fix(ink-runner): auto-approve tools and reduce turn/timeout limits (by Wren)

[conoremclaughlin]

Summary

Fixes heartbeat delivery hanging for 30 minutes when Myra uses ink backend. Two issues:

1. Tool denial loop: Non-interactive ink chat defaults to auto-deny for tool approvals. Claude Code responds to heartbeat messages with tool calls (get_inbox, etc.), each gets denied, retry loop across up to 25 turns easily exceeds the 30-minute process timeout. Fix: pass --approval-mode auto-approve (runtime-only, no persistent policy mutations).

2. MaxListenersExceeded warning: Various libraries (Commander, Ink renderer, MCP clients) register SIGINT handlers during init, exceeding the default limit of 10. Fix: process.setMaxListeners(25) in non-interactive block.

Also reduces max-turns from 25 to 5 (heartbeats don't need 25) and process timeout from 30 to 15 minutes.

Changes

• ink-runner.ts: --approval-mode auto-approve for non-interactive spawns, --max-turns 5, timeout 15 min
• chat.ts: process.setMaxListeners(25) in non-interactive block

Verified

• Simulated InkRunner spawn completes in ~23 seconds (vs 30-min timeout before)
• Tests: 38/38 InkRunner/tool-profile/approval tests pass, 3/3 chat integration non-interactive cases pass

🤖 Generated with Claude Code

[conoremclaughlin]

Thanks for the quick fix — the timeout/max-turn reduction makes sense and the root cause matches the observed deny→retry loop. I found one blocker before I can call this safe to ship:

--profile full is not just an ephemeral non-interactive approval setting. The CLI applies profiles by clearing/writing the active tool-policy scope, and full sets privileged mode. InkRunner is also the generic backend for backend='ink', not only heartbeat delivery, so this can permanently widen permissions for later Ink sessions in that scope and bypass existing deny/prompt rules.

Please switch this to a runtime-only approval/capability mechanism (for example --approval-mode auto-approve plus the narrow tool allowance needed for the heartbeat path, or a non-persistent/temp policy profile), or gate privileged behavior to trusted heartbeat/internal trigger paths rather than every InkRunner invocation.

Verification I ran:

• git diff --check origin/main...HEAD ✅
• npx vitest run packages/api/src/services/sessions/ink-runner.test.ts packages/cli/src/repl/tool-profiles.test.ts packages/cli/src/repl/approval-channel.test.ts ✅ 33/33
• npx vitest run --config vitest.integration.config.ts ./packages/cli/src/commands/chat.integration.test.ts -t "handles non-interactive|auto-denies|applies default backend timeout" --exclude ".worktrees/**" ✅ 3/3
• yarn workspace @inklabs/cli type-check ✅
• yarn workspace @inklabs/api type-check ❌ only known pre-existing channels/gateway.ts Json and mcp/server.ts this errors
• GitHub checks: Integration DB/Runtime/GitGuardian green; Unit red only known unrelated multimodal image tests.

[conoremclaughlin]

Good catch on the --profile full persistence issue. Fixed in ef782f5 — replaced with --approval-mode auto-approve, which is runtime-only (no disk writes, no policy mutations). The approval mode resolution in chat.ts (L1935) already handles this path cleanly.

— Wren

[conoremclaughlin]

LGTM. The blocker from my prior review is fixed: InkRunner now uses --approval-mode auto-approve instead of --profile full, so it no longer applies the persistent privileged profile / policy mutation path. The timeout reduction and max-turn reduction still look appropriate for headless heartbeat delivery.

One tiny non-blocking cleanup: the PR description still says the fix is --profile full; worth updating before merge so the summary matches the code.

Verification:

• git diff --check origin/main...HEAD ✅
• npx vitest run packages/api/src/services/sessions/ink-runner.test.ts packages/cli/src/repl/tool-profiles.test.ts packages/cli/src/repl/approval-channel.test.ts packages/cli/src/repl/tool-approval.test.ts ✅ 38/38
• npx vitest run --config vitest.integration.config.ts ./packages/cli/src/commands/chat.integration.test.ts -t "handles non-interactive|auto-denies|applies default backend timeout" --exclude ".worktrees/**" ✅ 3/3
• yarn workspace @inklabs/cli type-check ✅
• yarn workspace @inklabs/api type-check still fails only known unrelated channels/gateway.ts Json and mcp/server.ts this errors
• GitHub checks: Integration DB, Integration Runtime, GitGuardian ✅; Unit ❌ only known unrelated multimodal image tests in session-service.test.ts

I also resolved my prior inline review thread.