@agent-native/core 0.111.3 → 0.112.0

package/corpus/templates/brain/server/plugins/db.ts

@@ -183,6 +183,7 @@ const runBrainMigrations = runMigrations(
   priority INTEGER NOT NULL DEFAULT 0,
   attempts INTEGER NOT NULL DEFAULT 0,
   payload_json TEXT NOT NULL DEFAULT '{}',
+  lease_token TEXT,
   error TEXT,
   run_after TEXT,
   created_at TEXT NOT NULL DEFAULT (datetime('now')),
@@ -270,6 +271,209 @@ const runBrainMigrations = runMigrations(
         `CREATE INDEX IF NOT EXISTS brain_ingest_queue_capture_operation_idx ON brain_ingest_queue (capture_id, operation)`,
       ].join(";\n"),
     },
+    {
+      version: 21,
+      name: "brain-privacy-semantic-search-contracts",
+      sql: [
+        `ALTER TABLE brain_raw_captures ADD COLUMN IF NOT EXISTS sensitivity_disposition TEXT NOT NULL DEFAULT 'pending'`,
+        `ALTER TABLE brain_raw_captures ADD COLUMN IF NOT EXISTS sensitivity_policy_version TEXT`,
+        `ALTER TABLE brain_raw_captures ADD COLUMN IF NOT EXISTS audience_acl_hash TEXT`,
+        `ALTER TABLE brain_knowledge ADD COLUMN IF NOT EXISTS audience_id TEXT`,
+        `ALTER TABLE brain_knowledge ADD COLUMN IF NOT EXISTS audience_acl_hash TEXT`,
+        `ALTER TABLE brain_proposals ADD COLUMN IF NOT EXISTS audience_id TEXT`,
+        `ALTER TABLE brain_proposals ADD COLUMN IF NOT EXISTS audience_acl_hash TEXT`,
+        `ALTER TABLE brain_ingest_queue ADD COLUMN IF NOT EXISTS dedupe_key TEXT`,
+        `ALTER TABLE brain_ingest_queue ADD COLUMN IF NOT EXISTS lease_expires_at TEXT`,
+        `CREATE UNIQUE INDEX IF NOT EXISTS brain_ingest_queue_dedupe_idx ON brain_ingest_queue (dedupe_key)`,
+        `CREATE TABLE IF NOT EXISTS brain_audiences (
+  id TEXT PRIMARY KEY,
+  source_id TEXT NOT NULL,
+  kind TEXT NOT NULL,
+  upstream_ref_hash TEXT,
+  acl_hash TEXT NOT NULL,
+  membership_state TEXT NOT NULL DEFAULT 'stale',
+  last_synced_at TEXT,
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+)`,
+        `CREATE TABLE IF NOT EXISTS brain_audience_members (
+  id TEXT PRIMARY KEY,
+  audience_id TEXT NOT NULL,
+  principal_type TEXT NOT NULL,
+  principal_id TEXT NOT NULL,
+  upstream_principal_hash TEXT,
+  status TEXT NOT NULL DEFAULT 'active',
+  synced_at TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+)`,
+        `CREATE UNIQUE INDEX IF NOT EXISTS brain_audience_member_principal_idx ON brain_audience_members (audience_id, principal_type, principal_id)`,
+        `CREATE INDEX IF NOT EXISTS brain_audience_member_lookup_idx ON brain_audience_members (principal_type, principal_id, status)`,
+        `CREATE TABLE IF NOT EXISTS brain_capture_audiences (
+  id TEXT PRIMARY KEY,
+  capture_id TEXT NOT NULL,
+  audience_id TEXT NOT NULL,
+  acl_hash TEXT NOT NULL,
+  created_at TEXT NOT NULL
+)`,
+        `CREATE UNIQUE INDEX IF NOT EXISTS brain_capture_audience_unique_idx ON brain_capture_audiences (capture_id, audience_id)`,
+        `CREATE INDEX IF NOT EXISTS brain_knowledge_audience_status_idx ON brain_knowledge (audience_id, status, updated_at)`,
+        `CREATE INDEX IF NOT EXISTS brain_proposal_audience_status_idx ON brain_proposals (audience_id, status, updated_at)`,
+        `CREATE TABLE IF NOT EXISTS brain_sensitivity_events (
+  id TEXT PRIMARY KEY,
+  source_id TEXT NOT NULL,
+  capture_id TEXT,
+  locator_hmac TEXT NOT NULL,
+  disposition TEXT NOT NULL,
+  categories_json TEXT NOT NULL DEFAULT '[]',
+  confidence_band TEXT NOT NULL,
+  policy_version TEXT NOT NULL,
+  upstream_provider TEXT NOT NULL,
+  quarantine_blob_handle TEXT,
+  expires_at TEXT,
+  reviewed_by TEXT,
+  reviewed_at TEXT,
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+)`,
+        `CREATE UNIQUE INDEX IF NOT EXISTS brain_sensitivity_locator_policy_idx ON brain_sensitivity_events (locator_hmac, policy_version)`,
+        `CREATE INDEX IF NOT EXISTS brain_sensitivity_source_created_idx ON brain_sensitivity_events (source_id, created_at)`,
+        `CREATE TABLE IF NOT EXISTS brain_search_artifacts (
+  id TEXT PRIMARY KEY,
+  capture_id TEXT NOT NULL,
+  source_id TEXT NOT NULL,
+  audience_id TEXT NOT NULL,
+  acl_hash TEXT NOT NULL,
+  title TEXT NOT NULL,
+  question TEXT NOT NULL DEFAULT '',
+  summary TEXT NOT NULL DEFAULT '',
+  resolution TEXT NOT NULL DEFAULT '',
+  systems_json TEXT NOT NULL DEFAULT '[]',
+  code_refs_json TEXT NOT NULL DEFAULT '[]',
+  content_hash TEXT NOT NULL,
+  sensitivity_policy_version TEXT NOT NULL,
+  index_version TEXT NOT NULL,
+  status TEXT NOT NULL DEFAULT 'active',
+  captured_at TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+)`,
+        `CREATE UNIQUE INDEX IF NOT EXISTS brain_search_artifact_version_idx ON brain_search_artifacts (capture_id, content_hash, index_version)`,
+        `CREATE INDEX IF NOT EXISTS brain_search_artifact_audience_idx ON brain_search_artifacts (audience_id, status, updated_at)`,
+        `CREATE TABLE IF NOT EXISTS brain_search_bursts (
+  id TEXT PRIMARY KEY,
+  artifact_id TEXT NOT NULL,
+  capture_id TEXT NOT NULL,
+  source_id TEXT NOT NULL,
+  audience_id TEXT NOT NULL,
+  acl_hash TEXT NOT NULL,
+  ordinal INTEGER NOT NULL,
+  start_offset INTEGER NOT NULL,
+  end_offset INTEGER NOT NULL,
+  content TEXT NOT NULL,
+  contextual_text TEXT NOT NULL,
+  char_count INTEGER NOT NULL,
+  rare_term_score INTEGER NOT NULL DEFAULT 0,
+  reaction_count INTEGER NOT NULL DEFAULT 0,
+  indexed INTEGER NOT NULL DEFAULT 0,
+  content_hash TEXT NOT NULL,
+  index_version TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+)`,
+        `CREATE UNIQUE INDEX IF NOT EXISTS brain_search_burst_version_idx ON brain_search_bursts (capture_id, content_hash, index_version, ordinal)`,
+        `CREATE INDEX IF NOT EXISTS brain_search_burst_audience_idx ON brain_search_bursts (audience_id, indexed, updated_at)`,
+        `CREATE TABLE IF NOT EXISTS brain_search_embeddings (
+  id TEXT PRIMARY KEY,
+  target_type TEXT NOT NULL,
+  target_id TEXT NOT NULL,
+  vector_key TEXT NOT NULL,
+  source_id TEXT NOT NULL,
+  audience_id TEXT NOT NULL,
+  acl_hash TEXT NOT NULL,
+  embedding_set_id TEXT NOT NULL,
+  dimensions INTEGER NOT NULL,
+  content_hash TEXT NOT NULL,
+  sensitivity_policy_version TEXT NOT NULL,
+  index_version TEXT NOT NULL,
+  status TEXT NOT NULL DEFAULT 'active',
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+)`,
+        `CREATE UNIQUE INDEX IF NOT EXISTS brain_search_embedding_target_idx ON brain_search_embeddings (embedding_set_id, target_type, target_id)`,
+        `CREATE INDEX IF NOT EXISTS brain_search_embedding_audience_idx ON brain_search_embeddings (audience_id, status, updated_at)`,
+        `CREATE TABLE IF NOT EXISTS brain_term_stats (
+  term TEXT PRIMARY KEY,
+  document_count INTEGER NOT NULL DEFAULT 0,
+  updated_at TEXT NOT NULL
+)`,
+        `CREATE TABLE IF NOT EXISTS brain_search_corpus_stats (
+  id TEXT PRIMARY KEY,
+  document_count INTEGER NOT NULL DEFAULT 0,
+  updated_at TEXT NOT NULL
+)`,
+        `CREATE TABLE IF NOT EXISTS brain_projects (
+  id TEXT PRIMARY KEY,
+  title TEXT NOT NULL,
+  description TEXT NOT NULL DEFAULT '',
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL,
+  owner_email TEXT NOT NULL DEFAULT 'local@localhost',
+  org_id TEXT,
+  visibility TEXT NOT NULL DEFAULT 'private'
+)`,
+        `CREATE TABLE IF NOT EXISTS brain_project_shares (
+  id TEXT PRIMARY KEY,
+  resource_id TEXT NOT NULL,
+  principal_type TEXT NOT NULL,
+  principal_id TEXT NOT NULL,
+  role TEXT NOT NULL DEFAULT 'viewer',
+  created_by TEXT NOT NULL,
+  created_at TEXT NOT NULL
+)`,
+        `CREATE TABLE IF NOT EXISTS brain_project_sources (
+  id TEXT PRIMARY KEY,
+  project_id TEXT NOT NULL,
+  source_id TEXT NOT NULL,
+  created_at TEXT NOT NULL
+)`,
+        `CREATE UNIQUE INDEX IF NOT EXISTS brain_project_source_unique_idx ON brain_project_sources (project_id, source_id)`,
+        `CREATE INDEX IF NOT EXISTS brain_project_shares_principal_idx ON brain_project_shares (resource_id, principal_type, principal_id)`,
+      ].join(";\n"),
+    },
+    {
+      version: 22,
+      name: "brain-ingest-queue-lease-token",
+      sql: `ALTER TABLE brain_ingest_queue ADD COLUMN IF NOT EXISTS lease_token TEXT`,
+    },
+    {
+      version: 23,
+      name: "brain-audience-dependencies",
+      sql: [
+        `CREATE TABLE IF NOT EXISTS brain_audience_dependencies (
+  id TEXT PRIMARY KEY,
+  audience_id TEXT NOT NULL,
+  depends_on_audience_id TEXT NOT NULL,
+  created_at TEXT NOT NULL
+)`,
+        `CREATE UNIQUE INDEX IF NOT EXISTS brain_audience_dependency_unique_idx ON brain_audience_dependencies (audience_id, depends_on_audience_id)`,
+        `CREATE INDEX IF NOT EXISTS brain_audience_dependency_upstream_idx ON brain_audience_dependencies (depends_on_audience_id, audience_id)`,
+      ].join(";\n"),
+    },
+    {
+      version: 24,
+      name: "brain-audience-source-dependencies",
+      sql: [
+        `CREATE TABLE IF NOT EXISTS brain_audience_source_dependencies (
+  id TEXT PRIMARY KEY,
+  audience_id TEXT NOT NULL,
+  source_id TEXT NOT NULL,
+  created_at TEXT NOT NULL
+)`,
+        `CREATE UNIQUE INDEX IF NOT EXISTS brain_audience_source_dependency_unique_idx ON brain_audience_source_dependencies (audience_id, source_id)`,
+        `CREATE INDEX IF NOT EXISTS brain_audience_source_dependency_source_idx ON brain_audience_source_dependencies (source_id, audience_id)`,
+      ].join(";\n"),
+    },
   ],
   { table: "brain_migrations" },
 );

package/corpus/templates/brain/server/register-secrets.ts

@@ -1,5 +1,7 @@
 import { registerRequiredSecret } from "@agent-native/core/secrets";
 
+import "./onboarding.js";
+
 registerRequiredSecret({
   key: "SLACK_BOT_TOKEN",
   label: "Slack Bot Token (local fallback)",
@@ -11,6 +13,17 @@ registerRequiredSecret({
   required: false,
 });
 
+registerRequiredSecret({
+  key: "SLACK_SIGNING_SECRET",
+  label: "Slack Signing Secret",
+  description:
+    "Optional for Slack Events API delivery. Brain verifies signed events before refreshing an allow-listed channel thread.",
+  docsUrl: "https://api.slack.com/authentication/verifying-requests-from-slack",
+  scope: "workspace",
+  kind: "api-key",
+  required: false,
+});
+
 registerRequiredSecret({
   key: "GRANOLA_API_KEY",
   label: "Granola Enterprise API Key",
@@ -34,3 +47,36 @@ registerRequiredSecret({
   kind: "api-key",
   required: false,
 });
+
+registerRequiredSecret({
+  key: "GEMINI_API_KEY",
+  label: "Gemini API Key",
+  description:
+    "Optional shared embedding provider for Brain semantic retrieval. Lexical search remains available without it.",
+  docsUrl: "https://aistudio.google.com/apikey",
+  scope: "workspace",
+  kind: "api-key",
+  required: false,
+});
+
+registerRequiredSecret({
+  key: "COHERE_API_KEY",
+  label: "Cohere API Key",
+  description:
+    "Optional shared embedding provider for Brain semantic retrieval. Lexical search remains available without it.",
+  docsUrl: "https://dashboard.cohere.com/api-keys",
+  scope: "workspace",
+  kind: "api-key",
+  required: false,
+});
+
+registerRequiredSecret({
+  key: "VOYAGE_API_KEY",
+  label: "Voyage API Key",
+  description:
+    "Optional shared embedding provider for Brain semantic retrieval. Lexical search remains available without it.",
+  docsUrl: "https://dashboard.voyageai.com/api-keys",
+  scope: "workspace",
+  kind: "api-key",
+  required: false,
+});

package/corpus/templates/brain/server/routes/api/_agent-native/brain/ingest.post.ts

@@ -8,6 +8,7 @@ import { z } from "zod";
 
 import { getDb, schema } from "../../../../db/index.js";
 import {
+  BrainCaptureBlockedError,
   createCapture,
   parseJson,
   serializeCapture,
@@ -110,22 +111,41 @@ export default defineEventHandler(async (event) => {
       orgId: source.orgId ?? undefined,
     },
     async () => {
-      const capture = await createCapture({
-        sourceId: source.id,
-        externalId: payload.externalId,
-        title: payload.title,
-        kind: "transcript",
-        content: textFromPayload(payload),
-        capturedAt: payload.occurredAt,
-        metadata: {
-          sourceKey: payload.sourceKey,
-          participants: payload.participants,
-          segments: payload.segments ?? [],
-          sourceUrl: payload.sourceUrl,
-          tags: payload.tags,
-          raw: payload.raw,
-        },
-      });
+      let capture;
+      try {
+        capture = await createCapture({
+          sourceId: source.id,
+          externalId: payload.externalId,
+          title: payload.title,
+          kind: "transcript",
+          content: textFromPayload(payload),
+          capturedAt: payload.occurredAt,
+          metadata: {
+            sourceKey: payload.sourceKey,
+            participants: payload.participants,
+            segments: payload.segments ?? [],
+            sourceUrl: payload.sourceUrl,
+            tags: payload.tags,
+            raw: payload.raw,
+          },
+          audience: {
+            kind: "meeting",
+            memberEmails: payload.participants.filter(
+              (participant): participant is string =>
+                typeof participant === "string",
+            ),
+            upstreamRefHash: payload.externalId,
+          },
+        });
+      } catch (error) {
+        if (!(error instanceof BrainCaptureBlockedError)) throw error;
+        return {
+          ok: true,
+          sourceId: source.id,
+          capture: null,
+          sensitivityReceipt: error.receipt,
+        };
+      }
 
       return {
         ok: true,

package/corpus/templates/brain/server/routes/api/_agent-native/brain/slack-events.post.ts

@@ -0,0 +1,28 @@
+import {
+  defineEventHandler,
+  getHeader,
+  readRawBody,
+  setResponseStatus,
+} from "h3";
+
+import { enqueueSlackThreadRefreshFromEvent } from "../../../../lib/slack-events.js";
+
+export default defineEventHandler(async (event) => {
+  const rawBody = (await readRawBody(event)) ?? "";
+  const result = await enqueueSlackThreadRefreshFromEvent({
+    rawBody,
+    timestamp: getHeader(event, "x-slack-request-timestamp"),
+    signature: getHeader(event, "x-slack-signature"),
+  });
+
+  if (result.status === "invalid") {
+    setResponseStatus(event, 401);
+    return { ok: false, error: "invalid Slack signature or payload" };
+  }
+  if (result.status === "missing-signing-secret") {
+    setResponseStatus(event, 503);
+    return { ok: false, error: "Slack signing secret is not configured" };
+  }
+  if (result.challenge) return result.challenge;
+  return { ok: true };
+});

package/corpus/templates/brain/shared/types.ts

@@ -62,6 +62,11 @@ export interface BrainSettings {
   captureSanitizationEnabled?: boolean;
   captureSanitizationModel?: string;
   captureSanitizationInstructions?: string;
+  privacyClassifierModel?: string;
+  privacyClassifierEngine?: string;
+  sensitivityCustomInstructions?: string;
+  publicChannelExclusionPatterns?: string[];
+  quarantineRetentionHours?: number;
   connectorPollMinutes: number;
   requireCitations?: boolean;
   autoArchiveResolved?: boolean;
@@ -82,6 +87,11 @@ export const DEFAULT_BRAIN_SETTINGS: BrainSettings = {
   captureSanitizationModel: "",
   captureSanitizationInstructions:
     "Keep durable company-relevant information and remove personal, recruiting, hiring, candidate-evaluation, sensitive, or casual content before storage.",
+  privacyClassifierModel: "",
+  privacyClassifierEngine: "",
+  sensitivityCustomInstructions: "",
+  publicChannelExclusionPatterns: [],
+  quarantineRetentionHours: 72,
   connectorPollMinutes: 60,
   requireCitations: true,
   autoArchiveResolved: true,

package/dist/cli/code-agent-executor.d.ts

@@ -15,6 +15,10 @@ export interface ExecuteCodeAgentRunOptions {
     stdout?: NodeJS.WritableStream;
     signal?: AbortSignal;
 }
+interface CodeAgentApprovalExecutionOptions {
+    stdout?: NodeJS.WritableStream;
+    signal?: AbortSignal;
+}
 export declare function executeCodeAgentRun(options: ExecuteCodeAgentRunOptions): Promise<CodeAgentRunRecord | null>;
 export declare function codeAgentMcpInvocationPolicy(permissionMode: CodeAgentPermissionMode): McpToolInvocationPolicy;
 export declare function executeExistingCodeAgentRun(runId: string, options?: Omit<ExecuteCodeAgentRunOptions, "runId">): Promise<CodeAgentRunRecord | null>;
@@ -23,20 +27,14 @@ export declare function executeExistingCodeAgentRun(runId: string, options?: Omi
  * and auto-resume.  Future occurrences of this exact command will bypass the
  * approval gate without prompting.
  */
-export declare function executeApproveAlwaysCodeAgentApproval(runId: string, options?: {
-    stdout?: NodeJS.WritableStream;
-}): Promise<CodeAgentRunRecord | null>;
-export declare function executePendingCodeAgentApproval(runId: string, options?: {
-    stdout?: NodeJS.WritableStream;
-}): Promise<CodeAgentRunRecord | null>;
+export declare function executeApproveAlwaysCodeAgentApproval(runId: string, options?: CodeAgentApprovalExecutionOptions): Promise<CodeAgentRunRecord | null>;
+export declare function executePendingCodeAgentApproval(runId: string, options?: CodeAgentApprovalExecutionOptions): Promise<CodeAgentRunRecord | null>;
 /**
  * Deny a pending approval: record the denial, feed it back to the model as a
  * "command denied by user" result, and immediately resume the run so the model
  * can adapt its plan without leaving the run dangling.
  */
-export declare function executeDenyCodeAgentApproval(runId: string, options?: {
-    stdout?: NodeJS.WritableStream;
-}): Promise<CodeAgentRunRecord | null>;
+export declare function executeDenyCodeAgentApproval(runId: string, options?: CodeAgentApprovalExecutionOptions): Promise<CodeAgentRunRecord | null>;
 /**
  * Reconstruct a sequence of EngineMessage objects from transcript events,
  * preserving the native tool-call / tool-result pair structure that models
@@ -86,4 +84,5 @@ export type CodeAgentCommandPermission = {
 };
 export declare function classifyCodeAgentCommandPermission(command: string): CodeAgentCommandPermission;
 export declare function writeCodeAgentUsageSnapshot(cwd: string, usage: AgentLoopUsage | null): void;
+export {};
 //# sourceMappingURL=code-agent-executor.d.ts.map

package/dist/cli/code-agent-executor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"code-agent-executor.d.ts","sourceRoot":"","sources":["../../src/cli/code-agent-executor.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EACV,WAAW,EAEX,aAAa,EAEd,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAIL,KAAK,cAAc,EACpB,MAAM,8BAA8B,CAAC;AAMtC,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,sCAAsC,CAAC;AAS9C,OAAO,EAIL,KAAK,uBAAuB,EAC7B,MAAM,wBAAwB,CAAC;AAMhC,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAQL,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACxB,MAAM,sBAAsB,CAAC;AAE9B,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,WAAW,CAAC,EAAE,qBAAqB,EAAE,CAAC;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IAC/B,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AA0CD,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,0BAA0B,GAClC,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CA4apC;AAED,wBAAgB,4BAA4B,CAC1C,cAAc,EAAE,uBAAuB,GACtC,uBAAuB,CAIzB;AA8RD,wBAAsB,2BAA2B,CAC/C,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,IAAI,CAAC,0BAA0B,EAAE,OAAO,CAAM,GACtD,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAEpC;AAED;;;;GAIG;AACH,wBAAsB,qCAAqC,CACzD,KAAK,EAAE,MAAM,EACb,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC,cAAc,CAAA;CAAO,GAC/C,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAYpC;AAED,wBAAsB,+BAA+B,CACnD,KAAK,EAAE,MAAM,EACb,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC,cAAc,CAAA;CAAO,GAC/C,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CA4FpC;AAED;;;;GAIG;AACH,wBAAsB,4BAA4B,CAChD,KAAK,EAAE,MAAM,EACb,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC,cAAc,CAAA;CAAO,GAC/C,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CA0CpC;AAyTD;;;;;;;;;;;;;;;;;GAiBG;AACH,wCAAwC;AACxC,wBAAgB,iCAAiC,CAC/C,MAAM,EAAE,SAAS,OAAO,sBAAsB,EAAE,wBAAwB,EAAE,GACzE,aAAa,EAAE,CAmHjB;AAmED;;;;;;;;;GASG;AACH,wCAAwC;AACxC,wBAAsB,0BAA0B,CAC9C,GAAG,EAAE,MAAM,EACX,cAAc,EAAE,uBAAuB,GACtC,OAAO,CAAC,MAAM,CAAC,CA4BjB;AAED,wCAAwC;AACxC,wBAAgB,0BAA0B,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAc1E;AAED,wCAAwC;AACxC,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,MAAM,EACX,cAAc,EAAE,uBAAuB,EACvC,qBAAqB,SAAK,EAC1B,WAAW,SAAK,GACf,MAAM,CA4DR;AAuFD,MAAM,MAAM,0BAA0B,GAClC;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAChB;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,GACjB;IAAE,IAAI,EAAE,mBAAmB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC7C;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1C,wBAAgB,kCAAkC,CAChD,OAAO,EAAE,MAAM,GACd,0BAA0B,CAuD5B;AA0FD,wBAAgB,2BAA2B,CACzC,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,cAAc,GAAG,IAAI,GAC3B,IAAI,CAgBN"}
+{"version":3,"file":"code-agent-executor.d.ts","sourceRoot":"","sources":["../../src/cli/code-agent-executor.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EACV,WAAW,EAEX,aAAa,EAEd,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAIL,KAAK,cAAc,EACpB,MAAM,8BAA8B,CAAC;AAMtC,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,sCAAsC,CAAC;AAS9C,OAAO,EAIL,KAAK,uBAAuB,EAC7B,MAAM,wBAAwB,CAAC;AAMhC,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAQL,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACxB,MAAM,sBAAsB,CAAC;AAE9B,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,WAAW,CAAC,EAAE,qBAAqB,EAAE,CAAC;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IAC/B,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAWD,UAAU,iCAAiC;IACzC,MAAM,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IAC/B,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAiCD,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,0BAA0B,GAClC,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CA4apC;AAED,wBAAgB,4BAA4B,CAC1C,cAAc,EAAE,uBAAuB,GACtC,uBAAuB,CAIzB;AA8RD,wBAAsB,2BAA2B,CAC/C,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,IAAI,CAAC,0BAA0B,EAAE,OAAO,CAAM,GACtD,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAEpC;AAED;;;;GAIG;AACH,wBAAsB,qCAAqC,CACzD,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,iCAAsC,GAC9C,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAYpC;AAED,wBAAsB,+BAA+B,CACnD,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,iCAAsC,GAC9C,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAgGpC;AAED;;;;GAIG;AACH,wBAAsB,4BAA4B,CAChD,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,iCAAsC,GAC9C,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CA6CpC;AAyTD;;;;;;;;;;;;;;;;;GAiBG;AACH,wCAAwC;AACxC,wBAAgB,iCAAiC,CAC/C,MAAM,EAAE,SAAS,OAAO,sBAAsB,EAAE,wBAAwB,EAAE,GACzE,aAAa,EAAE,CAmHjB;AAmED;;;;;;;;;GASG;AACH,wCAAwC;AACxC,wBAAsB,0BAA0B,CAC9C,GAAG,EAAE,MAAM,EACX,cAAc,EAAE,uBAAuB,GACtC,OAAO,CAAC,MAAM,CAAC,CA4BjB;AAED,wCAAwC;AACxC,wBAAgB,0BAA0B,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAc1E;AAED,wCAAwC;AACxC,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,MAAM,EACX,cAAc,EAAE,uBAAuB,EACvC,qBAAqB,SAAK,EAC1B,WAAW,SAAK,GACf,MAAM,CA4DR;AAuFD,MAAM,MAAM,0BAA0B,GAClC;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAChB;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,GACjB;IAAE,IAAI,EAAE,mBAAmB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC7C;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1C,wBAAgB,kCAAkC,CAChD,OAAO,EAAE,MAAM,GACd,0BAA0B,CAuD5B;AA0FD,wBAAgB,2BAA2B,CACzC,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,cAAc,GAAG,IAAI,GAC3B,IAAI,CAgBN"}

package/dist/cli/code-agent-executor.js

@@ -729,7 +729,7 @@ export async function executePendingCodeAgentApproval(runId, options = {}) {
             command: approval.command,
         },
     });
-    const result = await runCodingCommand(approval.command, record.cwd || process.cwd(), DEFAULT_COMMAND_TIMEOUT_MS);
+    const result = await runCodingCommand(approval.command, record.cwd || process.cwd(), DEFAULT_COMMAND_TIMEOUT_MS, { signal: options.signal });
     const summary = truncateCodingOutput([
         `Approved command finished with exit code ${result.code}.`,
         result.timedOut ? "Timed out: true" : "",
@@ -772,7 +772,10 @@ export async function executePendingCodeAgentApproval(runId, options = {}) {
         message: "Resuming run after approval.",
         metadata: { status: "running", phase: "approval-resuming" },
     });
-    return executeExistingCodeAgentRun(runId, { stdout: options.stdout });
+    return executeExistingCodeAgentRun(runId, {
+        stdout: options.stdout,
+        signal: options.signal,
+    });
 }
 /**
  * Deny a pending approval: record the denial, feed it back to the model as a
@@ -820,7 +823,10 @@ export async function executeDenyCodeAgentApproval(runId, options = {}) {
         message: "Resuming run after denial — model will adapt its plan.",
         metadata: { status: "running", phase: "approval-denied-resuming" },
     });
-    return executeExistingCodeAgentRun(runId, { stdout: options.stdout });
+    return executeExistingCodeAgentRun(runId, {
+        stdout: options.stdout,
+        signal: options.signal,
+    });
 }
 function latestUserPrompt(runId) {
     const events = listCodeAgentTranscriptEvents(runId);