(await connectOutcome(port, '127.0.0.1')).toBe('open')
    expect(await connectOutcome(port, LAN_HOST)).toBe('ECONNREFUSED')
    expect(first.pairing!.qr).not.toContain('u=')
@@ -1124,7 +1283,11 @@ describe('mobile link controller', () => {
    const allowed = await h.link.lanAllow()

    expect(h.firewallWrites()).toEqual([`add:${port}`])
-    expect(allowed).toMatchObject({ pairing: null, listening: false, lan: { direct: true, listening: false, firewall: 'allowed' } })
+    expect(allowed).toMatchObject({
+      pairing: null,
+      listening: false,
+      lan: { direct: true, listening: false, firewall: 'allowed' }
+    })
    expect(h.store.value.lanDirect).toBe(true)

    const second = await h.link.pairBegin()
@@ -1168,7 +1331,14 @@ describe('mobile link controller', () => {

    const h = linkHarness({
      rule: { state: 'present', ports: [47321] },
-      stored: { v: 1, enabled: true, port: null, firewallPort: 47321, fingerprint: null, devices: [{ id, name: 'Pixel', tokenHash: 'a'.repeat(64), createdAt: 5, lastSeenAt: 5 }] }
+      stored: {
+        v: 1,
+        enabled: true,
+        port: null,
+        firewallPort: 47321,
+        fingerprint: null,
+        devices: [{ id, name: 'Pixel', tokenHash: 'a'.repeat(64), createdAt: 5, lastSeenAt: 5 }]
+      }
    })

    const resumed = await h.link.start()
@@ -1189,7 +1359,11 @@ describe('mobile link controller', () => {

    await h.link.enable()
    await expect(h.link.pairBegin()).rejects.toThrow(/^aiturk-mobile:relay_unavailable$/)
-    expect(await h.link.state()).toMatchObject({ pairing: null, listening: false, relay: { ready: false, status: 'off' } })
+    expect(await h.link.state()).toMatchObject({
+      pairing: null,
+      listening: false,
+      relay: { ready: false, status: 'off' }
+    })
    expect(h.offers()).toEqual([])

    // Direct access on, but no usable LAN address either.
@@ -1201,7 +1375,9 @@ describe('mobile link controller', () => {

    const state = await h.link.pairBegin()

-    expect(state.pairing!.qr).toMatch(new RegExp(`^aiturk://pair\\?v=1&fp=[A-Za-z0-9_-]{43}&c=[A-Z2-9]{8}&r=${RELAY_IDS[0]}$`))
+    expect(state.pairing!.qr).toMatch(
+      new RegExp(`^aiturk://pair\\?v=1&fp=[A-Za-z0-9_-]{43}&c=[A-Z2-9]{8}&r=${RELAY_IDS[0]}$`)
+    )
    await h.link.stop()

    const broken = createMobileLink({
@@ -1252,7 +1428,10 @@ describe('mobile link controller', () => {
    expect(h.vault.value.relay).toEqual({ relayId: RELAY_IDS[0], hostToken: HOST_TOKENS[0] })
    expect(h.vault.value.accountToken).toBe('eski-alan')

-    const claim = await call(port, 'POST', '/aiturk/pair/claim', { ca, body: { code: state.pairing!.code, device_name: 'Pixel' } })
+    const claim = await call(port, 'POST', '/aiturk/pair/claim', {
+      ca,
+      body: { code: state.pairing!.code, device_name: 'Pixel' }
+    })

    expect(claim.status).toBe(200)
    await until(() => h.events.some(event => event.type === 'paired'))
@@ -1263,10 +1442,16 @@ describe('mobile link controller', () => {
    // "Röle kimliğini yenile".
    const renewed = await h.link.relayRenew()

-    expect(renewed).toMatchObject({ devices: [], listening: false, relay: { status: 'off', ready: true, reissued: true } })
+    expect(renewed).toMatchObject({
+      devices: [],
+      listening: false,
+      relay: { status: 'off', ready: true, reissued: true }
+    })
    expect(h.store.value.relayId).toBe(RELAY_IDS[1])
    expect(h.vault.value.relay.hostToken).toBe(HOST_TOKENS[1])
-    expect((await call(port, 'GET', '/api/sessions', { ca, token: claim.json.token }).catch(() => ({ status: 0 }))).status).not.toBe(200)
+    expect(
+      (await call(port, 'GET', '/api/sessions', { ca, token: claim.json.token }).catch(() => ({ status: 0 }))).status
+    ).not.toBe(200)
    await until(() => h.hostSockets[0].closed !== null)

    const again = await h.link.pairBegin()
@@ -1275,7 +1460,9 @@ describe('mobile link controller', () => {
    await until(() => h.events.at(-1)?.state.relay.status === 'connected')
    // Every socket after the renewal carries the new token; the old one is never sent again.
    expect(h.hostSockets.length).toBeGreaterThan(1)
-    expect(h.hostSockets.slice(1).every(socket => socket.headers.Authorization === `Bearer ${HOST_TOKENS[1]}`)).toBe(true)
+    expect(h.hostSockets.slice(1).every(socket => socket.headers.Authorization === `Bearer ${HOST_TOKENS[1]}`)).toBe(
+      true
+    )
    expect(h.hostSockets.at(-1)!.url).toBe(`wss://turkservis.online/v1/aiturk/mobile-relay/host/${RELAY_IDS[1]}`)

    // Renewal that cannot reach the gateway changes nothing.
@@ -1284,11 +1471,22 @@ describe('mobile link controller', () => {
    expect(h.store.value.relayId).toBe(RELAY_IDS[1])

    // The host token never reaches a log line, an event, a state answer or the plain store.
-    const exposed = [h.logs.join('\n'), JSON.stringify(h.events), JSON.stringify(await h.link.state()), JSON.stringify(h.store.value)].join('\n')
+    const exposed = [
+      h.logs.join('\n'),
+      JSON.stringify(h.events),
+      JSON.stringify(await h.link.state()),
+      JSON.stringify(h.store.value)
+    ].join('\n')

    expect(exposed).not.toContain('tsmr_')
-    expect(h.logs.filter(line => line.startsWith('relay '))).toEqual(expect.arrayContaining(['relay connecting', 'relay connected', 'relay off']))
-    expect(h.logs.filter(line => line.startsWith('relay ')).every(line => /^relay (?:off|connecting|connected|failed:[a-z_]+)$/.test(line))).toBe(true)
+    expect(h.logs.filter(line => line.startsWith('relay '))).toEqual(
+      expect.arrayContaining(['relay connecting', 'relay connected', 'relay off'])
+    )
+    expect(
+      h.logs
+        .filter(line => line.startsWith('relay '))
+        .every(line => /^relay (?:off|connecting|connected|failed:[a-z_]+)$/.test(line))
+    ).toBe(true)
    await h.link.stop()
  })

@@ -1299,7 +1497,10 @@ describe('mobile link controller', () => {

    const state = await h.link.pairBegin()

-    await call(state.port as number, 'POST', '/aiturk/pair/claim', { ca: h.vault.value.lanTls.cert, body: { code: state.pairing!.code, device_name: 'Pixel' } })
+    await call(state.port as number, 'POST', '/aiturk/pair/claim', {
+      ca: h.vault.value.lanTls.cert,
+      body: { code: state.pairing!.code, device_name: 'Pixel' }
+    })
    await until(() => h.events.some(event => event.type === 'paired'))
    await h.link.stop()

@@ -1453,7 +1654,13 @@ describe('mobile link controller: rendezvous record retries', () => {

    const again = (await h.link.pairRepublish()).pairing!

-    expect(again).toMatchObject({ code: begun.code, qr: begun.qr, expiresAt: begun.expiresAt, securityCode: begun.securityCode, codePath: 'pending' })
+    expect(again).toMatchObject({
+      code: begun.code,
+      qr: begun.qr,
+      expiresAt: begun.expiresAt,
+      securityCode: begun.securityCode,
+      codePath: 'pending'
+    })
    await until(() => h.events.at(-1)?.state.pairing?.codePath === 'ready')
    expect(h.offers()).toHaveLength(2)
    expect(lookupOf(h, 1)).toBe(lookupOf(h, 0))
@@ -1501,7 +1708,13 @@ describe('mobile link controller: rendezvous record retries', () => {
 })

 describe('publishPairOffer / cancelPairOffer', () => {
-  const input = { code: 'ABCDEFGH', addresses: [] as string[], port: 47321, fingerprint: 'f'.repeat(43), relay: RELAY_IDS[0] }
+  const input = {
+    code: 'ABCDEFGH',
+    addresses: [] as string[],
+    port: 47321,
+    fingerprint: 'f'.repeat(43),
+    relay: RELAY_IDS[0]
+  }
  const good = { offerId: '0f8fad5b-d9cb-469f-a165-70867728950e', cancelToken: `tsmp_${'c'.repeat(43)}` }

  function plan(outcomes: (number | 'throw')[]) {
@@ -1577,7 +1790,10 @@ describe('publishPairOffer / cancelPairOffer', () => {

    const told = plan([409])

-    expect(await publishPairOffer(told.fetcher, input, { ...told.options, earlierTryMayHaveLanded: true })).toEqual({ offerId: null, cancelToken: null })
+    expect(await publishPairOffer(told.fetcher, input, { ...told.options, earlierTryMayHaveLanded: true })).toEqual({
+      offerId: null,
+      cancelToken: null
+    })
  })

  it('stops as soon as the pairing is over, without a log line', async () => {
@@ -1624,12 +1840,18 @@ describe('pure helpers', () => {
    expect(normalizePairCode(' abcd-efgh ')).toBe('ABCDEFGH')
    expect(normalizePairCode(12345678)).toBe('')
    expect(formatPairCode('ABCDEFGH')).toBe('ABCD-EFGH')
-    expect(pairLookup('abcd-efgh')).toBe(crypto.createHash('sha256').update('aiturk-mobile-pair-v1:ABCDEFGH').digest('hex'))
+    expect(pairLookup('abcd-efgh')).toBe(
+      crypto.createHash('sha256').update('aiturk-mobile-pair-v1:ABCDEFGH').digest('hex')
+    )
  })

  it('address candidates: private IPv4 only, default route first, virtual adapters dropped, at most four', () => {
    expect(['10.1.2.3', '172.16.0.1', '172.31.255.254', '192.168.0.1'].every(isPrivateIpv4)).toBe(true)
-    expect(['172.15.0.1', '172.32.0.1', '8.8.8.8', '169.254.1.1', '127.0.0.1', '192.168.1', '::1', '192.168.1.999'].some(isPrivateIpv4)).toBe(false)
+    expect(
+      ['172.15.0.1', '172.32.0.1', '8.8.8.8', '169.254.1.1', '127.0.0.1', '192.168.1', '::1', '192.168.1.999'].some(
+        isPrivateIpv4
+      )
+    ).toBe(false)

    const v4 = (address: string, internal = false) => [{ address, family: 'IPv4', internal }]

@@ -1646,13 +1868,25 @@ describe('pure helpers', () => {
      'Ethernet 4': v4('192.168.4.2')
    }

-    expect(selectLanAddresses(interfaces, '192.168.1.20')).toEqual(['192.168.1.20', '10.0.0.5', '192.168.2.2', '192.168.3.2'])
+    expect(selectLanAddresses(interfaces, '192.168.1.20')).toEqual([
+      '192.168.1.20',
+      '10.0.0.5',
+      '192.168.2.2',
+      '192.168.3.2'
+    ])
    expect(selectLanAddresses(interfaces, null)[0]).toBe('10.0.0.5')
    expect(selectLanAddresses({ 'vEthernet (Default Switch)': v4('172.20.0.1') }, null)).toEqual([])
-    expect(() => buildPairQrPayload({ addresses: ['8.8.8.8'], port: 47321, fingerprint: 'f'.repeat(43), code: 'ABCDEFGH' })).toThrow(
-      'aiturk-mobile:no_lan_address'
-    )
-    expect(buildPairQrPayload({ addresses: ['1.1.1.1', '10.0.0.1', '10.0.0.2', '10.0.0.3', '10.0.0.4', '10.0.0.5'], port: 47321, fingerprint: 'f'.repeat(43), code: 'ABCDEFGH' })).toBe(
+    expect(() =>
+      buildPairQrPayload({ addresses: ['8.8.8.8'], port: 47321, fingerprint: 'f'.repeat(43), code: 'ABCDEFGH' })
+    ).toThrow('aiturk-mobile:no_lan_address')
+    expect(
+      buildPairQrPayload({
+        addresses: ['1.1.1.1', '10.0.0.1', '10.0.0.2', '10.0.0.3', '10.0.0.4', '10.0.0.5'],
+        port: 47321,
+        fingerprint: 'f'.repeat(43),
+        code: 'ABCDEFGH'
+      })
+    ).toBe(
      `aiturk://pair?v=1&u=10.0.0.1:47321&u=10.0.0.2:47321&u=10.0.0.3:47321&u=10.0.0.4:47321&fp=${'f'.repeat(43)}&c=ABCDEFGH`
    )
  })
@@ -1683,7 +1917,11 @@ describe('pure helpers', () => {
      expect(() => firewallCommand('add', bad)).toThrow('aiturk-mobile:invalid_port')
    }

-    for (const [exit, expected] of [[0, { ok: true }], [77, { ok: false, reason: 'denied' }], [1, { ok: false, reason: 'failed' }]] as const) {
+    for (const [exit, expected] of [
+      [0, { ok: true }],
+      [77, { ok: false, reason: 'denied' }],
+      [1, { ok: false, reason: 'failed' }]
+    ] as const) {
      const spawned: any[] = []

      const firewall = createWindowsFirewall({
@@ -1725,7 +1963,11 @@ describe('pure helpers', () => {
      parseMobileLinkStored({
        enabled: 'yes',
        port: 99999,
-        devices: [{ id, name: 'Pixel', tokenHash: hash, createdAt: 5, token: 'amd_x' }, { id: 'x', name: 'bad', tokenHash: hash, createdAt: 1 }, null]
+        devices: [
+          { id, name: 'Pixel', tokenHash: hash, createdAt: 5, token: 'amd_x' },
+          { id: 'x', name: 'bad', tokenHash: hash, createdAt: 1 },
+          null
+        ]
      })
    ).toEqual({
      enabled: false,
@@ -1748,8 +1990,12 @@ describe('pure helpers', () => {
      relayReissued: false
    })
    // Only an explicit `true` turns direct LAN access on; a relay id must be a uuid.
-    expect(parseMobileLinkStored({ lanDirect: 'yes', relayId: 'https://evil.example', relayReissued: 1 })).toMatchObject({ lanDirect: false, relayId: null, relayReissued: false })
-    expect(parseMobileLinkStored({ lanDirect: true, relayId: RELAY_IDS[0].toUpperCase(), relayReissued: true })).toMatchObject({
+    expect(
+      parseMobileLinkStored({ lanDirect: 'yes', relayId: 'https://evil.example', relayReissued: 1 })
+    ).toMatchObject({ lanDirect: false, relayId: null, relayReissued: false })
+    expect(
+      parseMobileLinkStored({ lanDirect: true, relayId: RELAY_IDS[0].toUpperCase(), relayReissued: true })
+    ).toMatchObject({
      lanDirect: true,
      relayId: RELAY_IDS[0],
      relayReissued: true
@@ -1760,16 +2006,30 @@ describe('pure helpers', () => {
    const fp = 'f'.repeat(43)
    const relay = RELAY_IDS[0]

-    expect(buildPairQrPayload({ addresses: [], port: 47321, fingerprint: fp, code: 'ABCDEFGH', relay })).toBe(`aiturk://pair?v=1&fp=${fp}&c=ABCDEFGH&r=${relay}`)
-    expect(buildPairQrPayload({ addresses: ['192.168.1.20'], port: 47321, fingerprint: fp, code: 'ABCDEFGH', relay })).toBe(
-      `aiturk://pair?v=1&u=192.168.1.20:47321&fp=${fp}&c=ABCDEFGH&r=${relay}`
+    expect(buildPairQrPayload({ addresses: [], port: 47321, fingerprint: fp, code: 'ABCDEFGH', relay })).toBe(
+      `aiturk://pair?v=1&fp=${fp}&c=ABCDEFGH&r=${relay}`
+    )
+    expect(
+      buildPairQrPayload({ addresses: ['192.168.1.20'], port: 47321, fingerprint: fp, code: 'ABCDEFGH', relay })
+    ).toBe(`aiturk://pair?v=1&u=192.168.1.20:47321&fp=${fp}&c=ABCDEFGH&r=${relay}`)
+    expect(buildPairQrPayload({ addresses: ['192.168.1.20'], port: 47321, fingerprint: fp, code: 'ABCDEFGH' })).toBe(
+      `aiturk://pair?v=1&u=192.168.1.20:47321&fp=${fp}&c=ABCDEFGH`
    )
-    expect(buildPairQrPayload({ addresses: ['192.168.1.20'], port: 47321, fingerprint: fp, code: 'ABCDEFGH' })).toBe(`aiturk://pair?v=1&u=192.168.1.20:47321&fp=${fp}&c=ABCDEFGH`)

    // Anything that is not exactly a uuid is dropped, never echoed into the QR.
-    for (const bad of [`https://turkservis.online/v1/aiturk/mobile-relay/r/${relay}`, relay.toUpperCase(), `${relay}&u=1.2.3.4:1`, '', 7 as any]) {
-      expect(buildPairQrPayload({ addresses: ['10.0.0.5'], port: 47321, fingerprint: fp, code: 'ABCDEFGH', relay: bad })).not.toContain('r=')
-      expect(() => buildPairQrPayload({ addresses: [], port: 47321, fingerprint: fp, code: 'ABCDEFGH', relay: bad })).toThrow('aiturk-mobile:no_lan_address')
+    for (const bad of [
+      `https://turkservis.online/v1/aiturk/mobile-relay/r/${relay}`,
+      relay.toUpperCase(),
+      `${relay}&u=1.2.3.4:1`,
+      '',
+      7 as any
+    ]) {
+      expect(
+        buildPairQrPayload({ addresses: ['10.0.0.5'], port: 47321, fingerprint: fp, code: 'ABCDEFGH', relay: bad })
+      ).not.toContain('r=')
+      expect(() =>
+        buildPairQrPayload({ addresses: [], port: 47321, fingerprint: fp, code: 'ABCDEFGH', relay: bad })
+      ).toThrow('aiturk-mobile:no_lan_address')
    }

    const bodies: any[] = []
@@ -1777,13 +2037,22 @@ describe('pure helpers', () => {
    const fetcher = async (_url: string, init: any) => {
      bodies.push(JSON.parse(init.body))

-      return { status: 201, json: async () => ({ offerId: '0f8fad5b-d9cb-469f-a165-70867728950e', cancelToken: `tsmp_${'c'.repeat(43)}` }) }
+      return {
+        status: 201,
+        json: async () => ({ offerId: '0f8fad5b-d9cb-469f-a165-70867728950e', cancelToken: `tsmp_${'c'.repeat(43)}` })
+      }
    }

-    expect(await publishPairOffer(fetcher, { code: 'ABCDEFGH', addresses: [], port: 47321, fingerprint: fp, relay })).not.toBeNull()
-    expect(await publishPairOffer(fetcher, { code: 'ABCDEFGH', addresses: ['10.0.0.5'], port: 47321, fingerprint: fp })).not.toBeNull()
+    expect(
+      await publishPairOffer(fetcher, { code: 'ABCDEFGH', addresses: [], port: 47321, fingerprint: fp, relay })
+    ).not.toBeNull()
+    expect(
+      await publishPairOffer(fetcher, { code: 'ABCDEFGH', addresses: ['10.0.0.5'], port: 47321, fingerprint: fp })
+    ).not.toBeNull()
    // Neither a LAN url nor a relay: nothing is published.
-    expect(await publishPairOffer(fetcher, { code: 'ABCDEFGH', addresses: [], port: 47321, fingerprint: fp, relay: 'nope' })).toBeNull()
+    expect(
+      await publishPairOffer(fetcher, { code: 'ABCDEFGH', addresses: [], port: 47321, fingerprint: fp, relay: 'nope' })
+    ).toBeNull()
    expect(bodies).toEqual([
      { lookup: pairLookup('ABCDEFGH'), urls: [], fp, relay },
      { lookup: pairLookup('ABCDEFGH'), urls: ['https://10.0.0.5:47321'], fp }
@@ -1793,7 +2062,10 @@ describe('pure helpers', () => {
  it('firewall rule query: fixed netsh arguments; English and Turkish answers; present / absent / other port / disabled / unreadable', async () => {
    const query = firewallQueryCommand('C:\\Windows')

-    expect(query).toEqual({ file: 'C:\\Windows\\System32\\netsh.exe', args: ['advfirewall', 'firewall', 'show', 'rule', 'name=AITURK IDE Telefon Baglantisi'] })
+    expect(query).toEqual({
+      file: 'C:\\Windows\\System32\\netsh.exe',
+      args: ['advfirewall', 'firewall', 'show', 'rule', 'name=AITURK IDE Telefon Baglantisi']
+    })
    expect(firewallQueryCommand("C:\\x'; calc; '").file).toBe('C:\\Windows\\System32\\netsh.exe')

    const english = (port: string, enabled = 'Yes') =>
@@ -1840,14 +2112,24 @@ describe('pure helpers', () => {
    expect(parseFirewallRuleOutput(english('47321'), 0)).toEqual({ state: 'present', ports: [47321] })
    expect(parseFirewallRuleOutput(turkish('47321'), 0)).toEqual({ state: 'present', ports: [47321] })
    expect(parseFirewallRuleOutput(english('47330'), 0)).toEqual({ state: 'present', ports: [47330] })
-    expect(parseFirewallRuleOutput(turkish('47321,47325-47326'), 0)).toEqual({ state: 'present', ports: [47321, 47325, 47326] })
+    expect(parseFirewallRuleOutput(turkish('47321,47325-47326'), 0)).toEqual({
+      state: 'present',
+      ports: [47321, 47325, 47326]
+    })
    // Two rules under the same name (the port changed once): both ports count.
-    expect(parseFirewallRuleOutput(english('47321') + turkish('47322'), 0)).toEqual({ state: 'present', ports: [47321, 47322] })
+    expect(parseFirewallRuleOutput(english('47321') + turkish('47322'), 0)).toEqual({
+      state: 'present',
+      ports: [47321, 47322]
+    })
    // A disabled rule allows nothing.
    expect(parseFirewallRuleOutput(english('47321', 'No'), 0)).toEqual({ state: 'present', ports: [] })
    expect(parseFirewallRuleOutput(turkish('47321', 'Hayýr'), 0)).toEqual({ state: 'present', ports: [] })
-    expect(parseFirewallRuleOutput('\r\nNo rules match the specified criteria.\r\n\r\n', 1)).toEqual({ state: 'absent' })
-    expect(parseFirewallRuleOutput('\r\nBelirtilen ölçütlerle eþleen kural yok.\r\n\r\n', 1)).toEqual({ state: 'absent' })
+    expect(parseFirewallRuleOutput('\r\nNo rules match the specified criteria.\r\n\r\n', 1)).toEqual({
+      state: 'absent'
+    })
+    expect(parseFirewallRuleOutput('\r\nBelirtilen ölçütlerle eþleen kural yok.\r\n\r\n', 1)).toEqual({
+      state: 'absent'
+    })
    // No answer at all (netsh missing, timeout) is not "no rule".
    expect(parseFirewallRuleOutput('', null)).toEqual({ state: 'unknown' })
    expect(parseFirewallRuleOutput('', 1)).toEqual({ state: 'unknown' })
@@ -1871,9 +2153,16 @@ describe('pure helpers', () => {
    expect(await firewall.queryRule!()).toEqual({ state: 'present', ports: [47321] })
    expect(ran).toEqual([query])

-    const failing = createWindowsFirewall({ platform: 'win32', env: {}, spawn: () => ({ on: () => undefined }), run: async () => Promise.reject(new Error('x')) })
+    const failing = createWindowsFirewall({
+      platform: 'win32',
+      env: {},
+      spawn: () => ({ on: () => undefined }),
+      run: async () => Promise.reject(new Error('x'))
+    })

    expect(await failing.queryRule!()).toEqual({ state: 'unknown' })
-    expect(await createWindowsFirewall({ platform: 'linux', env: {}, spawn: () => ({ on: () => undefined }) }).queryRule!()).toEqual({ state: 'unknown' })
+    expect(
+      await createWindowsFirewall({ platform: 'linux', env: {}, spawn: () => ({ on: () => undefined }) }).queryRule!()
+    ).toEqual({ state: 'unknown' })
  })
 })
@@ -150,7 +150,11 @@ export function selectLanAddresses(
      const ipv4 = item.family === 'IPv4' || item.family === 4

      if (ipv4 && !item.internal && isPrivateIpv4(item.address) && !rows.some(row => row.address === item.address)) {
-        rows.push({ address: item.address, primary: item.address === defaultRoute, virtual: VIRTUAL_ADAPTER_RE.test(name) })
+        rows.push({
+          address: item.address,
+          primary: item.address === defaultRoute,
+          virtual: VIRTUAL_ADAPTER_RE.test(name)
+        })
      }
    }
  }
@@ -216,7 +220,13 @@ export function defaultRouteAddress(): Promise<null | string> {
 * registration exists. A QR with neither would be a code that cannot work, so
 * that is refused.
 */
-export function buildPairQrPayload(input: { addresses: string[]; port: number; fingerprint: string; code: string; relay?: null | string }): string {
+export function buildPairQrPayload(input: {
+  addresses: string[]
+  port: number
+  fingerprint: string
+  code: string
+  relay?: null | string
+}): string {
  const hosts = input.addresses.filter(isPrivateIpv4).slice(0, MOBILE_LAN_MAX_URLS)
  const relay = isRelayId(input.relay) ? input.relay : null

@@ -437,7 +447,10 @@ export interface MobileFirewall {

 /** `netsh advfirewall firewall show rule name=…` — fixed arguments, no shell, no elevation. */
 export function firewallQueryCommand(systemRoot?: string) {
-  const root = systemRoot && /^[A-Za-z]:\\[A-Za-z0-9 ._\\-]{1,100}$/.test(systemRoot) ? systemRoot.replace(/\\+$/, '') : 'C:\\Windows'
+  const root =
+    systemRoot && /^[A-Za-z]:\\[A-Za-z0-9 ._\\-]{1,100}$/.test(systemRoot)
+      ? systemRoot.replace(/\\+$/, '')
+      : 'C:\\Windows'

  return {
    file: `${root}\\System32\\netsh.exe`,
@@ -479,7 +492,9 @@ export function parseFirewallRuleOutput(stdout: string, exitCode: null | number)
      continue
    }

-    const portLine = block.find(line => /^LocalPort\s*:/i.test(line)) ?? block.find(line => /^\d{1,5}(?:\s*[,-]\s*\d{1,5})*$/.test(value(line)))
+    const portLine =
+      block.find(line => /^LocalPort\s*:/i.test(line)) ??
+      block.find(line => /^\d{1,5}(?:\s*[,-]\s*\d{1,5})*$/.test(value(line)))

    for (const part of value(portLine).split(',')) {
      const [from, to = from] = part.split('-').map(item => Number(item.trim()))
@@ -519,7 +534,10 @@ function assertPort(port: number): number {
 * shell is involved (the caller spawns PowerShell with an argument array).
 */
 export function firewallCommand(action: 'add' | 'remove', port: number, systemRoot?: string) {
-  const root = systemRoot && /^[A-Za-z]:\\[A-Za-z0-9 ._\\-]{1,100}$/.test(systemRoot) ? systemRoot.replace(/\\+$/, '') : 'C:\\Windows'
+  const root =
+    systemRoot && /^[A-Za-z]:\\[A-Za-z0-9 ._\\-]{1,100}$/.test(systemRoot)
+      ? systemRoot.replace(/\\+$/, '')
+      : 'C:\\Windows'

  const netshArgs =
    action === 'add'
@@ -537,7 +555,11 @@ export function firewallCommand(action: 'add' | 'remove', port: number, systemRo
 }

 export interface FirewallSpawn {
-  (file: string, args: string[], options: Record<string, unknown>): {
+  (
+    file: string,
+    args: string[],
+    options: Record<string, unknown>
+  ): {
    on: (event: string, listener: (...args: any[]) => void) => unknown
  }
 }
@@ -686,7 +708,9 @@ export type PairingEndReason = 'claimed' | 'locked' | 'expired' | 'cancelled'
 export interface LanProxyOptions {
  tls: { key: string; cert: string }
  /** Must resolve the LOCAL backend or throw (remote mode, backend down). */
-  resolveBackend: () => Promise<MobileBackend>
+  resolveBackend: (profile: string) => Promise<MobileBackend>
+  /** Resolution only, never the duration of an agent/tool/cron execution. */
+  backendResolveTimeoutMs?: number
  version: string
  pcName: string
  devices?: MobileDeviceRecord[]
@@ -733,7 +757,13 @@ const DROPPED_REQUEST_HEADERS = new Set([

 const DROPPED_RESPONSE_HEADERS = ['set-cookie', 'connection', 'keep-alive', 'transfer-encoding', 'proxy-authenticate']
 const LOOPBACK_HOSTS = new Set(['127.0.0.1', 'localhost', '[::1]'])
-const STATUS_TEXT: Record<number, string> = { 400: 'Bad Request', 401: 'Unauthorized', 403: 'Forbidden', 404: 'Not Found', 503: 'Service Unavailable' }
+const STATUS_TEXT: Record<number, string> = {
+  400: 'Bad Request',
+  401: 'Unauthorized',
+  403: 'Forbidden',
+  404: 'Not Found',
+  503: 'Service Unavailable'
+}

 export function createLanProxy(options: LanProxyOptions) {
  const now = options.now ?? Date.now
@@ -752,7 +782,13 @@ export function createLanProxy(options: LanProxyOptions) {
  }

  const records = (): MobileDeviceRecord[] =>
-    [...devices.values()].map(({ id, name, tokenHash, createdAt, lastSeenAt }) => ({ id, name, tokenHash, createdAt, lastSeenAt }))
+    [...devices.values()].map(({ id, name, tokenHash, createdAt, lastSeenAt }) => ({
+      id,
+      name,
+      tokenHash,
+      createdAt,
+      lastSeenAt
+    }))

  const log = (method: string | undefined, path: string, status: number) => {
    if (options.log) {
@@ -814,9 +850,21 @@ export function createLanProxy(options: LanProxyOptions) {
    return device
  }

-  async function localBackend(): Promise<null | { target: URL; token: string }> {
+  async function localBackend(url: URL): Promise<null | { target: URL; token: string }> {
+    let timer: ReturnType<typeof setTimeout> | undefined
    try {
-      const backend = await options.resolveBackend()
+      // A paired phone controls this machine, but its selected profile is NOT
+      // the desktop window's selection. `all` is an aggregate read on the root
+      // dashboard, not a profile to spawn. Keep the original query downstream.
+      const selected = url.searchParams.get('profile')?.trim().toLowerCase() || 'default'
+      const profile = selected === 'all' ? 'default' : selected
+      if (!/^[a-z0-9][a-z0-9_-]{0,63}$/.test(profile)) return null
+      const backend = await Promise.race([
+        options.resolveBackend(profile),
+        new Promise<never>((_resolve, reject) => {
+          timer = setTimeout(() => reject(new Error('backend_not_ready')), options.backendResolveTimeoutMs ?? 8000)
+        })
+      ])
      const target = new URL(backend.baseUrl)

      // Never forward a phone to anything but the loopback backend.
@@ -827,6 +875,8 @@ export function createLanProxy(options: LanProxyOptions) {
      return { target, token: backend.token }
    } catch {
      return null
+    } finally {
+      if (timer) clearTimeout(timer)
    }
  }

@@ -883,7 +933,13 @@ export function createLanProxy(options: LanProxyOptions) {
    }

    // eslint-disable-next-line no-control-regex
-    const name = typeof data?.device_name === 'string' ? data.device_name.replace(/[\x00-\x1f\x7f]/g, ' ').replace(/\s+/g, ' ').trim() : ''
+    const name =
+      typeof data?.device_name === 'string'
+        ? data.device_name
+            .replace(/[\x00-\x1f\x7f]/g, ' ')
+            .replace(/\s+/g, ' ')
+            .trim()
+        : ''

    if (!data || typeof data !== 'object' || typeof data.code !== 'string' || name.length < 1 || name.length > 60) {
      return reply(req, res, path, 400, { error: 'invalid_request' })
@@ -933,12 +989,27 @@ export function createLanProxy(options: LanProxyOptions) {
      return reply(req, res, path, 500, { error: 'internal' })
    }

-    options.onPairingEnded?.('claimed', records().find(row => row.id === device.id))
+    options.onPairingEnded?.(
+      'claimed',
+      records().find(row => row.id === device.id)
+    )

-    return reply(req, res, path, 200, { token, device_id: device.id, pc_name: options.pcName, version: options.version })
+    return reply(req, res, path, 200, {
+      token,
+      device_id: device.id,
+      pc_name: options.pcName,
+      version: options.version
+    })
  }

-  function forward(req: http.IncomingMessage, res: http.ServerResponse, url: URL, path: string, device: LiveDevice, backend: { target: URL; token: string }) {
+  function forward(
+    req: http.IncomingMessage,
+    res: http.ServerResponse,
+    url: URL,
+    path: string,
+    device: LiveDevice,
+    backend: { target: URL; token: string }
+  ) {
    const headers: Record<string, string | string[]> = {}

    for (const [key, value] of Object.entries(req.headers)) {
@@ -1037,7 +1108,9 @@ export function createLanProxy(options: LanProxyOptions) {
      return reply(req, res, path, 403, { error: 'forbidden' })
    }

-    const backend = await localBackend()
+    const backend = await localBackend(url)
+
+    if (res.destroyed) return

    if (!backend) {
      return reply(req, res, path, 503, { error: 'backend_unavailable' })
@@ -1086,7 +1159,9 @@ export function createLanProxy(options: LanProxyOptions) {
      return refuse(path, 403, 'forbidden')
    }

-    const backend = await localBackend()
+    const backend = await localBackend(url)
+
+    if (socket.destroyed) return

    if (!backend) {
      return refuse(path, 503, 'backend_unavailable')
@@ -1118,9 +1193,19 @@ export function createLanProxy(options: LanProxyOptions) {
    socket.on('close', close)
    upstream.once('connect', () => {
      // No Origin / Cookie / Authorization: only what the WebSocket handshake needs.
-      const lines = [`GET ${path}${url.search} HTTP/1.1`, `Host: ${backend.target.host}`, 'Connection: Upgrade', 'Upgrade: websocket']
+      const lines = [
+        `GET ${path}${url.search} HTTP/1.1`,
+        `Host: ${backend.target.host}`,
+        'Connection: Upgrade',
+        'Upgrade: websocket'
+      ]

-      for (const key of ['sec-websocket-key', 'sec-websocket-version', 'sec-websocket-extensions', 'sec-websocket-protocol']) {
+      for (const key of [
+        'sec-websocket-key',
+        'sec-websocket-version',
+        'sec-websocket-extensions',
+        'sec-websocket-protocol'
+      ]) {
        const value = req.headers[key]

        if (typeof value === 'string' && value) {
@@ -1140,9 +1225,12 @@ export function createLanProxy(options: LanProxyOptions) {
    })
  }

-  const server = https.createServer({ key: options.tls.key, cert: options.tls.cert, minVersion: 'TLSv1.2' }, (req, res) => {
-    onRequest(req, res).catch(() => reply(req, res, '(error)', 500, { error: 'internal' }))
-  })
+  const server = https.createServer(
+    { key: options.tls.key, cert: options.tls.cert, minVersion: 'TLSv1.2' },
+    (req, res) => {
+      onRequest(req, res).catch(() => reply(req, res, '(error)', 500, { error: 'internal' }))
+    }
+  )

  server.on('upgrade', (req, socket, head) => {
    onUpgrade(req, socket, head).catch(() => socket.destroy())
@@ -1201,7 +1289,11 @@ export function createLanProxy(options: LanProxyOptions) {
    beginPairing(): { code: string; expiresAt: number } {
      const code = generatePairCode(randomBytes)

-      pairing = { codeHash: crypto.createHash('sha256').update(code).digest(), expiresAt: now() + codeTtlMs, attempts: 0 }
+      pairing = {
+        codeHash: crypto.createHash('sha256').update(code).digest(),
+        expiresAt: now() + codeTtlMs,
+        attempts: 0
+      }

      return { code, expiresAt: pairing.expiresAt }
    },
@@ -1217,7 +1309,13 @@ export function createLanProxy(options: LanProxyOptions) {
    pairingOpen,
    records,
    devices: (): MobileDeviceView[] =>
-      [...devices.values()].map(({ id, name, createdAt, lastSeenAt, sockets: live }) => ({ id, name, createdAt, lastSeenAt, live: live.size })),
+      [...devices.values()].map(({ id, name, createdAt, lastSeenAt, sockets: live }) => ({
+        id,
+        name,
+        createdAt,
+        lastSeenAt,
+        live: live.size
+      })),
    /** Removes the device: its token turns 401 and its open connections are closed. */
    async revoke(id: string): Promise<boolean> {
      for (const [hash, device] of devices) {
@@ -1293,7 +1391,8 @@ export function createMobileLinkFileStore(directory: string, file: string, fs: M
  }
 }

-const validPort = (value: unknown): value is number => Number.isInteger(value) && (value as number) > 0 && (value as number) < 65536
+const validPort = (value: unknown): value is number =>
+  Number.isInteger(value) && (value as number) > 0 && (value as number) < 65536

 export function parseMobileLinkStored(raw: unknown): MobileLinkStored {
  const row = (raw && typeof raw === 'object' ? raw : {}) as Record<string, unknown>
@@ -1407,12 +1506,13 @@ export interface MobileLinkState {
  devices: MobileDeviceView[]
 }

-export type MobileLinkEvent = { type: 'state'; state: MobileLinkState } | { type: 'paired'; name: string; state: MobileLinkState }
+export type MobileLinkEvent =
+  { type: 'state'; state: MobileLinkState } | { type: 'paired'; name: string; state: MobileLinkState }

 export interface MobileLinkDeps {
  vault: MobileLanVault
  store: MobileLinkStore
-  resolveBackend: () => Promise<MobileBackend>
+  resolveBackend: (profile: string) => Promise<MobileBackend>
  isRemoteMode: () => boolean
  firewall: MobileFirewall
  fetch: PairFetch
@@ -1577,7 +1677,12 @@ export function createMobileLink(deps: MobileLinkDeps) {
      port: data.port,
      remote: deps.isRemoteMode(),
      firewall: firewallState(data),
-      relay: { status: relayState.status, code: relayState.code, ready: data.relayId !== null, reissued: data.relayReissued },
+      relay: {
+        status: relayState.status,
+        code: relayState.code,
+        ready: data.relayId !== null,
+        reissued: data.relayReissued
+      },
      lan: {
        direct: data.lanDirect,
        listening: listening && data.lanDirect && proxy?.host === lanHost,
@@ -1586,7 +1691,13 @@ export function createMobileLink(deps: MobileLinkDeps) {
      },
      pcName,
      pairing: session
-        ? { code: session.code, qr: session.qr, expiresAt: session.expiresAt, codePath: session.codePath, securityCode: session.fingerprint.slice(0, 8) }
+        ? {
+            code: session.code,
+            qr: session.qr,
+            expiresAt: session.expiresAt,
+            codePath: session.codePath,
+            securityCode: session.fingerprint.slice(0, 8)
+          }
        : null,
      devices: proxy
        ? proxy.devices()
@@ -1635,7 +1746,13 @@ export function createMobileLink(deps: MobileLinkDeps) {
  function publishOffer(current: PairSession, relayId: null | string) {
    current.codePath = 'pending'

-    const input = { code: current.code, addresses: current.addresses, port: current.port, fingerprint: current.fingerprint, relay: relayId }
+    const input = {
+      code: current.code,
+      addresses: current.addresses,
+      port: current.port,
+      fingerprint: current.fingerprint,
+      relay: relayId
+    }

    void publishPairOffer(deps.fetch, input, {
      sleep,
@@ -1704,12 +1821,12 @@ export function createMobileLink(deps: MobileLinkDeps) {

    proxy = createLanProxy({
      tls: identity,
-      resolveBackend: async () => {
+      resolveBackend: async profile => {
        if (deps.isRemoteMode()) {
          throw new MobileLinkError('remote_mode')
        }

-        return deps.resolveBackend()
+        return deps.resolveBackend(profile)
      },
      version: deps.version,
      pcName,
@@ -1785,12 +1902,17 @@ export function createMobileLink(deps: MobileLinkDeps) {

          const row = (await deps.vault.load())?.relay

-          return isRelayCredentials(row) && row.relayId === data.relayId ? { relayId: row.relayId, hostToken: row.hostToken } : null
+          return isRelayCredentials(row) && row.relayId === data.relayId
+            ? { relayId: row.relayId, hostToken: row.hostToken }
+            : null
        },
        async save(credentials, info) {
          const previous = data.relayId

-          await deps.vault.save({ ...((await deps.vault.load()) ?? {}), relay: { relayId: credentials.relayId, hostToken: credentials.hostToken } })
+          await deps.vault.save({
+            ...((await deps.vault.load()) ?? {}),
+            relay: { relayId: credentials.relayId, hostToken: credentials.hostToken }
+          })
          data.relayId = credentials.relayId

          // The public address the paired phones stored is gone with the old registration.
@@ -1876,7 +1998,8 @@ export function createMobileLink(deps: MobileLinkDeps) {
   * is paired OR pairing is in progress). Both follow the same condition.
   */
  async function syncListening(data: MobileLinkStored) {
-    const wanted = () => !stopped && data.enabled && !deps.isRemoteMode() && (data.devices.length > 0 || session !== null)
+    const wanted = () =>
+      !stopped && data.enabled && !deps.isRemoteMode() && (data.devices.length > 0 || session !== null)

    // ensureProxy may drop phones paired against a replaced certificate, so ask again after it.
    const instance = wanted() ? await ensureProxy(data) : proxy
@@ -2002,7 +2125,9 @@ export function createMobileLink(deps: MobileLinkDeps) {
        }

        // LAN candidates only when the phone could really reach them.
-        const addresses = directWanted(data) ? (await deps.addresses()).filter(isPrivateIpv4).slice(0, MOBILE_LAN_MAX_URLS) : []
+        const addresses = directWanted(data)
+          ? (await deps.addresses()).filter(isPrivateIpv4).slice(0, MOBILE_LAN_MAX_URLS)
+          : []

        if (!relayUrl && !addresses.length) {
          throw new MobileLinkError('no_lan_address')
@@ -2022,9 +2147,12 @@ export function createMobileLink(deps: MobileLinkDeps) {
          codePath: 'pending',
          offer: null,
          // The proxy notices expiry lazily (on a request); this closes the socket on time.
-          timer: setTimer(() => {
-            instance.pairingOpen()
-          }, Math.max(0, expiresAt - now()) + 50),
+          timer: setTimer(
+            () => {
+              instance.pairingOpen()
+            },
+            Math.max(0, expiresAt - now()) + 50
+          ),
          addresses,
          port,
          fingerprint,
@@ -0,0 +1,139 @@
+/** Opt-in acceptance against a running local IDE backend. No credentials on disk. */
+import https from 'node:https'
+import crypto from 'node:crypto'
+import type { PeerCertificate } from 'node:tls'
+import { expect, it } from 'vitest'
+import { WebSocket } from 'ws'
+import { createSelfSignedCertificate } from './mobile-lan-cert'
+import { createLanProxy } from './mobile-lan-proxy'
+
+it.skipIf(!process.env.AITURK_TEST_BACKEND_PORT)(
+  'real backend: pinned TLS, screens, cron lifecycle and chat socket',
+  async () => {
+    const port = Number(process.env.AITURK_TEST_BACKEND_PORT)
+    expect(Number.isInteger(port) && port > 0 && port < 65536).toBe(true)
+    const baseUrl = `http://127.0.0.1:${port}`
+    const root = await (await fetch(baseUrl)).text()
+    const session = root.match(/window\.__HERMES_SESSION_TOKEN__\s*=\s*"([^"]+)"/)?.[1]
+    expect(Boolean(session)).toBe(true)
+    const identity = createSelfSignedCertificate()
+    const checkServerIdentity = (_host: string, cert: PeerCertificate) =>
+      crypto.createHash('sha256').update(cert.raw).digest('base64url') === identity.fingerprint
+        ? undefined
+        : new Error('Certificate pin mismatch')
+    const proxy = createLanProxy({
+      tls: identity,
+      version: 'acceptance',
+      pcName: 'acceptance',
+      resolveBackend: async profile => {
+        if (profile !== 'default') throw new Error('Acceptance may only use the default profile')
+        return { baseUrl, token: session! }
+      }
+    })
+    const proxyPort = await proxy.listen(0, '127.0.0.1')
+    let deviceToken = ''
+    let createdId: string | undefined
+    const call = (path: string, method = 'GET', body?: unknown): Promise<{ status: number; data: any }> =>
+      new Promise((resolve, reject) => {
+        const req = https.request(
+          {
+            hostname: '127.0.0.1',
+            port: proxyPort,
+            path,
+            method,
+            ca: identity.cert,
+            checkServerIdentity,
+            headers: {
+              ...(deviceToken ? { Authorization: `Bearer ${deviceToken}` } : {}),
+              'Content-Type': 'application/json'
+            }
+          },
+          res => {
+            let value = ''
+            res.on('data', chunk => (value += chunk))
+            res.on('end', () => {
+              try {
+                resolve({ status: res.statusCode!, data: value ? JSON.parse(value) : null })
+              } catch {
+                reject(new Error(`Non-JSON response: ${path}`))
+              }
+            })
+          }
+        )
+        req.setTimeout(60000, () => req.destroy(new Error(`Timeout: ${path}`)))
+        req.on('error', reject)
+        req.end(body === undefined ? undefined : JSON.stringify(body))
+      })
+    try {
+      const pair = await call('/aiturk/pair/claim', 'POST', {
+        code: proxy.beginPairing().code,
+        device_name: 'Acceptance ephemeral'
+      })
+      expect(pair.status).toBe(200)
+      deviceToken = pair.data.token
+      for (const endpoint of [
+        'health',
+        'profiles',
+        'sessions',
+        'cron/jobs',
+        'cron/blueprints',
+        'cron/delivery-targets',
+        'model/info',
+        'skills',
+        'tools/toolsets',
+        'mcp/servers',
+        'plugins/kanban/boards'
+      ]) {
+        const response = await call(`/api/${endpoint}?profile=default`)
+        expect(response.status, endpoint).toBe(200)
+      }
+      const created = await call('/api/cron/jobs?profile=default', 'POST', {
+        name: `AITURK mobile acceptance ${Date.now()}`,
+        schedule: '0 0 1 1 *',
+        prompt: 'Temporary acceptance record; deleted immediately without execution.',
+        deliver: 'local'
+      })
+      expect(created.status).toBe(200)
+      createdId = created.data.id
+      expect(typeof createdId).toBe('string')
+      const route = `/api/cron/jobs/${encodeURIComponent(createdId!)}`
+      expect((await call(`${route}/pause?profile=default`, 'POST')).status).toBe(200)
+      expect(
+        (await call(`${route}?profile=default`, 'PUT', { updates: { name: 'AITURK acceptance updated' } })).status
+      ).toBe(200)
+      expect((await call(`${route}/resume?profile=default`, 'POST')).status).toBe(200)
+      await new Promise<void>((resolve, reject) => {
+        const ws = new WebSocket(`wss://127.0.0.1:${proxyPort}/api/ws?profile=default`, {
+          ca: identity.cert,
+          checkServerIdentity,
+          headers: { Authorization: `Bearer ${deviceToken}` }
+        })
+        const timer = setTimeout(() => {
+          ws.terminate()
+          reject(new Error('Chat ping timed out'))
+        }, 15000)
+        ws.on('open', () => ws.send(JSON.stringify({ jsonrpc: '2.0', id: 123, method: 'gateway.ping', params: {} })))
+        ws.on('message', raw => {
+          const message = JSON.parse(String(raw))
+          if (message.id === 123) {
+            clearTimeout(timer)
+            ws.close()
+            message.error ? reject(new Error('Chat ping rejected')) : resolve()
+          }
+        })
+        ws.on('error', error => {
+          clearTimeout(timer)
+          reject(error)
+        })
+      })
+    } finally {
+      if (createdId) {
+        const route = `/api/cron/jobs/${encodeURIComponent(createdId)}?profile=default`
+        expect((await call(route, 'DELETE')).status).toBe(200)
+        expect((await call(route)).status).toBe(404)
+      }
+      await proxy.stop()
+    }
+  },
+  180000
+)
@@ -173,3 +173,21 @@ test('reset rejects with a typed error and never enters either backend', async (
  assert.equal(options.connectRemote.mock.calls.length, 0)
  assert.equal(options.ensureLocalRuntime.mock.calls.length, 0)
 })
+
+test('a sibling runtime completion re-resolves the primary profile without re-running the stale installer', async () => {
+  const gate = createFirstRunSetupGate({ stuckAfterMs: 0 })
+  const installed = { kind: 'python', activeRoot: bootstrapBackend.activeRoot, args: ['--profile', 'fusion-frontier'] }
+  const prepareLocalBackend = vi.fn().mockResolvedValueOnce(bootstrapBackend).mockResolvedValue(installed)
+  const options = startupOptions({ waitForDecision: gate.wait, prepareLocalBackend })
+  const pending = runPrimaryBackendStartup(options)
+  await vi.waitFor(() => assert.equal(gate.hasWaiter(), true))
+  gate.runtimeAvailable(bootstrapBackend.activeRoot)
+  await pending
+  assert.deepEqual(options.ensureLocalRuntime.mock.calls, [[installed]])
+})
+
+test('a runtime that disappeared after readiness cannot silently trigger another installation', async () => {
+  const options = startupOptions({ waitForDecision: async () => 'runtime-ready' as const })
+  await assert.rejects(runPrimaryBackendStartup(options), /no longer available/)
+  assert.equal(options.ensureLocalRuntime.mock.calls.length, 0)
+})
@@ -109,5 +109,13 @@ export async function runPrimaryBackendStartup<Backend, RuntimeBackend, Remote,
    throw new FirstRunSetupResetError()
  }

+  if (decision === 'runtime-ready') {
+    const current = await prepareLocalBackend()
+    if ((current as { kind?: string }).kind === 'bootstrap-needed') {
+      throw new Error('The completed local runtime is no longer available. Retry setup.')
+    }
+    return { kind: 'local', backend: await ensureLocalRuntime(current) }
+  }
+
  return { kind: 'local', backend: await ensureLocalRuntime(backend) }
 }
@@ -2,7 +2,7 @@
  "name": "aiturk-ide",
  "productName": "AITURK IDE",
  "private": true,
-  "version": "1.0.0-beta.17",
+  "version": "1.0.0-beta.19",
  "description": "TurkServis resmi yapay zekâ geliştirme ortamı. Hermes Agent tabanlıdır.",
  "author": "AITURK / TurkServis",
  "repository": {
@@ -0,0 +1,12 @@
+import { defineConfig } from 'vitest/config'
+
+export default defineConfig({
+  test: {
+    environment: 'node',
+    include: [
+      'electron/mobile-*.test.ts',
+      'electron/first-run-setup*.test.ts',
+      'electron/primary-backend-startup.test.ts'
+    ]
+  }
+})
@@ -1470,6 +1470,34 @@ def _wait_for_oneshot_background_completions(cli) -> None:
        )


+def _emit_approval_required(session_id) -> None:
+    """Report approvals a one-shot run could not put in front of a human.
+
+    One ``approval_required: <json>`` line per blocked request on stderr,
+    next to ``session_id:``, so the process that launched this run can tell
+    "blocked, needs a human" from "still working" without parsing prose.
+    Nothing was applied for these requests; resuming the same session in an
+    interactive surface is the way to get them approved.
+    """
+    try:
+        from tools.approval import drain_human_approval_required
+        records = drain_human_approval_required()
+    except Exception:
+        return
+    for record in records:
+        try:
+            if not record.get("session_id"):
+                record["session_id"] = session_id or ""
+            record["resume"] = "interactive"
+            print(
+                "approval_required: "
+                + json.dumps(record, ensure_ascii=True, sort_keys=True),
+                file=sys.stderr,
+            )
+        except Exception:
+            continue
+
+
 def _finalize_single_query(cli) -> None:
    """Close one-shot CLI resources before releasing the active session lease."""
    try:
@@ -22360,6 +22388,7 @@ def main(

                        # Session ID goes to stderr so piped stdout is clean.
                        print(f"\nsession_id: {cli.session_id}", file=sys.stderr)
+                        _emit_approval_required(cli.session_id)

                        # Ensure proper exit code for automation wrappers.
                        #
@@ -65,7 +65,7 @@
    },
    "apps/desktop": {
      "name": "aiturk-ide",
-      "version": "1.0.0-beta.17",
+      "version": "1.0.0-beta.19",
      "license": "MIT",
      "dependencies": {
        "@assistant-ui/core": "0.2.23",
@@ -272,6 +272,7 @@ _HERMES_BEHAVIORAL_VARS = frozenset({
    "HERMES_REAL_HOME",
    "TERMINAL_HOME_MODE",
    "HERMES_INTERACTIVE",
+    "HERMES_SINGLE_QUERY_SESSION",
    "HERMES_QUIET",
    "HERMES_TOOL_PROGRESS",
    "HERMES_TOOL_PROGRESS_MODE",
@@ -0,0 +1,578 @@
+"""Protected instruction-file gate when no human can be reached.
+
+A one-shot run (``chat -q`` / ``--query-file``) installs the CLI approval
+callback but never starts the prompt UI. The gate used to treat the
+registered callback as a reachable human and wait out ``approvals.timeout``
+on a panel nobody could see. These tests pin the fixed contract:
+
+* no reachable human -> BLOCKED at once, nothing written, the outcome is
+  recorded for the launching process;
+* the gate itself is unchanged: still asks a real human every time, still
+  ignores yolo and ``approvals.single_query_mode``;
+* an approval that arrives after the calling execute_code script stopped
+  waiting is not applied.
+"""
+
+import json
+import time
+
+import pytest
+
+
+@pytest.fixture(autouse=True)
+def _gate_on(monkeypatch):
+    import tools.approval as A
+    import tools.file_tools as ft
+
+    monkeypatch.setattr(ft, "_protected_instruction_config", lambda: (True, []))
+    monkeypatch.delenv("HERMES_SINGLE_QUERY_SESSION", raising=False)
+    A.drain_human_approval_required()
+    A.set_approval_reply_deadline(None)
+    yield
+    A.drain_human_approval_required()
+    A.set_approval_reply_deadline(None)
+
+
+@pytest.fixture
+def approvals():
+    """CLI approval callback that records calls and gives a scripted answer."""
+    from tools.terminal_tool import set_approval_callback
+
+    state = {"calls": [], "answer": "deny"}
+
+    def cb(command, description, **kwargs):
+        state["calls"].append({"command": command, **kwargs})
+        answer = state["answer"]
+        if callable(answer):
+            return answer()
+        return answer
+
+    set_approval_callback(cb)
+    yield state
+    set_approval_callback(None)
+
+
+@pytest.fixture
+def one_shot(monkeypatch):
+    monkeypatch.setenv("HERMES_SINGLE_QUERY_SESSION", "1")
+
+
+def _write(path, content="injected"):
+    from tools.file_tools import write_file_tool
+
+    return json.loads(write_file_tool(str(path), content))
+
+
+def _records():
+    import tools.approval as A
+
+    return A.drain_human_approval_required()
+
+
+# ---- one-shot run: callback registered, nobody to answer ------------------
+
+
+class TestOneShotRun:
+    def test_blocks_at_once_without_prompting(self, tmp_path, approvals, one_shot):
+        target = tmp_path / "AGENTS.md"
+        target.write_text("rules\n", encoding="utf-8")
+        approvals["answer"] = "once"  # would be honored if anyone were asked
+
+        started = time.monotonic()
+        res = _write(target)
+        elapsed = time.monotonic() - started
+
+        assert res.get("error") and "BLOCKED" in res["error"]
+        assert "APPROVAL REQUIRED" in res["error"]
+        assert target.read_text(encoding="utf-8") == "rules\n"
+        assert approvals["calls"] == [], "prompted on a surface nobody can see"
+        assert elapsed < 5
+
+    def test_outcome_is_recorded_for_the_launcher(self, tmp_path, approvals, one_shot):
+        import tools.approval as A
+
+        target = tmp_path / "CLAUDE.md"
+        sid = A._approval_session_id.set("sess-123")
+        tcid = A._approval_tool_call_id.set("call-9")
+        try:
+            _write(target)
+        finally:
+            A._approval_tool_call_id.reset(tcid)
+            A._approval_session_id.reset(sid)
+
+        records = _records()
+        assert len(records) == 1
+        rec = records[0]
+        assert rec["kind"] == "protected_instruction_file"
+        assert rec["reason"] == "no_interactive_user"
+        assert rec["applied"] is False
+        assert rec["session_id"] == "sess-123"
+        assert rec["tool_call_id"] == "call-9"
+        assert rec["request_id"]
+        assert any("CLAUDE.md" in t for t in rec["targets"])
+        assert _records() == [], "drain must clear"
+
+    def test_yolo_does_not_open_the_gate(self, tmp_path, approvals, one_shot, monkeypatch):
+        import tools.approval as A
+
+        monkeypatch.setattr(A, "_YOLO_MODE_FROZEN", True)
+        target = tmp_path / "AGENTS.md"
+        res = _write(target)
+        assert res.get("error") and "BLOCKED" in res["error"]
+        assert not target.exists()
+
+    def test_single_query_mode_approve_does_not_open_the_gate(
+        self, tmp_path, approvals, one_shot, monkeypatch
+    ):
+        import tools.approval as A
+
+        real_cfg_get = A.cfg_get
+
+        def fake_cfg_get(config, *keys, default=None):
+            if keys == ("approvals", "single_query_mode"):
+                return "approve"
+            return real_cfg_get(config, *keys, default=default)
+
+        monkeypatch.setattr(A, "cfg_get", fake_cfg_get)
+        target = tmp_path / "SOUL.md"
+        res = _write(target)
+        assert res.get("error") and "BLOCKED" in res["error"]
+        assert not target.exists()
+
+    def test_regular_file_still_writes(self, tmp_path, approvals, one_shot):
+        target = tmp_path / "notes.md"
+        res = _write(target, "hello")
+        assert not res.get("error"), res
+        assert target.read_text(encoding="utf-8") == "hello"
+        assert _records() == []
+
+    def test_multi_file_patch_applies_nothing(self, tmp_path, approvals, one_shot):
+        from tools.file_tools import patch_tool
+
+        agents = tmp_path / "AGENTS.md"
+        agents.write_text("rules\n", encoding="utf-8")
+        plain = tmp_path / "plain.txt"
+        plain.write_text("hello\n", encoding="utf-8")
+        patch = (
+            "*** Begin Patch\n"
+            f"*** Update File: {plain}\n"
+            "@@\n"
+            "-hello\n"
+            "+world\n"
+            f"*** Update File: {agents}\n"
+            "@@\n"
+            "-rules\n"
+            "+injected\n"
+            "*** End Patch"
+        )
+        res = json.loads(patch_tool(mode="patch", patch=patch))
+        assert res.get("error") and "BLOCKED" in res["error"]
+        assert plain.read_text(encoding="utf-8") == "hello\n"
+        assert agents.read_text(encoding="utf-8") == "rules\n"
+        assert approvals["calls"] == []
+
+    def test_retry_in_same_run_blocks_again(self, tmp_path, approvals, one_shot):
+        target = tmp_path / "AGENTS.md"
+        _write(target)
+        res = _write(target)
+        assert res.get("error") and "BLOCKED" in res["error"]
+        assert not target.exists()
+        assert len(_records()) == 2
+
+
+# ---- no channel at all ----------------------------------------------------
+
+
+def test_no_channel_fails_closed_and_is_recorded(tmp_path):
+    target = tmp_path / "AGENTS.md"
+    res = _write(target)
+    assert res.get("error") and "BLOCKED" in res["error"]
+    assert not target.exists()
+    records = _records()
+    assert [r["reason"] for r in records] == ["no_approval_channel"]
+
+
+def test_undeliverable_gateway_request_is_recorded(tmp_path):
+    import tools.approval as A
+
+    session_key = "protected-unattended-undelivered"
+    token = A.set_current_session_key(session_key)
+    try:
+        def notify(approval_data):
+            raise RuntimeError("client went away")
+
+        A.register_gateway_notify(session_key, notify)
+        try:
+            target = tmp_path / "AGENTS.md"
+            res = _write(target)
+        finally:
+            A.unregister_gateway_notify(session_key)
+    finally:
+        A.reset_current_session_key(token)
+
+    assert res.get("error") and "BLOCKED" in res["error"]
+    assert not target.exists()
+    assert [r["reason"] for r in _records()] == ["approval_not_delivered"]
+
+
+# ---- a reachable human: the gate behaves exactly as before -----------------
+
+
+class TestReachableHuman:
+    def test_allow_writes(self, tmp_path, approvals):
+        target = tmp_path / "AGENTS.md"
+        approvals["answer"] = "once"
+        res = _write(target, "approved")
+        assert not res.get("error"), res
+        assert target.read_text(encoding="utf-8") == "approved"
+        assert len(approvals["calls"]) == 1
+        assert _records() == []
+
+    @pytest.mark.parametrize("answer", ["deny", "timeout"])
+    def test_deny_and_silence_block(self, tmp_path, approvals, answer):
+        target = tmp_path / "AGENTS.md"
+        approvals["answer"] = answer
+        res = _write(target)
+        assert res.get("error") and "BLOCKED" in res["error"]
+        assert not target.exists()
+        assert len(approvals["calls"]) == 1
+        # A human was asked and did not consent: not an "unattended" outcome.
+        assert _records() == []
+
+    def test_prompt_that_dies_blocks(self, tmp_path, approvals):
+        """Cancel / lost surface: the prompt raising is not consent."""
+        def boom():
+            raise RuntimeError("prompt surface lost")
+
+        target = tmp_path / "AGENTS.md"
+        approvals["answer"] = boom
+        res = _write(target)
+        assert res.get("error") and "BLOCKED" in res["error"]
+        assert not target.exists()
+
+
+# ---- approval that arrives after the caller stopped waiting ----------------
+
+
+class TestLateApproval:
+    def test_late_cli_approval_is_not_applied(self, tmp_path, approvals):
+        import tools.approval as A
+
+        target = tmp_path / "AGENTS.md"
+        target.write_text("rules\n", encoding="utf-8")
+
+        def answer_after_deadline():
+            # The human says yes, but only once the execute_code script that
+            # asked for this write has already timed out.
+            A.set_approval_reply_deadline(time.monotonic() - 1)
+            return "once"
+
+        A.set_approval_reply_deadline(time.monotonic() + 300)
+        approvals["answer"] = answer_after_deadline
+        res = _write(target)
+
+        assert res.get("error") and "BLOCKED" in res["error"]
+        assert "NOT applied" in res["error"]
+        assert target.read_text(encoding="utf-8") == "rules\n"
+
+    def test_late_approval_does_not_carry_to_the_next_request(self, tmp_path, approvals):
+        import tools.approval as A
+
+        target = tmp_path / "AGENTS.md"
+        A.set_approval_reply_deadline(time.monotonic() - 1)
+        approvals["answer"] = "once"
+        assert "BLOCKED" in _write(target).get("error", "")
+        assert not target.exists()
+
+        # A fresh call (new deadline) asks again; the old yes is not reused.
+        A.set_approval_reply_deadline(time.monotonic() + 300)
+        approvals["answer"] = "deny"
+        assert "BLOCKED" in _write(target).get("error", "")
+        assert not target.exists()
+        assert len(approvals["calls"]) == 2
+
+    def test_in_time_approval_is_applied(self, tmp_path, approvals):
+        import tools.approval as A
+
+        target = tmp_path / "AGENTS.md"
+        A.set_approval_reply_deadline(time.monotonic() + 300)
+        approvals["answer"] = "once"
+        res = _write(target, "approved")
+        assert not res.get("error"), res
+        assert target.read_text(encoding="utf-8") == "approved"
+
+    def test_late_gateway_approval_is_not_applied(self, tmp_path):
+        import tools.approval as A
+
+        session_key = "protected-unattended-late"
+        token = A.set_current_session_key(session_key)
+        try:
+            def notify(approval_data):
+                A.resolve_gateway_approval(session_key, "once")
+
+            A.register_gateway_notify(session_key, notify)
+            try:
+                A.set_approval_reply_deadline(time.monotonic() - 1)
+                target = tmp_path / "AGENTS.md"
+                res = _write(target)
+            finally:
+                A.unregister_gateway_notify(session_key)
+        finally:
+            A.reset_current_session_key(token)
+
+        assert res.get("error") and "NOT applied" in res["error"]
+        assert not target.exists()
+
+    def test_no_deadline_outside_execute_code(self):
+        import tools.approval as A
+
+        assert A.approval_reply_window_remaining() is None
+        assert A.approval_arrived_too_late() is False
+
+    def test_rpc_dispatch_binds_and_restores_the_deadline(self):
+        import tools.approval as A
+        import tools.code_execution_tool as cet
+
+        start = time.monotonic()
+        previous = cet._bind_rpc_reply_deadline(start)
+        try:
+            remaining = A.approval_reply_window_remaining()
+            assert remaining is not None
+            assert 0 < remaining <= cet._RPC_REPLY_TIMEOUT_SECONDS
+        finally:
+            cet._restore_rpc_reply_deadline(previous)
+        assert A.approval_reply_window_remaining() is None
+
+    def test_deadline_is_per_thread(self):
+        import threading
+
+        import tools.approval as A
+
+        A.set_approval_reply_deadline(time.monotonic() - 1)
+        seen = {}
+
+        def other():
+            seen["late"] = A.approval_arrived_too_late()
+
+        worker = threading.Thread(target=other)
+        worker.start()
+        worker.join()
+        assert seen["late"] is False
+        assert A.approval_arrived_too_late() is True
+
+
+# ---- what the launching process sees ---------------------------------------
+
+
+def test_recorded_outcomes_are_bounded():
+    import tools.approval as A
+
+    for i in range(A._HUMAN_APPROVAL_REQUIRED_MAX + 20):
+        A.note_human_approval_required("protected_instruction_file", [f"f{i}"], "x")
+    records = A.drain_human_approval_required()
+    assert len(records) == A._HUMAN_APPROVAL_REQUIRED_MAX
+    assert records[-1]["targets"] == [f"f{A._HUMAN_APPROVAL_REQUIRED_MAX + 19}"]
+
+
+def test_one_shot_exit_reports_approval_required_on_stderr(capsys):
+    import cli as cli_module
+    import tools.approval as A
+
+    A.note_human_approval_required(
+        "protected_instruction_file", ["AGENTS.md"], "no_interactive_user"
+    )
+    cli_module._emit_approval_required("sess-42")
+
+    err = capsys.readouterr().err
+    lines = [l for l in err.splitlines() if l.startswith("approval_required: ")]
+    assert len(lines) == 1
+    payload = json.loads(lines[0].split(": ", 1)[1])
+    assert payload["session_id"] == "sess-42"
+    assert payload["applied"] is False
+    assert payload["reason"] == "no_interactive_user"
+    assert payload["resume"] == "interactive"
+    assert payload["targets"] == ["AGENTS.md"]
+
+    cli_module._emit_approval_required("sess-42")
+    assert "approval_required" not in capsys.readouterr().err
+
+
+# ---- execute_code RPC: the dispatcher really binds the window ---------------
+
+
+def _drive_rpc_once(dispatch, stop_event=None):
+    """Send one tool call through the real RPC server loop; return its reply."""
+    import socket
+    import threading
+
+    import tools.code_execution_tool as cet
+
+    server = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+    server.bind(("127.0.0.1", 0))
+    server.listen(1)
+    stop_event = stop_event or threading.Event()
+    worker = threading.Thread(
+        target=cet._rpc_server_loop,
+        args=(server, "task", [], [0], 5, frozenset({"patch"}), stop_event, "tok", dispatch),
+        daemon=True,
+    )
+    worker.start()
+    client = socket.create_connection(server.getsockname(), timeout=10)
+    try:
+        client.sendall(
+            (json.dumps({"tool": "patch", "args": {}, "token": "tok"}) + "\n").encode()
+        )
+        buf = b""
+        while not buf.endswith(b"\n"):
+            chunk = client.recv(65536)
+            if not chunk:
+                break
+            buf += chunk
+    finally:
+        client.close()
+        stop_event.set()
+        worker.join(timeout=10)
+        server.close()
+    return buf.decode().strip()
+
+
+def test_rpc_server_loop_binds_reply_window_around_dispatch():
+    import tools.approval as A
+    import tools.code_execution_tool as cet
+
+    seen = {}
+
+    def dispatch(tool_name, tool_args):
+        seen["remaining"] = A.approval_reply_window_remaining()
+        seen["late"] = A.approval_arrived_too_late()
+        return json.dumps({"ok": True})
+
+    reply = _drive_rpc_once(dispatch)
+    assert json.loads(reply) == {"ok": True}
+    assert seen["late"] is False
+    assert 0 < seen["remaining"] <= cet._RPC_REPLY_TIMEOUT_SECONDS
+
+
+def test_rpc_approval_after_script_ended_is_late():
+    """Script killed by its own run timeout while the prompt is still open."""
+    import threading
+
+    import tools.approval as A
+
+    stop_event = threading.Event()
+    seen = {}
+
+    def dispatch(tool_name, tool_args):
+        seen["before"] = A.approval_arrived_too_late()
+        stop_event.set()  # the script ended while a human was deciding
+        seen["after"] = A.approval_arrived_too_late()
+        return json.dumps({"ok": True})
+
+    _drive_rpc_once(dispatch, stop_event)
+    assert seen == {"before": False, "after": True}
+
+
+def test_protected_write_through_rpc_is_dropped_when_script_ended(tmp_path, approvals):
+    """End to end through the RPC loop: late yes -> BLOCKED, file untouched."""
+    import threading
+
+    from tools.file_tools import write_file_tool
+    from tools.terminal_tool import _get_approval_callback, set_approval_callback
+
+    target = tmp_path / "AGENTS.md"
+    target.write_text("rules\n", encoding="utf-8")
+    stop_event = threading.Event()
+    callback = _get_approval_callback()
+
+    def answer_after_script_died():
+        stop_event.set()
+        return "once"
+
+    approvals["answer"] = answer_after_script_died
+
+    def dispatch(tool_name, tool_args):
+        set_approval_callback(callback)  # the RPC thread carries the cell's callback
+        try:
+            return write_file_tool(str(target), "injected")
+        finally:
+            set_approval_callback(None)
+
+    reply = json.loads(_drive_rpc_once(dispatch, stop_event))
+    assert "NOT applied" in reply.get("error", "")
+    assert target.read_text(encoding="utf-8") == "rules\n"
+    assert len(approvals["calls"]) == 1
+
+
+def test_retired_kernel_cell_counts_as_gone():
+    import tools.approval as A
+
+    cell = {"active": True}
+    previous = A.also_gone_when(lambda: not cell["active"])
+    try:
+        assert A.approval_arrived_too_late() is False
+        cell["active"] = False
+        assert A.approval_arrived_too_late() is True
+    finally:
+        A.restore_approval_reply_deadline(previous)
+    assert A.approval_arrived_too_late() is False
+
+
+# ---- an automatic approver is not a person ----------------------------------
+
+
+def test_subagent_auto_approve_cannot_open_the_gate(tmp_path):
+    from tools.delegate_tool import _subagent_auto_approve
+    from tools.terminal_tool import set_approval_callback
+
+    target = tmp_path / "AGENTS.md"
+    set_approval_callback(_subagent_auto_approve)
+    try:
+        res = _write(target)
+    finally:
+        set_approval_callback(None)
+    assert res.get("error") and "BLOCKED" in res["error"]
+    assert not target.exists()
+    assert [r["reason"] for r in _records()] == ["no_interactive_user"]
+
+
+def test_blocked_message_survives_braces_in_target(tmp_path):
+    import tools.file_tools as ft
+
+    res = ft._request_protected_instruction_approval(["{be}/AGENTS.md"])
+    assert res.startswith("BLOCKED") and "{be}/AGENTS.md" in res
+
+
+# ---- sibling gates in a one-shot run ----------------------------------------
+
+
+def test_computer_use_does_not_wait_in_one_shot_run(one_shot, monkeypatch):
+    import tools.computer_use.tool as cu
+
+    calls = []
+    monkeypatch.setattr(cu, "_approval_callback", lambda *a, **k: calls.append(a) or "approve_once")
+    res = cu._request_approval("click", {}, session_id="unattended-test")
+    assert res is not None and "one-shot run" in json.loads(res)["error"]
+    assert calls == []
+
+
+def test_computer_use_still_asks_when_interactive(monkeypatch):
+    import tools.computer_use.tool as cu
+
+    calls = []
+    monkeypatch.setattr(cu, "_approval_callback", lambda *a, **k: calls.append(a) or "approve_once")
+    assert cu._request_approval("click", {}, session_id="attended-test") is None
+    assert len(calls) == 1
+
+
+def test_memory_write_prompt_unavailable_in_one_shot_run(approvals, monkeypatch):
+    import tools.write_approval as wa
+
+    assert wa._interactive_approval_available() is True
+    monkeypatch.setenv("HERMES_SINGLE_QUERY_SESSION", "1")
+    assert wa._interactive_approval_available() is False
+
+
+def test_one_shot_marker_is_not_inherited_by_child_processes(one_shot):
+    from tools.environments.local import _make_run_env
+
+    assert "HERMES_SINGLE_QUERY_SESSION" not in _make_run_env({})
@@ -78,6 +78,115 @@ _hermes_interactive_ctx: contextvars.ContextVar[Optional[str]] = contextvars.Con
 )


+# Absolute ``time.monotonic()`` instant after which whoever issued the
+# current tool call has stopped waiting for its result. Set by the
+# execute_code RPC dispatchers, whose sandbox client gives up after a fixed
+# reply timeout. An approval that resolves after this instant must NOT be
+# acted on: the caller already reported the call as failed, so applying it
+# would be a write the agent believes never happened (and may redo).
+# The reply timeout is not the only way a caller goes away: the script can
+# hit its own run timeout or be interrupted first. ``gone`` is a probe the
+# dispatcher supplies for that ("has my script/cell already ended?").
+# Thread-local on purpose: the dispatcher and the tool handler it calls run
+# on the same thread, whatever context the handler is re-bound to.
+_approval_reply_deadline = threading.local()
+
+
+def set_approval_reply_deadline(deadline: Optional[float], gone=None):
+    """Bind the caller's reply window for this thread; return the prior binding.
+
+    ``deadline`` is monotonic seconds (None = unbounded); ``gone`` is an
+    optional zero-argument callable that turns true once the caller has
+    ended. Pass the returned value to :func:`restore_approval_reply_deadline`.
+    """
+    previous = (
+        getattr(_approval_reply_deadline, "value", None),
+        getattr(_approval_reply_deadline, "gone", None),
+    )
+    _approval_reply_deadline.value = deadline
+    _approval_reply_deadline.gone = gone
+    return previous
+
+
+def restore_approval_reply_deadline(previous) -> None:
+    """Undo :func:`set_approval_reply_deadline` / :func:`also_gone_when`."""
+    deadline, gone = previous if previous else (None, None)
+    _approval_reply_deadline.value = deadline
+    _approval_reply_deadline.gone = gone
+
+
+def also_gone_when(probe):
+    """Add another "caller has ended" probe, keeping the current window."""
+    deadline = getattr(_approval_reply_deadline, "value", None)
+    current = getattr(_approval_reply_deadline, "gone", None)
+
+    def gone() -> bool:
+        return bool(probe()) or bool(current and current())
+
+    return set_approval_reply_deadline(deadline, gone)
+
+
+def approval_reply_window_remaining() -> Optional[float]:
+    """Seconds left before the caller stops waiting, or None when unbounded."""
+    deadline = getattr(_approval_reply_deadline, "value", None)
+    if deadline is None:
+        return None
+    return deadline - time.monotonic()
+
+
+def approval_arrived_too_late() -> bool:
+    """True when the caller of the current tool call has stopped waiting."""
+    gone = getattr(_approval_reply_deadline, "gone", None)
+    if gone is not None:
+        try:
+            if gone():
+                return True
+        except Exception:
+            pass
+    remaining = approval_reply_window_remaining()
+    return remaining is not None and remaining <= 0
+
+
+# Approvals that could not be put in front of a human because the run has
+# no interactive channel (single-query ``chat -Q`` stage runs, scripts).
+# The single-query CLI reports them on stderr as ``approval_required:``
+# lines so the coordinating process gets a machine-readable outcome
+# instead of inferring one from prose. Bounded: long-lived processes that
+# never drain it must not grow without limit.
+_human_approval_required: list[dict] = []
+_HUMAN_APPROVAL_REQUIRED_MAX = 50
+_human_approval_required_lock = threading.Lock()
+
+
+def note_human_approval_required(kind: str, targets: list[str], reason: str) -> dict:
+    """Record an approval the run could not present to a human.
+
+    Captures the active session/tool-call identity so the coordinator can
+    tie the outcome to the exact job and resume the same session.
+    """
+    record = {
+        "kind": kind,
+        "targets": list(dict.fromkeys(str(t) for t in targets)),
+        "reason": reason,
+        "request_id": uuid.uuid4().hex,
+        "tool_call_id": _approval_tool_call_id.get() or "",
+        "session_id": _approval_session_id.get() or os.getenv("HERMES_SESSION_ID", ""),
+        "applied": False,
+    }
+    with _human_approval_required_lock:
+        _human_approval_required.append(record)
+        del _human_approval_required[:-_HUMAN_APPROVAL_REQUIRED_MAX]
+    return dict(record)
+
+
+def drain_human_approval_required() -> list[dict]:
+    """Return and clear the recorded approval-required outcomes."""
+    with _human_approval_required_lock:
+        records = list(_human_approval_required)
+        _human_approval_required.clear()
+    return records
+
+
 def set_hermes_interactive_context(interactive: bool) -> contextvars.Token:
    """Bind interactive mode for the current context (thread or asyncio task).

@@ -716,6 +716,36 @@ def _call(tool_name, args):
 # RPC server (runs in a thread inside the parent process)
 # ---------------------------------------------------------------------------

+# How long the generated sandbox client waits for one tool-call reply
+# (``_sock.settimeout(300)`` / the file transport's 300s poll deadline).
+_RPC_REPLY_TIMEOUT_SECONDS = 300
+
+
+def _bind_rpc_reply_deadline(call_start: float, stop_event=None):
+    """Tell the approval gates when this call's requester stops waiting.
+
+    The requester is gone at the reply timeout, or earlier when the script
+    itself ended (run timeout, interrupt): ``stop_event`` is set then.
+    """
+    try:
+        from tools.approval import set_approval_reply_deadline
+        gone = stop_event.is_set if stop_event is not None else None
+        return (True, set_approval_reply_deadline(
+            call_start + _RPC_REPLY_TIMEOUT_SECONDS, gone))
+    except Exception:
+        return (False, None)
+
+
+def _restore_rpc_reply_deadline(previous) -> None:
+    if not previous or not previous[0]:
+        return
+    try:
+        from tools.approval import restore_approval_reply_deadline
+        restore_approval_reply_deadline(previous[1])
+    except Exception:
+        pass
+
+
 # Terminal parameters that must not be used from ephemeral sandbox scripts
 _TERMINAL_BLOCKED_PARAMS = {"background", "pty", "notify", "notify_on_complete", "watch_patterns"}

@@ -826,12 +856,18 @@ def _rpc_server_loop(
                # Dispatch through the standard tool handler.
                # Suppress stdout/stderr from internal tool handlers so
                # their status prints don't leak into the CLI spinner.
+                # The sandbox client stops waiting for this reply after
+                # _RPC_REPLY_TIMEOUT_SECONDS; an approval granted later
+                # must not apply a write the script already saw fail.
+                _prev_deadline = _bind_rpc_reply_deadline(call_start, stop_event)
                try:
                    with thread_scoped_silence():
                        result = dispatch(tool_name, tool_args)
                except Exception as exc:
                    logger.error("Tool call failed in sandbox: %s", exc, exc_info=True)
                    result = tool_error(str(exc))
+                finally:
+                    _restore_rpc_reply_deadline(_prev_deadline)

                tool_call_counter[0] += 1
                call_duration = time.monotonic() - call_start
@@ -1101,6 +1137,7 @@ def _rpc_poll_loop(
                            tool_args.pop(param, None)

                    # Dispatch through the standard tool handler
+                    _prev_deadline = _bind_rpc_reply_deadline(call_start, stop_event)
                    try:
                        with thread_scoped_silence():
                            tool_result = handle_function_call(
@@ -1110,6 +1147,8 @@ def _rpc_poll_loop(
                        logger.error("Tool call failed in remote sandbox: %s",
                                     exc, exc_info=True)
                        tool_result = tool_error(str(exc))
+                    finally:
+                        _restore_rpc_reply_deadline(_prev_deadline)

                    tool_call_counter[0] += 1
                    call_duration = time.monotonic() - call_start
@@ -322,9 +322,25 @@ class CellAuthority:
                set_sudo(self._sudo_cb)
            except Exception:
                previous = None
+        # A cell that settled (timeout, interrupt, error) no longer waits for
+        # this call: an approval granted afterwards must not be applied.
+        reply_window = None
+        try:
+            from tools.approval import also_gone_when
+
+            reply_window = (also_gone_when(lambda: not self.active),)
+        except Exception:
+            reply_window = None
        try:
            return handle_function_call(tool_name, tool_args, task_id=self.task_id)
        finally:
+            if reply_window is not None:
+                try:
+                    from tools.approval import restore_approval_reply_deadline
+
+                    restore_approval_reply_deadline(reply_window[0])
+                except Exception:
+                    pass
            if previous is not None and self._callback_setters is not None:
                set_approval, set_sudo = self._callback_setters
                try:
@@ -613,6 +613,22 @@ def _request_approval(action: str, args: Dict[str, Any],
        # No CLI approval wired — default allow. Gateway approval is handled
        # one layer out via the normal tool-approval infra.
        return None
+    try:
+        from tools.approval import _is_single_query_approval_context
+        unattended = _is_single_query_approval_context()
+    except Exception:
+        unattended = False
+    if unattended:
+        # One-shot run: the prompt callback is installed but its panel is
+        # never shown, so asking would only wait out approvals.timeout.
+        return json.dumps({
+            "error": (
+                "approval required but this is a one-shot run with no "
+                "interactive user to approve it. Silence is not consent; "
+                "do not retry without the user."
+            ),
+            "action": action,
+        })
    summary = _summarize_action(action, args)
    try:
        verdict = cb(action, args, summary)
@@ -102,6 +102,11 @@ def _subagent_auto_approve(command: str, description: str, **kwargs) -> str:
    return "once"


+# Not a person: gates that require real human consent every time (protected
+# instruction files) must not accept this callback's answer.
+_subagent_auto_approve.unattended = True
+
+
 def _get_subagent_approval_callback():
    """Return the callback to install into subagent worker threads.

@@ -1546,6 +1546,10 @@ def _make_run_env(env: dict) -> dict:
            run_env[real_key] = v
        elif _is_hermes_internal_secret(k):
            continue
+        elif k == "HERMES_SINGLE_QUERY_SESSION":
+            # Describes this process only. A child (an interactive hermes
+            # started from a one-shot run's terminal) sets its own.
+            continue
        else:
            first_party = _is_terminal_first_party_env(k)
            passthrough = _is_passthrough(k)
@@ -861,12 +861,18 @@ def _request_protected_instruction_approval(
        "required (not bypassed by auto-approve)."
    )
    display = f"<write to {targets}>"
-    blocked = (
-        f"BLOCKED: write to protected agent-instruction file(s) ({targets}) "
-        "{why} The user has NOT consented to this write. Do NOT retry it or "
-        "attempt the same edit via another path (terminal, execute_code, "
-        "etc.)."
-    )
+    class _Blocked:
+        # Not str.format: a target path may itself contain braces.
+        @staticmethod
+        def format(why: str) -> str:
+            return (
+                "BLOCKED: write to protected agent-instruction file(s) "
+                f"({targets}) {why} The user has NOT consented to this "
+                "write. Do NOT retry it or attempt the same edit via "
+                "another path (terminal, execute_code, etc.)."
+            )
+
+    blocked = _Blocked

    try:
        import tools.approval as _approval
@@ -874,6 +880,41 @@ def _request_protected_instruction_approval(
        return blocked.format(why="requires approval but the approval "
                                  "subsystem is unavailable.")

+    def _needs_human(reason: str, why: str) -> str:
+        # No human could be shown this request. Record it so a one-shot
+        # run can hand its coordinator a machine-readable outcome, and tell
+        # the agent where a human CAN approve it instead of waiting on a
+        # prompt nobody sees.
+        try:
+            _approval.note_human_approval_required(
+                "protected_instruction_file", list(reasons), reason)
+        except Exception:
+            pass
+        return blocked.format(
+            why=why + " APPROVAL REQUIRED: a human must approve this from "
+                      "an interactive session (resume this same session in "
+                      "the desktop app or an interactive terminal and "
+                      "request the write again there).")
+
+    def _too_late() -> str | None:
+        # The approval came back after whoever issued this call stopped
+        # waiting (execute_code RPC reply timeout). The caller already saw
+        # a failure, so applying the write now would be an edit the agent
+        # believes never happened.
+        try:
+            late = _approval.approval_arrived_too_late()
+        except Exception:
+            late = False
+        if not late:
+            return None
+        logger.warning(
+            "Approval for protected instruction file(s) %s arrived after "
+            "the caller stopped waiting; write not applied.", targets)
+        return blocked.format(
+            why="was approved only after the calling script had stopped "
+                "waiting for the result, so the write was NOT applied. "
+                "The approval is spent; a new request needs a new approval.")
+
    # Gateway surface: block on the button round-trip when a notify callback
    # is registered for this session (Telegram/Discord/Slack). One-operation
    # only — no session/permanent buttons are offered.
@@ -898,14 +939,15 @@ def _request_protected_instruction_approval(
            session_key, notify_cb, approval_data, surface="gateway",
        )
        if decision.get("notify_failed"):
-            return blocked.format(
-                why="requires approval but the approval request could not "
-                    "be delivered.")
+            return _needs_human(
+                "approval_not_delivered",
+                "requires approval but the approval request could not "
+                "be delivered.")
        choice = decision.get("choice")
        if decision.get("resolved") and choice in {"once", "session", "always"}:
            # One-operation grant regardless of the tapped scope — nothing
            # is persisted for this gate.
-            return None
+            return _too_late()
        if not decision.get("resolved"):
            return blocked.format(
                why="approval prompt timed out without a user response. "
@@ -921,6 +963,28 @@ def _request_protected_instruction_approval(
        callback = None

    if callback is not None:
+        # A one-shot run (``chat -q`` / ``--query-file``) installs the
+        # prompt callback but never starts the prompt UI: the panel would
+        # be painted nowhere and the wait would last the whole
+        # approvals.timeout with nobody able to answer. A registered
+        # callback is not a reachable human. Fail closed NOW;
+        # approvals.single_query_mode does not apply to this gate.
+        try:
+            unattended = _approval._is_single_query_approval_context()
+        except Exception:
+            unattended = False
+        if unattended:
+            return _needs_human(
+                "no_interactive_user",
+                "requires approval but this is a one-shot run with no "
+                "interactive user to approve it.")
+        if getattr(callback, "unattended", False):
+            # An auto-answering callback (subagent auto-approve) is not a
+            # person; this gate takes consent from a human only.
+            return _needs_human(
+                "no_interactive_user",
+                "requires approval but only an automatic approver is "
+                "attached to this run, not a person.")
        choice = _approval.prompt_dangerous_approval(
            display, description,
            allow_permanent=False,
@@ -929,7 +993,7 @@ def _request_protected_instruction_approval(
        )
        if choice in {"once", "session", "always"}:
            # One-operation grant; never persisted (see docstring).
-            return None
+            return _too_late()
        if choice == "timeout":
            return blocked.format(
                why="approval prompt timed out without a user response. "
@@ -938,9 +1002,10 @@ def _request_protected_instruction_approval(

    # No human channel at all (script, cron, background thread): fail
    # closed. Auto-approving here would recreate the persistence vector.
-    return blocked.format(
-        why="requires approval but no interactive user or gateway is "
-            "present to approve it.")
+    return _needs_human(
+        "no_approval_channel",
+        "requires approval but no interactive user or gateway is "
+        "present to approve it.")


 def _check_protected_instruction_write(paths: list[str],
@@ -327,6 +327,14 @@ def _interactive_approval_available() -> bool:
      review affordance (``/memory pending``) instead.
    * Scripts, cron, and background threads — no user present.
    """
+    try:
+        from tools.approval import _is_single_query_approval_context
+        if _is_single_query_approval_context():
+            # One-shot run: the callback exists but its panel is never
+            # shown, so an inline prompt would wait with nobody to answer.
+            return False
+    except Exception:
+        pass
    try:
        from tools.terminal_tool import _get_approval_callback
        return _get_approval_callback() is not None