feat(box): passkey fetch, agent key-approval flow, unified lookups, tmux agent UX

- box passkey [show|fetch] (+ muse passkey): documents VM-only passkey
  (/srv/box/passkey.txt, fallback /etc/netvm/passkey.txt on 34.139.37.135),
  probes VM over SSH with graceful fallback; --json supported. No secrets on bl.
- approvals: request_key_approval / check_node_key_request; KEY_APPROVAL status
  surfaced in `box approvals check`; allow/deny resolve + audit to box-ctl.jsonl;
  never auto-approved. New `box approvals request-key <node> --reason`.
- box lookup (summary|fleet|threads|unread|approvals|key|docs) and docs-lookup
  engine with lookup_internal/ database (docs_internal symlink).
- muse-tmux: non-TTY attach falls back to scrollback capture; prune NameError fix.
- box/muse passthrough for tmux/muse/docs; thread list/view alias + prefix resolve.
- Docs: AGENTS.md, AGENT-TOOLING.md, BOX-WEB-SURFACE-GUIDE.md, README.
- Tests: key-approval + passkey tests; sync stale sidechat UUIDs and manifest name.
- .gitignore runtime trackers (subagent-sessions, conversation-nudge-tracker).

bin/fleet-alert-check.sh

@@ -185,22 +185,29 @@ HEALTHY_AGENTS=""
     esac
 done
 
-# --- Agent approval blockage detection (catches agents held up on approvals) ---
+# --- Agent approval blockage & input wait detection ---
 "$BIN/netvm-registry.py" 2>/dev/null | while IFS=: read -r node port; do
     [ -n "$node" ] || continue
-    cond="approval:$node"
-    pending_info=$(python3 -c "
-import sys
+    node_data=$(python3 -c "
+import sys, json
 sys.path.insert(0, '$BIN')
 import approvals
 info = approvals.inspect_node_approvals('$node')
-if info.get('has_pending'):
-    print(f\"{info.get('ip') or 'unknown'}|{info.get('title') or ''}\")
-" 2>/dev/null || true)
+out = {
+    'has_pending': info.get('has_pending', False),
+    'target': info.get('target') or info.get('ip') or 'unknown',
+    'title': info.get('title') or '',
+    'waits': info.get('input_waits') or []
+}
+print(json.dumps(out))
+" 2>/dev/null || echo '{"has_pending":false,"target":"unknown","title":"","waits":[]}')
 
-    if [ -n "$pending_info" ]; then
+    # 1. Egress permission dialog
+    cond="approval:$node"
+    has_pending=$(python3 -c "import json,sys; print(1 if json.loads(sys.argv[1]).get('has_pending') else 0)" "$node_data" 2>/dev/null || echo 0)
+    if [ "$has_pending" = "1" ]; then
         failing=1
-        target="${pending_info%%|*}"
+        target=$(python3 -c "import json,sys; print(json.loads(sys.argv[1]).get('target','unknown'))" "$node_data" 2>/dev/null || echo unknown)
         detail="Agent $node held up on browser approval for $target"
     else
         failing=0
@@ -220,6 +227,37 @@ if info.get('has_pending'):
             log "$cond still critical x$fails — re-page suppressed"
             ;;
     esac
+
+    # 2. Sidebar task waiting on human input
+    cond_in="input_wait:$node"
+    wait_summary=$(python3 -c "
+import json,sys
+w = json.loads(sys.argv[1]).get('waits', [])
+if w:
+    print('; '.join(f\"{item.get('task')}: {item.get('status')}\" for item in w)[:120])
+" "$node_data" 2>/dev/null || true)
+
+    if [ -n "$wait_summary" ]; then
+        failing_in=1
+        detail_in="Agent $node task waiting for human input: $wait_summary"
+    else
+        failing_in=0
+        detail_in="Agent $node tasks running"
+    fi
+    injected "$cond_in" && failing_in=1
+    read -r action_in fails_in < <(state_machine "$cond_in" "$failing_in")
+    case "$action_in" in
+        ALERT_FIRST|ALERT_REALERT)
+            emit_record "ALERT" "$cond_in" "$detail_in" "$fails_in"
+            echo "$cond_in" >> "$STATE_DIR/.alerts.tmp"
+            ;;
+        RECOVERY)
+            emit_record "RECOVERY" "$cond_in" "$detail_in" "$fails_in"
+            ;;
+        SUPPRESSED)
+            log "$cond_in still critical x$fails_in — re-page suppressed"
+            ;;
+    esac
 done
 
 # --- Warp partition detection (2026-10-04) ---