@co0ontty/wand 3.1.1 → 4.0.0

package/dist/storage.d.ts

@@ -1,9 +1,16 @@
-import { SessionSnapshot } from "./types.js";
+import { SessionSnapshot, ConversationTurn, StructuredSessionState } from "./types.js";
 import { type PasswordVault, type PasswordVaultItem, type PasswordVaultItemFilter, type PasswordVaultItemInput } from "./password-manager.js";
 export declare const DEFAULT_DB_FILE = "wand.db";
+export type AuthPrincipalKind = "browser-admin" | "connected-app";
+export type AuthScope = "admin" | "sessions" | "files" | "password-vault" | "session-preferences";
+export interface AuthPrincipal {
+    kind: AuthPrincipalKind;
+    scopes: AuthScope[];
+}
 export interface PersistedAuthSession {
     token: string;
     expiresAt: number;
+    principal: AuthPrincipal;
 }
 export declare function resolveDatabasePath(configPath: string): string;
 export declare function ensureDatabaseFile(dbPath: string): boolean;
@@ -11,6 +18,11 @@ export declare class WandStorage {
     private readonly db;
     constructor(dbPath: string);
     close(): void;
+    /**
+     * Run a synchronous group of storage operations atomically. Calls must not
+     * be nested because SQLite does not support a second BEGIN on this connection.
+     */
+    transaction<T>(action: () => T): T;
     /** Get a config value from database */
     getConfigValue(key: string): string | null;
     /** Set a config value in database */
@@ -43,17 +55,23 @@ export declare class WandStorage {
     updatePasswordItem(id: string, input: PasswordVaultItemInput): PasswordVaultItem | null;
     touchPasswordItem(id: string): PasswordVaultItem | null;
     deletePasswordItem(id: string): boolean;
-    saveAuthSession(token: string, expiresAt: number): void;
+    saveAuthSession(token: string, expiresAt: number, principal?: AuthPrincipal): void;
     getAuthSession(token: string): PersistedAuthSession | null;
     deleteAuthSession(token: string): void;
+    deleteAllAuthSessions(): void;
     deleteExpiredAuthSessions(now: number): void;
     saveSession(snapshot: SessionSnapshot): void;
+    /** Update runtime/scalar fields without serializing or rewriting messages/output. */
+    updateSessionRuntimeMetadata(snapshot: SessionSnapshot): void;
+    /** Compatibility alias for older callers; intentionally excludes output/messages. */
+    saveSessionMetadata(snapshot: SessionSnapshot): void;
+    /** Checkpoint only the PTY/structured text output window. */
+    checkpointSessionOutput(id: string, output: string): void;
     /**
-     * Lightweight update — only touches scalar session fields, skips messages.
-     * Use this in the hot persist path to avoid serializing large message arrays.
-     * Full messages are written by saveSession() at state transitions (exit/stop).
+     * Checkpoint the conversation payload once, optionally folding the matching
+     * structured state/output into the same statement.
      */
-    saveSessionMetadata(snapshot: SessionSnapshot): void;
+    checkpointSessionMessages(id: string, messages: ConversationTurn[], structuredState?: StructuredSessionState | null, output?: string): void;
     getSession(id: string): SessionSnapshot | null;
     getLatestSessionByClaudeSessionId(claudeSessionId: string): SessionSnapshot | null;
     loadSessions(): SessionSnapshot[];

package/dist/storage.js

@@ -1,5 +1,5 @@
 import crypto from "node:crypto";
-import { existsSync, mkdirSync } from "node:fs";
+import { chmodSync, existsSync, mkdirSync } from "node:fs";
 import path from "node:path";
 import { DatabaseSync } from "node:sqlite";
 import { DEFAULT_PASSWORD_VAULT_ID, DEFAULT_PASSWORD_VAULT_NAME, itemMatchesFilter, normalizePasswordItemInput, normalizeVaultName, nowIso, } from "./password-manager.js";
@@ -13,6 +13,157 @@ function safeJsonParse(raw) {
         return undefined;
     }
 }
+const SESSION_OPTIONS_SCHEMA_VERSION = 1;
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isAutonomyPolicy(value) {
+    return value === "assist" || value === "agent" || value === "agent-max";
+}
+function isApprovalPolicy(value) {
+    return value === "ask-every-time" || value === "approve-once" || value === "remember-this-turn";
+}
+function isEscalationScope(value) {
+    return value === "write_file"
+        || value === "run_command"
+        || value === "network"
+        || value === "outside_workspace"
+        || value === "dangerous_shell"
+        || value === "unknown";
+}
+function isEscalationResolution(value) {
+    return value === "approve_once" || value === "approve_turn" || value === "deny" || value === "fallback_manual";
+}
+function parsePendingEscalation(value) {
+    if (!isRecord(value)
+        || typeof value.requestId !== "string"
+        || !isEscalationScope(value.scope)
+        || (value.runner !== "json" && value.runner !== "pty")
+        || (value.source !== "tool_permission_request"
+            && value.source !== "sandbox_hard_block"
+            && value.source !== "workspace_policy_limit"
+            && value.source !== "cli_capability_limit"
+            && value.source !== "unknown")
+        || typeof value.reason !== "string") {
+        return undefined;
+    }
+    const parsed = {
+        requestId: value.requestId,
+        scope: value.scope,
+        runner: value.runner,
+        source: value.source,
+        reason: value.reason,
+    };
+    if (isEscalationResolution(value.resolution))
+        parsed.resolution = value.resolution;
+    if (typeof value.target === "string")
+        parsed.target = value.target;
+    return parsed;
+}
+function parseLastEscalationResult(value) {
+    if (!isRecord(value)
+        || typeof value.requestId !== "string"
+        || !isEscalationResolution(value.resolution)
+        || typeof value.reason !== "string") {
+        return undefined;
+    }
+    return {
+        requestId: value.requestId,
+        resolution: value.resolution,
+        reason: value.reason,
+    };
+}
+function parseApprovalStats(value) {
+    if (!isRecord(value))
+        return undefined;
+    const counts = [value.tool, value.command, value.file, value.total];
+    if (!counts.every((count) => Number.isSafeInteger(count) && count >= 0))
+        return undefined;
+    return {
+        tool: value.tool,
+        command: value.command,
+        file: value.file,
+        total: value.total,
+    };
+}
+function isThinkingEffort(value) {
+    return value === "off"
+        || value === "standard"
+        || value === "deep"
+        || value === "max"
+        || (typeof value === "string" && /^codex:[a-z0-9][a-z0-9_-]{0,31}$/.test(value));
+}
+function serializeSessionOptions(snapshot) {
+    const options = {
+        schemaVersion: SESSION_OPTIONS_SCHEMA_VERSION,
+        autonomyPolicy: snapshot.autonomyPolicy,
+        approvalPolicy: snapshot.approvalPolicy,
+        allowedScopes: snapshot.allowedScopes,
+        pendingEscalation: snapshot.pendingEscalation,
+        lastEscalationResult: snapshot.lastEscalationResult,
+        autoApprovePermissions: snapshot.autoApprovePermissions,
+        approvalStats: snapshot.approvalStats,
+        selectedModel: snapshot.selectedModel,
+        thinkingEffort: snapshot.thinkingEffort,
+        ptyCols: snapshot.ptyCols,
+        ptyRows: snapshot.ptyRows,
+        currentTaskTitle: snapshot.currentTaskTitle,
+        summary: snapshot.summary,
+    };
+    return JSON.stringify(options);
+}
+function parseSessionOptions(raw) {
+    const parsed = safeJsonParse(raw);
+    if (!isRecord(parsed) || parsed.schemaVersion !== SESSION_OPTIONS_SCHEMA_VERSION)
+        return {};
+    const options = {};
+    if (isAutonomyPolicy(parsed.autonomyPolicy))
+        options.autonomyPolicy = parsed.autonomyPolicy;
+    if (isApprovalPolicy(parsed.approvalPolicy))
+        options.approvalPolicy = parsed.approvalPolicy;
+    if (Array.isArray(parsed.allowedScopes)) {
+        options.allowedScopes = parsed.allowedScopes.filter(isEscalationScope);
+    }
+    if (parsed.pendingEscalation === null) {
+        options.pendingEscalation = null;
+    }
+    else {
+        const pendingEscalation = parsePendingEscalation(parsed.pendingEscalation);
+        if (pendingEscalation)
+            options.pendingEscalation = pendingEscalation;
+    }
+    if (parsed.lastEscalationResult === null) {
+        options.lastEscalationResult = null;
+    }
+    else {
+        const lastEscalationResult = parseLastEscalationResult(parsed.lastEscalationResult);
+        if (lastEscalationResult)
+            options.lastEscalationResult = lastEscalationResult;
+    }
+    if (typeof parsed.autoApprovePermissions === "boolean") {
+        options.autoApprovePermissions = parsed.autoApprovePermissions;
+    }
+    const approvalStats = parseApprovalStats(parsed.approvalStats);
+    if (approvalStats)
+        options.approvalStats = approvalStats;
+    if (parsed.selectedModel === null || typeof parsed.selectedModel === "string") {
+        options.selectedModel = parsed.selectedModel;
+    }
+    if (parsed.thinkingEffort === null || isThinkingEffort(parsed.thinkingEffort)) {
+        options.thinkingEffort = parsed.thinkingEffort;
+    }
+    if (Number.isSafeInteger(parsed.ptyCols) && parsed.ptyCols > 0) {
+        options.ptyCols = parsed.ptyCols;
+    }
+    if (Number.isSafeInteger(parsed.ptyRows) && parsed.ptyRows > 0) {
+        options.ptyRows = parsed.ptyRows;
+    }
+    if (typeof parsed.currentTaskTitle === "string")
+        options.currentTaskTitle = parsed.currentTaskTitle;
+    if (typeof parsed.summary === "string")
+        options.summary = parsed.summary;
+    return options;
+}
 function parseQueuedMessages(raw) {
     const parsed = safeJsonParse(raw);
     return Array.isArray(parsed) ? parsed.filter((item) => typeof item === "string") : undefined;
@@ -69,12 +220,12 @@ function mapWorktreeMergeFields(row) {
 }
 function sessionSelectFields() {
     return `id, session_source, automation_id, provider, session_kind, runner, command, cwd, mode, status, exit_code, started_at, ended_at, output, archived, archived_at, claude_session_id, messages, queued_messages, structured_state
-             , resumed_from_session_id, auto_recovered, worktree_enabled, worktree_info, worktree_merge_status, worktree_merge_info, title, description`;
+             , resumed_from_session_id, auto_recovered, worktree_enabled, worktree_info, worktree_merge_status, worktree_merge_info, title, description, session_options`;
 }
 function sessionPersistFields() {
     return `id, session_source, automation_id, command, cwd, mode, status, exit_code, started_at, ended_at, output
              , archived, archived_at, claude_session_id, provider, session_kind, runner, messages, queued_messages, structured_state
-             , resumed_from_session_id, auto_recovered, worktree_enabled, worktree_info, worktree_merge_status, worktree_merge_info, title, description`;
+             , resumed_from_session_id, auto_recovered, worktree_enabled, worktree_info, worktree_merge_status, worktree_merge_info, title, description, session_options`;
 }
 function sessionPersistAssignments() {
     return `session_source = excluded.session_source,
@@ -103,17 +254,18 @@ function sessionPersistAssignments() {
              worktree_merge_status = excluded.worktree_merge_status,
              worktree_merge_info = excluded.worktree_merge_info,
              title = excluded.title,
-             description = excluded.description`;
+             description = excluded.description,
+             session_options = excluded.session_options`;
 }
-function sessionMetadataAssignments() {
+function sessionRuntimeMetadataAssignments() {
     return `session_source = ?, automation_id = ?,
            command = ?, cwd = ?, mode = ?, status = ?, exit_code = ?,
-           started_at = ?, ended_at = ?, output = ?,
+           started_at = ?, ended_at = ?,
            archived = ?, archived_at = ?, claude_session_id = ?,
-           provider = ?, session_kind = ?, runner = ?, structured_state = ?,
+           provider = ?, session_kind = ?, runner = ?, queued_messages = ?, structured_state = ?,
            resumed_from_session_id = ?, auto_recovered = ?,
            worktree_enabled = ?, worktree_info = ?, worktree_merge_status = ?, worktree_merge_info = ?,
-           title = ?, description = ?`;
+           title = ?, description = ?, session_options = ?`;
 }
 function sessionPersistValues(snapshot) {
     return [
@@ -145,9 +297,10 @@ function sessionPersistValues(snapshot) {
         serializeWorktreeMergeInfo(snapshot.worktreeMergeInfo),
         snapshot.title ?? null,
         snapshot.description ?? null,
+        serializeSessionOptions(snapshot),
     ];
 }
-function sessionMetadataValues(snapshot) {
+function sessionRuntimeMetadataValues(snapshot) {
     return [
         normalizeSessionSource(snapshot.sessionSource),
         snapshot.automationId ?? null,
@@ -158,13 +311,13 @@ function sessionMetadataValues(snapshot) {
         snapshot.exitCode,
         snapshot.startedAt,
         snapshot.endedAt,
-        snapshot.output,
         snapshot.archived ? 1 : 0,
         snapshot.archivedAt,
         snapshot.claudeSessionId,
         snapshot.provider ?? null,
         snapshot.sessionKind ?? "pty",
         snapshot.runner ?? null,
+        snapshot.queuedMessages ? JSON.stringify(snapshot.queuedMessages) : null,
         snapshot.structuredState ? JSON.stringify(snapshot.structuredState) : null,
         snapshot.resumedFromSessionId ?? null,
         snapshot.autoRecovered ? 1 : 0,
@@ -174,11 +327,13 @@ function sessionMetadataValues(snapshot) {
         serializeWorktreeMergeInfo(snapshot.worktreeMergeInfo),
         snapshot.title ?? null,
         snapshot.description ?? null,
+        serializeSessionOptions(snapshot),
         snapshot.id,
     ];
 }
 function mapSessionCore(row) {
     const provider = inferSessionProvider(row);
+    const sessionOptions = parseSessionOptions(row.session_options);
     return {
         id: row.id,
         sessionSource: normalizeSessionSource(row.session_source),
@@ -207,6 +362,10 @@ function mapSessionCore(row) {
         title: row.title ?? undefined,
         description: row.description ?? undefined,
         ...mapWorktreeMergeFields(row),
+        ...sessionOptions,
+        ...(Object.prototype.hasOwnProperty.call(sessionOptions, "pendingEscalation")
+            ? { permissionBlocked: Boolean(sessionOptions.pendingEscalation) }
+            : {}),
     };
 }
 function sessionRowQuery(base) {
@@ -219,7 +378,9 @@ export function resolveDatabasePath(configPath) {
 const INIT_SQL = `
   CREATE TABLE IF NOT EXISTS auth_sessions (
     token TEXT PRIMARY KEY,
-    expires_at INTEGER NOT NULL
+    expires_at INTEGER NOT NULL,
+    kind TEXT NOT NULL DEFAULT 'browser-admin',
+    scopes TEXT NOT NULL DEFAULT '["admin"]'
   );
 
   CREATE TABLE IF NOT EXISTS command_sessions (
@@ -251,7 +412,8 @@ const INIT_SQL = `
     worktree_merge_status TEXT,
     worktree_merge_info TEXT,
     title TEXT,
-    description TEXT
+    description TEXT,
+    session_options TEXT NOT NULL DEFAULT '{"schemaVersion":1}'
   );
 
   CREATE TABLE IF NOT EXISTS app_config (
@@ -291,26 +453,53 @@ const INIT_SQL = `
   CREATE INDEX IF NOT EXISTS idx_password_items_updated ON password_items(updated_at);
 `;
 export function ensureDatabaseFile(dbPath) {
-    mkdirSync(path.dirname(dbPath), { recursive: true });
+    const dir = path.dirname(dbPath);
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    chmodSync(dir, 0o700);
     const created = !existsSync(dbPath);
     const db = new DatabaseSync(dbPath);
     db.exec(INIT_SQL);
+    ensureAuthSessionSchema(db);
     ensureCommandSessionSchema(db);
     db.close();
+    chmodSync(dbPath, 0o600);
     return created;
 }
 export class WandStorage {
     db;
     constructor(dbPath) {
-        mkdirSync(path.dirname(dbPath), { recursive: true });
+        const dir = path.dirname(dbPath);
+        mkdirSync(dir, { recursive: true, mode: 0o700 });
+        chmodSync(dir, 0o700);
         this.db = new DatabaseSync(dbPath);
+        chmodSync(dbPath, 0o600);
         this.db.exec(INIT_SQL);
+        ensureAuthSessionSchema(this.db);
         ensureCommandSessionSchema(this.db);
         this.ensureDefaultPasswordVault();
     }
     close() {
         this.db.close();
     }
+    /**
+     * Run a synchronous group of storage operations atomically. Calls must not
+     * be nested because SQLite does not support a second BEGIN on this connection.
+     */
+    transaction(action) {
+        this.db.exec("BEGIN IMMEDIATE");
+        try {
+            const result = action();
+            this.db.exec("COMMIT");
+            return result;
+        }
+        catch (error) {
+            try {
+                this.db.exec("ROLLBACK");
+            }
+            catch { /* preserve the original error */ }
+            throw error;
+        }
+    }
     // ============ Config Methods ============
     /** Get a config value from database */
     getConfigValue(key) {
@@ -494,59 +683,84 @@ export class WandStorage {
         return result.changes > 0;
     }
     // ============ Auth Session Methods ============
-    saveAuthSession(token, expiresAt) {
+    saveAuthSession(token, expiresAt, principal = { kind: "browser-admin", scopes: ["admin"] }) {
         this.db
-            .prepare(`INSERT INTO auth_sessions (token, expires_at)
-         VALUES (?, ?)
-         ON CONFLICT(token) DO UPDATE SET expires_at = excluded.expires_at`)
-            .run(token, expiresAt);
+            .prepare(`INSERT INTO auth_sessions (token, expires_at, kind, scopes)
+         VALUES (?, ?, ?, ?)
+         ON CONFLICT(token) DO UPDATE SET
+           expires_at = excluded.expires_at,
+           kind = excluded.kind,
+           scopes = excluded.scopes`)
+            .run(token, expiresAt, principal.kind, JSON.stringify(principal.scopes));
     }
     getAuthSession(token) {
         const row = this.db
-            .prepare("SELECT token, expires_at FROM auth_sessions WHERE token = ?")
+            .prepare("SELECT token, expires_at, kind, scopes FROM auth_sessions WHERE token = ?")
             .get(token);
         if (!row) {
             return null;
         }
         return {
             token: row.token,
-            expiresAt: row.expires_at
+            expiresAt: row.expires_at,
+            principal: parseAuthPrincipal(row.kind, row.scopes),
         };
     }
     deleteAuthSession(token) {
         this.db.prepare("DELETE FROM auth_sessions WHERE token = ?").run(token);
     }
+    deleteAllAuthSessions() {
+        this.db.prepare("DELETE FROM auth_sessions").run();
+    }
     deleteExpiredAuthSessions(now) {
         this.db.prepare("DELETE FROM auth_sessions WHERE expires_at < ?").run(now);
     }
     saveSession(snapshot) {
-        this.db.exec("BEGIN IMMEDIATE");
-        try {
-            this.db
-                .prepare(`INSERT INTO command_sessions (
-           ${sessionPersistFields()}
-           ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-           ON CONFLICT(id) DO UPDATE SET
-             ${sessionPersistAssignments()}`)
-                .run(...sessionPersistValues(snapshot));
-            this.db.exec("COMMIT");
-        }
-        catch (error) {
-            this.db.exec("ROLLBACK");
-            throw error;
-        }
+        // A single SQLite statement is already atomic. Avoid BEGIN IMMEDIATE in
+        // this hot path so streaming checkpoints do not take an unnecessary write
+        // lock and saveSession can also participate in a caller-owned transaction.
+        this.db
+            .prepare(`INSERT INTO command_sessions (
+         ${sessionPersistFields()}
+         ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+         ON CONFLICT(id) DO UPDATE SET
+           ${sessionPersistAssignments()}`)
+            .run(...sessionPersistValues(snapshot));
+    }
+    /** Update runtime/scalar fields without serializing or rewriting messages/output. */
+    updateSessionRuntimeMetadata(snapshot) {
+        this.db
+            .prepare(`UPDATE command_sessions SET
+           ${sessionRuntimeMetadataAssignments()}
+         WHERE id = ?`)
+            .run(...sessionRuntimeMetadataValues(snapshot));
+    }
+    /** Compatibility alias for older callers; intentionally excludes output/messages. */
+    saveSessionMetadata(snapshot) {
+        this.updateSessionRuntimeMetadata(snapshot);
+    }
+    /** Checkpoint only the PTY/structured text output window. */
+    checkpointSessionOutput(id, output) {
+        this.db.prepare("UPDATE command_sessions SET output = ? WHERE id = ?").run(output, id);
     }
     /**
-     * Lightweight update — only touches scalar session fields, skips messages.
-     * Use this in the hot persist path to avoid serializing large message arrays.
-     * Full messages are written by saveSession() at state transitions (exit/stop).
+     * Checkpoint the conversation payload once, optionally folding the matching
+     * structured state/output into the same statement.
      */
-    saveSessionMetadata(snapshot) {
+    checkpointSessionMessages(id, messages, structuredState, output) {
+        const assignments = ["messages = ?"];
+        const values = [JSON.stringify(messages)];
+        if (structuredState !== undefined) {
+            assignments.push("structured_state = ?");
+            values.push(structuredState ? JSON.stringify(structuredState) : null);
+        }
+        if (output !== undefined) {
+            assignments.push("output = ?");
+            values.push(output);
+        }
         this.db
-            .prepare(`UPDATE command_sessions SET
-           ${sessionMetadataAssignments()}
-         WHERE id = ?`)
-            .run(...sessionMetadataValues(snapshot));
+            .prepare(`UPDATE command_sessions SET ${assignments.join(", ")} WHERE id = ?`)
+            .run(...values, id);
     }
     getSession(id) {
         const row = this.db
@@ -629,7 +843,20 @@ const SCHEMA_MIGRATIONS = [
     ["worktree_merge_info", "ALTER TABLE command_sessions ADD COLUMN worktree_merge_info TEXT"],
     ["title", "ALTER TABLE command_sessions ADD COLUMN title TEXT"],
     ["description", "ALTER TABLE command_sessions ADD COLUMN description TEXT"],
+    ["session_options", `ALTER TABLE command_sessions ADD COLUMN session_options TEXT NOT NULL DEFAULT '{"schemaVersion":1}'`],
 ];
+const AUTH_SESSION_MIGRATIONS = [
+    ["kind", "ALTER TABLE auth_sessions ADD COLUMN kind TEXT NOT NULL DEFAULT 'browser-admin'"],
+    ["scopes", `ALTER TABLE auth_sessions ADD COLUMN scopes TEXT NOT NULL DEFAULT '["admin"]'`],
+];
+function ensureAuthSessionSchema(db) {
+    const columns = db.prepare("PRAGMA table_info(auth_sessions)").all();
+    const names = new Set(columns.map((column) => column.name));
+    for (const [column, sql] of AUTH_SESSION_MIGRATIONS) {
+        if (!names.has(column))
+            db.exec(sql);
+    }
+}
 function ensureCommandSessionSchema(db) {
     const columns = db.prepare("PRAGMA table_info(command_sessions)").all();
     const names = new Set(columns.map((column) => column.name));
@@ -639,3 +866,23 @@ function ensureCommandSessionSchema(db) {
         }
     }
 }
+const AUTH_SCOPES = new Set([
+    "admin",
+    "sessions",
+    "files",
+    "password-vault",
+    "session-preferences",
+]);
+function parseAuthPrincipal(kind, rawScopes) {
+    const normalizedKind = kind === "browser-admin" ? "browser-admin" : "connected-app";
+    const parsed = safeJsonParse(rawScopes);
+    const scopes = Array.isArray(parsed)
+        ? parsed.filter((scope) => typeof scope === "string" && AUTH_SCOPES.has(scope))
+        : [];
+    return {
+        kind: normalizedKind,
+        scopes: normalizedKind === "browser-admin" && !scopes.includes("admin")
+            ? ["admin", ...scopes]
+            : scopes,
+    };
+}

package/dist/structured-claude-adapter.d.ts

@@ -0,0 +1,19 @@
+import type { ExecutionMode, SessionSnapshot } from "./types.js";
+export type WandPermissionMode = "default" | "acceptEdits" | "bypassPermissions";
+export interface PermissionPolicy {
+    permissionMode: WandPermissionMode;
+    allowedTools: string[] | undefined;
+}
+export declare function derivePermissionPolicy(mode: ExecutionMode, autoApprove: boolean, cwd: string): PermissionPolicy;
+export declare function buildAppendSystemPromptParts(language: string | undefined, mode: ExecutionMode): string[];
+export interface ClaudeCliArgsOptions {
+    permissionPolicy: PermissionPolicy;
+    systemPromptParts?: string[];
+}
+export declare function buildClaudeCliArgs(session: SessionSnapshot, options: ClaudeCliArgsOptions): string[];
+export declare function buildClaudeSdkThinking(effort: SessionSnapshot["thinkingEffort"]): {
+    type: "enabled";
+    budgetTokens: number;
+} | {
+    type: "disabled";
+};