fix: dedup file_permission pendings (10s window) + clean description text

extension/out/extension.js

@@ -502,13 +502,33 @@ function startObserverHttpBridge() {
                             // File permission: inject multi-choice buttons
                             const cmdLower = (data.command || '').toLowerCase();
                             if (cmdLower.includes('allow') && !pending.buttons) {
+                                // Dedup: skip if another file_permission pending was created within 10s
+                                const nowMs = Date.now();
+                                try {
+                                    const existingFiles = fs.readdirSync(pendingDir).filter((f) => f.endsWith('.json'));
+                                    for (const ef of existingFiles) {
+                                        const existing = JSON.parse(fs.readFileSync(path.join(pendingDir, ef), 'utf-8'));
+                                        if (existing.step_type === 'file_permission' && existing.status === 'pending') {
+                                            const age = nowMs - (existing.timestamp * 1000);
+                                            if (age < 10_000 && age >= 0) {
+                                                logToFile(`[HTTP] filtered duplicate file_permission (${age}ms old): ${ef}`);
+                                                res.writeHead(200, { 'Content-Type': 'application/json' });
+                                                res.end(JSON.stringify({ ok: false, filtered: true, reason: 'dedup_file_permission' }));
+                                                return;
+                                            }
+                                        }
+                                    }
+                                }
+                                catch { }
                                 pending.buttons = [
                                     { text: 'Allow Once', index: 0 },
                                     { text: 'Allow This Conversation', index: 1 },
                                     { text: 'Deny', index: 2 },
                                 ];
                                 pending.step_type = 'file_permission';
-                                pending.command = `파일 접근 권한: ${data.description || data.command}`;
+                                // Clean description: remove button labels from text
+                                const rawDesc = (data.description || data.command || '').replace(/Deny|Allow Once|Allow This Conversation/gi, '').trim();
+                                pending.command = `파일 접근 권한${rawDesc ? ': ' + rawDesc : ''}`;
                             }
                             fs.writeFileSync(path.join(pendingDir, `${rid}.json`), JSON.stringify(pending, null, 2));
                             logToFile(`[HTTP] pending created: ${rid} cmd="${data.command}" btns=${(data.buttons || []).length} ctx="${(data.description || '').substring(0, 50)}"`);