@drisp/cli 0.5.28 → 0.6.0

package/README.md

@@ -50,7 +50,7 @@ and model preferences. The runtime handles the rest.
 
 **Harness-agnostic** -- same workflows, same UI, same session model across Claude Code and Codex.
 
-**CI-native** -- `drisp exec` runs headlessly with safe defaults, JSONL output, and structured exit codes.
+**CI-native** -- `drisp run` runs headlessly with safe defaults, JSONL output, and structured exit codes.
 
 <br>
 
@@ -126,19 +126,29 @@ drisp workflow install e2e-test-builder@lespaceman/athena-workflow-marketplace
 
 ## CI / Automation
 
-`drisp exec` is built for pipelines. Safe by default -- permission and question hooks fail unless you opt in.
+`drisp run` is built for pipelines. Safe by default -- permission and question hooks fail unless you opt in.
+
+### Permissions with no hub attached
+
+drisp has a single door. A permission request or a question is answered by whoever is attached to the Run: the interactive terminal, or a paired dashboard delivering decisions. With no hub attached (a headless `drisp run` with no dashboard paired) there is nobody to ask, so under `guarded` and `standard` the request **waits**: the Run holds on the pending decision, and nothing is auto-approved or auto-denied on its behalf. The hold ends one of two ways. If you set `--timeout-ms`, the run exits with the timeout exit code when it expires. If the Run belongs to a workflow, the request is **held, then parked, then replayed**:
+
+- **Hold.** A permission request no rule answers is held for the **grace window** — `permissionGraceMs` in `~/.config/athena/config.json` or `.athena/config.json` (project wins), `--permission-grace-ms` per run, default 60 000 ms — so an attached hub can answer it. With no hub attached there is nobody to wait for, and the request is deferred at once.
+- **Park.** When the window elapses unanswered, the tool call is refused with a _deferred_ result, the Turn ends, and the Run parks in `awaiting_attention` with the request recorded — its id, the tool, and a one-line input summary — in the Journal and on the run record. `drisp runs` shows the pending question and the hub receives it as a `needs_human` frame.
+- **Replay.** `drisp run --continue=<session> --answer=allow|deny "<reply>"` (or an `answer` the hub sends while the Run is parked) stores the answer against that request. On continue the agent re-issues the same call and the stored answer is replayed into it without a prompt; without one, the request is held again. See [human resume](docs/guides/human-resume.md).
+
+**`--isolation autonomous` runs with nobody watching.** A permission prompt that no **ask rule** claims is answered _allow_ by the preset's policy, within the tool surface the preset already grants, and the workflow runs to `WORKFLOW_COMPLETE`. Exactly two things park the Run as needs-human: an ask rule that fires, or a Turn that ends on `<!-- NEEDS_HUMAN: reason -->`. Ask rules are a provisional, per-workflow list of tool-name patterns in `workflow.json` whose prompts must always reach a person — `"askRules": ["Bash", "mcp__github__*"]` — and a parked Run shows in `drisp runs` as **Parked** with the rule that fired (or the marker's reason); `drisp run --continue` wakes it.
 
 ```bash
-drisp exec "summarize risk in this PR"                                        # plain text
-drisp exec "run checks" --json --on-permission=deny --on-question=empty       # JSONL
-drisp exec "write release notes" --output-last-message release-notes.md       # artifact
+drisp run "summarize risk in this PR"                                        # plain text
+drisp run "run checks" --json --on-permission=deny --on-question=empty       # JSONL
+drisp run "write release notes" --output-last-message release-notes.md       # artifact
 ```
 
 <details>
 <summary>GitHub Actions</summary>
 
 ```yaml
-name: drisp-exec
+name: drisp-run
 on: [pull_request]
 jobs:
   drisp:
@@ -149,7 +159,7 @@ jobs:
         with:
           node-version: 20
       - run: npm ci
-      - run: npx @drisp/cli exec "summarize risk in this PR" \
+      - run: npx @drisp/cli run "summarize risk in this PR" \
           --json --on-permission=deny --on-question=empty \
           --output-last-message drisp-summary.md
       - uses: actions/upload-artifact@v4
@@ -164,11 +174,11 @@ jobs:
 <summary>GitLab CI</summary>
 
 ```yaml
-drisp_exec:
+drisp_run:
   image: node:20
   script:
     - npm ci
-    - npx @drisp/cli exec "summarize pipeline status" \
+    - npx @drisp/cli run "summarize pipeline status" \
       --json --on-permission=deny --on-question=empty \
       --output-last-message drisp-summary.md
   artifacts:
@@ -181,20 +191,48 @@ drisp_exec:
 <details>
 <summary>Exit codes</summary>
 
-| Code | Meaning                           |
-| ---- | --------------------------------- |
-| `0`  | Success                           |
-| `2`  | Usage / validation error          |
-| `3`  | Bootstrap / configuration failure |
-| `4`  | Runtime / process failure         |
-| `5`  | Non-interactive policy failure    |
-| `6`  | Timeout exceeded                  |
-| `7`  | Output write failure              |
+| Code | Meaning                                                                 |
+| ---- | ----------------------------------------------------------------------- |
+| `0`  | Execution returned; check workflow outcome for completion or suspension |
+| `2`  | Usage / validation error                                                |
+| `3`  | Bootstrap / configuration failure                                       |
+| `4`  | Runtime / process failure                                               |
+| `5`  | Reserved legacy policy code (no longer emitted)                         |
+| `6`  | Timeout exceeded                                                        |
+| `7`  | Output write failure                                                    |
 
 </details>
 
 <br>
 
+## Runner
+
+`drisp runner` is the one long-lived process that pairs a machine with the hub, receives its Runs over the instance socket, and executes them. The instance socket is the default delivery path. Assignments can also request a per-run callback socket and artifact uploads; see the [delivery contract](docs/execution-contract.md#compatibility-and-delivery).
+
+```bash
+drisp runner pair <token> --url https://hub.example.com   # pair, then start the runner in the background
+drisp runner                                              # run it in the foreground (Ctrl-C stops it)
+drisp runner --detach                                     # start it in the background
+drisp runner status                                       # pairing, process, socket, token — non-zero on any unhealthy axis
+drisp runner runs --active                                # the Runs it has handled
+drisp runner logs --follow                                # tail its log
+drisp runner stop                                         # SIGTERM to the pid in runner.pid
+drisp runner install                                      # launchd / systemd unit so it starts on login
+```
+
+A second `drisp runner` on the same machine exits non-zero with `already running (pid N)`. Its state lives in `~/.local/state/drisp/`:
+
+| File                 | What it is                                                                                                                                                                          |
+| -------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `runner.pid`         | Liveness and the single-instance lock.                                                                                                                                              |
+| `runner.status.json` | The runner's snapshot (socket, wire mode, active and recent Runs), rewritten on change; what `status` and `runs` read. Removed on a clean stop.                                     |
+| `runner.db`          | One SQLite database: the feed outbox the runner drains to the hub and the decision inbox the hub's answers wait in. A runner killed mid-Run drains and re-delivers both on restart. |
+| `runner.log`         | The rotating log.                                                                                                                                                                   |
+
+`drisp dashboard <sub>` is a deprecated alias of `drisp runner` for one release (`dashboard daemon start` is `runner --detach`; `daemon foreground` / `connect` is bare `runner`). The pre-0.6 `dashboard-feed-outbox.db` and `dashboard-decision-inbox.db` are imported into `runner.db` on the first start and removed.
+
+<br>
+
 ## Configuration
 
 Config merges in order: **global &rarr; project &rarr; CLI flags**.
@@ -216,41 +254,42 @@ Config merges in order: **global &rarr; project &rarr; CLI flags**.
 <details>
 <summary>CLI flags</summary>
 
-| Flag            | Description                                   |
-| --------------- | --------------------------------------------- |
-| `--project-dir` | Project directory (default: cwd)              |
-| `--plugin`      | Path to a plugin directory (repeatable)       |
-| `--isolation`   | `strict` (default) · `minimal` · `permissive` |
-| `--theme`       | `dark` (default) · `light` · `high-contrast`  |
-| `--ascii`       | ASCII-only UI glyphs                          |
-| `--verbose`     | Extra rendering detail                        |
-
-**exec-only:**
-
-| Flag                    | Description                                            |
-| ----------------------- | ------------------------------------------------------ |
-| `--continue`            | Resume most recent exec session (or `--continue=<id>`) |
-| `--json`                | JSONL lifecycle events on stdout                       |
-| `--output-last-message` | Write final assistant message to a file                |
-| `--ephemeral`           | Disable session persistence for this run               |
-| `--on-permission`       | `allow` · `deny` · `fail` (default)                    |
-| `--on-question`         | `empty` · `fail` (default)                             |
-| `--timeout-ms`          | Hard timeout for the run                               |
+| Flag            | Description                                     |
+| --------------- | ----------------------------------------------- |
+| `--project-dir` | Project directory (default: cwd)                |
+| `--plugin`      | Path to a plugin directory (repeatable)         |
+| `--isolation`   | `guarded` (default) · `standard` · `autonomous` |
+| `--theme`       | `dark` (default) · `light` · `high-contrast`    |
+| `--ascii`       | ASCII-only UI glyphs                            |
+| `--verbose`     | Extra rendering detail                          |
+
+**run-only:**
+
+| Flag                    | Description                                           |
+| ----------------------- | ----------------------------------------------------- |
+| `--continue`            | Resume most recent run session (or `--continue=<id>`) |
+| `--steer`               | Queue a human steer for the next Turn (repeatable)    |
+| `--json`                | JSONL lifecycle events on stdout                      |
+| `--output-last-message` | Write final assistant message to a file               |
+| `--ephemeral`           | Disable session persistence for this run              |
+| `--on-permission`       | `allow` · `deny` · `fail` (default)                   |
+| `--on-question`         | `empty` · `fail` (default)                            |
+| `--timeout-ms`          | Hard timeout for the run                              |
 
 </details>
 
 <details>
 <summary>Commands</summary>
 
-| Command             | Description                                                  |
-| ------------------- | ------------------------------------------------------------ |
-| _(default)_         | Start interactive session in cwd                             |
-| `setup`             | Re-run setup wizard                                          |
-| `sessions`          | Interactive session picker                                   |
-| `resume [id]`       | Resume most recent or specific session                       |
-| `exec "<prompt>"`   | Headless run for CI / scripting                              |
-| `workflow <sub>`    | `install` · `list` · `search` · `remove` · `upgrade` · `use` |
-| `marketplace <sub>` | `add` · `refresh` · `remove` · `list`                        |
+| Command             | Description                                                    |
+| ------------------- | -------------------------------------------------------------- |
+| _(default)_         | Start interactive session in cwd                               |
+| `setup`             | Re-run setup wizard                                            |
+| `sessions`          | Interactive session picker                                     |
+| `resume [id]`       | Resume most recent or specific session                         |
+| `run "<prompt>"`    | Headless run for CI / scripting (`exec` is a deprecated alias) |
+| `workflow <sub>`    | `install` · `list` · `search` · `remove` · `upgrade` · `use`   |
+| `marketplace <sub>` | `add` · `refresh` · `remove` · `list`                          |
 
 </details>
 
@@ -284,3 +323,5 @@ Commit the output so others can build without the generator.
 ## License
 
 [MIT](LICENSE)
+
+For a plain-English source map, see the [architecture diagrams](docs/drisp-architecture.md). The [execution contract](docs/execution-contract.md) explains continuation, configuration precedence, failures, and contributor checks.

package/dist/{WorkflowInstallWizard-7OSOOVS2.js → WorkflowInstallWizard-JLB7P37Y.js}

@@ -1,14 +1,15 @@
 import {
   McpOptionsStep,
   StepStatus
-} from "./chunk-2HR7FV3M.js";
+} from "./chunk-KPDCVR6Q.js";
 import {
   collectMcpServersWithOptions,
   installWorkflowFromSource,
   installWorkflowPlugins,
   resolveWorkflow,
   writeGlobalConfig
-} from "./chunk-2QV7YSX6.js";
+} from "./chunk-QVRTU2MM.js";
+import "./chunk-PZ5AY32C.js";
 
 // src/setup/steps/WorkflowInstallWizard.tsx
 import { useState, useEffect, useCallback, useRef } from "react";
@@ -92,4 +93,4 @@ function WorkflowInstallWizard({ source, onDone }) {
 export {
   WorkflowInstallWizard as default
 };
-//# sourceMappingURL=WorkflowInstallWizard-7OSOOVS2.js.map
+//# sourceMappingURL=WorkflowInstallWizard-JLB7P37Y.js.map

package/dist/chunk-GMB4EJLK.js

@@ -0,0 +1,56 @@
+import {
+  startRunnerProcess
+} from "./chunk-PMRYQUBV.js";
+
+// src/app/entry/runnerDaemon.ts
+import path from "path";
+import { fileURLToPath } from "url";
+async function runRunnerDaemonEntry() {
+  if (startedViaDeprecatedEntry()) {
+    process.stderr.write(
+      'drisp runner: started through the deprecated drisp-dashboard-daemon entry (removed in 0.7.0); run "drisp runner install" to refresh the service unit.\n'
+    );
+  }
+  let runner;
+  try {
+    runner = await startRunnerProcess();
+  } catch (err) {
+    process.stderr.write(
+      `drisp runner: ${err instanceof Error ? err.message : String(err)}
+`
+    );
+    return 1;
+  }
+  const reason = await new Promise((resolve) => {
+    const onSignal = (signal) => {
+      process.off("SIGINT", onSignal);
+      process.off("SIGTERM", onSignal);
+      resolve(signal);
+    };
+    process.on("SIGINT", onSignal);
+    process.on("SIGTERM", onSignal);
+  });
+  await runner.stop(reason);
+  return 0;
+}
+function startedViaDeprecatedEntry() {
+  try {
+    return path.basename(fileURLToPath(import.meta.url)).startsWith("dashboard-daemon");
+  } catch {
+    return false;
+  }
+}
+if (process.argv.includes("--help")) {
+  process.stdout.write(
+    'Usage: drisp-runner\n\nStarts the paired runner service. Use "drisp runner" to pair, install, inspect, or stop it.\n'
+  );
+} else {
+  void runRunnerDaemonEntry().then((code) => {
+    process.exit(code);
+  });
+}
+
+export {
+  runRunnerDaemonEntry
+};
+//# sourceMappingURL=chunk-GMB4EJLK.js.map

package/dist/{chunk-2HR7FV3M.js → chunk-KPDCVR6Q.js}

@@ -499,4 +499,4 @@ export {
   StepStatus,
   McpOptionsStep
 };
-//# sourceMappingURL=chunk-2HR7FV3M.js.map
+//# sourceMappingURL=chunk-KPDCVR6Q.js.map