fix(agents): deny native AskUserQuestion — it hangs unattended runs (v0.193.2)

CHANGELOG.md

@@ -8,6 +8,20 @@ new version heading in the same commit.
 
 ## [Unreleased]
 
+## [0.195.1] — 2026-07-14
+### Fixed
+- **Agents can no longer hang a run on the native `AskUserQuestion` picker.** Claude's built-in
+  `AskUserQuestion` tool renders an interactive multiple-choice prompt in the terminal TUI and blocks the
+  turn until someone presses Enter at the keyboard — but an Agent OS run has no human at the terminal
+  (chat/automation/task/Slack runs are unattended). So an agent that reached for it (e.g. asked to "ask a
+  question") would **hang forever**: no turn output, nothing in the Inbox, a stuck pane — and in the new
+  Chat surface it looked like the question tool "wasn't rendering." The launcher now **denies
+  `AskUserQuestion`** (`terminal/claude-launch.sh`; deny rules apply even under
+  `--dangerously-skip-permissions`), and the operating notes steer agents to **`ask_human`** (governed →
+  Inbox card + DM, blocks for the reply) or plain prose — both work in every surface, including Chat.
+  This was a latent bug for all unattended runs, surfaced by the Chat work. (`terminal/claude-launch.sh`,
+  `src/terminal.ts`.)
+
 ## [0.195.0] — 2026-07-14
 ### Fixed
 - **Plain-text links in the terminal are now clickable — no scheme needed, and OSC-8 markdown links work

package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-os",
-  "version": "0.195.0",
+  "version": "0.195.1",
   "description": "A generic, governed operating system for running autonomous agents safely across brands. Ships with a local web console.",
   "license": "MIT",
   "type": "commonjs",

src/terminal.ts

@@ -78,7 +78,9 @@ into this prompt — you must reach for it:
 ## Talking to the human — use the Inbox, not just the terminal
 Your terminal output may not be read. The operator lives in the Inbox:
 - \`ask\` when you're blocked on a judgement only the human can make — it waits for their reply. Prefer
-  asking over guessing on anything risky or ambiguous.
+  asking over guessing on anything risky or ambiguous. This is the ONLY way to ask a person here: there
+  is no human at your terminal, so a native multiple-choice/interactive prompt just hangs unanswered —
+  always use \`ask\` (or plain text if you're in a chat), never an interactive picker.
 - \`report\` exactly once when you finish, with the outcome and a one-line summary, so the result is
   visible without anyone reading the terminal. If the task taught you something durable, pass it in
   \`lessons\` — it's saved to your memory as a note to your future self.

terminal/claude-launch.sh

@@ -71,7 +71,13 @@ STATUSLINE="$(dirname "$HOOK")/statusline.js"
 # under it and a deny would block the agent reading its OWN files — so we deny only crown-jewel
 # paths that never overlap the agent folder.
 H="${HOME#/}"
-DENYS="\"Read(//$H/.ssh/**)\", \"Read(//$H/.aws/**)\", \"Read(//$H/.gnupg/**)\", \"Read(//$H/.claude/**)\""
+# Deny the native AskUserQuestion tool: it renders a multiple-choice picker in the TUI and BLOCKS the
+# turn until someone presses Enter at the keyboard — but an Agent OS run has no human at the terminal
+# (chat/automation/task/Slack runs are unattended; even an attached session interacts via the console).
+# So it hangs the run forever and never reaches the Inbox. Denied here, the agent asks via `ask_human`
+# (governed → Inbox card + DM, blocks for the answer) or in plain prose — both work everywhere. (deny
+# rules apply even under --dangerously-skip-permissions.)
+DENYS="\"AskUserQuestion\", \"Read(//$H/.ssh/**)\", \"Read(//$H/.aws/**)\", \"Read(//$H/.gnupg/**)\", \"Read(//$H/.claude/**)\""
 DATA_HOME="$(cd "$AGENT_DIR/../.." 2>/dev/null && pwd)"
 if [ -n "$DATA_HOME" ]; then
   DH="${DATA_HOME#/}"