@chibitek/chibi 0.1.162 → 0.1.169

package/dist-server/server/auto-approve.js

@@ -12,6 +12,7 @@
 // own it is the harness that answers each tool permission (`god-mode`).
 // Questions never come through here: a bot's question always reaches a human.
 import { supportsApprovalMode } from "../shared/approval-mode.js";
+import { isElicitationTool } from "./mcp-elicitation.js";
 /** A failed delivery is a runtime error, not another permission decision.
  * An expired ask must never become a fresh Allow/Deny card. */
 export async function deliverFullAccessApproval(adapter, threadId, requestId, turnId, isCurrent = () => false) {
@@ -64,7 +65,9 @@ export function autoVerdict(mode, tool, context) {
     // A question is for a person, whatever channel it arrived on — and
     // whatever the mode: even Full has no answer to give, only an approval
     // that would run the tool with none.
-    if (ASKS_A_PERSON.has(tool.replace(/^mcp__[^_]+__/, "").toLowerCase())) {
+    // An MCP server asked the person to confirm a change (elicitation): no
+    // mode answers for them, Full included (server/mcp-elicitation.ts).
+    if (isElicitationTool(tool) || ASKS_A_PERSON.has(tool.replace(/^mcp__[^_]+__/, "").toLowerCase())) {
         return { approve: null, source: "no-grant" };
     }
     // Full's promise is literal: even a sandbox widening is approved. Entering

package/dist-server/server/brand.js

@@ -29,6 +29,15 @@ export const brandSchema = z
         .max(MAX_LOGO_CHARS, `logo must be under ${MAX_LOGO_CHARS} characters (inline a small SVG or link an https:// image)`)
         .refine((v) => v.startsWith("data:image/") || v.startsWith("https://"), "logo must be a data:image/... URI or an https:// URL")
         .optional(),
+    /** The company whose people use this deployment: the setup wizard greets
+     * people from it with its logo. Its own name and logo, so a client's
+     * deployment can carry the client's. */
+    companyName: z.string().trim().min(1).max(80, "companyName must be 80 characters or fewer").optional(),
+    companyLogo: z
+        .string()
+        .max(MAX_LOGO_CHARS, `companyLogo must be under ${MAX_LOGO_CHARS} characters`)
+        .refine((v) => v.startsWith("data:image/") || v.startsWith("https://") || v.startsWith("/"), "companyLogo must be a data:image/... URI, an https:// URL or a path on this server")
+        .optional(),
     /** Where "get help" points for this deployment. */
     supportUrl: z.string().url().startsWith("https://", "supportUrl must be an https:// URL").optional(),
     /** Tab and home-screen icon: an inline data:image/... URI (PNG or SVG, small) or an https:// URL. */
@@ -49,6 +58,8 @@ export const DEFAULT_BRAND = {
     accentLight: "#004F71",
     accentDark: "#00B398",
     logo: "/app-icon.svg",
+    companyName: "Chibitek",
+    companyLogo: "/chibitek-logo.png",
 };
 export function brandFile() {
     return process.env.OMB_BRAND_FILE || join(DATA_DIR, "brand.json");

package/dist-server/server/config.js

@@ -19,6 +19,7 @@ import { isRemoteMcpServer, parseStoredMcpServer } from "./mcp-registry.js";
 import { hydrateMcpServers, mcpLaunchBlocker, mcpLaunchBlockerReason, mcpServersForDisk } from "./mcp-secrets.js";
 import { secureStdioLaunch } from "../electron/mcp-secrets.mjs";
 import { parseJson, schemaIssue } from "./schema.js";
+import { dropEnginesOffPlatform, onDeviceFleet, restoreEnginesOffPlatform } from "./engine-platform-fleet.js";
 const optionalText = z.string().optional();
 const SSH_ALIAS = /^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/;
 const LEGACY_BROWSER_PROFILE_ID = /^[A-Za-z0-9_-]{1,40}$/;
@@ -904,8 +905,9 @@ export function loadConfig() {
     try {
         cfg = parseStoredConfig(parseJson(readFileSync(join(DATA_DIR, "config.json"), "utf8")));
     }
-    catch {
-        /* first run — env fallbacks below */
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw new Error("Saved Atomic settings could not be read; config.json has been left untouched.", { cause: error });
     }
     // MCP server secrets the desktop keeps in its encrypted store: config.json
     // holds placeholders, filled here for this process only (server/mcp-secrets.ts)
@@ -1118,12 +1120,11 @@ export function saveConfig(patch, options = {}) {
     const p = join(DATA_DIR, "config.json");
     let disk = {};
     try {
-        const parsed = jsonObjectSchema.safeParse(parseJson(readFileSync(p, "utf8")));
-        if (parsed.success)
-            disk = configWithoutRemovedIntegration(parsed.data).document;
+        disk = configWithoutRemovedIntegration(jsonObjectSchema.parse(parseJson(readFileSync(p, "utf8")))).document;
     }
-    catch {
-        /* first write */
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw new Error("Cannot save over unreadable Atomic settings; config.json has been left untouched.", { cause: error });
     }
     const checkedPatch = appConfigSchema.partial().extend({ threads: threadsPatchSchema.optional(), newBots: newBotsPatchSchema.optional() }).parse(patch);
     const before = configSaveListeners.size ? structuredClone(disk) : disk;
@@ -1317,8 +1318,8 @@ export function withInstanceCli(cfg, instanceId, cli) {
     return { ok: true, config: next };
 }
 /** Materialize defaults without freezing injected workspace settings or secrets. */
-export function persistableInstanceConfigs(cfg) {
-    const map = instanceConfigs(cfg);
+export function persistableInstanceConfigs(cfg, platform = process.platform) {
+    const map = instanceConfigs(cfg, undefined, undefined, platform);
     for (const [id, entry] of Object.entries(map)) {
         const environment = cfg.instances?.[id]?.environment;
         if (environment)
@@ -1337,7 +1338,7 @@ export function persistableInstanceConfigs(cfg) {
         else
             delete entry.config;
     }
-    return map;
+    return restoreEnginesOffPlatform(map, cfg.instances, platform);
 }
 /** The credential env instanceConfigs() injects for one driver at runtime.
  * Each secret goes only to the driver that actually reads it: the API-key
@@ -1388,13 +1389,6 @@ const ATOMIC_FLEET = {
     "atomic-engine": { driver: "customAcp", displayName: "Atomic Engine", config: { cli: "atomic acp" } },
     ollamaCloud: { driver: "ollamaCloud", displayName: "Ollama Cloud" },
 };
-/** Apple Intelligence runs only on Apple silicon Macs; elsewhere the engine
- * is left out of the fleet rather than listed as unavailable. */
-export function onDeviceFleet(platform = process.platform, arch = process.arch) {
-    return platform === "darwin" && arch === "arm64"
-        ? { appleIntelligence: { driver: "appleIntelligence", displayName: "Apple Intelligence (on this Mac)" } }
-        : {};
-}
 function plainObject(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
 }
@@ -1427,7 +1421,7 @@ function separateClaudeLogin(instanceId, entry) {
     const configDir = plainObject(entry.config)?.configDir;
     return typeof configDir === "string" && configDir.trim() !== "";
 }
-export function instanceConfigs(cfg, onDevice = onDeviceFleet(), accountKeys = instanceKeys()) {
+export function instanceConfigs(cfg, onDevice = onDeviceFleet(), accountKeys = instanceKeys(), platform = process.platform) {
     // The default `grok` instance rides the `grokAgent` driver, not the API-key
     // one: like claude and codex it needs no credential from us, just the CLI
     // installed and logged in (it shows up unavailable otherwise). The API-key
@@ -1499,6 +1493,7 @@ export function instanceConfigs(cfg, onDevice = onDeviceFleet(), accountKeys = i
         if (Object.hasOwn(map, id))
             map[id] = withFleetDefaults(map[id], fallback);
     }
+    dropEnginesOffPlatform(map, platform);
     for (const [id, sourceEntry] of Object.entries(map)) {
         // instanceConfigs() builds a transient runtime map. Never mutate the
         // caller's persisted entries while injecting workspace defaults: doing so

package/dist-server/server/connection-credential.js

@@ -0,0 +1,59 @@
+import { z } from "zod";
+import { MAX_MCP_SERVERS, isRemoteMcpServer, parseStoredMcpServer } from "./mcp-registry.js";
+const schema = z.object({
+    name: z.string().regex(/^[a-z][a-z0-9_-]{0,31}$/),
+    url: z.string().max(2048),
+    header: z.string().regex(/^[A-Za-z][A-Za-z0-9-]{0,127}$/),
+    prefix: z.literal("Bearer ").optional(),
+}).strict();
+const forbiddenHeaders = /^(host|content-.*|accept|connection|transfer-encoding|proxy-.*|mcp-.*|origin|referer|cookie|set-cookie)$/i;
+const fail = (message, status = 400) => { throw Object.assign(new Error(message), { status }); };
+/** Non-secret, reviewed destination only. No arbitrary config paths or URLs carrying secrets. */
+export function connectionCredential(raw) {
+    const parsed = schema.safeParse(raw);
+    if (!parsed.success)
+        return fail("Provide a connection name, HTTPS URL and credential header, without the secret.");
+    const connection = parsed.data;
+    let url;
+    try {
+        url = new URL(connection.url);
+    }
+    catch {
+        return fail("Use the service's full HTTPS MCP address.");
+    }
+    if (url.protocol !== "https:" || url.username || url.password || url.search || url.hash) {
+        return fail("Use an HTTPS MCP address without credentials, query parameters or fragments.");
+    }
+    if (forbiddenHeaders.test(connection.header))
+        return fail("Choose the service's credential header, such as x-api-key or Authorization.");
+    connection.url = url.href;
+    // Reuse the catalog's reserved-name and server validation.
+    const server = parseStoredMcpServer(connection.name, { type: "http", url: connection.url });
+    if (!server.ok)
+        return fail("This connection name or address is not supported.");
+    return connection;
+}
+/** Keep other headers and settings. Never redirect an existing connection. */
+export function connectionCredentialServer(connection, current, value) {
+    const raw = current[connection.name];
+    const parsed = parseStoredMcpServer(connection.name, raw ?? {
+        type: "http", url: connection.url, enabled: true, autoAllowReadOnly: false,
+    });
+    if (!parsed.ok || !isRemoteMcpServer(parsed.server) || parsed.server.url !== connection.url) {
+        return fail("This connection changed or uses another address. Request a new secure card.", 409);
+    }
+    if (raw === undefined && Object.keys(current).length >= MAX_MCP_SERVERS)
+        return fail("The MCP server limit has been reached.");
+    const server = parsed.server;
+    if (value === undefined)
+        return server;
+    if (!value || Buffer.byteLength(value) > 4096 || (/[\r\n]/.test(value) || value.includes(String.fromCharCode(0))))
+        return fail("Enter a credential of 1 to 4096 bytes on one line.");
+    // HTTP field names are case-insensitive: replace just the chosen field.
+    const headers = Object.fromEntries(Object.entries(server.headers).filter(([key]) => key.toLowerCase() !== connection.header.toLowerCase()));
+    headers[connection.header] = (connection.prefix ?? "") + value;
+    return { ...server, headers };
+}
+export function sameConnectionCredential(a, b) {
+    return a?.name === b?.name && a?.url === b?.url && a?.header === b?.header && a?.prefix === b?.prefix;
+}

package/dist-server/server/container-computer.js

@@ -323,28 +323,10 @@ export function localVmRecreatableOnDemand(status) {
         && status.container === "missing"
         && status.create_supported;
 }
-/** Whether a turn may replace this stopped Local VM itself.
- *
- * A stopped desktop is never resumed (see `statusProblem`), but a stopped
- * container that Atomic made, on the current image, with its safety limits
- * and its durable workspace mount, can simply be removed and run again: the
- * person's files live in the host workspace folder, so only the desktop
- * session resets. Docker or Podman stops containers whenever the runtime or
- * the Mac restarts, so without this every such restart sent the person to
- * App Settings to delete and recreate the Local VM by hand. Anything foreign,
- * stale or unsafe still stays the person's call.
- */
-export function localVmReplaceableWhenStopped(status) {
-    return Boolean(status.runtime
-        && status.daemonUp
-        && status.image
-        && status.container === "stopped"
-        && status.create_supported
-        && status.managed
-        && status.imageMatches
-        && status.network !== "unsafe"
-        && status.security !== "unsafe"
-        && status.persistence === "durable");
+/** A stopped VM may contain installed applications and files outside the mount.
+ * Replacement requires an explicit removal; startup never discards its disk. */
+export function localVmReplaceableWhenStopped(_status) {
+    return false;
 }
 /** Whether Auto may attach this Local VM without a person choosing it: the
  * desktop is ready, or its image is prepared and the container can simply be
@@ -375,11 +357,8 @@ function statusProblem(status) {
         return "The existing Local VM is missing safety limits; recreate it";
     if (status.persistence === "unsafe")
         return "The existing Local VM is missing its durable workspace; recreate it";
-    if (status.container === "stopped" && localVmReplaceableWhenStopped(status)) {
-        return "The Local VM stopped; a fresh one starts the next time a bot uses it, and your files are kept";
-    }
     if (status.container === "stopped")
-        return "This desktop image cannot safely resume; recreate the Local VM";
+        return "The Local VM is stopped and its disk is kept. This image cannot safely resume. Export needed files before explicitly removing and recreating it.";
     if (status.desktop_error)
         return `The Local VM desktop failed to start: ${status.desktop_error}`;
     if (!status.desktopReady)

package/dist-server/server/credential-card-request.js

@@ -0,0 +1,52 @@
+import { randomUUID } from "node:crypto";
+import { CREDENTIAL_TARGETS, credentialIsConfigured, isCredentialTargetId, isReusableCredentialRequest } from "../shared/credential-request.js";
+import { connectionCredential, connectionCredentialServer, sameConnectionCredential } from "./connection-credential.js";
+const answer = (status, body) => ({ status, body });
+const handoff = (label) => `Securely provide the ${label} from Atomic on your phone or computer. It is never added to chat.`;
+export function requestCredentialCard(body, from, fromThreadId, room, cfg, store, storage, refusalFor) {
+    if (!isCredentialTargetId(body.credentialId)) {
+        return answer(400, { error: "unsupported credential id" });
+    }
+    const credentialId = body.credentialId;
+    const target = CREDENTIAL_TARGETS[credentialId];
+    const connection = credentialId === "connectionSecret" ? connectionCredential(body.connection) : undefined;
+    if (connection) {
+        if (storage() !== "os")
+            return answer(503, { error: "Secure connection entry requires this computer's encrypted credential store." });
+        if (from.mcpServers && !from.mcpServers.includes(connection.name))
+            return answer(403, { error: "Enable this connection for this bot before requesting its credential." });
+        const server = connectionCredentialServer(connection, cfg.mcpServers ?? {});
+        const refusal = refusalFor(connection.name, server);
+        if (refusal)
+            return answer(403, { error: refusal });
+    }
+    if (credentialIsConfigured(cfg, credentialId)) {
+        return answer(200, { alreadyConfigured: true, label: target.label });
+    }
+    const existing = store.activePath(fromThreadId).find((message) => isReusableCredentialRequest(message, credentialId, from.id, room) && sameConnectionCredential(message.secret?.connection, connection));
+    if (existing) {
+        if (!existing.text?.trim()) {
+            store.patchMessage(fromThreadId, existing.id, {
+                text: handoff(target.label),
+            });
+        }
+        return answer(200, { messageId: existing.id, label: target.label });
+    }
+    const reason = typeof body.reason === "string" ? body.reason.trim().slice(0, 240) : "";
+    const message = store.appendMessage(fromThreadId, {
+        role: "bot",
+        kind: "secret",
+        text: handoff(target.label),
+        ...(room ? { from: { botId: from.id, name: from.name, color: from.color } } : {}),
+        secret: {
+            target: credentialId,
+            ...(connection ? { connection } : {}),
+            label: connection ? `${connection.name} credential` : target.label,
+            description: `${reason ? `${target.description} ${reason}` : target.description} ${connection ? `Save for ${connection.url}, field ${connection.header}. ` : ""}${from.name} can use it but never read it back.`,
+            placeholder: target.placeholder,
+            helpUrl: target.helpUrl,
+            requestKey: randomUUID(),
+        },
+    });
+    return answer(201, { messageId: message.id, label: target.label });
+}

package/dist-server/server/dictation.js

@@ -86,13 +86,16 @@ export function checkCleanup(input, output) {
     }
     return { ok: true, text: cleaned };
 }
-async function ask(provider, prompt, timeoutMs) {
+export async function ask(provider, prompt, timeoutMs) {
     if (!provider.generateText)
         return null;
     const expiry = new AbortController();
-    const timer = setTimeout(() => expiry.abort(), timeoutMs);
+    let timer;
+    const timeout = new Promise(resolve => {
+        timer = setTimeout(() => { expiry.abort(); resolve(null); }, timeoutMs);
+    });
     try {
-        return await provider.generateText(prompt, { signal: expiry.signal });
+        return await Promise.race([provider.generateText(prompt, { signal: expiry.signal }), timeout]);
     }
     catch {
         return null;

package/dist-server/server/drivers/agents-call.js

@@ -6,7 +6,7 @@
 //
 // Nothing here reads the environment or holds state of its own. The caller
 // passes a ToolCallContext, and the per-turn counters live on it.
-import { CREDENTIAL_TARGETS, isCredentialTargetId } from "../../shared/credential-request.js";
+import { requestCredential } from "./agents-credential.js";
 import { normalizeCronSchedule } from "../../shared/routine-schedule.js";
 import { peerRecallSpeaker } from "../peer-provenance.js";
 import { peerName } from "../peer-roster.js";
@@ -835,28 +835,8 @@ export async function callTool(name, args, context) {
         const message = typeof r.message === "string" ? r.message : `Updated room ${roomId}.`;
         return { text: message };
     }
-    if (name === "request_credential") {
-        const credentialId = args.credential_id;
-        if (!isCredentialTargetId(credentialId)) {
-            return { text: "request_credential needs a supported credential_id.", isError: true };
-        }
-        const reason = typeof args.reason === "string" ? args.reason.trim().slice(0, 240) : "";
-        const r = await api("/api/internal/request-credential", {
-            method: "POST",
-            body: JSON.stringify({
-                fromBotId: BOT_ID,
-                fromThreadId: THREAD_ID,
-                credentialId,
-                ...(reason ? { reason } : {}),
-            }),
-        });
-        if (r.alreadyConfigured) {
-            return { text: `${r.label ?? CREDENTIAL_TARGETS[credentialId].label} is already configured. Continue the task.` };
-        }
-        return {
-            text: `A secure ${r.label ?? CREDENTIAL_TARGETS[credentialId].label} request is ready. The desktop app and a freshly QR-paired mobile app show its secure entry card; older mobile pairings explain how to pair again or finish on the computer. End this turn; Atomic will resume the task after the user saves or declines. Never ask them to paste the key into chat.`,
-        };
-    }
+    if (name === "request_credential")
+        return requestCredential(args, BOT_ID, THREAD_ID, api);
     if (name === "list_routines") {
         const query = new URLSearchParams({ fromBotId: BOT_ID, fromThreadId: THREAD_ID });
         const r = await api(`/api/internal/routines?${query.toString()}`);

package/dist-server/server/drivers/agents-catalog.js

@@ -10,7 +10,7 @@
 // turn. It is pinned byte for byte, and its size budgeted, by
 // agents-catalog-wire.test.ts: change a description or a schema on purpose,
 // then update the goldens there.
-import { CREDENTIAL_TARGETS } from "../../shared/credential-request.js";
+import { credentialTool } from "./agents-credential.js";
 import { PRIVATE_BOT_HIDDEN_TOOLS, agentToolAnnotations } from "../agent-tool-policy.js";
 /** The profile a spawned proxy was given. Everything is off unless the
  * harness says "1". */
@@ -450,25 +450,7 @@ const toolDefinitions = (externalRuntime) => [
             required: ["room_id", "action"],
         },
     },
-    {
-        name: "request_credential",
-        description: "Ask the user for a supported API key through Atomic's secure credential flow. The desktop app and a freshly QR-paired mobile app show a secure entry card; older mobile pairings show how to pair again or finish on the computer. Never claim a secure field opened unless this request succeeds, and never ask the user to paste a secret into chat. The secret is saved by the desktop app and is never returned to you. After calling this tool, end the turn; Atomic resumes the task after the user saves or declines.",
-        inputSchema: {
-            type: "object",
-            properties: {
-                credential_id: {
-                    type: "string",
-                    enum: Object.keys(CREDENTIAL_TARGETS),
-                    description: "The credential the current task requires.",
-                },
-                reason: {
-                    type: "string",
-                    description: "Optional short, non-sensitive explanation of why the task needs it.",
-                },
-            },
-            required: ["credential_id"],
-        },
-    },
+    credentialTool,
     {
         name: "marketplace_search",
         description: "Find an app or service the person wants connected in Atomic's Marketplace: official servers Atomic connects, and official apps through their Claude account. Then call open_marketplace. Never offer to build a connection or a community server.",

package/dist-server/server/drivers/agents-credential.js

@@ -0,0 +1,57 @@
+import { CREDENTIAL_TARGETS, isCredentialTargetId } from "../../shared/credential-request.js";
+export async function requestCredential(args, BOT_ID, THREAD_ID, api) {
+    const credentialId = args.credential_id;
+    if (!isCredentialTargetId(credentialId)) {
+        return { text: "request_credential needs a supported credential_id.", isError: true };
+    }
+    const reason = typeof args.reason === "string" ? args.reason.trim().slice(0, 240) : "";
+    const r = await api("/api/internal/request-credential", {
+        method: "POST",
+        body: JSON.stringify({
+            fromBotId: BOT_ID,
+            fromThreadId: THREAD_ID,
+            credentialId,
+            ...(credentialId === "connectionSecret" ? { connection: args.connection } : {}),
+            ...(reason ? { reason } : {}),
+        }),
+    });
+    if (r.error)
+        return { text: String(r.error), isError: true };
+    if (r.alreadyConfigured) {
+        return { text: `${r.label ?? CREDENTIAL_TARGETS[credentialId].label} is already configured. Continue the task.` };
+    }
+    return {
+        text: `A secure ${r.label ?? CREDENTIAL_TARGETS[credentialId].label} request is ready. The desktop app and a freshly QR-paired mobile app show its secure entry card; older mobile pairings explain how to pair again or finish on the computer. End this turn; Atomic will resume the task after the user saves or declines. Never ask them to paste the key into chat.`,
+    };
+}
+export const credentialTool = {
+    name: "request_credential",
+    description: "Ask for a password, API key or token through Atomic's secure credential flow. Use connectionSecret with connection details for any HTTPS MCP service, or a built-in credential_id for a provider. The desktop app and a freshly QR-paired mobile app show a secure entry card; older mobile pairings show how to pair again or finish on the computer. Never claim a secure field opened unless this request succeeds, and never ask the user to paste a secret into chat. The secret is saved by the desktop app and is never returned to you. After calling this tool, end the turn; Atomic resumes the task after the user saves or declines.",
+    inputSchema: {
+        type: "object",
+        properties: {
+            credential_id: {
+                type: "string",
+                enum: Object.keys(CREDENTIAL_TARGETS),
+                description: "The credential the current task requires.",
+            },
+            connection: {
+                type: "object",
+                description: "Required for connectionSecret. The person reviews this HTTPS MCP destination before entering a password, API key or token. Never include the secret here.",
+                properties: {
+                    name: { type: "string", description: "MCP server name." },
+                    url: { type: "string", description: "Official HTTPS MCP URL, without credentials or query parameters." },
+                    header: { type: "string", description: "Credential header name, for example x-api-key or Authorization." },
+                    prefix: { type: "string", enum: ["Bearer "], description: "Only when the service requires a Bearer token." },
+                },
+                required: ["name", "url", "header"],
+                additionalProperties: false,
+            },
+            reason: {
+                type: "string",
+                description: "Optional short, non-sensitive explanation of why the task needs it.",
+            },
+        },
+        required: ["credential_id"],
+    },
+};

package/dist-server/server/drivers/builtIn.js

@@ -1,3 +1,4 @@
+import { engineOnPlatform } from "../../shared/engine-platforms.js";
 import { AntigravityDriver } from "./antigravity.js";
 import { BoxAgentDriver } from "./boxagent.js";
 import { ClaudeDriver } from "./claude.js";
@@ -20,7 +21,8 @@ import { MistralDriver } from "./mistral.js";
 import { MinimaxDriver } from "./minimax.js";
 import { OllamaCloudDriver } from "./ollama-cloud.js";
 import { AppleIntelligenceDriver } from "./apple-intelligence.js";
-export const BUILT_IN_DRIVERS = [
+/** Every built-in driver, on every OS. Most code wants BUILT_IN_DRIVERS. */
+export const ALL_BUILT_IN_DRIVERS = [
     GrokDriver,
     GrokAgentDriver,
     GeminiAgentDriver,
@@ -44,3 +46,9 @@ export const BUILT_IN_DRIVERS = [
     OllamaCloudDriver,
     AppleIntelligenceDriver,
 ];
+/** The drivers registered on `platform`: all of them minus any engine switched
+ * off there (shared/engine-platforms.ts, e.g. Qwen on Windows for now). */
+export function builtInDriversFor(platform) {
+    return ALL_BUILT_IN_DRIVERS.filter((driver) => engineOnPlatform(driver.driverKind, platform));
+}
+export const BUILT_IN_DRIVERS = builtInDriversFor(process.platform);

package/dist-server/server/drivers/claude-elicitation.js

@@ -0,0 +1,76 @@
+// MCP elicitation for Claude bots. Claude Code (2.1.270, stream-json input)
+// forwards a configured server's `elicitation/create` to its host as
+//
+//   {"type":"control_request","request_id":"…","request":{"subtype":"elicitation",
+//    "mcp_server_name":"addigy","message":"Delete policy X?","requested_schema":{…}}}
+//
+// and waits for a control_response on stdin. Addigy's hosted server confirms
+// every write this way. A plain confirmation becomes a permission card that
+// always needs the person (its tool is an elicitation tool: no approval
+// mode, remembered grant or reviewer answers it). Anything else is answered
+// `cancel` and never filled in (server/mcp-elicitation.ts).
+import { newId } from "../contracts.js";
+import { elicitationAnswer, elicitationConfirm, elicitationSummary, elicitationTool } from "../mcp-elicitation.js";
+import { claudeControlResponse } from "./claude-stdin.js";
+/** How long a confirmation card waits before it goes back as `cancel`. */
+export const ELICITATION_TIMEOUT_MS = 15 * 60_000;
+export function createClaudeElicitations(deps) {
+    const open = new Map();
+    return {
+        /** A control_request frame from the CLI's stdout. True when it was an
+         * elicitation (answered now or once the person decides). */
+        handle(frame, ctx) {
+            const o = frame;
+            if (!o || o.request?.subtype !== "elicitation")
+                return false;
+            if (typeof o.request_id !== "string")
+                return true;
+            const controlId = o.request_id;
+            const reply = (result) => ctx.write(claudeControlResponse(controlId, result));
+            const confirm = elicitationConfirm(o.request);
+            if (!confirm || ctx.closing) {
+                reply({ action: "cancel" });
+                return true;
+            }
+            const server = typeof o.request.mcp_server_name === "string" ? o.request.mcp_server_name : undefined;
+            const requestId = newId();
+            const finish = (allowed, source) => {
+                if (!open.delete(requestId))
+                    return;
+                clearTimeout(timer);
+                reply(allowed === null ? { action: "cancel" } : elicitationAnswer(confirm, allowed));
+                deps.emit({ ...deps.base(ctx.threadId, ctx.turnId), type: "request.resolved", requestId, behavior: allowed ? "allow" : "deny", source });
+            };
+            const timer = setTimeout(() => finish(null, "timeout"), deps.timeoutMs ?? ELICITATION_TIMEOUT_MS);
+            timer.unref?.();
+            open.set(requestId, { threadId: ctx.threadId, finish });
+            deps.emit({
+                ...deps.base(ctx.threadId, ctx.turnId),
+                type: "request.opened",
+                requestId,
+                requestType: "permission",
+                tool: elicitationTool(server),
+                summary: elicitationSummary(server, confirm),
+                requiresExplicitApproval: true,
+            });
+            return true;
+        },
+        /** The person's answer to a card, or null when the card is not one of these. */
+        respond(threadId, requestId, decision) {
+            const entry = open.get(requestId);
+            if (!entry)
+                return null;
+            if (entry.threadId !== threadId)
+                return "unavailable";
+            const allowed = decision.behavior === "allow";
+            entry.finish(allowed, "user");
+            return allowed ? "allowed-once" : "rejected";
+        },
+        /** The session ended: every open question goes back as "no answer". */
+        endThread(threadId) {
+            for (const entry of Array.from(open.values()))
+                if (entry.threadId === threadId)
+                    entry.finish(null, "system");
+        },
+    };
+}

package/dist-server/server/drivers/claude-stdin.js

@@ -0,0 +1,47 @@
+// The stream-json frames Atomic writes to the Claude CLI's stdin: a user
+// turn, its diagnostic copy for native traces, and the answer to a control
+// request the CLI forwarded (an MCP server's elicitation).
+import { readFileSync } from "node:fs";
+/** Claude's stream-json input accepts the same image source blocks as the
+ * Anthropic Messages API. Keep the old string form for text-only turns so a
+ * CLI update cannot disturb the overwhelmingly common path. */
+export function claudeUserMessage(text, images) {
+    if (!images?.length)
+        return { type: "user", message: { role: "user", content: text } };
+    const content = images.map((image) => ({
+        type: "image",
+        source: {
+            type: "base64",
+            media_type: image.mime,
+            data: readFileSync(image.path).toString("base64"),
+        },
+    }));
+    if (text)
+        content.push({ type: "text", text });
+    return { type: "user", message: { role: "user", content } };
+}
+/** Native traces are routinely attached to bug reports. Preserve the image
+ * block's shape and size for debugging, but never persist its base64 bytes. */
+export function diagnosticClaudeUserMessage(message) {
+    if (!Array.isArray(message.message.content))
+        return message;
+    return {
+        ...message,
+        message: {
+            ...message.message,
+            content: message.message.content.map((block) => block.type === "image"
+                ? {
+                    ...block,
+                    source: {
+                        ...block.source,
+                        data: `[image data: ${block.source.data.length} base64 chars]`,
+                    },
+                }
+                : block),
+        },
+    };
+}
+/** The reply to one control_request the CLI sent on stdout. */
+export function claudeControlResponse(requestId, response) {
+    return { type: "control_response", response: { subtype: "success", request_id: requestId, response } };
+}