@av-pi-studio/server 0.0.1

package/dist/agent/manifest.js

@@ -0,0 +1,27 @@
+import { MOCK_CAPABILITIES } from "./providers/mock/mock-provider.js";
+import { PI_CAPABILITIES } from "./providers/pi/agent.js";
+/**
+ * Provider manifest (features/agent-providers.md § Registration surface). UI scaffolding only —
+ * actual models/modes/features are discovered at runtime. Modes carry an `icon` + `colorTier`.
+ */
+export const PROVIDER_MANIFEST = {
+    pi: {
+        id: "pi",
+        label: "Pi",
+        description: "The Pi coding agent (pi --mode rpc)",
+        capabilities: PI_CAPABILITIES,
+        modes: [
+            { id: "plan", label: "Plan", icon: "Compass", colorTier: "planning" },
+            { id: "default", label: "Default", icon: "Bot", colorTier: "moderate" },
+            { id: "full-access", label: "Full access", icon: "ShieldAlert", colorTier: "dangerous" },
+        ],
+    },
+    mock: {
+        id: "mock",
+        label: "Mock",
+        description: "In-process test provider (dev/test only)",
+        capabilities: MOCK_CAPABILITIES,
+        modes: [{ id: "default", label: "Default", icon: "Bot", colorTier: "safe" }],
+    },
+};
+//# sourceMappingURL=manifest.js.map

package/dist/agent/manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../../src/agent/manifest.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE1D;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAuC;IACnE,EAAE,EAAE;QACF,EAAE,EAAE,IAAI;QACR,KAAK,EAAE,IAAI;QACX,WAAW,EAAE,qCAAqC;QAClD,YAAY,EAAE,eAAe;QAC7B,KAAK,EAAE;YACL,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE;YACrE,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE;YACvE,EAAE,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE;SACzF;KACF;IACD,IAAI,EAAE;QACJ,EAAE,EAAE,MAAM;QACV,KAAK,EAAE,MAAM;QACb,WAAW,EAAE,0CAA0C;QACvD,YAAY,EAAE,iBAAiB;QAC/B,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;KAC7E;CACF,CAAC"}

package/dist/agent/mcp-server.d.ts

@@ -0,0 +1,100 @@
+import { z } from "zod";
+/**
+ * Daemon MCP server (features/mcp-server.md). Hosts orchestration tools at `/mcp/agents` so agents
+ * can control other agents + the daemon. The tool set mirrors the WS/CLI control plane. When
+ * `daemon.mcp.injectIntoAgents` is enabled, a per-agent `--mcp-config` is generated for Pi (adapter
+ * OAuth disabled); user/project MCP files are never touched.
+ *
+ * The transport (HTTP server) is wired in bootstrap; this module owns the tool registry, the
+ * `create_agent` semantics, and the injection-config generation, all injectable for tests.
+ */
+export declare const MCP_ENDPOINT_PATH = "/mcp/agents";
+export declare const MCP_SERVER_KEY = "pi-studio-agents";
+export interface McpToolResult {
+    ok: boolean;
+    [key: string]: unknown;
+}
+export interface McpToolContext {
+    /** The agent invoking the tool (the "parent"), when the call originates inside an agent. */
+    callerAgentId?: string;
+}
+export type McpToolHandler<A> = (args: A, ctx: McpToolContext) => Promise<McpToolResult> | McpToolResult;
+/** Backend the orchestration tools route to (AgentManager / permission / provider services). */
+export interface McpBackend {
+    /** Create an async child agent. Returns its id. */
+    createAgent(input: {
+        config: Record<string, unknown>;
+        labels: Record<string, string>;
+        initialPrompt?: string;
+        notifyOnFinish: boolean;
+        autoArchive?: boolean;
+    }): Promise<{
+        agentId: string;
+    }>;
+    updateAgent?(agentId: string, patch: Record<string, unknown>): Promise<void>;
+    sendPrompt(agentId: string, prompt: string): Promise<void>;
+    getStatus(agentId: string): {
+        status: string;
+        title?: string;
+    } | undefined;
+    getActivity?(agentId: string): unknown;
+    listAgents(): Array<{
+        agentId: string;
+        status: string;
+        title?: string;
+    }>;
+    setMode?(agentId: string, modeId: string): Promise<void>;
+    /** Resolve when the agent reaches a terminal turn; resolve early/late is the backend's concern. */
+    waitForAgent(agentId: string, timeoutMs: number): Promise<{
+        status: string;
+        timedOut: boolean;
+    }>;
+    cancelAgent?(agentId: string): Promise<void>;
+    killAgent?(agentId: string): Promise<void>;
+    archiveAgent(agentId: string): Promise<void>;
+    listPendingPermissions(agentId?: string): Array<{
+        requestId: string;
+        agentId: string;
+        toolName?: string;
+    }>;
+    respondToPermission(requestId: string, response: unknown): {
+        resolved: boolean;
+    };
+    listProviders(): unknown;
+    inspectProvider?(providerId: string): unknown;
+    listModels(providerId: string): unknown;
+}
+export interface McpServerDeps {
+    backend: McpBackend;
+    /** Whether the MCP server is enabled (`daemon.mcp.enabled`/present). */
+    enabled: boolean;
+    /** Whether to inject the server into agents (`daemon.mcp.injectIntoAgents`). */
+    injectIntoAgents: boolean;
+    /** Daemon home; per-agent mcp configs live under `<home>/mcp/`. */
+    home: string;
+    /** Base URL of the local endpoint (host:port). */
+    baseUrl?: string;
+    defaultWaitTimeoutMs?: number;
+}
+export declare class McpServer {
+    private readonly deps;
+    private readonly tools;
+    private readonly defaultWaitTimeoutMs;
+    constructor(deps: McpServerDeps);
+    get enabled(): boolean;
+    /** Tool names currently exposed (empty when disabled). */
+    toolNames(): string[];
+    /** Register an extension tool (schedule/chat/loop/terminal/worktree tasks attach theirs here). */
+    registerTool<A>(name: string, schema: z.ZodType<A>, handler: McpToolHandler<A>): void;
+    /** Validate args + dispatch a tool call. */
+    callTool(name: string, rawArgs: unknown, ctx?: McpToolContext): Promise<McpToolResult>;
+    /** The `--mcp-config` object injected into Pi for a per-agent local server (OAuth disabled). */
+    injectionConfig(): Record<string, unknown> | null;
+    /**
+     * Write a per-agent `--mcp-config` under `<home>/mcp/agent-<id>.json` (never user/project files).
+     * Returns the path, or null when injection is disabled.
+     */
+    writeInjectionConfig(agentId: string): Promise<string | null>;
+    private registerCoreTools;
+}
+//# sourceMappingURL=mcp-server.d.ts.map

package/dist/agent/mcp-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-server.d.ts","sourceRoot":"","sources":["../../src/agent/mcp-server.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB;;;;;;;;GAQG;AAEH,eAAO,MAAM,iBAAiB,gBAAgB,CAAC;AAC/C,eAAO,MAAM,cAAc,qBAAqB,CAAC;AAEjD,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,OAAO,CAAC;IACZ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,cAAc;IAC7B,4FAA4F;IAC5F,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,MAAM,cAAc,CAAC,CAAC,IAAI,CAC9B,IAAI,EAAE,CAAC,EACP,GAAG,EAAE,cAAc,KAChB,OAAO,CAAC,aAAa,CAAC,GAAG,aAAa,CAAC;AAO5C,gGAAgG;AAChG,MAAM,WAAW,UAAU;IACzB,mDAAmD;IACnD,WAAW,CAAC,KAAK,EAAE;QACjB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAChC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC/B,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,cAAc,EAAE,OAAO,CAAC;QACxB,WAAW,CAAC,EAAE,OAAO,CAAC;KACvB,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjC,WAAW,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7E,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;IAC3E,WAAW,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;IACvC,UAAU,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACzE,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,mGAAmG;IACnG,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACjG,WAAW,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,SAAS,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,sBAAsB,CACpB,OAAO,CAAC,EAAE,MAAM,GACf,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpE,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAG;QAAE,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC;IACjF,aAAa,IAAI,OAAO,CAAC;IACzB,eAAe,CAAC,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;IAC9C,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;CACzC;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,UAAU,CAAC;IACpB,wEAAwE;IACxE,OAAO,EAAE,OAAO,CAAC;IACjB,gFAAgF;IAChF,gBAAgB,EAAE,OAAO,CAAC;IAC1B,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAC;IACb,kDAAkD;IAClD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,qBAAa,SAAS;IAIR,OAAO,CAAC,QAAQ,CAAC,IAAI;IAHjC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqC;IAC3D,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAS;gBAEjB,IAAI,EAAE,aAAa;IAKhD,IAAI,OAAO,IAAI,OAAO,CAErB;IAED,0DAA0D;IAC1D,SAAS,IAAI,MAAM,EAAE;IAIrB,kGAAkG;IAClG,YAAY,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,GAAG,IAAI;IAKrF,4CAA4C;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,GAAE,cAAmB,GAAG,OAAO,CAAC,aAAa,CAAC;IAWhG,gGAAgG;IAChG,eAAe,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IAUjD;;;OAGG;IACG,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAYnE,OAAO,CAAC,iBAAiB;CAiI1B"}

package/dist/agent/mcp-server.js

@@ -0,0 +1,163 @@
+import { mkdir, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { z } from "zod";
+import { PARENT_AGENT_ID_LABEL } from "./agent-manager.js";
+/**
+ * Daemon MCP server (features/mcp-server.md). Hosts orchestration tools at `/mcp/agents` so agents
+ * can control other agents + the daemon. The tool set mirrors the WS/CLI control plane. When
+ * `daemon.mcp.injectIntoAgents` is enabled, a per-agent `--mcp-config` is generated for Pi (adapter
+ * OAuth disabled); user/project MCP files are never touched.
+ *
+ * The transport (HTTP server) is wired in bootstrap; this module owns the tool registry, the
+ * `create_agent` semantics, and the injection-config generation, all injectable for tests.
+ */
+export const MCP_ENDPOINT_PATH = "/mcp/agents";
+export const MCP_SERVER_KEY = "pi-studio-agents";
+export class McpServer {
+    deps;
+    tools = new Map();
+    defaultWaitTimeoutMs;
+    constructor(deps) {
+        this.deps = deps;
+        this.defaultWaitTimeoutMs = deps.defaultWaitTimeoutMs ?? 5 * 60_000;
+        if (deps.enabled)
+            this.registerCoreTools();
+    }
+    get enabled() {
+        return this.deps.enabled;
+    }
+    /** Tool names currently exposed (empty when disabled). */
+    toolNames() {
+        return [...this.tools.keys()].toSorted();
+    }
+    /** Register an extension tool (schedule/chat/loop/terminal/worktree tasks attach theirs here). */
+    registerTool(name, schema, handler) {
+        if (!this.deps.enabled)
+            return;
+        this.tools.set(name, { schema, handler: handler });
+    }
+    /** Validate args + dispatch a tool call. */
+    async callTool(name, rawArgs, ctx = {}) {
+        if (!this.deps.enabled)
+            return { ok: false, error: "mcp_disabled" };
+        const tool = this.tools.get(name);
+        if (!tool)
+            return { ok: false, error: `unknown_tool:${name}` };
+        const parsed = tool.schema.safeParse(rawArgs ?? {});
+        if (!parsed.success)
+            return { ok: false, error: "invalid_args", issues: parsed.error.issues };
+        return tool.handler(parsed.data, ctx);
+    }
+    // ─── Injection ─────────────────────────────────────────────────────────────
+    /** The `--mcp-config` object injected into Pi for a per-agent local server (OAuth disabled). */
+    injectionConfig() {
+        if (!this.deps.enabled || !this.deps.injectIntoAgents)
+            return null;
+        const url = `${this.deps.baseUrl ?? "http://127.0.0.1:0"}${MCP_ENDPOINT_PATH}`;
+        return {
+            mcpServers: {
+                [MCP_SERVER_KEY]: { type: "http", url, auth: false, oauth: false },
+            },
+        };
+    }
+    /**
+     * Write a per-agent `--mcp-config` under `<home>/mcp/agent-<id>.json` (never user/project files).
+     * Returns the path, or null when injection is disabled.
+     */
+    async writeInjectionConfig(agentId) {
+        const config = this.injectionConfig();
+        if (!config)
+            return null;
+        const dir = join(this.deps.home, "mcp");
+        await mkdir(dir, { recursive: true });
+        const path = join(dir, `agent-${agentId}.json`);
+        await writeFile(path, JSON.stringify(config, null, 2));
+        return path;
+    }
+    // ─── Core tools ──────────────────────────────────────────────────────────────
+    registerCoreTools() {
+        const b = this.deps.backend;
+        // create_agent — always async (agent-scoped); parent label unless detached; notifyOnFinish=true.
+        this.registerTool("create_agent", z.object({
+            config: z.record(z.unknown()).default({}),
+            prompt: z.string().optional(),
+            detached: z.boolean().optional(),
+            notifyOnFinish: z.boolean().optional(),
+            autoArchive: z.boolean().optional(),
+            labels: z.record(z.string()).optional(),
+        }), async (args, ctx) => {
+            const labels = { ...args.labels };
+            if (!args.detached && ctx.callerAgentId) {
+                labels[PARENT_AGENT_ID_LABEL] = ctx.callerAgentId;
+            }
+            const { agentId } = await b.createAgent({
+                config: args.config ?? {},
+                labels,
+                initialPrompt: args.prompt,
+                notifyOnFinish: args.notifyOnFinish ?? true,
+                autoArchive: args.autoArchive,
+            });
+            return { ok: true, agentId, detached: Boolean(args.detached) };
+        });
+        this.registerTool("wait_for_agent", z.object({ agentId: z.string(), timeoutMs: z.number().int().positive().optional() }), async (args) => {
+            const result = await b.waitForAgent(args.agentId, args.timeoutMs ?? this.defaultWaitTimeoutMs);
+            return { ok: true, ...result };
+        });
+        this.registerTool("send_agent_prompt", z.object({ agentId: z.string(), prompt: z.string() }), async (args) => {
+            await b.sendPrompt(args.agentId, args.prompt);
+            return { ok: true };
+        });
+        this.registerTool("get_agent_status", z.object({ agentId: z.string() }), (args) => {
+            const status = b.getStatus(args.agentId);
+            return status ? { ok: true, ...status } : { ok: false, error: "unknown_agent" };
+        });
+        this.registerTool("get_agent_activity", z.object({ agentId: z.string() }), (args) => ({
+            ok: true,
+            activity: b.getActivity?.(args.agentId) ?? null,
+        }));
+        this.registerTool("list_agents", z.object({}).passthrough(), () => ({
+            ok: true,
+            agents: b.listAgents(),
+        }));
+        this.registerTool("update_agent", z.object({ agentId: z.string(), patch: z.record(z.unknown()).default({}) }), async (args) => {
+            await b.updateAgent?.(args.agentId, args.patch ?? {});
+            return { ok: true };
+        });
+        this.registerTool("set_agent_mode", z.object({ agentId: z.string(), modeId: z.string() }), async (args) => {
+            await b.setMode?.(args.agentId, args.modeId);
+            return { ok: true };
+        });
+        this.registerTool("cancel_agent", z.object({ agentId: z.string() }), async (args) => {
+            await b.cancelAgent?.(args.agentId);
+            return { ok: true };
+        });
+        this.registerTool("kill_agent", z.object({ agentId: z.string() }), async (args) => {
+            await b.killAgent?.(args.agentId);
+            return { ok: true };
+        });
+        this.registerTool("archive_agent", z.object({ agentId: z.string() }), async (args) => {
+            await b.archiveAgent(args.agentId);
+            return { ok: true };
+        });
+        // Permissions.
+        this.registerTool("list_pending_permissions", z.object({ agentId: z.string().optional() }), (args) => ({ ok: true, permissions: b.listPendingPermissions(args.agentId) }));
+        this.registerTool("respond_to_permission", z.object({ requestId: z.string(), response: z.unknown() }), (args) => {
+            const result = b.respondToPermission(args.requestId, args.response);
+            return result.resolved ? { ok: true } : { ok: false, error: "unknown_permission" };
+        });
+        // Providers / models.
+        this.registerTool("list_providers", z.object({}).passthrough(), () => ({
+            ok: true,
+            providers: b.listProviders(),
+        }));
+        this.registerTool("inspect_provider", z.object({ providerId: z.string() }), (args) => ({
+            ok: true,
+            provider: b.inspectProvider?.(args.providerId) ?? null,
+        }));
+        this.registerTool("list_models", z.object({ providerId: z.string() }), (args) => ({
+            ok: true,
+            models: b.listModels(args.providerId),
+        }));
+    }
+}
+//# sourceMappingURL=mcp-server.js.map

package/dist/agent/mcp-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-server.js","sourceRoot":"","sources":["../../src/agent/mcp-server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE3D;;;;;;;;GAQG;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,aAAa,CAAC;AAC/C,MAAM,CAAC,MAAM,cAAc,GAAG,kBAAkB,CAAC;AAiEjD,MAAM,OAAO,SAAS;IAIS;IAHZ,KAAK,GAAG,IAAI,GAAG,EAA0B,CAAC;IAC1C,oBAAoB,CAAS;IAE9C,YAA6B,IAAmB;QAAnB,SAAI,GAAJ,IAAI,CAAe;QAC9C,IAAI,CAAC,oBAAoB,GAAG,IAAI,CAAC,oBAAoB,IAAI,CAAC,GAAG,MAAM,CAAC;QACpE,IAAI,IAAI,CAAC,OAAO;YAAE,IAAI,CAAC,iBAAiB,EAAE,CAAC;IAC7C,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;IAC3B,CAAC;IAED,0DAA0D;IAC1D,SAAS;QACP,OAAO,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC3C,CAAC;IAED,kGAAkG;IAClG,YAAY,CAAI,IAAY,EAAE,MAAoB,EAAE,OAA0B;QAC5E,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAC/B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAkC,EAAE,CAAC,CAAC;IAChF,CAAC;IAED,4CAA4C;IAC5C,KAAK,CAAC,QAAQ,CAAC,IAAY,EAAE,OAAgB,EAAE,MAAsB,EAAE;QACrE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;QACpE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,IAAI,EAAE,EAAE,CAAC;QAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAC9F,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACxC,CAAC;IAED,8EAA8E;IAE9E,gGAAgG;IAChG,eAAe;QACb,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB;YAAE,OAAO,IAAI,CAAC;QACnE,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,oBAAoB,GAAG,iBAAiB,EAAE,CAAC;QAC/E,OAAO;YACL,UAAU,EAAE;gBACV,CAAC,cAAc,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE;aACnE;SACF,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,oBAAoB,CAAC,OAAe;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QACtC,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACxC,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,SAAS,OAAO,OAAO,CAAC,CAAC;QAChD,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACvD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,gFAAgF;IAExE,iBAAiB;QACvB,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;QAE5B,iGAAiG;QACjG,IAAI,CAAC,YAAY,CACf,cAAc,EACd,CAAC,CAAC,MAAM,CAAC;YACP,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;YACzC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC7B,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;YAChC,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;YACtC,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;YACnC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;SACxC,CAAC,EACF,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;YAClB,MAAM,MAAM,GAA2B,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YAC1D,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,GAAG,CAAC,aAAa,EAAE,CAAC;gBACxC,MAAM,CAAC,qBAAqB,CAAC,GAAG,GAAG,CAAC,aAAa,CAAC;YACpD,CAAC;YACD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,CAAC,WAAW,CAAC;gBACtC,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE;gBACzB,MAAM;gBACN,aAAa,EAAE,IAAI,CAAC,MAAM;gBAC1B,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,IAAI;gBAC3C,WAAW,EAAE,IAAI,CAAC,WAAW;aAC9B,CAAC,CAAC;YACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjE,CAAC,CACF,CAAC;QAEF,IAAI,CAAC,YAAY,CACf,gBAAgB,EAChB,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,EACpF,KAAK,EAAE,IAAI,EAAE,EAAE;YACb,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,YAAY,CACjC,IAAI,CAAC,OAAO,EACZ,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,oBAAoB,CAC5C,CAAC;YACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC;QACjC,CAAC,CACF,CAAC;QAEF,IAAI,CAAC,YAAY,CACf,mBAAmB,EACnB,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EACrD,KAAK,EAAE,IAAI,EAAE,EAAE;YACb,MAAM,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YAC9C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACtB,CAAC,CACF,CAAC;QAEF,IAAI,CAAC,YAAY,CAAC,kBAAkB,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE;YAChF,MAAM,MAAM,GAAG,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACzC,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;QAClF,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,YAAY,CAAC,oBAAoB,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACpF,EAAE,EAAE,IAAI;YACR,QAAQ,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI;SAChD,CAAC,CAAC,CAAC;QAEJ,IAAI,CAAC,YAAY,CAAC,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YAClE,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,CAAC,CAAC,UAAU,EAAE;SACvB,CAAC,CAAC,CAAC;QAEJ,IAAI,CAAC,YAAY,CACf,cAAc,EACd,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,EAC3E,KAAK,EAAE,IAAI,EAAE,EAAE;YACb,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;YACtD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACtB,CAAC,CACF,CAAC;QAEF,IAAI,CAAC,YAAY,CACf,gBAAgB,EAChB,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EACrD,KAAK,EAAE,IAAI,EAAE,EAAE;YACb,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YAC7C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACtB,CAAC,CACF,CAAC;QAEF,IAAI,CAAC,YAAY,CAAC,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YAClF,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACpC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACtB,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YAChF,MAAM,CAAC,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAClC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACtB,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,YAAY,CAAC,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YACnF,MAAM,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACnC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACtB,CAAC,CAAC,CAAC;QAEH,eAAe;QACf,IAAI,CAAC,YAAY,CACf,0BAA0B,EAC1B,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,EAC5C,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAC9E,CAAC;QAEF,IAAI,CAAC,YAAY,CACf,uBAAuB,EACvB,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,EAC1D,CAAC,IAAI,EAAE,EAAE;YACP,MAAM,MAAM,GAAG,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YACpE,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;QACrF,CAAC,CACF,CAAC;QAEF,sBAAsB;QACtB,IAAI,CAAC,YAAY,CAAC,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YACrE,EAAE,EAAE,IAAI;YACR,SAAS,EAAE,CAAC,CAAC,aAAa,EAAE;SAC7B,CAAC,CAAC,CAAC;QACJ,IAAI,CAAC,YAAY,CAAC,kBAAkB,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACrF,EAAE,EAAE,IAAI;YACR,QAAQ,EAAE,CAAC,CAAC,eAAe,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI;SACvD,CAAC,CAAC,CAAC;QACJ,IAAI,CAAC,YAAY,CAAC,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAChF,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;SACtC,CAAC,CAAC,CAAC;IACN,CAAC;CACF"}

package/dist/agent/permissions.d.ts

@@ -0,0 +1,71 @@
+import type { Session } from "../ws/session.js";
+import type { HandlerRegistry } from "../ws/router.js";
+import type { AgentManager } from "./agent-manager.js";
+/**
+ * Tool-call permission flow + question-permission bridge
+ * (features/tool-permissions.md § Flow messages / § Behavior / § Question-permission bridge).
+ *
+ * When an agent's mode requires approval:
+ *  1. A tool call creates an `AgentPermissionRequest`, flags the agent as awaiting-input, and
+ *     broadcasts `agent_permission_request` to all clients.
+ *  2. The turn WAITS until `resolvePermission(requestId, response)` is called.
+ *  3. The first resolution wins; `agent_permission_resolved` is broadcast to all clients.
+ *  4. Full-access modes (`colorTier:"dangerous"`) emit no requests.
+ *
+ * Question bridge: Pi `select`/`input`/`editor`/`confirm` surface as question permissions. A
+ * `select` with `allowComment:true` is ONE combined question — answer the `select`, then
+ * auto-answer the follow-up optional `input` (supplied comment or empty string).
+ */
+export interface AgentPermissionRequestRecord {
+    requestId: string;
+    agentId: string;
+    toolName?: string;
+    action?: unknown;
+    responses?: string[];
+    /** Question-bridge kind. */
+    questionKind?: "select" | "input" | "editor" | "confirm";
+    allowComment?: boolean;
+}
+export type ResolutionResponse = string | Record<string, unknown>;
+export interface LivePermission extends AgentPermissionRequestRecord {
+    resolve: (response: ResolutionResponse) => void;
+}
+/**
+ * In-memory permission state (not separately persisted — only broadcast-live per scope).
+ * Keyed by `requestId`.
+ */
+export declare class PermissionStore {
+    private readonly pending;
+    add(req: LivePermission): void;
+    get(requestId: string): LivePermission | undefined;
+    remove(requestId: string): void;
+    listForAgent(agentId: string): LivePermission[];
+}
+export declare const globalPermissionStore: PermissionStore;
+export interface PermissionServiceDeps {
+    manager: AgentManager;
+    broadcast: (sessions: Iterable<Session>, message: unknown) => void;
+    store?: PermissionStore;
+}
+export declare class PermissionService {
+    private readonly deps;
+    private readonly store;
+    constructor(deps: PermissionServiceDeps);
+    registerHandlers(registry: HandlerRegistry, getActiveSessions: () => Iterable<Session>): void;
+    private broadcastAll;
+    /**
+     * Create a permission request, broadcast it, and wait for resolution. Returns the decision.
+     * Throws if interrupted (the promise is rejected externally).
+     */
+    requestPermission(req: Omit<AgentPermissionRequestRecord, "requestId">, getSessions: () => Iterable<Session>): {
+        requestId: string;
+        decision: Promise<ResolutionResponse>;
+    };
+    /**
+     * Handle a respond-to-permission RPC. First resolution wins; subsequent calls are no-ops.
+     */
+    handleRespond(msg: Record<string, unknown>, getSessions: () => Iterable<Session>): Record<string, unknown>;
+    /** Cancel all pending permissions for an agent (called on interrupt). */
+    cancelPending(agentId: string, getSessions: () => Iterable<Session>): void;
+}
+//# sourceMappingURL=permissions.d.ts.map

package/dist/agent/permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../src/agent/permissions.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD;;;;;;;;;;;;;;GAcG;AAEH,MAAM,WAAW,4BAA4B;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,4BAA4B;IAC5B,YAAY,CAAC,EAAE,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,SAAS,CAAC;IACzD,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAElE,MAAM,WAAW,cAAe,SAAQ,4BAA4B;IAClE,OAAO,EAAE,CAAC,QAAQ,EAAE,kBAAkB,KAAK,IAAI,CAAC;CACjD;AAED;;;GAGG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqC;IAE7D,GAAG,CAAC,GAAG,EAAE,cAAc,GAAG,IAAI;IAI9B,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAIlD,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAI/B,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,EAAE;CAGhD;AAED,eAAO,MAAM,qBAAqB,iBAAwB,CAAC;AAE3D,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,YAAY,CAAC;IACtB,SAAS,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC;IACnE,KAAK,CAAC,EAAE,eAAe,CAAC;CACzB;AAED,qBAAa,iBAAiB;IAGhB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAFjC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAkB;gBAEX,IAAI,EAAE,qBAAqB;IAIxD,gBAAgB,CAAC,QAAQ,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,QAAQ,CAAC,OAAO,CAAC,GAAG,IAAI;IAO7F,OAAO,CAAC,YAAY;IAIpB;;;OAGG;IACH,iBAAiB,CACf,GAAG,EAAE,IAAI,CAAC,4BAA4B,EAAE,WAAW,CAAC,EACpD,WAAW,EAAE,MAAM,QAAQ,CAAC,OAAO,CAAC,GACnC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAC,kBAAkB,CAAC,CAAA;KAAE;IAsB/D;;OAEG;IACH,aAAa,CACX,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,WAAW,EAAE,MAAM,QAAQ,CAAC,OAAO,CAAC,GACnC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAyD1B,yEAAyE;IACzE,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC,OAAO,CAAC,GAAG,IAAI;CAe3E"}

package/dist/agent/permissions.js

@@ -0,0 +1,132 @@
+import { randomUUID } from "node:crypto";
+/**
+ * In-memory permission state (not separately persisted — only broadcast-live per scope).
+ * Keyed by `requestId`.
+ */
+export class PermissionStore {
+    pending = new Map();
+    add(req) {
+        this.pending.set(req.requestId, req);
+    }
+    get(requestId) {
+        return this.pending.get(requestId);
+    }
+    remove(requestId) {
+        this.pending.delete(requestId);
+    }
+    listForAgent(agentId) {
+        return [...this.pending.values()].filter((p) => p.agentId === agentId);
+    }
+}
+export const globalPermissionStore = new PermissionStore();
+export class PermissionService {
+    deps;
+    store;
+    constructor(deps) {
+        this.deps = deps;
+        this.store = deps.store ?? globalPermissionStore;
+    }
+    registerHandlers(registry, getActiveSessions) {
+        registry.register("agent.permission.respond.request", (ctx) => this.handleRespond(ctx.message, getActiveSessions));
+        registry.registerAlias("respond_to_permission", "agent.permission.respond.request");
+    }
+    broadcastAll(sessions, msg) {
+        this.deps.broadcast(sessions, msg);
+    }
+    /**
+     * Create a permission request, broadcast it, and wait for resolution. Returns the decision.
+     * Throws if interrupted (the promise is rejected externally).
+     */
+    requestPermission(req, getSessions) {
+        const requestId = randomUUID();
+        let resolve;
+        const decision = new Promise((res) => {
+            resolve = res;
+        });
+        this.store.add({ ...req, requestId, resolve });
+        this.broadcastAll(getSessions(), {
+            type: "session",
+            message: {
+                type: "agent_permission_request",
+                requestId,
+                agentId: req.agentId,
+                toolName: req.toolName,
+                action: req.action,
+                responses: req.responses ?? ["allow", "deny"],
+            },
+        });
+        return { requestId, decision };
+    }
+    /**
+     * Handle a respond-to-permission RPC. First resolution wins; subsequent calls are no-ops.
+     */
+    handleRespond(msg, getSessions) {
+        const permId = msg.permissionRequestId;
+        const response = msg.response;
+        const pending = this.store.get(permId);
+        if (!pending) {
+            // Already resolved or unknown.
+            return {
+                type: "agent.permission.respond.response",
+                requestId: msg.requestId,
+                payload: { resolved: false },
+            };
+        }
+        this.store.remove(permId);
+        pending.resolve(response);
+        this.broadcastAll(getSessions(), {
+            type: "session",
+            message: {
+                type: "agent_permission_resolved",
+                requestId: permId,
+                agentId: pending.agentId,
+                decision: typeof response === "string" ? response : "allow",
+            },
+        });
+        // Question bridge: auto-answer a follow-up optional comment input.
+        if (pending.allowComment) {
+            // The Pi adapter will surface the follow-up `input` as another question permission;
+            // the comment (if any) is embedded in the response, or we auto-answer with empty string.
+            const comment = typeof response === "object" && "comment" in response ? response.comment : "";
+            // Find and resolve any pending follow-up input for the same agent.
+            const followUp = this.store
+                .listForAgent(pending.agentId)
+                .find((p) => p.questionKind === "input");
+            if (followUp) {
+                this.store.remove(followUp.requestId);
+                followUp.resolve(comment);
+                this.broadcastAll(getSessions(), {
+                    type: "session",
+                    message: {
+                        type: "agent_permission_resolved",
+                        requestId: followUp.requestId,
+                        agentId: pending.agentId,
+                        decision: "auto",
+                    },
+                });
+            }
+        }
+        return {
+            type: "agent.permission.respond.response",
+            requestId: msg.requestId,
+            payload: { resolved: true },
+        };
+    }
+    /** Cancel all pending permissions for an agent (called on interrupt). */
+    cancelPending(agentId, getSessions) {
+        for (const pending of this.store.listForAgent(agentId)) {
+            this.store.remove(pending.requestId);
+            pending.resolve("canceled");
+            this.broadcastAll(getSessions(), {
+                type: "session",
+                message: {
+                    type: "agent_permission_resolved",
+                    requestId: pending.requestId,
+                    agentId,
+                    decision: "canceled",
+                },
+            });
+        }
+    }
+}
+//# sourceMappingURL=permissions.js.map

package/dist/agent/permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../src/agent/permissions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAuCzC;;;GAGG;AACH,MAAM,OAAO,eAAe;IACT,OAAO,GAAG,IAAI,GAAG,EAA0B,CAAC;IAE7D,GAAG,CAAC,GAAmB;QACrB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACvC,CAAC;IAED,GAAG,CAAC,SAAiB;QACnB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACrC,CAAC;IAED,MAAM,CAAC,SAAiB;QACtB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;IAED,YAAY,CAAC,OAAe;QAC1B,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;IACzE,CAAC;CACF;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,eAAe,EAAE,CAAC;AAQ3D,MAAM,OAAO,iBAAiB;IAGC;IAFZ,KAAK,CAAkB;IAExC,YAA6B,IAA2B;QAA3B,SAAI,GAAJ,IAAI,CAAuB;QACtD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,qBAAqB,CAAC;IACnD,CAAC;IAED,gBAAgB,CAAC,QAAyB,EAAE,iBAA0C;QACpF,QAAQ,CAAC,QAAQ,CAAC,kCAAkC,EAAE,CAAC,GAAG,EAAE,EAAE,CAC5D,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAkC,EAAE,iBAAiB,CAAC,CAC9E,CAAC;QACF,QAAQ,CAAC,aAAa,CAAC,uBAAuB,EAAE,kCAAkC,CAAC,CAAC;IACtF,CAAC;IAEO,YAAY,CAAC,QAA2B,EAAE,GAAY;QAC5D,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACrC,CAAC;IAED;;;OAGG;IACH,iBAAiB,CACf,GAAoD,EACpD,WAAoC;QAEpC,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC;QAC/B,IAAI,OAAyC,CAAC;QAC9C,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAqB,CAAC,GAAG,EAAE,EAAE;YACvD,OAAO,GAAG,GAAG,CAAC;QAChB,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,GAAG,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,EAAE;YAC/B,IAAI,EAAE,SAAS;YACf,OAAO,EAAE;gBACP,IAAI,EAAE,0BAA0B;gBAChC,SAAS;gBACT,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC;aAC9C;SACF,CAAC,CAAC;QACH,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,aAAa,CACX,GAA4B,EAC5B,WAAoC;QAEpC,MAAM,MAAM,GAAG,GAAG,CAAC,mBAA6B,CAAC;QACjD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAA8B,CAAC;QACpD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,+BAA+B;YAC/B,OAAO;gBACL,IAAI,EAAE,mCAAmC;gBACzC,SAAS,EAAE,GAAG,CAAC,SAAmB;gBAClC,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE;aAC7B,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC1B,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC1B,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,EAAE;YAC/B,IAAI,EAAE,SAAS;YACf,OAAO,EAAE;gBACP,IAAI,EAAE,2BAA2B;gBACjC,SAAS,EAAE,MAAM;gBACjB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,QAAQ,EAAE,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO;aAC5D;SACF,CAAC,CAAC;QAEH,mEAAmE;QACnE,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;YACzB,oFAAoF;YACpF,yFAAyF;YACzF,MAAM,OAAO,GACX,OAAO,QAAQ,KAAK,QAAQ,IAAI,SAAS,IAAI,QAAQ,CAAC,CAAC,CAAE,QAAQ,CAAC,OAAkB,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5F,mEAAmE;YACnE,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK;iBACxB,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC;iBAC7B,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,OAAO,CAAC,CAAC;YAC3C,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;gBACtC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;gBAC1B,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,EAAE;oBAC/B,IAAI,EAAE,SAAS;oBACf,OAAO,EAAE;wBACP,IAAI,EAAE,2BAA2B;wBACjC,SAAS,EAAE,QAAQ,CAAC,SAAS;wBAC7B,OAAO,EAAE,OAAO,CAAC,OAAO;wBACxB,QAAQ,EAAE,MAAM;qBACjB;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO;YACL,IAAI,EAAE,mCAAmC;YACzC,SAAS,EAAE,GAAG,CAAC,SAAmB;YAClC,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;SAC5B,CAAC;IACJ,CAAC;IAED,yEAAyE;IACzE,aAAa,CAAC,OAAe,EAAE,WAAoC;QACjE,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;YACvD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACrC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YAC5B,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,EAAE;gBAC/B,IAAI,EAAE,SAAS;gBACf,OAAO,EAAE;oBACP,IAAI,EAAE,2BAA2B;oBACjC,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,OAAO;oBACP,QAAQ,EAAE,UAAU;iBACrB;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF"}