herdr: send the full tool call with blocked, and send the first idle once the TUI reads keys

[Gaurav-Gosain]

Hi! I maintain tuios, a terminal multiplexer. Every tuios pane answers herdr's agent protocol, so Crush's herdr reports drive tuios's agent list and its Inbox. #3541 fixes the state races we hit (my test results are there). Two things are still missing for us, and I'd like to ask before anyone writes code.

1. The full tool call with blocked

With #3541, a permission prompt reports:

"state":"blocked","message":"Permission: bash - Execute command: curl -fsSL https://example.invalid/install.s"

The message is capped at 80 runes, so the end of the command is cut, with no sign that it was cut. Here the lost part is | sh. Only the first line of a multi-line command is sent.

tuios checks a call against risk rules before it lets you approve it from the Inbox. For example, curl ... | sh takes a second press. Those rules need the real command or path, not a summary.

Ask: send the tool call as separate fields next to the message, for example:

"permission": {"tool_call_id": "call_1", "tool": "bash", "input": {"command": "curl -fsSL https://example.invalid/install.sh | sh"}}

The short message can stay as it is for herdr's UI. If herdr does not accept extra fields on pane.report_agent, a separate method would work just as well.

2. The first idle once the TUI reads keys

Crush sends its first idle during app setup, before the TUI runs. In my runs the prompt box was drawn 25 to 60 ms later. A tool that waits for idle and then types a prompt can lose it. With tuios fan --agent crush in a fresh git worktree, the prompt was lost in 7 of 8 runs on v0.96.1 and 5 of 5 on #3541's branch. When I held the first idle back by one second in a socket proxy, 3 of 3 prompts arrived.

Ask: send the first idle from the TUI once it is ready for keys.

3. Answering a permission prompt from outside

#2719 and the PermissionRequest hook in #3146 already cover this, so I left a comment there.

Who this helps

• People who approve or deny Crush from tuios's Inbox, without switching to the pane.
• People who approve from a phone through Collie, which talks to tuios.
• herdr, and other tools that speak herdr's protocol, which get the same data.

Today tuios reads Crush's dialog off the screen to do this. That works, but it breaks when the dialog wraps a long command or when its wording changes.

I'm happy to send a PR for 1 and 2 if you'd like them.

Drafted with the help of Claude Code.