@2kw/ai 6.3.0-dev.98 → 6.4.0-dev.10

package/dist/commands/transcribe.js

@@ -1,10 +1,9 @@
 import { Command } from "commander";
-import { resolveAuthHeader } from "../lib/client.js";
-import { resolveConfig, isJsonOutput } from "../lib/config.js";
+import { getClient } from "../lib/client.js";
+import { isJsonOutput } from "../lib/config.js";
 import { handleError } from "../lib/errors.js";
 import { formatDetail, withSpinner } from "../lib/output.js";
 import { fileToBlob } from "../lib/multipart.js";
-import { BackboneApiError } from "../lib/errors.js";
 export function makeTranscribeCommand() {
     const cmd = new Command("transcribe")
         .description("Transcribe an audio file")
@@ -17,8 +16,6 @@ export function makeTranscribeCommand() {
         .action(async (file, opts, command) => {
         const json = isJsonOutput(command);
         try {
-            const config = resolveConfig(command);
-            const authHeader = await resolveAuthHeader(config);
             const { blob, filename } = fileToBlob(file);
             const formData = new FormData();
             formData.append("file", blob, filename);
@@ -31,30 +28,15 @@ export function makeTranscribeCommand() {
                 formData.append("response_format", opts.format);
             if (opts.temperature)
                 formData.append("temperature", opts.temperature);
-            const baseUrl = config.baseUrl.replace(/\/+$/, "");
-            const url = `${baseUrl}/v1/audio/transcriptions`;
+            const client = getClient(command);
             const data = await withSpinner("Transcribing...", async () => {
-                const res = await fetch(url, {
-                    method: "POST",
-                    headers: { Authorization: authHeader },
-                    body: formData,
+                // The generated type describes "file" as a binary string, which FormData cannot match;
+                // the placeholder satisfies it and bodySerializer sends the real parts.
+                const result = await client.POST("/v1/audio/transcriptions", {
+                    body: { file: "", model: opts.model },
+                    bodySerializer: () => formData,
                 });
-                if (!res.ok) {
-                    let body;
-                    try {
-                        body = await res.json();
-                    }
-                    catch {
-                        body = {
-                            error: res.statusText,
-                            message: `HTTP ${res.status}: ${res.statusText}`,
-                            status: res.status,
-                            timestamp: new Date().toISOString(),
-                        };
-                    }
-                    throw new BackboneApiError(body);
-                }
-                return res.json();
+                return result.data;
             });
             formatDetail(data, command);
         }

package/dist/lib/agent-decide.d.ts

@@ -22,21 +22,47 @@ export interface PromptAnswer {
     reason?: string;
     remember?: boolean;
 }
+/** One relayed tool call answered by `--output` or `--fail` (#671 D2, D3). */
+export interface ToolAnswer {
+    callId: string;
+    /** Sent verbatim as the item's `output` string. */
+    output: string;
+    failed: boolean;
+}
+export interface ToolAnswerIo {
+    readFile: (path: string) => string;
+    readStdin: () => string;
+}
+/**
+ * `--output` and `--fail` values as `<callId>=<value>`, split on the first `=`. `@<path>` reads a file and
+ * `@-` reads stdin, both verbatim. Only syntax is checked here: without stored state the CLI cannot list the
+ * calls a response released, so completeness is the server's check (#671 D4). Every check runs before any read.
+ */
+export declare function parseToolAnswers(outputs?: string[], fails?: string[], io?: ToolAnswerIo): ToolAnswer[];
 export declare function fetchPendingApprovals(client: ApiClient, agentId: string, responseId: string): Promise<ApprovalRow[]>;
 /**
  * The backend refuses a continuation that leaves any pending approval of the paused
  * response undecided (400 incomplete_tool_outputs), so the whole set is checked here first.
  */
 export declare function planDecisions(pending: ApprovalRow[], opts: DecideOptions, responseId: string): Decision[];
+/**
+ * The decisions a `decide` call sends beside its tool answers (#671 D5). A pure relay pause has no pending
+ * approval, so the approval flags are optional there: `--approve-all` / `--reject-all` add nothing (P1) and
+ * only explicit ids are refused. A mixed pause needs its approvals decided in the same call.
+ */
+export declare function planContinuation(pending: ApprovalRow[], opts: DecideOptions, toolAnswers: ToolAnswer[], responseId: string): Decision[];
 export declare function decisionsFromAnswers(pending: ApprovalRow[], answers: Map<string, PromptAnswer>): Decision[];
 /** Same item shape as n8n Decide Approval (#660). */
 export declare function toApprovalItems(decisions: Decision[]): Record<string, string>[];
+/** `failed: true` is Backbone's extension (#480): the tool's span ends ERROR. */
+export declare function toToolOutputItems(answers: ToolAnswer[]): Record<string, string | boolean>[];
 /**
  * Continues on `agent/<agentId>[@<label>][#<model>]` with the label and model override the run used: the
  * server resolves the continuation's tools, instructions and model from this reference, so both must match
  * the run's or the continuation drops to another version or the agent's default model.
  * Never the echoed `name@<versionNumber>` (it would 404 as a label).
  * With `mode`, the `backbone:mode` item follows the decisions (#656 D7); without it, nothing is added (D2).
+ * Tool answers go first, in flag order (#671 D6): the server replays accepted outputs ahead of other items.
  */
-export declare function continueWithDecisions(client: ApiClient, agentId: string, responseId: string, decisions: Decision[], label?: string, model?: string, mode?: ConversationMode): Promise<ResponsesResult>;
+export declare function continueWithDecisions(client: ApiClient, agentId: string, responseId: string, decisions: Decision[], label?: string, model?: string, mode?: ConversationMode, toolAnswers?: ToolAnswer[]): Promise<ResponsesResult>;
 //# sourceMappingURL=agent-decide.d.ts.map

package/dist/lib/agent-decide.js

@@ -1,6 +1,69 @@
+import { readFileSync } from "node:fs";
 import { modeItem } from "./agent-run.js";
 import { CliUsageError } from "./errors.js";
 import { paginationParams } from "./pagination.js";
+const defaultIo = {
+    readFile: (path) => readFileSync(path, "utf-8"),
+    // Not readStdinInput: that one trims, and a tool result is sent as read (P5).
+    readStdin: () => readFileSync(0, "utf-8"),
+};
+/**
+ * `--output` and `--fail` values as `<callId>=<value>`, split on the first `=`. `@<path>` reads a file and
+ * `@-` reads stdin, both verbatim. Only syntax is checked here: without stored state the CLI cannot list the
+ * calls a response released, so completeness is the server's check (#671 D4). Every check runs before any read.
+ */
+export function parseToolAnswers(outputs = [], fails = [], io = defaultIo) {
+    const entries = [
+        ...outputs.map((raw) => ({ raw, flag: "--output", noun: "value", failed: false })),
+        ...fails.map((raw) => ({ raw, flag: "--fail", noun: "message", failed: true })),
+    ].map(({ raw, flag, noun, failed }) => {
+        const eq = raw.indexOf("=");
+        if (eq < 0)
+            throw new CliUsageError(`Invalid ${flag} '${raw}': use <callId>=<${noun}>.`);
+        const callId = raw.slice(0, eq);
+        if (!callId)
+            throw new CliUsageError(`Invalid ${flag} '${raw}': the call id is empty.`);
+        return { callId, value: raw.slice(eq + 1), failed };
+    });
+    const seen = new Map();
+    for (const e of entries) {
+        const before = seen.get(e.callId);
+        if (before === undefined) {
+            seen.set(e.callId, e.failed);
+        }
+        else if (before === e.failed) {
+            throw new CliUsageError(`Tool call ${e.callId} is answered more than once.`);
+        }
+        else {
+            throw new CliUsageError(`Tool call ${e.callId} is answered by both --output and --fail.`);
+        }
+    }
+    if (entries.filter((e) => e.value === "@-").length > 1) {
+        throw new CliUsageError("Only one --output or --fail value can read stdin (@-).");
+    }
+    return entries.map(({ callId, value, failed }) => ({ callId, output: readAnswerValue(value, io), failed }));
+}
+function readAnswerValue(value, io) {
+    if (value === "@-") {
+        try {
+            return io.readStdin();
+        }
+        catch (err) {
+            // A closed or non-blocking stdin (EAGAIN, EOF) is a usage error like an unreadable file.
+            throw new CliUsageError(`stdin: cannot read (${err.code ?? err.message})`);
+        }
+    }
+    if (!value.startsWith("@"))
+        return value;
+    const path = value.slice(1);
+    try {
+        return io.readFile(path);
+    }
+    catch (err) {
+        const code = err.code;
+        throw new CliUsageError(`${path}: cannot read file (${code ?? err.message})`);
+    }
+}
 const MAX_PAGES = 50;
 export async function fetchPendingApprovals(client, agentId, responseId) {
     const rows = [];
@@ -41,7 +104,8 @@ export function planDecisions(pending, opts, responseId) {
         throw new CliUsageError("Use either --approve-all / --reject-all or explicit --approve / --reject ids, not both.");
     }
     if (!usesAll && approve.length === 0 && reject.length === 0) {
-        throw new CliUsageError("Choose a decision: --approve <ids...>, --reject <ids...>, --approve-all or --reject-all.");
+        throw new CliUsageError("Choose a decision: --approve <ids...>, --reject <ids...>, --approve-all or --reject-all " +
+            "(and answer relayed tool calls with --output / --fail).");
     }
     const choice = new Map();
     if (usesAll) {
@@ -84,6 +148,26 @@ export function planDecisions(pending, opts, responseId) {
         };
     });
 }
+/**
+ * The decisions a `decide` call sends beside its tool answers (#671 D5). A pure relay pause has no pending
+ * approval, so the approval flags are optional there: `--approve-all` / `--reject-all` add nothing (P1) and
+ * only explicit ids are refused. A mixed pause needs its approvals decided in the same call.
+ */
+export function planContinuation(pending, opts, toolAnswers, responseId) {
+    if (toolAnswers.length === 0)
+        return planDecisions(pending, opts, responseId);
+    const ids = [...(opts.approve ?? []), ...(opts.reject ?? [])];
+    if (pending.length === 0) {
+        if (ids.length)
+            throw new CliUsageError(`Not pending on ${responseId}: ${ids.join(", ")}`);
+        return [];
+    }
+    if (!opts.approveAll && !opts.rejectAll && ids.length === 0) {
+        throw new CliUsageError(`${responseId} also waits for approvals: every relayed tool call and every pending approval must be answered ` +
+            `in one call. Undecided: ${pending.map((r) => r.id).join(", ")} (add --approve-all, --reject-all or the ids).`);
+    }
+    return planDecisions(pending, opts, responseId);
+}
 export function decisionsFromAnswers(pending, answers) {
     return pending.map((r) => {
         const answer = answers.get(String(r.id));
@@ -109,20 +193,30 @@ export function toApprovalItems(decisions) {
         ...(d.remember ? { remember: d.remember } : {}),
     }));
 }
+/** `failed: true` is Backbone's extension (#480): the tool's span ends ERROR. */
+export function toToolOutputItems(answers) {
+    return answers.map((a) => ({
+        type: "function_call_output",
+        call_id: a.callId,
+        output: a.output,
+        ...(a.failed ? { failed: true } : {}),
+    }));
+}
 /**
  * Continues on `agent/<agentId>[@<label>][#<model>]` with the label and model override the run used: the
  * server resolves the continuation's tools, instructions and model from this reference, so both must match
  * the run's or the continuation drops to another version or the agent's default model.
  * Never the echoed `name@<versionNumber>` (it would 404 as a label).
  * With `mode`, the `backbone:mode` item follows the decisions (#656 D7); without it, nothing is added (D2).
+ * Tool answers go first, in flag order (#671 D6): the server replays accepted outputs ahead of other items.
  */
-export async function continueWithDecisions(client, agentId, responseId, decisions, label, model, mode) {
-    const approvals = toApprovalItems(decisions);
+export async function continueWithDecisions(client, agentId, responseId, decisions, label, model, mode, toolAnswers = []) {
+    const items = [...toToolOutputItems(toolAnswers), ...toApprovalItems(decisions)];
     const body = {
         model: `agent/${agentId}${label ? `@${label}` : ""}${model ? `#${model}` : ""}`,
         previous_response_id: responseId,
         stream: false,
-        input: mode ? [...approvals, modeItem(mode)] : approvals,
+        input: mode ? [...items, modeItem(mode)] : items,
     };
     // The generated body type does not model backbone: extension items, hence the cast.
     // eslint-disable-next-line @typescript-eslint/no-explicit-any

package/dist/lib/agent-run.d.ts

@@ -28,7 +28,8 @@ export interface PendingToolCall {
 /**
  * A connector the run waits for the user to connect, allow or reconnect in chat.2kw.ai: an open
  * `backbone:connector_auth_request` (#807 R12). The caller never answers the connect call; the
- * continuation re-checks access itself.
+ * continuation re-checks access itself. Decoded by `connect-pause.ts` (#1086), whose `id` and
+ * `callId` the envelope does not publish.
  */
 export interface PendingConnection {
     serverLabel: string;
@@ -115,6 +116,9 @@ export declare function parseAgentModel(model?: string): {
  * clipboard. Newlines and tabs stay. JSON output is never passed through this.
  */
 export declare function stripControl(s: string): string;
+export declare function hasInvisible(s: string): boolean;
+/** Replaces each hidden code point with a visible `<U+XXXX>`, so approving a diff means having seen it. */
+export declare function revealInvisible(s: string): string;
 export declare function shellQuote(value: string): string;
 /** "Connect a (h), allow the agent to use b (h) and reconnect c (h)". */
 export declare function connectionsSentence(connections: PendingConnection[]): string;

package/dist/lib/agent-run.js

@@ -1,6 +1,8 @@
 import chalk from "chalk";
 import { DEFAULT_CHAT_URL } from "./config.js";
+import { connectCallIds, connectionsPhrase, pendingConnectionsOf } from "./connect-pause.js";
 import { CliUsageError } from "./errors.js";
+import { previewIsIncomplete, previewLines } from "./skills-apply-preview.js";
 export const CONVERSATION_MODES = ["plan", "ask", "auto"];
 /** `--mode` help text, in the words of the embedded chat's mode chip (#655). */
 export const MODE_OPTION_HELP = "Conversation mode: plan (read-only), ask (no automatic approver; calls that need approval wait for you), " +
@@ -87,61 +89,91 @@ const CONTROL_CHARS = /[\x00-\x08\x0b-\x1f\x7f-\x9f]/g;
 export function stripControl(s) {
     return s.replace(CONTROL_CHARS, "");
 }
-export function shellQuote(value) {
-    if (/^[A-Za-z0-9._@/:-]+$/.test(value))
-        return value;
-    return `'${value.replace(/'/g, `'\\''`)}'`;
-}
-/** An open connector consent request; a continuation's projection carries another status. */
-function pendingConnectionsOf(output) {
-    return output
-        .filter((i) => i.type === "backbone:connector_auth_request" && (i.status === undefined || i.status === "in_progress"))
-        .map((i) => ({
-        serverLabel: String(i.server_label),
-        host: String(i.host),
-        reason: String(i.reason),
-        ...(Array.isArray(i.destinations) && i.destinations.length > 0
-            ? { destinations: i.destinations.map((d) => String(d)) }
-            : {}),
-    }));
-}
 /**
- * The call ids a connect pause withholds from the caller: the call each request names, and every
- * `mcp__<label>__connect` call for a pending connector (the model may call it more than once; one
- * request stands for all of them).
+ * Code points that print as nothing, or reorder what surrounds them, yet reach the model: Unicode
+ * tags, zero-width characters, directional marks, embeddings, overrides and isolates, the word
+ * joiner and the byte-order mark (#1027). As numbers, not an escaped regex, so no tool can fold
+ * them into the source. Kept in step with `surface/src/core/skills-apply-preview.ts`.
  */
-function connectCallIds(output, connections) {
-    const connectNames = new Set(connections.map((c) => `mcp__${c.serverLabel}__connect`));
-    const ids = new Set();
-    for (const item of output) {
-        if (item.type === "backbone:connector_auth_request" && (item.status === undefined || item.status === "in_progress")) {
-            ids.add(String(item.call_id));
-        }
-        else if (item.type === "function_call" && connectNames.has(String(item.name))) {
-            ids.add(String(item.call_id));
-        }
+const INVISIBLE_RANGES = [
+    [0xe0000, 0xe007f],
+    [0x200b, 0x200f],
+    [0x202a, 0x202e],
+    [0x2060, 0x2060],
+    [0x2066, 0x2069],
+    [0x061c, 0x061c],
+    [0xfeff, 0xfeff],
+];
+function isInvisible(codePoint) {
+    return INVISIBLE_RANGES.some(([low, high]) => codePoint >= low && codePoint <= high);
+}
+export function hasInvisible(s) {
+    for (const char of s)
+        if (isInvisible(char.codePointAt(0)))
+            return true;
+    return false;
+}
+/** Replaces each hidden code point with a visible `<U+XXXX>`, so approving a diff means having seen it. */
+export function revealInvisible(s) {
+    let out = "";
+    for (const char of s) {
+        const codePoint = char.codePointAt(0);
+        out += isInvisible(codePoint) ? `<U+${codePoint.toString(16).toUpperCase().padStart(4, "0")}>` : char;
     }
-    return ids;
+    return out;
 }
-function connectionPhrase(c) {
-    const target = `${c.serverLabel} (${c.host})`;
-    if (c.reason === "allow")
-        return `allow the agent to use ${target}`;
-    if (c.reason === "reconnect")
-        return `reconnect ${target}`;
-    return `connect ${target}`;
+export function shellQuote(value) {
+    if (/^[A-Za-z0-9._@/:-]+$/.test(value))
+        return value;
+    return `'${value.replace(/'/g, `'\\''`)}'`;
 }
 /** "Connect a (h), allow the agent to use b (h) and reconnect c (h)". */
 export function connectionsSentence(connections) {
-    const phrases = connections.map(connectionPhrase);
-    const joined = phrases.length > 1 ? `${phrases.slice(0, -1).join(", ")} and ${phrases.at(-1)}` : phrases[0] ?? "";
+    const joined = connectionsPhrase(connections);
     return joined.charAt(0).toUpperCase() + joined.slice(1);
 }
 /** Joins a connect pause's instruction to the command that continues it; {@link printRunText} breaks the line there. */
 const THEN_RUN = ", then run: ";
+/**
+ * The `decide` command that answers a relay pause (#671 D7): one `--output <callId>=@<file>` per pending call,
+ * plus `--approve-all` when approvals wait too. The call id is chosen by the model, so the suggested file name
+ * keeps only `[A-Za-z0-9_-]` (P2) and never repeats: it can be neither `../…` nor an absolute path.
+ */
+function relayDecideCommand(ref, responseId, calls, withApprovals) {
+    const used = new Set();
+    const outputs = calls.map((c) => {
+        const safe = c.callId.replace(/[^A-Za-z0-9_-]/g, "_");
+        let file = safe;
+        // Compared without case: on Windows and macOS `callA.out` and `calla.out` are one file.
+        for (let n = 2; used.has(file.toLowerCase()); n++)
+            file = `${safe}-${n}`;
+        used.add(file.toLowerCase());
+        return ` --output ${shellQuote(`${c.callId}=@${file}.out`)}`;
+    });
+    return (`2kw agents decide ${shellQuote(ref)} --response ${shellQuote(responseId)}${outputs.join("")}` +
+        (withApprovals ? " --approve-all" : ""));
+}
+/**
+ * A connector tool's open approval, decoded from the standard `mcp_approval_request` item (#949). The item
+ * is the MCP twin of `backbone:approval_request` (#805): it names the server and the tool, carries no call
+ * id, policy class or status, and exists only while the decision is open, so its id doubles as the call id
+ * and the tool is named as the approval row stores it, `mcp__<server_label>__<tool>`.
+ */
+function connectorApproval(i) {
+    return {
+        approvalId: String(i.id),
+        callId: String(i.id),
+        tool: `mcp__${String(i.server_label)}__${String(i.name)}`,
+        arguments: parseArguments(i.arguments),
+        policyClass: "unknown",
+        reason: null,
+        preview: null,
+    };
+}
 /**
  * Output item types the envelope decodes, or that never hold a run: text, reasoning and finished
- * connector calls. A pause on anything else (a connector approval's `mcp_approval_request`) is named.
+ * connector calls. A pause on anything else is named.
+ * `backbone:tool_image` is an image a finished `ViewImage` call attached (#1244): it never holds a run.
  */
 const DECODED_ITEM_TYPES = new Set([
     "message",
@@ -150,6 +182,8 @@ const DECODED_ITEM_TYPES = new Set([
     "function_call_output",
     "backbone:approval_request",
     "backbone:connector_auth_request",
+    "backbone:tool_image",
+    "mcp_approval_request",
     "mcp_call",
     "mcp_list_tools",
 ]);
@@ -173,20 +207,30 @@ export function buildRunEnvelope(result, agentRef, chatUrl = DEFAULT_CHAT_URL) {
         String(i.call_id),
         i.status === "incomplete" ? "incomplete" : "completed",
     ]));
-    const pendingApprovals = output
-        // Only an open request is pending; judge- or grant-decided requests (#634, #629) carry another status.
-        .filter((i) => i.type === "backbone:approval_request" && (i.status === undefined || i.status === "in_progress"))
-        .map((i) => ({
-        approvalId: String(i.id),
-        callId: String(i.call_id),
-        tool: String(i.tool),
-        arguments: parseArguments(i.arguments),
-        policyClass: String(i.policy_class),
-        reason: typeof i.reason === "string" && i.reason ? i.reason : null,
-        preview: i.preview && typeof i.preview === "object" && !Array.isArray(i.preview) ? i.preview : null,
+    const pendingApprovals = [
+        ...output
+            // Only an open request is pending; judge- or grant-decided requests (#634, #629) carry another status.
+            .filter((i) => i.type === "backbone:approval_request" && (i.status === undefined || i.status === "in_progress"))
+            .map((i) => ({
+            approvalId: String(i.id),
+            callId: String(i.call_id),
+            tool: String(i.tool),
+            arguments: parseArguments(i.arguments),
+            policyClass: String(i.policy_class),
+            reason: typeof i.reason === "string" && i.reason ? i.reason : null,
+            preview: i.preview && typeof i.preview === "object" && !Array.isArray(i.preview) ? i.preview : null,
+        })),
+        ...output.filter((i) => i.type === "mcp_approval_request").map(connectorApproval),
+    ];
+    // The one decoding rule (#1086): only an open request with its id, call id, label and host.
+    const connectRequests = pendingConnectionsOf(output);
+    const pendingConnections = connectRequests.map(({ serverLabel, host, reason, destinations }) => ({
+        serverLabel,
+        host,
+        reason,
+        ...(destinations ? { destinations } : {}),
     }));
-    const pendingConnections = pendingConnectionsOf(output);
-    const withheldCallIds = new Set([...pendingApprovals.map((a) => a.callId), ...connectCallIds(output, pendingConnections)]);
+    const withheldCallIds = new Set([...pendingApprovals.map((a) => a.callId), ...connectCallIds(output, connectRequests)]);
     const toolCalls = [];
     const pendingToolCalls = [];
     for (const item of output) {
@@ -225,8 +269,23 @@ export function buildRunEnvelope(result, agentRef, chatUrl = DEFAULT_CHAT_URL) {
     if (status === "requires_approval" && ref && responseId) {
         next = `2kw agents decide ${shellQuote(ref)} --response ${responseId} --approve-all`;
     }
-    else if (status === "requires_tool_output" && pendingConnections.length > 0 && pendingToolCalls.length === 0 && responseId) {
-        // Not with a relayed call beside it: a continuation without that call's output is refused.
+    else if (status === "requires_tool_output" && pendingToolCalls.length > 0) {
+        // The engine answers the connect call itself on the continuation, so connecting first is enough.
+        if (ref && responseId) {
+            const decide = relayDecideCommand(ref, responseId, pendingToolCalls, pendingApprovals.length > 0);
+            next = pendingConnections.length > 0
+                ? `${connectionsSentence(pendingConnections)} in ${chatUrl}/connectors${THEN_RUN}${decide}`
+                : decide;
+        }
+    }
+    else if (status === "requires_tool_output" && pendingConnections.length > 0 && pendingApprovals.length > 0 && ref && responseId) {
+        // A continuation must decide every pending approval (400 incomplete_tool_outputs otherwise), so
+        // `--continue` would fail; decide answers them and the engine re-checks access itself (#949 review).
+        next =
+            `${connectionsSentence(pendingConnections)} in ${chatUrl}/connectors${THEN_RUN}` +
+                `2kw agents decide ${shellQuote(ref)} --response ${shellQuote(responseId)} --approve-all`;
+    }
+    else if (status === "requires_tool_output" && pendingConnections.length > 0 && responseId) {
         // `agents run --continue` needs no input: the continuation re-checks access itself.
         const resume = ref
             ? `${THEN_RUN}2kw agents run ${shellQuote(ref)} --continue ${shellQuote(responseId)}`
@@ -272,19 +331,39 @@ export function printRunText(env) {
         console.log(chalk.dim(`\n── ${s(head.join(" · "))}`));
     if (env.toolCalls.length)
         console.log(chalk.dim(`   tools: ${env.toolCalls.map((c) => `${s(c.tool)} ${c.status === "incomplete" ? "✗" : "✓"}`).join("  ")}`));
-    if (env.status === "requires_approval") {
-        console.log(chalk.yellow("\nPaused for approval:"));
-        env.pendingApprovals.forEach((a, i) => {
-            console.log(`  ${i + 1}. ${s(a.tool)} [${s(a.policyClass)}] ${s(a.approvalId)}`);
+    const printApprovals = () => env.pendingApprovals.forEach((a, i) => {
+        console.log(`  ${i + 1}. ${s(a.tool)} [${s(a.policyClass)}] ${s(a.approvalId)}`);
+        // A SkillsApply change reads as its diff (#1028), like the interactive prompt; an incomplete
+        // preview keeps the arguments, the one place a member can read what would persist.
+        if (a.preview)
+            for (const line of previewLines(a.preview))
+                console.log(chalk.dim(`     ${s(line)}`));
+        if (!a.preview || previewIsIncomplete(a.preview)) {
             // JSON.stringify escapes C0 controls but leaves DEL and C1 raw.
             console.log(chalk.dim(`     ${s(JSON.stringify(a.arguments))}`));
-            if (a.reason)
-                console.log(chalk.dim(`     reason: ${s(a.reason)}`));
-        });
+        }
+        if (a.reason)
+            console.log(chalk.dim(`     reason: ${s(a.reason)}`));
+    });
+    if (env.status === "requires_approval") {
+        console.log(chalk.yellow("\nPaused for approval:"));
+        printApprovals();
         if (env.next)
             console.log(`\nDecide with:\n  ${s(env.next)}`);
     }
     else if (env.status === "requires_tool_output") {
+        if (env.pendingToolCalls.length) {
+            console.log(chalk.yellow("\nPaused: the agent waits for client-side tool output:"));
+            env.pendingToolCalls.forEach((c) => {
+                console.log(`  - ${s(c.tool)} (${s(c.callId)})`);
+                console.log(chalk.dim(`    ${s(JSON.stringify(c.arguments))}`));
+            });
+            // The printed command carries --approve-all, so show what it approves (#671 P3).
+            if (env.pendingApprovals.length) {
+                console.log(chalk.yellow("\nIt also waits for approval:"));
+                printApprovals();
+            }
+        }
         if (env.pendingConnections.length) {
             console.log(chalk.yellow("\nPaused: the agent needs you to connect in chat:"));
             env.pendingConnections.forEach((c) => {
@@ -296,9 +375,8 @@ export function printRunText(env) {
             if (env.next)
                 console.log(`\n${s(env.next.replace(THEN_RUN, ", then run:\n  "))}`);
         }
-        if (env.pendingToolCalls.length) {
-            console.log(chalk.yellow("\nPaused: the agent needs client-side tool output this CLI cannot provide:"));
-            env.pendingToolCalls.forEach((c) => console.log(`  - ${s(c.tool)} (${s(c.callId)})`));
+        else if (env.pendingToolCalls.length && env.next) {
+            console.log(`\nAnswer with:\n  ${s(env.next)}`);
         }
         if (!env.pendingConnections.length && !env.pendingToolCalls.length) {
             console.log(chalk.yellow("\nPaused on something this CLI cannot show:"));

package/dist/lib/approval-prompt.js

@@ -1,6 +1,6 @@
 import { createInterface } from "node:readline/promises";
 import chalk from "chalk";
-import { stripControl } from "./agent-run.js";
+import { hasInvisible, revealInvisible, stripControl } from "./agent-run.js";
 import { REMEMBER_NOTE, previewIsIncomplete, previewLines } from "./skills-apply-preview.js";
 /** Raised when the prompt's input closes (EOF, Ctrl+C, Ctrl+D) before an answer arrives. */
 export class PromptAbortedError extends Error {
@@ -50,9 +50,11 @@ export function readlineAsk(input = process.stdin, output = process.stderr) {
 }
 export async function promptApprovals(pending, ask, write = (line) => console.error(line)) {
     const answers = new Map();
-    const s = stripControl;
+    const s = (value) => revealInvisible(stripControl(value));
     for (const [index, a] of pending.entries()) {
-        const destructive = a.policyClass.toLowerCase() === "destructive";
+        // A connector approval carries no policy class (#949): "unknown" may be destructive, so it is never
+        // offered a standing grant here; the server drops one for a destructive row anyway.
+        const destructive = ["destructive", "unknown"].includes(a.policyClass.toLowerCase());
         write(chalk.yellow(`\nApproval ${index + 1}/${pending.length}: ${s(a.tool)} [${s(a.policyClass)}]`));
         // JSON.stringify escapes C0 controls but leaves DEL and C1 raw.
         const request = () => write(chalk.dim(s(JSON.stringify(a.arguments, null, 2))));
@@ -60,7 +62,12 @@ export async function promptApprovals(pending, ask, write = (line) => console.er
             // A SkillsApply change reads as its diff (#782, spec §10). When the preview leaves changes
             // out, the full arguments follow it: this prompt never runs with --json, so it is the only
             // place the member can read what would persist (spec D7).
-            for (const line of previewLines(a.preview))
+            const lines = previewLines(a.preview);
+            // Hidden characters are shown as <U+XXXX> below; the warning says why (#1027, spec D7).
+            if (lines.some(hasInvisible)) {
+                write(chalk.yellow("Hidden characters found: shown as <U+XXXX>. A model reads them; you would not see them. Check each marked line before you approve."));
+            }
+            for (const line of lines)
                 write(colourPreviewLine(s(line)));
             if (previewIsIncomplete(a.preview)) {
                 write(chalk.dim("Full request (the preview leaves changes out):"));

package/dist/lib/config.d.ts

@@ -52,12 +52,12 @@ export declare const DEFAULT_BASE_URL: string;
  */
 export declare const DEFAULT_AUTH_URL: string;
 export declare function defaultAuthUrlFor(baseUrl: string): string;
-/** Fallback chat.2kw.ai origin when the API host is not one we recognise. */
-export declare const DEFAULT_CHAT_URL = "https://chat.2kw.ai";
+export { DEFAULT_CHAT_URL } from "./connect-pause.js";
 /**
  * The chat web host that belongs to an API base URL, where a member connects a connector
  * (`<chat>/connectors`). `AI_2KW_CHAT_URL` overrides the mapping, for deployments the map
- * does not know; a trailing slash is dropped so callers can append a path.
+ * does not know; a trailing slash is dropped so callers can append a path. The mapping itself
+ * is `connect-pause.ts`'s {@link chatOriginFor}, shared with the MCP server and n8n (#1086).
  */
 export declare function chatUrlFor(baseUrl: string, env?: NodeJS.ProcessEnv): string;
 declare const store: Conf<BackboneConfigStore>;