@2kw/ai 6.4.0-dev.7 → 7.0.0-dev.10

package/README.md

@@ -110,7 +110,7 @@ kubectl-style contexts switch between organizations and environments:
 | `tracing` | Inspect request traces and tracing settings |
 | `memory` | Your agent memory files (list, read, write, delete, forget); member totals and erasure for admins |
 | `providers` | Manage BYOK AI providers |
-| `analytics` | Usage analytics: spend, quality, providers, errors |
+| `analytics` | Usage analytics: operations, tokens, quality, providers, errors |
 | `billing` | Check subscription tier and usage limits |
 | `agents` | Run agents and answer paused runs (approvals and relayed tool calls); apply, export and scaffold agent.yaml; manage versions, labels, approvals and tool catalogs |
 | `skills` | Import and export SKILL.md bundles; manage skill versions and labels |

package/dist/agent-config/schema.d.ts

@@ -221,6 +221,25 @@ export declare const agentSchema: {
                 };
             };
         };
+        readonly bashTool: {
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["type"];
+            readonly properties: {
+                readonly type: {
+                    readonly const: "backbone.bash";
+                };
+                readonly approval: {
+                    readonly enum: readonly ["sandbox", "pause"];
+                };
+                readonly outputs: {
+                    readonly enum: readonly ["immediate", "held"];
+                };
+                readonly annotations: {
+                    readonly $ref: "#/$defs/annotations";
+                };
+            };
+        };
         readonly functionTool: {
             readonly type: "object";
             readonly additionalProperties: false;
@@ -335,6 +354,18 @@ export declare const agentSchema: {
                 readonly then: {
                     readonly $ref: "#/$defs/skillTool";
                 };
+            }, {
+                readonly if: {
+                    required: string[];
+                    properties: {
+                        type: {
+                            const: string;
+                        };
+                    };
+                };
+                readonly then: {
+                    readonly $ref: "#/$defs/bashTool";
+                };
             }, {
                 readonly if: {
                     required: string[];

package/dist/agent-config/schema.js

@@ -35,6 +35,7 @@ const BUILTIN_TYPES = [
     "backbone.document_convert",
     "backbone.todo",
     "backbone.skill",
+    "backbone.bash",
     "function",
 ];
 const typeIs = (t) => ({ required: ["type"], properties: { type: { const: t } } });
@@ -161,6 +162,19 @@ export const agentSchema = {
                 skills: { type: "array", minItems: 1, maxItems: 20, uniqueItems: true, items: { type: "string", pattern: SKILL_REF } },
             },
         },
+        // The envelope BashToolEntryValidator accepts: no name, no requiresConfirmation, and none of
+        // the egress of the withdrawn per-agent network design (#925).
+        bashTool: {
+            type: "object",
+            additionalProperties: false,
+            required: ["type"],
+            properties: {
+                type: { const: "backbone.bash" },
+                approval: { enum: ["sandbox", "pause"] },
+                outputs: { enum: ["immediate", "held"] },
+                annotations: { $ref: "#/$defs/annotations" },
+            },
+        },
         functionTool: {
             type: "object",
             additionalProperties: false,
@@ -194,6 +208,7 @@ export const agentSchema = {
                 { if: typeIs("backbone.document_convert"), then: { $ref: "#/$defs/documentConvertTool" } },
                 { if: typeIs("backbone.todo"), then: { $ref: "#/$defs/todoTool" } },
                 { if: typeIs("backbone.skill"), then: { $ref: "#/$defs/skillTool" } },
+                { if: typeIs("backbone.bash"), then: { $ref: "#/$defs/bashTool" } },
                 { if: typeIs("function"), then: { $ref: "#/$defs/functionTool" } },
                 {
                     // The validator reports these with the reason from NON_AUTHORABLE_TOOL_TYPES; this keeps the published schema honest.

package/dist/agent-config/template.js

@@ -33,6 +33,8 @@ tools: []
 #   - type: backbone.todo
 #   - type: backbone.skill
 #     skills: [skill-name@latest]
+#   - type: backbone.bash
+#     approval: sandbox
 #   - type: function
 #     name: lookup_order
 #     description: Look up an order by number

package/dist/commands/agent-run.js

@@ -124,7 +124,7 @@ async function finishRun(command, client, target, first, opts) {
 }
 export function makeAgentRunCommand() {
     return new Command("run")
-        .description("Run an agent on a task (exit 3 = paused for approval, 4 = needs client tool output or a connector connected in chat, 5 = incomplete)")
+        .description("Run an agent on a task (exit 3 = paused for approval, 4 = needs client tool output, a connector connected in chat or your answer in chat, 5 = incomplete)")
         .argument("<agent>", "Agent name or id, optionally with @label and #model")
         .argument("[input]", "Task text (or use --input-file, or pipe it on stdin); optional with --continue")
         .option("--input-file <path>", "Read the task text from a file")

package/dist/commands/analytics.js

@@ -8,7 +8,7 @@ function addDateOptions(cmd) {
 }
 export function makeAnalyticsCommand() {
     const cmd = new Command("analytics").description("Organization analytics");
-    const summary = new Command("summary").description("Cross-surface summary (total ops, spend, p95, per-surface breakdown)");
+    const summary = new Command("summary").description("Cross-surface summary (total ops, tokens, p95, per-surface breakdown)");
     addDateOptions(summary);
     summary.action(async (opts, command) => {
         await runAction(command, async () => {
@@ -66,7 +66,6 @@ export function makeAnalyticsCommand() {
                 "successfulExtractions",
                 "successRate",
                 "totalTokens",
-                "totalCost",
                 "avgDurationMs",
             ]);
         });
@@ -89,7 +88,6 @@ export function makeAnalyticsCommand() {
                 "successfulExtractions",
                 "successRate",
                 "totalTokens",
-                "totalCost",
                 "avgDurationMs",
             ]);
         });

package/dist/commands/billing.js

@@ -4,6 +4,8 @@ import { isJsonOutput } from "../lib/config.js";
 import { CliUsageError } from "../lib/errors.js";
 import { formatDetail, formatList } from "../lib/output.js";
 import chalk from "chalk";
+/** What human output shows for a null tier: an organisation without a plan (#1356). */
+const NO_PLAN = "no plan";
 export function makeBillingCommand() {
     const cmd = new Command("billing").description("Billing and subscription management");
     cmd
@@ -23,7 +25,9 @@ export function makeBillingCommand() {
         await runAction(command, async () => {
             const client = getClient(command);
             const { data } = await client.GET("/v1/billing/tier");
-            formatDetail(data, command);
+            // A null name is an organisation without a plan (#1356); --json keeps the raw null.
+            const shown = data && data.name == null && !isJsonOutput(command) ? { ...data, name: NO_PLAN } : data;
+            formatDetail(shown, command);
         });
     });
     cmd
@@ -37,7 +41,7 @@ export function makeBillingCommand() {
                 console.log(JSON.stringify(data, null, 2));
             }
             else {
-                console.log(chalk.cyan(`Tier: ${data?.tier ?? "unknown"}`));
+                console.log(chalk.cyan(`Tier: ${data?.tier ?? NO_PLAN}`));
                 console.log();
                 if (data?.resources?.length) {
                     console.log(chalk.bold("Resources:"));

package/dist/commands/convert.js

@@ -1,9 +1,8 @@
 import { Command } from "commander";
 import { readFileSync, writeFileSync } from "node:fs";
 import chalk from "chalk";
-import { getClient, resolveAuthHeader, runAction } from "../lib/client.js";
-import { resolveConfig, isJsonOutput } from "../lib/config.js";
-import { BackboneApiError } from "../lib/errors.js";
+import { getClient, runAction } from "../lib/client.js";
+import { isJsonOutput } from "../lib/config.js";
 import { formatDetail, withSpinner } from "../lib/output.js";
 import { fileToBlob, getMimeType } from "../lib/multipart.js";
 function mapFormat(format) {
@@ -136,34 +135,19 @@ function buildFormData(paths, opts) {
     formData.append("options", new Blob([JSON.stringify(pipelineOptions)], { type: "application/json" }));
     return formData;
 }
+/**
+ * POST the multipart body through the typed client. The generated type describes `files` as string[],
+ * which FormData cannot match, so the placeholder body satisfies the type and bodySerializer sends the
+ * real parts; the client's auth and error middleware apply.
+ */
 async function multipartConvert(command, formData, endpoint, pipeline) {
-    const config = resolveConfig(command);
-    const authHeader = await resolveAuthHeader(config);
-    const baseUrl = config.baseUrl.replace(/\/+$/, "");
-    const url = pipeline
-        ? `${baseUrl}${endpoint}?pipeline=${encodeURIComponent(pipeline)}`
-        : `${baseUrl}${endpoint}`;
-    const res = await fetch(url, {
-        method: "POST",
-        headers: { Authorization: authHeader },
-        body: formData,
+    const client = getClient(command);
+    const { data } = await client.POST(endpoint, {
+        params: { query: { pipeline } },
+        body: { files: [] },
+        bodySerializer: () => formData,
     });
-    if (!res.ok) {
-        let body;
-        try {
-            body = await res.json();
-        }
-        catch {
-            body = {
-                error: res.statusText,
-                message: `HTTP ${res.status}: ${res.statusText}`,
-                status: res.status,
-                timestamp: new Date().toISOString(),
-            };
-        }
-        throw new BackboneApiError(body);
-    }
-    return (await res.json());
+    return data;
 }
 export function makeConvertCommand() {
     const cmd = new Command("convert").description("Convert documents");

package/dist/commands/experiments.js

@@ -16,8 +16,18 @@ function formatComparisonCell(result) {
         return chalk.red("ERROR");
     const scores = result.scores ?? [];
     if (scores.length > 0) {
-        const avg = scores.reduce((sum, s) => sum + (s.score ?? 0), 0) / scores.length;
-        return avg.toFixed(2);
+        // A SKIP carries a placeholder 0.0 that is not a rating, and a comment-only
+        // score has no number; neither takes part in the average (#693).
+        const rated = scores.filter((s) => s.label !== "SKIP" && s.score != null);
+        if (rated.length > 0) {
+            return (rated.reduce((sum, s) => sum + s.score, 0) / rated.length).toFixed(2);
+        }
+        // A label-only verdict (#1163) has no number; show its label, as the console does.
+        const verdict = scores.find((s) => s.label && s.label !== "SKIP");
+        if (verdict)
+            return String(verdict.label);
+        if (scores.every((s) => s.label === "SKIP"))
+            return chalk.dim("skipped");
     }
     return result.durationMs != null ? `${result.durationMs}ms` : chalk.dim("done");
 }
@@ -392,8 +402,14 @@ export function makeExperimentsCommand() {
                 console.log(chalk.dim(`Page ${(page.number ?? 0) + 1} of ${page.totalPages ?? 0} (${page.totalElements ?? 0} total)`));
             }
             if (aggregates.length > 0) {
+                const skippedOf = (agg) => Object.entries((agg.skippedEvaluatorCounts ?? {}))
+                    .filter(([, n]) => n > 0)
+                    .map(([evaluatorId, n]) => `${evaluatorId}: ${n}`)
+                    .join(", ");
+                // Only when something was skipped, so a clean run keeps its narrow table (#693).
+                const showSkipped = aggregates.some((agg) => skippedOf(agg) !== "");
                 const aggTable = new Table({
-                    head: ["Variant", "Items", "Avg Duration", "Avg Tokens", "Total Cost"].map((h) => chalk.cyan(h)),
+                    head: ["Variant", "Items", "Avg Duration", "Avg Tokens", "Total Cost", ...(showSkipped ? ["Skipped"] : [])].map((h) => chalk.cyan(h)),
                     wordWrap: true,
                 });
                 for (const agg of aggregates) {
@@ -403,6 +419,7 @@ export function makeExperimentsCommand() {
                         agg.avgDurationMs != null ? `${Math.round(agg.avgDurationMs)}ms` : "—",
                         agg.avgTokens != null ? Math.round(agg.avgTokens) : "—",
                         agg.totalCost != null ? `$${agg.totalCost}` : "—",
+                        ...(showSkipped ? [skippedOf(agg) || "—"] : []),
                     ]);
                 }
                 console.log(chalk.bold("\nAggregates:"));

package/dist/commands/files.js

@@ -8,19 +8,20 @@ import { formatPage, formatDetail, formatSuccess, withSpinner } from "../lib/out
 import { addPaginationOptions, paginationParams } from "../lib/pagination.js";
 import { fileToBlob } from "../lib/multipart.js";
 /**
- * Upload a single file with purpose=agent_input|knowledge. The generated type
- * describes the "file" part as a binary string, which FormData cannot match,
- * so the placeholder body satisfies the type and bodySerializer sends the
- * real part.
+ * Upload a single file with purpose=agent_input|knowledge. Both are multipart
+ * form parts. The generated type describes the "file" part as a binary string,
+ * which FormData cannot match, so the placeholder body satisfies the type and
+ * bodySerializer sends the real parts.
  */
 async function uploadFile(command, filePath, purpose) {
     const { blob, filename } = fileToBlob(filePath);
     const formData = new FormData();
     formData.append("file", blob, filename);
+    formData.append("purpose", purpose);
     const client = getClient(command);
     const { data } = await client.POST("/v1/files", {
-        params: { query: { purpose } },
-        body: { file: "" },
+        // The server validates the purpose and answers 400 for an unknown one, so the CLI does not narrow it.
+        body: { file: "", purpose: purpose },
         bodySerializer: () => formData,
     });
     return data;

package/dist/commands/providers.js

@@ -14,7 +14,7 @@ export function makeProvidersCommand() {
             const { data } = await client.GET("/v1/providers", {
                 params: { query: { search: opts.search, ...paginationParams(opts) } },
             });
-            formatPage(data, command, ["id", "name", "type", "enabled", "createdAt"]);
+            formatPage(data, command, ["id", "name", "provider", "createdAt"]);
         });
     });
     cmd.addCommand(list);
@@ -36,7 +36,7 @@ export function makeProvidersCommand() {
         .description("Create a new provider")
         .requiredOption("-n, --name <name>", "Provider name")
         .requiredOption("--type <type>", "Provider type (openai, azure_openai, anthropic, xai, mistral, ollama)")
-        .requiredOption("--provider-api-key <key>", "API key for the AI provider")
+        .option("--provider-api-key <key>", "API key for the AI provider (not needed for ollama)")
         .option("-c, --config <json>", "Provider config as JSON")
         .action(async (opts, command) => {
         await runAction(command, async () => {
@@ -54,7 +54,6 @@ export function makeProvidersCommand() {
         .argument("<id>", "Provider ID")
         .option("-n, --name <name>", "New name")
         .option("--type <type>", "New type")
-        .option("--enabled <bool>", "Enable/disable")
         .option("-c, --config <json>", "New config as JSON")
         .action(async (id, opts, command) => {
         await runAction(command, async () => {
@@ -64,8 +63,6 @@ export function makeProvidersCommand() {
                 body.name = opts.name;
             if (opts.type)
                 body.provider = opts.type.toUpperCase();
-            if (opts.enabled !== undefined)
-                body.enabled = opts.enabled === "true";
             if (opts.config)
                 body.config = JSON.parse(opts.config);
             const { data } = await client.PATCH("/v1/providers/{id}", {
@@ -95,13 +92,7 @@ export function makeProvidersCommand() {
         await runAction(command, async () => {
             const client = getClient(command);
             const { data } = await client.GET("/v1/providers/all");
-            formatList(data, command, [
-                "id",
-                "name",
-                "provider",
-                "enabled",
-                "createdAt",
-            ]);
+            formatList(data, command, ["id", "name", "provider", "createdAt"]);
         });
     });
     cmd

package/dist/commands/skills.js

@@ -149,18 +149,16 @@ export function makeSkillsCommand() {
                 }
                 ({ blob, filename } = fileToBlob(path));
             }
-            const config = resolveConfig(command);
-            const authHeader = await resolveAuthHeader(config);
             const formData = new FormData();
             formData.append("file", blob, filename);
+            const client = getClient(command);
             const data = await withSpinner("Importing skill...", async () => {
-                const res = await fetch(`${config.baseUrl.replace(/\/+$/, "")}/v1/skills/import`, {
-                    method: "POST",
-                    headers: { Authorization: authHeader },
-                    body: formData,
+                // Placeholder body for the generated type; bodySerializer sends the real part.
+                const result = await client.POST("/v1/skills/import", {
+                    body: { file: "" },
+                    bodySerializer: () => formData,
                 });
-                await checkResponse(res);
-                return res.json();
+                return result.data;
             });
             formatDetail(data, command);
         });

package/dist/commands/transcribe.js

@@ -1,10 +1,9 @@
 import { Command } from "commander";
-import { resolveAuthHeader } from "../lib/client.js";
-import { resolveConfig, isJsonOutput } from "../lib/config.js";
+import { getClient } from "../lib/client.js";
+import { isJsonOutput } from "../lib/config.js";
 import { handleError } from "../lib/errors.js";
 import { formatDetail, withSpinner } from "../lib/output.js";
 import { fileToBlob } from "../lib/multipart.js";
-import { BackboneApiError } from "../lib/errors.js";
 export function makeTranscribeCommand() {
     const cmd = new Command("transcribe")
         .description("Transcribe an audio file")
@@ -17,8 +16,6 @@ export function makeTranscribeCommand() {
         .action(async (file, opts, command) => {
         const json = isJsonOutput(command);
         try {
-            const config = resolveConfig(command);
-            const authHeader = await resolveAuthHeader(config);
             const { blob, filename } = fileToBlob(file);
             const formData = new FormData();
             formData.append("file", blob, filename);
@@ -31,30 +28,15 @@ export function makeTranscribeCommand() {
                 formData.append("response_format", opts.format);
             if (opts.temperature)
                 formData.append("temperature", opts.temperature);
-            const baseUrl = config.baseUrl.replace(/\/+$/, "");
-            const url = `${baseUrl}/v1/audio/transcriptions`;
+            const client = getClient(command);
             const data = await withSpinner("Transcribing...", async () => {
-                const res = await fetch(url, {
-                    method: "POST",
-                    headers: { Authorization: authHeader },
-                    body: formData,
+                // The generated type describes "file" as a binary string, which FormData cannot match;
+                // the placeholder satisfies it and bodySerializer sends the real parts.
+                const result = await client.POST("/v1/audio/transcriptions", {
+                    body: { file: "", model: opts.model },
+                    bodySerializer: () => formData,
                 });
-                if (!res.ok) {
-                    let body;
-                    try {
-                        body = await res.json();
-                    }
-                    catch {
-                        body = {
-                            error: res.statusText,
-                            message: `HTTP ${res.status}: ${res.statusText}`,
-                            status: res.status,
-                            timestamp: new Date().toISOString(),
-                        };
-                    }
-                    throw new BackboneApiError(body);
-                }
-                return res.json();
+                return result.data;
             });
             formatDetail(data, command);
         }

package/dist/lib/agent-run.d.ts

@@ -1,4 +1,5 @@
 import type { components } from "../generated/openapi.js";
+import { type InputMode } from "./connect-pause.js";
 type AnyRecord = Record<string, any>;
 export type RunStatus = "completed" | "requires_approval" | "requires_tool_output" | "incomplete";
 /** A built-in SkillsApply approval's preview (#781, spec §6); the generated type, fields all optional. */
@@ -39,6 +40,19 @@ export interface PendingConnection {
     /** The egress difference an allow is re-asked for; absent otherwise. */
     destinations?: string[];
 }
+/**
+ * A connector's question the run waits on (#1320, connectors spec §12): an open
+ * `backbone:input_request`. Only the user who started the run answers it, and only in chat, at
+ * `answerUrl`; the envelope never carries the question, its form or its link (D7).
+ */
+export interface PendingInput {
+    inputRequestId: string;
+    serverLabel: string;
+    tool: string;
+    /** `form`, `url`, `mixed` (both) or `unknown`: what the user does in chat. */
+    mode: InputMode;
+    answerUrl: string;
+}
 /** The end user's conversation mode (epic &59); the server matches these three values exactly. */
 export type ConversationMode = "plan" | "ask" | "auto";
 export declare const CONVERSATION_MODES: readonly ConversationMode[];
@@ -72,6 +86,7 @@ export interface RunEnvelope {
     pendingApprovals: PendingApproval[];
     pendingToolCalls: PendingToolCall[];
     pendingConnections: PendingConnection[];
+    pendingInputs: PendingInput[];
     incompleteReason: string | null;
     usage: {
         inputTokens: number;
@@ -116,6 +131,9 @@ export declare function parseAgentModel(model?: string): {
  * clipboard. Newlines and tabs stay. JSON output is never passed through this.
  */
 export declare function stripControl(s: string): string;
+export declare function hasInvisible(s: string): boolean;
+/** Replaces each hidden code point with a visible `<U+XXXX>`, so approving a diff means having seen it. */
+export declare function revealInvisible(s: string): string;
 export declare function shellQuote(value: string): string;
 /** "Connect a (h), allow the agent to use b (h) and reconnect c (h)". */
 export declare function connectionsSentence(connections: PendingConnection[]): string;

package/dist/lib/agent-run.js

@@ -1,7 +1,8 @@
 import chalk from "chalk";
 import { DEFAULT_CHAT_URL } from "./config.js";
-import { connectCallIds, connectionsPhrase, pendingConnectionsOf } from "./connect-pause.js";
+import { answerUrlFor, connectCallIds, connectionsPhrase, inputLabelsPhrase, pendingConnectionsOf, pendingInputsOf, } from "./connect-pause.js";
 import { CliUsageError } from "./errors.js";
+import { previewIsIncomplete, previewLines } from "./skills-apply-preview.js";
 export const CONVERSATION_MODES = ["plan", "ask", "auto"];
 /** `--mode` help text, in the words of the embedded chat's mode chip (#655). */
 export const MODE_OPTION_HELP = "Conversation mode: plan (read-only), ask (no automatic approver; calls that need approval wait for you), " +
@@ -88,6 +89,39 @@ const CONTROL_CHARS = /[\x00-\x08\x0b-\x1f\x7f-\x9f]/g;
 export function stripControl(s) {
     return s.replace(CONTROL_CHARS, "");
 }
+/**
+ * Code points that print as nothing, or reorder what surrounds them, yet reach the model: Unicode
+ * tags, zero-width characters, directional marks, embeddings, overrides and isolates, the word
+ * joiner and the byte-order mark (#1027). As numbers, not an escaped regex, so no tool can fold
+ * them into the source. Kept in step with `surface/src/core/skills-apply-preview.ts`.
+ */
+const INVISIBLE_RANGES = [
+    [0xe0000, 0xe007f],
+    [0x200b, 0x200f],
+    [0x202a, 0x202e],
+    [0x2060, 0x2060],
+    [0x2066, 0x2069],
+    [0x061c, 0x061c],
+    [0xfeff, 0xfeff],
+];
+function isInvisible(codePoint) {
+    return INVISIBLE_RANGES.some(([low, high]) => codePoint >= low && codePoint <= high);
+}
+export function hasInvisible(s) {
+    for (const char of s)
+        if (isInvisible(char.codePointAt(0)))
+            return true;
+    return false;
+}
+/** Replaces each hidden code point with a visible `<U+XXXX>`, so approving a diff means having seen it. */
+export function revealInvisible(s) {
+    let out = "";
+    for (const char of s) {
+        const codePoint = char.codePointAt(0);
+        out += isInvisible(codePoint) ? `<U+${codePoint.toString(16).toUpperCase().padStart(4, "0")}>` : char;
+    }
+    return out;
+}
 export function shellQuote(value) {
     if (/^[A-Za-z0-9._@/:-]+$/.test(value))
         return value;
@@ -119,9 +153,26 @@ function relayDecideCommand(ref, responseId, calls, withApprovals) {
     return (`2kw agents decide ${shellQuote(ref)} --response ${shellQuote(responseId)}${outputs.join("")}` +
         (withApprovals ? " --approve-all" : ""));
 }
+/**
+ * A connector tool's open approval, decoded from the standard `mcp_approval_request` item (#949). The item
+ * is the MCP twin of `backbone:approval_request` (#805): it names the server and the tool, carries no call
+ * id, policy class or status, and exists only while the decision is open, so its id doubles as the call id
+ * and the tool is named as the approval row stores it, `mcp__<server_label>__<tool>`.
+ */
+function connectorApproval(i) {
+    return {
+        approvalId: String(i.id),
+        callId: String(i.id),
+        tool: `mcp__${String(i.server_label)}__${String(i.name)}`,
+        arguments: parseArguments(i.arguments),
+        policyClass: "unknown",
+        reason: null,
+        preview: null,
+    };
+}
 /**
  * Output item types the envelope decodes, or that never hold a run: text, reasoning and finished
- * connector calls. A pause on anything else (a connector approval's `mcp_approval_request`) is named.
+ * connector calls. A pause on anything else is named.
  * `backbone:tool_image` is an image a finished `ViewImage` call attached (#1244): it never holds a run.
  */
 const DECODED_ITEM_TYPES = new Set([
@@ -131,7 +182,9 @@ const DECODED_ITEM_TYPES = new Set([
     "function_call_output",
     "backbone:approval_request",
     "backbone:connector_auth_request",
+    "backbone:input_request",
     "backbone:tool_image",
+    "mcp_approval_request",
     "mcp_call",
     "mcp_list_tools",
 ]);
@@ -155,18 +208,21 @@ export function buildRunEnvelope(result, agentRef, chatUrl = DEFAULT_CHAT_URL) {
         String(i.call_id),
         i.status === "incomplete" ? "incomplete" : "completed",
     ]));
-    const pendingApprovals = output
-        // Only an open request is pending; judge- or grant-decided requests (#634, #629) carry another status.
-        .filter((i) => i.type === "backbone:approval_request" && (i.status === undefined || i.status === "in_progress"))
-        .map((i) => ({
-        approvalId: String(i.id),
-        callId: String(i.call_id),
-        tool: String(i.tool),
-        arguments: parseArguments(i.arguments),
-        policyClass: String(i.policy_class),
-        reason: typeof i.reason === "string" && i.reason ? i.reason : null,
-        preview: i.preview && typeof i.preview === "object" && !Array.isArray(i.preview) ? i.preview : null,
-    }));
+    const pendingApprovals = [
+        ...output
+            // Only an open request is pending; judge- or grant-decided requests (#634, #629) carry another status.
+            .filter((i) => i.type === "backbone:approval_request" && (i.status === undefined || i.status === "in_progress"))
+            .map((i) => ({
+            approvalId: String(i.id),
+            callId: String(i.call_id),
+            tool: String(i.tool),
+            arguments: parseArguments(i.arguments),
+            policyClass: String(i.policy_class),
+            reason: typeof i.reason === "string" && i.reason ? i.reason : null,
+            preview: i.preview && typeof i.preview === "object" && !Array.isArray(i.preview) ? i.preview : null,
+        })),
+        ...output.filter((i) => i.type === "mcp_approval_request").map(connectorApproval),
+    ];
     // The one decoding rule (#1086): only an open request with its id, call id, label and host.
     const connectRequests = pendingConnectionsOf(output);
     const pendingConnections = connectRequests.map(({ serverLabel, host, reason, destinations }) => ({
@@ -175,7 +231,22 @@ export function buildRunEnvelope(result, agentRef, chatUrl = DEFAULT_CHAT_URL) {
         reason,
         ...(destinations ? { destinations } : {}),
     }));
-    const withheldCallIds = new Set([...pendingApprovals.map((a) => a.callId), ...connectCallIds(output, connectRequests)]);
+    // A connector's question (#1320): answered in chat only, so the envelope names where, never what (D7).
+    const inputRequests = pendingInputsOf(output);
+    const answerUrl = answerUrlFor(chatUrl, result?.conversation?.id ?? null);
+    const pendingInputs = inputRequests.map(({ id, serverLabel, tool, mode }) => ({
+        inputRequestId: id,
+        serverLabel,
+        tool,
+        mode,
+        answerUrl,
+    }));
+    const withheldCallIds = new Set([
+        ...pendingApprovals.map((a) => a.callId),
+        ...connectCallIds(output, connectRequests),
+        // An awaiting call has no function_call item (spec §5); withheld all the same, never the caller's to answer.
+        ...inputRequests.map((i) => i.callId),
+    ]);
     const toolCalls = [];
     const pendingToolCalls = [];
     for (const item of output) {
@@ -199,9 +270,10 @@ export function buildRunEnvelope(result, agentRef, chatUrl = DEFAULT_CHAT_URL) {
             status = "incomplete";
             break;
         case "requires_action":
-            // A connect pause keeps exit 4 (§8, CLI agents D14): the CLI cannot answer it either.
+            // A connect pause keeps exit 4 (§8, CLI agents D14): the CLI cannot answer it either, nor an
+            // input pause, which outranks every other (#1320, P91).
             status =
-                pendingToolCalls.length > 0 || pendingConnections.length > 0 || pendingApprovals.length === 0
+                pendingInputs.length > 0 || pendingToolCalls.length > 0 || pendingConnections.length > 0 || pendingApprovals.length === 0
                     ? "requires_tool_output"
                     : "requires_approval";
             break;
@@ -211,7 +283,14 @@ export function buildRunEnvelope(result, agentRef, chatUrl = DEFAULT_CHAT_URL) {
     const responseId = result?.id ?? null;
     const ref = agentRef ?? agent;
     let next = null;
-    if (status === "requires_approval" && ref && responseId) {
+    if (pendingInputs.length > 0) {
+        // Only the requester's continuation resolves the response (spec D9), and only chat sends one: no
+        // command here can continue it, whatever else waits (#1320, P91).
+        const labels = inputLabelsPhrase(pendingInputs);
+        const needs = new Set(pendingInputs.map((i) => i.serverLabel)).size > 1 ? "need" : "needs";
+        next = `${labels} ${needs} your input: answer in chat at ${answerUrl}. The run continues there.`;
+    }
+    else if (status === "requires_approval" && ref && responseId) {
         next = `2kw agents decide ${shellQuote(ref)} --response ${responseId} --approve-all`;
     }
     else if (status === "requires_tool_output" && pendingToolCalls.length > 0) {
@@ -223,6 +302,13 @@ export function buildRunEnvelope(result, agentRef, chatUrl = DEFAULT_CHAT_URL) {
                 : decide;
         }
     }
+    else if (status === "requires_tool_output" && pendingConnections.length > 0 && pendingApprovals.length > 0 && ref && responseId) {
+        // A continuation must decide every pending approval (400 incomplete_tool_outputs otherwise), so
+        // `--continue` would fail; decide answers them and the engine re-checks access itself (#949 review).
+        next =
+            `${connectionsSentence(pendingConnections)} in ${chatUrl}/connectors${THEN_RUN}` +
+                `2kw agents decide ${shellQuote(ref)} --response ${shellQuote(responseId)} --approve-all`;
+    }
     else if (status === "requires_tool_output" && pendingConnections.length > 0 && responseId) {
         // `agents run --continue` needs no input: the continuation re-checks access itself.
         const resume = ref
@@ -248,6 +334,7 @@ export function buildRunEnvelope(result, agentRef, chatUrl = DEFAULT_CHAT_URL) {
         pendingApprovals,
         pendingToolCalls,
         pendingConnections,
+        pendingInputs,
         incompleteReason: result?.incomplete_details?.reason ?? null,
         usage: result?.usage
             ? { inputTokens: result.usage.input_tokens ?? 0, outputTokens: result.usage.output_tokens ?? 0 }
@@ -255,6 +342,13 @@ export function buildRunEnvelope(result, agentRef, chatUrl = DEFAULT_CHAT_URL) {
         next,
     };
 }
+/** What the user does in chat for each input mode, in {@link printRunText}'s words. */
+const INPUT_MODE_WORDS = {
+    form: "form",
+    url: "link",
+    mixed: "form and link",
+    unknown: "question",
+};
 /** Human-readable rendering of an envelope on stdout. Every value printed is passed through {@link stripControl}. */
 export function printRunText(env) {
     const s = stripControl;
@@ -271,8 +365,15 @@ export function printRunText(env) {
         console.log(chalk.dim(`   tools: ${env.toolCalls.map((c) => `${s(c.tool)} ${c.status === "incomplete" ? "✗" : "✓"}`).join("  ")}`));
     const printApprovals = () => env.pendingApprovals.forEach((a, i) => {
         console.log(`  ${i + 1}. ${s(a.tool)} [${s(a.policyClass)}] ${s(a.approvalId)}`);
-        // JSON.stringify escapes C0 controls but leaves DEL and C1 raw.
-        console.log(chalk.dim(`     ${s(JSON.stringify(a.arguments))}`));
+        // A SkillsApply change reads as its diff (#1028), like the interactive prompt; an incomplete
+        // preview keeps the arguments, the one place a member can read what would persist.
+        if (a.preview)
+            for (const line of previewLines(a.preview))
+                console.log(chalk.dim(`     ${s(line)}`));
+        if (!a.preview || previewIsIncomplete(a.preview)) {
+            // JSON.stringify escapes C0 controls but leaves DEL and C1 raw.
+            console.log(chalk.dim(`     ${s(JSON.stringify(a.arguments))}`));
+        }
         if (a.reason)
             console.log(chalk.dim(`     reason: ${s(a.reason)}`));
     });
@@ -282,6 +383,21 @@ export function printRunText(env) {
         if (env.next)
             console.log(`\nDecide with:\n  ${s(env.next)}`);
     }
+    else if (env.status === "requires_tool_output" && env.pendingInputs.length) {
+        // A connector's question outranks every other pause (#1320, P91): it is answered in chat, and that
+        // one answer also carries the rest, so no command is printed for anything else.
+        console.log(chalk.yellow("\nPaused: the agent needs your answer in chat:"));
+        env.pendingInputs.forEach((i) => console.log(`  - ${s(i.serverLabel)}: ${s(i.tool)} (${INPUT_MODE_WORDS[i.mode]})`));
+        const others = [
+            env.pendingApprovals.length ? `${env.pendingApprovals.length} approval(s)` : null,
+            env.pendingConnections.length ? `${env.pendingConnections.length} connection(s)` : null,
+            env.pendingToolCalls.length ? `${env.pendingToolCalls.length} client-side tool call(s)` : null,
+        ].filter(Boolean);
+        if (others.length)
+            console.log(chalk.dim(`    It also waits for ${others.join(", ")}: answer them in chat too.`));
+        if (env.next)
+            console.log(`\n${s(env.next)}`);
+    }
     else if (env.status === "requires_tool_output") {
         if (env.pendingToolCalls.length) {
             console.log(chalk.yellow("\nPaused: the agent waits for client-side tool output:"));

package/dist/lib/approval-prompt.js

@@ -1,6 +1,6 @@
 import { createInterface } from "node:readline/promises";
 import chalk from "chalk";
-import { stripControl } from "./agent-run.js";
+import { hasInvisible, revealInvisible, stripControl } from "./agent-run.js";
 import { REMEMBER_NOTE, previewIsIncomplete, previewLines } from "./skills-apply-preview.js";
 /** Raised when the prompt's input closes (EOF, Ctrl+C, Ctrl+D) before an answer arrives. */
 export class PromptAbortedError extends Error {
@@ -50,9 +50,11 @@ export function readlineAsk(input = process.stdin, output = process.stderr) {
 }
 export async function promptApprovals(pending, ask, write = (line) => console.error(line)) {
     const answers = new Map();
-    const s = stripControl;
+    const s = (value) => revealInvisible(stripControl(value));
     for (const [index, a] of pending.entries()) {
-        const destructive = a.policyClass.toLowerCase() === "destructive";
+        // A connector approval carries no policy class (#949): "unknown" may be destructive, so it is never
+        // offered a standing grant here; the server drops one for a destructive row anyway.
+        const destructive = ["destructive", "unknown"].includes(a.policyClass.toLowerCase());
         write(chalk.yellow(`\nApproval ${index + 1}/${pending.length}: ${s(a.tool)} [${s(a.policyClass)}]`));
         // JSON.stringify escapes C0 controls but leaves DEL and C1 raw.
         const request = () => write(chalk.dim(s(JSON.stringify(a.arguments, null, 2))));
@@ -60,7 +62,12 @@ export async function promptApprovals(pending, ask, write = (line) => console.er
             // A SkillsApply change reads as its diff (#782, spec §10). When the preview leaves changes
             // out, the full arguments follow it: this prompt never runs with --json, so it is the only
             // place the member can read what would persist (spec D7).
-            for (const line of previewLines(a.preview))
+            const lines = previewLines(a.preview);
+            // Hidden characters are shown as <U+XXXX> below; the warning says why (#1027, spec D7).
+            if (lines.some(hasInvisible)) {
+                write(chalk.yellow("Hidden characters found: shown as <U+XXXX>. A model reads them; you would not see them. Check each marked line before you approve."));
+            }
+            for (const line of lines)
                 write(colourPreviewLine(s(line)));
             if (previewIsIncomplete(a.preview)) {
                 write(chalk.dim("Full request (the preview leaves changes out):"));

package/dist/lib/connect-pause.d.ts

@@ -7,7 +7,8 @@
  * `n8n/nodes/TwoKw/operations/connect-pause.ts` are byte copies of it under a header: edit it
  * here, then run `npm run sync:connect-pause` in mcp/ and `npm run sync-connect-pause` in n8n/.
  * Its golden fixture, `cli/tests/fixtures/connect-pause-cases.json`, is copied the same way into
- * mcp/, n8n/ and surface/, and every client's decoder test runs every case of it.
+ * mcp/, n8n/ and surface/, and every client's decoder test runs every case of it. The input pause
+ * (#1320, connectors spec §12) lives here too, with its own fixture `input-pause-cases.json`.
  *
  * Plain TypeScript with no imports, no `process`, no Node types and no timers, so n8n's source
  * scanner and its empty `dependencies` accept the copy. The CLI and the MCP server keep their
@@ -68,4 +69,37 @@ export declare function connectCallIds(output: unknown, connections: readonly Pi
 export declare function connectionPhrase(c: ConnectTarget): string;
 /** "connect a (h), allow the agent to use b (h) and reconnect c (h)"; empty for none. */
 export declare function connectionsPhrase(connections: readonly ConnectTarget[]): string;
+/**
+ * What an open input request asks for: a form, a page to open, both (`mixed`), or neither of the
+ * modes this client knows (`unknown`). It names no URL: the question stays in chat (D7).
+ */
+export type InputMode = "form" | "url" | "mixed" | "unknown";
+/**
+ * One open `backbone:input_request` (#1320, connectors spec §12): a connector's question that only
+ * the requester can answer, and only in chat. `id` is the item's `inreq_…` id. Its message, schema
+ * and URL are never read: no assistant may see them (D7).
+ */
+export interface PendingInput {
+    id: string;
+    callId: string;
+    serverLabel: string;
+    /** The tool's own name, without the `mcp__<label>__` prefix. */
+    tool: string;
+    mode: InputMode;
+}
+/**
+ * The questions a response's `output` still waits on, in order, by the chat's own rule
+ * (`surface/src/core/chat.ts`, so a link never points at a question the chat would not show): an
+ * `in_progress` request whose id no other-status projection and no `backbone:input_response`
+ * resolved, and only the newest open round of its call. An item without a non-empty `id`,
+ * `call_id`, `server_label` or `name`, or without one request entry that has a `key`, is skipped.
+ */
+export declare function pendingInputsOf(output: unknown): PendingInput[];
+/**
+ * Where the user answers: the chat's slug-less conversation link (`<chat>/c/<id>`, the path
+ * `surface/src/hosts/web/routes.ts` `answerPath` builds), or the chat itself without a conversation.
+ */
+export declare function answerUrlFor(chatOrigin: string, conversationId: string | null | undefined): string;
+/** "erp", "erp and crm", "erp, crm and drive": each connector that asks, once; empty for none. */
+export declare function inputLabelsPhrase(inputs: readonly Pick<PendingInput, "serverLabel">[]): string;
 //# sourceMappingURL=connect-pause.d.ts.map

package/dist/lib/connect-pause.js

@@ -7,7 +7,8 @@
  * `n8n/nodes/TwoKw/operations/connect-pause.ts` are byte copies of it under a header: edit it
  * here, then run `npm run sync:connect-pause` in mcp/ and `npm run sync-connect-pause` in n8n/.
  * Its golden fixture, `cli/tests/fixtures/connect-pause-cases.json`, is copied the same way into
- * mcp/, n8n/ and surface/, and every client's decoder test runs every case of it.
+ * mcp/, n8n/ and surface/, and every client's decoder test runs every case of it. The input pause
+ * (#1320, connectors spec §12) lives here too, with its own fixture `input-pause-cases.json`.
  *
  * Plain TypeScript with no imports, no `process`, no Node types and no timers, so n8n's source
  * scanner and its empty `dependencies` accept the copy. The CLI and the MCP server keep their
@@ -144,4 +145,77 @@ export function connectionsPhrase(connections) {
         return phrases[0] ?? "";
     return `${phrases.slice(0, -1).join(", ")} and ${phrases[phrases.length - 1]}`;
 }
+const INPUT_REQUEST = "backbone:input_request";
+const INPUT_RESPONSE = "backbone:input_response";
+function roundOf(value) {
+    return typeof value === "number" && Number.isInteger(value) ? value : 1;
+}
+function inputModeOf(requests) {
+    const modes = new Set(requests.map((entry) => entry.mode).filter((mode) => mode === "form" || mode === "url"));
+    if (modes.size === 2)
+        return "mixed";
+    if (modes.has("form"))
+        return "form";
+    return modes.has("url") ? "url" : "unknown";
+}
+/**
+ * The questions a response's `output` still waits on, in order, by the chat's own rule
+ * (`surface/src/core/chat.ts`, so a link never points at a question the chat would not show): an
+ * `in_progress` request whose id no other-status projection and no `backbone:input_response`
+ * resolved, and only the newest open round of its call. An item without a non-empty `id`,
+ * `call_id`, `server_label` or `name`, or without one request entry that has a `key`, is skipped.
+ */
+export function pendingInputsOf(output) {
+    const items = itemsOf(output);
+    const resolved = new Set();
+    const newestRound = new Map();
+    for (const item of items) {
+        if (item.type === INPUT_REQUEST) {
+            const id = text(item.id);
+            if (id && item.status !== "in_progress")
+                resolved.add(id);
+            const callId = text(item.call_id);
+            if (callId && item.status === "in_progress") {
+                newestRound.set(callId, Math.max(newestRound.get(callId) ?? 0, roundOf(item.round)));
+            }
+        }
+        else if (item.type === INPUT_RESPONSE) {
+            const id = text(item.input_request_id);
+            if (id)
+                resolved.add(id);
+        }
+    }
+    const pending = new Map();
+    for (const item of items) {
+        if (item.type !== INPUT_REQUEST || item.status !== "in_progress")
+            continue;
+        const id = text(item.id);
+        const callId = text(item.call_id);
+        const serverLabel = text(item.server_label);
+        const tool = text(item.name);
+        if (!id || !callId || !serverLabel || !tool || resolved.has(id) || pending.has(id))
+            continue;
+        if (roundOf(item.round) !== newestRound.get(callId))
+            continue;
+        const requests = itemsOf(item.requests).filter((entry) => text(entry.key) !== undefined);
+        if (requests.length === 0)
+            continue;
+        pending.set(id, { id, callId, serverLabel, tool, mode: inputModeOf(requests) });
+    }
+    return [...pending.values()];
+}
+/**
+ * Where the user answers: the chat's slug-less conversation link (`<chat>/c/<id>`, the path
+ * `surface/src/hosts/web/routes.ts` `answerPath` builds), or the chat itself without a conversation.
+ */
+export function answerUrlFor(chatOrigin, conversationId) {
+    return conversationId ? `${chatOrigin}/c/${encodeURIComponent(conversationId)}` : `${chatOrigin}/`;
+}
+/** "erp", "erp and crm", "erp, crm and drive": each connector that asks, once; empty for none. */
+export function inputLabelsPhrase(inputs) {
+    const labels = [...new Set(inputs.map((input) => input.serverLabel))];
+    if (labels.length < 2)
+        return labels[0] ?? "";
+    return `${labels.slice(0, -1).join(", ")} and ${labels[labels.length - 1]}`;
+}
 //# sourceMappingURL=connect-pause.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@2kw/ai",
-  "version": "6.4.0-dev.7",
+  "version": "7.0.0-dev.10",
   "description": "CLI for 2kw.ai — schema-driven document extraction, an OpenAI-compatible EU LLM gateway, transcription, prompts, datasets, and experiments from your terminal or agentic workflows. Ships as 2kw, backbone, and bb.",
   "keywords": [
     "cli",