@drisp/cli 0.7.13 → 0.7.14

package/README.md

@@ -128,6 +128,10 @@ drisp workflow install e2e-test-builder@lespaceman/athena-workflow-marketplace
 
 `drisp run` is built for pipelines. Safe by default -- permission and question hooks fail unless you opt in.
 
+### Human gates
+
+In a Workflow Run, four actions stop the session for a member: plan approval, merges, the token budget, and irreversible actions (deploys, releases, publishes, destructive git). Set each one to `ask` or `auto` in `.athena/config.json` under `"gates"`, or for one run with `--gate merge=ask`. Merges and irreversible actions are enforced by PreToolUse hook rules for the session and every subagent. See [docs/human-gates.md](docs/human-gates.md) for the matcher's rules.
+
 ### Permissions with no hub attached
 
 drisp has a single door. A permission request or a question is answered by whoever is attached to the Run: the interactive terminal, or the hub delivering decisions through the Runner. With no hub attached (a headless `drisp run`) there is nobody to ask, so under `guarded` and `standard` the request **waits**: the Run holds on the pending decision, and nothing is auto-approved or auto-denied on its behalf. The hold ends one of two ways. If you set `--timeout-ms`, the run exits with the timeout exit code when it expires. If the Run belongs to a workflow, the request is **held, then parked, then replayed**:
@@ -138,6 +142,8 @@ drisp has a single door. A permission request or a question is answered by whoev
 
 **`--isolation autonomous` runs with nobody watching.** A permission prompt that no **ask rule** claims is answered _allow_ by the preset's policy, within the tool surface the preset already grants, and the workflow runs to `WORKFLOW_COMPLETE`. Exactly two things park the Run as needs-human: an ask rule that fires, or a Turn that ends on `<!-- NEEDS_HUMAN: reason -->`. Ask rules are a provisional, per-workflow list of tool-name patterns in `workflow.json` whose prompts must always reach a person — `"askRules": ["Bash", "mcp__github__*"]` — and a parked Run shows in `drisp runs` as **Parked** with the rule that fired (or the marker's reason); `drisp run --continue` wakes it.
 
+**A Workflow can allow the native subagent tools no preset grants.** `"allowedTools": ["SendMessage", "ToolSearch", "Monitor", "TaskStop", "ListAgents"]` in `workflow.json` answers those permission prompts _allow_ under any preset, in `drisp run` and the interactive session alike. Only these five names and exact MCP tool names (`mcp__<server>__<tool>`, no wildcards) are accepted; anything else fails validation. In `drisp run` an ask rule naming the same tool still claims it; the interactive session does not apply ask rules. The presets themselves stay as they are.
+
 ```bash
 drisp run "summarize risk in this PR"                                        # plain text
 drisp run "run checks" --json --on-permission=deny --on-question=empty       # JSONL

package/dist/{WorkflowInstallWizard-VPBOZJY5.js → WorkflowInstallWizard-MVTO43MW.js}

@@ -8,7 +8,7 @@ import {
   installWorkflowPlugins,
   resolveWorkflow,
   writeGlobalConfig
-} from "./chunk-SACVOS6T.js";
+} from "./chunk-GGAPZULS.js";
 import "./chunk-G3PMV62Z.js";
 
 // src/setup/steps/WorkflowInstallWizard.tsx
@@ -93,4 +93,4 @@ function WorkflowInstallWizard({ source, onDone }) {
 export {
   WorkflowInstallWizard as default
 };
-//# sourceMappingURL=WorkflowInstallWizard-VPBOZJY5.js.map
+//# sourceMappingURL=WorkflowInstallWizard-MVTO43MW.js.map

package/dist/{chunk-CD6EY4ZE.js → chunk-3LF5QYZK.js}

@@ -1,6 +1,6 @@
 import {
   runMachineRunners
-} from "./chunk-5TM2ARN3.js";
+} from "./chunk-HCTFAAGU.js";
 
 // src/app/entry/runnerDaemon.ts
 if (process.argv.includes("--help")) {
@@ -13,4 +13,4 @@ if (process.argv.includes("--help")) {
     process.exitCode = 1;
   });
 }
-//# sourceMappingURL=chunk-CD6EY4ZE.js.map
+//# sourceMappingURL=chunk-3LF5QYZK.js.map

package/dist/{chunk-SACVOS6T.js → chunk-GGAPZULS.js}

@@ -887,6 +887,177 @@ function resolveMarketplacePluginTargetFromRepo(ref, repoDir) {
 import fs5 from "fs";
 import os3 from "os";
 import path4 from "path";
+
+// src/core/gates/gates.ts
+import { createHash } from "crypto";
+var GATE_NAMES = [
+  "planApproval",
+  "merge",
+  "budget",
+  "irreversible"
+];
+var DEFAULT_GATES = Object.freeze({
+  planApproval: "ask",
+  merge: "auto",
+  budget: "ask",
+  irreversible: "ask"
+});
+function resolveGates(sources) {
+  const gates = { ...DEFAULT_GATES };
+  const provenance = Object.fromEntries(
+    GATE_NAMES.map((name) => [name, "default"])
+  );
+  for (const name of GATE_NAMES) {
+    const floors = ["team", "global"].filter(
+      (source) => sources[source]?.[name] !== void 0
+    );
+    if (floors.length === 0) continue;
+    const asking = floors.find((source) => sources[source][name] === "ask");
+    gates[name] = asking ? "ask" : "auto";
+    provenance[name] = asking ?? floors[0];
+  }
+  const ignored = [];
+  for (const source of ["project", "build"]) {
+    const tightened = tightenGates(gates, sources[source]);
+    for (const name of GATE_NAMES) {
+      if (tightened.gates[name] !== gates[name]) provenance[name] = source;
+    }
+    for (const gate of tightened.ignored) {
+      ignored.push({
+        gate,
+        source,
+        floor: provenance[gate]
+      });
+    }
+    Object.assign(gates, tightened.gates);
+  }
+  return { gates, provenance, ignored };
+}
+function tightenGates(base, overrides) {
+  const gates = { ...base };
+  const ignored = [];
+  for (const name of GATE_NAMES) {
+    const mode = overrides?.[name];
+    if (mode === "ask") gates[name] = "ask";
+    else if (mode === "auto" && base[name] === "ask") ignored.push(name);
+  }
+  return { gates, ignored };
+}
+function describeIgnoredGate(input2) {
+  return `gate ${input2.gate}=auto from ${input2.source} ignored: the ${input2.floor} floor is ask, and a ${input2.source} setting may only tighten a gate`;
+}
+function isGateName(name) {
+  return GATE_NAMES.includes(name);
+}
+function parseGateOverrides(raw, where) {
+  if (raw === void 0) return void 0;
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+    throw new Error(
+      `Invalid config: "${where}" field "gates" must be an object of gate \u2192 "ask" | "auto"`
+    );
+  }
+  const out = {};
+  for (const [name, mode] of Object.entries(raw)) {
+    if (!isGateName(name)) {
+      throw new Error(
+        `Invalid config: "${where}" has unknown gate "${name}" (gates: ${GATE_NAMES.join(", ")})`
+      );
+    }
+    if (mode !== "ask" && mode !== "auto") {
+      throw new Error(
+        `Invalid config: "${where}" gate "${name}" must be "ask" or "auto"`
+      );
+    }
+    out[name] = mode;
+  }
+  return out;
+}
+function parseGateFlags(flags) {
+  if (!flags || flags.length === 0) return void 0;
+  const out = {};
+  for (const pair of flags.flatMap((flag) => flag.split(","))) {
+    const [name, mode] = pair.trim().split("=");
+    if (!name || !isGateName(name) || mode !== "ask" && mode !== "auto") {
+      throw new Error(
+        `--gate expects <gate>=ask|auto with gate one of ${GATE_NAMES.join(", ")}; got "${pair}"`
+      );
+    }
+    out[name] = mode;
+  }
+  return out;
+}
+function gateDenialReason(input2) {
+  return `Drisp gate: ${input2.gate} is ask \u2014 this call ${input2.reason} (\`${input2.command}\`) and needs a member's approval. It was not run. Do not retry it or work around the gate. ` + (input2.subagent ? "Report blocked to the Orchestrator with this exact command as the decision needed." : "Finish what you can without it, note it in the Journal, and end your Turn: the Run parks for the member once no subagent is running, and you are woken with their answer.");
+}
+function isPlanStartAnswer(value) {
+  if (typeof value === "string")
+    return /\{\s*"choice"\s*:\s*"start"\s*\}/.test(value);
+  return typeof value === "object" && value !== null && value.choice === "start";
+}
+var DISPATCH_TOOLS = /* @__PURE__ */ new Set(["Agent", "Task"]);
+function planApprovalDenial(toolName, hits) {
+  const dispatch = DISPATCH_TOOLS.has(toolName);
+  if (!dispatch && !hits.some((hit) => hit.gate === "merge")) return null;
+  return `Drisp gate: plan approval pending: end the Turn with <!-- AWAITING_APPROVAL --> as the Journal's last line. This ${dispatch ? "subagent dispatch" : "merge or push to the default branch"} was not run: nothing is built, merged or pushed before a member starts the plan. You are woken with their answer.`;
+}
+function failingChecksReason(command, checks) {
+  return `Drisp gate: merge is auto, but the pull request's required checks are failing (${checks.join(", ")}), so \`${command}\` was not run. Fix the failing checks, then merge.`;
+}
+function unclaimedSubagentPermissionReason(toolName) {
+  return `Drisp: no rule answers this ${toolName} permission inside a subagent, so it is denied instead of waiting for a member. Do not retry it; report blocked to the Orchestrator with what you needed and why.`;
+}
+function directPushReason(command, options = {}) {
+  return `Drisp gate: merge is auto, but \`${command}\` pushes straight to the default branch, skipping the required checks. ` + (options.driveMerge ? `It was not run. ${DRIVE_MERGE_INSTRUCTION}` : `It was not run. Push a branch, open a pull request and merge that once its checks pass.`);
+}
+var DRIVE_MERGE_INSTRUCTION = "Merge with `drisp drive merge <item> --worktree <path> [--pr <n>]`: it rebases, proves the checks and merges, and prints the outcome.";
+function driveMergeOnlyReason(command) {
+  return `Drisp gate: merge is auto, but in a drive Run only \`drisp drive merge\` merges, so \`${command}\` was not run. ` + DRIVE_MERGE_INSTRUCTION;
+}
+function driveMergeSubagentReason(command) {
+  return `Drisp gate: \`${command}\` was not run. Only the Orchestrator merges; end with your Report and leave the merge to it.`;
+}
+function unverifiedChecksReason(command, detail) {
+  return `Drisp gate: merge is auto, but the required checks of \`${command}\` could not be verified (${detail}), so it was not run. Retry once the checks have passed.`;
+}
+function gatedCallOf(toolName, toolInput, hits) {
+  const input2 = typeof toolInput === "object" && toolInput !== null ? toolInput : {};
+  const command = !toolName.startsWith("mcp__") && typeof input2["command"] === "string" ? input2["command"] : JSON.stringify(toolInput ?? {});
+  const parts = [];
+  for (const hit of hits) {
+    if (!parts.some((part) => part.rule === hit.rule)) {
+      parts.push({ gate: hit.gate, rule: hit.rule, reason: hit.reason });
+    }
+  }
+  const rules = parts.map((part) => part.rule).sort();
+  const fingerprint = createHash("sha256").update(JSON.stringify([toolName, command, rules])).digest("hex");
+  return { command, parts, fingerprint };
+}
+function gateQuestion(fingerprint) {
+  return `gate:${fingerprint}`;
+}
+function gateHarnessCheck(input2) {
+  if (input2.blocksToolCalls) return null;
+  const asking = ["merge", "irreversible"].filter(
+    (gate) => input2.gates[gate] === "ask"
+  );
+  if (asking.length === 0) return null;
+  const explicit = asking.filter((gate) => input2.explicit.has(gate));
+  if (explicit.length === 0) {
+    return {
+      kind: "warn",
+      message: `gates are not enforced on ${input2.harness}; merge/irreversible run unattended (the ask defaults cannot block a tool call there; set a gate explicitly to refuse such Runs instead)`
+    };
+  }
+  return {
+    kind: "refuse",
+    message: `Human gates hold only on Claude Code: ${input2.harness} cannot block a tool call, so the ${explicit.join(" and ")} gate${explicit.length > 1 ? "s" : ""} set to ask cannot be enforced. Run this Workflow on Claude Code, or set ${explicit.map((gate) => `${gate}=auto`).join(" and ")} in the Team or global gates (a project or --gate can only tighten them).`
+  };
+}
+function unknownPushTargetReason(command) {
+  return `Drisp gate: merge is auto, but \`${command}\` pushes to a branch that cannot be read from the command, which may be the default branch, so it was not run. Name the branch explicitly (\`git push origin <branch>\`).`;
+}
+
+// src/infra/plugins/config.ts
 var EMPTY_CONFIG = { plugins: [], additionalDirectories: [] };
 var STALE_CONFIG_KEYS = ["channels"];
 var warnedStaleKeys = /* @__PURE__ */ new Set();
@@ -952,6 +1123,13 @@ function readConfigFile(configPath, baseDir) {
       `Invalid config: "${configPath}" field "permissionGraceMs" must be a non-negative number of milliseconds`
     );
   }
+  if (raw.checks !== void 0 && (!Array.isArray(raw.checks) || raw.checks.length === 0 || !raw.checks.every(
+    (check2) => typeof check2 === "string" && check2.trim().length > 0
+  ))) {
+    throw new Error(
+      `Invalid config: "${configPath}" field "checks" must be a non-empty array of non-empty command strings`
+    );
+  }
   if ("workflowMarketplaceSource" in raw) {
     throw new Error(
       `Invalid config: "${configPath}" uses deprecated "workflowMarketplaceSource"; use "workflowMarketplaceSources"`
@@ -994,7 +1172,9 @@ function readConfigFile(configPath, baseDir) {
     // is NOT relative-resolved against baseDir (R1) — Issue 3 resolves it
     // to an absolute path at install time.
     mcpServers: raw.mcpServers,
-    skills: raw.skills
+    skills: raw.skills,
+    gates: parseGateOverrides(raw.gates, configPath),
+    ...raw.checks !== void 0 ? { checks: raw.checks } : {}
   };
 }
 function readExistingConfig(configPath) {
@@ -21134,9 +21314,21 @@ var pluginSpec = external_exports.union(
   ],
   { error: PLUGIN_MESSAGE }
 );
+var WORKFLOW_ALLOWABLE_TOOLS = /* @__PURE__ */ new Set([
+  "SendMessage",
+  "ToolSearch",
+  "Monitor",
+  "TaskStop",
+  "ListAgents"
+]);
+var EXACT_MCP_TOOL = /^mcp__[A-Za-z0-9_.-]+__[A-Za-z0-9_.-]+$/;
+function isWorkflowAllowableTool(name) {
+  return WORKFLOW_ALLOWABLE_TOOLS.has(name) || EXACT_MCP_TOOL.test(name);
+}
 var FIELD_MESSAGES = {
   plugins: PLUGIN_MESSAGE,
   askRules: '"askRules" must be an array of non-empty tool-name patterns',
+  allowedTools: '"allowedTools" may only name SendMessage, ToolSearch, Monitor, TaskStop, ListAgents or an exact MCP tool (mcp__<server>__<tool>, no wildcards)',
   examplePrompts: '"examplePrompts" must be an array of strings',
   skills: '"skills" must be an array of names',
   mcpServers: '"mcpServers" must be an array of names',
@@ -21158,6 +21350,9 @@ var workflowSchema = external_exports.looseObject({
   loop: loopSchema.optional(),
   isolation: external_exports.string().optional(),
   askRules: external_exports.array(external_exports.string().refine(nonEmpty), { error: FIELD_MESSAGES["askRules"] }).optional(),
+  allowedTools: external_exports.array(external_exports.string().refine(isWorkflowAllowableTool), {
+    error: FIELD_MESSAGES["allowedTools"]
+  }).optional(),
   model: external_exports.string().optional(),
   effort: external_exports.string().optional(),
   env: external_exports.record(external_exports.string(), external_exports.string()).optional(),
@@ -21359,6 +21554,46 @@ function orchestratorWorkflow(workflowFile) {
   };
 }
 
+// src/core/workflows/builtins/drive/workflow.md
+var workflow_default2 = '# Drive: build a Plan with native subagents\n\nYou are the Orchestrator of a Drisp Build (root ADR-0018). This one session plans the work and delivers it. You read\nthe issues yourself, write the plan to your Journal, and hand each issue to a native subagent working in its own git\nworktree. Your working directory is the project\'s main checkout. You never write product code in it: subagents do.\n\nThe Run\'s prompt names the work in one of two ways:\n\n- `Linear project: <id>`: the Plan is that Linear project. Read it with the `linear` MCP server.\n- an inline issue list: each issue with its identifier, title, description, acceptance criteria and the issues it\n  depends on. Use it as given; never look it up elsewhere.\n\nAnything else the member wrote in the prompt is their instruction for this Build. It defines the approved scope,\ntogether with each issue\'s own text.\n\n## 1. Plan (first Turn)\n\n1. Read every issue of the Plan. From Linear: `list_issues` for the project, then `get_issue` with\n   `includeRelations: true` for each, and `list_comments` where the description leaves questions. An issue is\n   eligible only in Todo with the `ready-for-agent` label and without `ready-for-human`, `needs-info`, `needs-triage`\n   or `wontfix`. Skip the others and say why in the plan. An inline issue list is eligible as a whole.\n2. Order the eligible issues by their dependencies (`blockedBy` in Linear, "depends on" inline). An issue is ready\n   when every issue it depends on is merged. Dependencies on an issue outside the Plan count as merged only when\n   that issue is Done or Released.\n3. Prepare the main checkout: it must be clean and on the default branch, up to date with `origin` when there is one\n   (`git pull --ff-only`). Subagent worktrees branch from its HEAD. Make sure `.claude/worktrees/` is ignored:\n   `git check-ignore -q .claude/worktrees/x || echo \'.claude/worktrees/\' >> .git/info/exclude`. Note whether\n   `origin` is a GitHub remote (`git remote get-url origin`).\n4. Write the plan into the Journal: delete the `<!-- JOURNAL_SKELETON -->` line, replace the skeleton\'s Plan\n   section with these sections, and keep them current from then on:\n\n```\n## Plan\n\n| Item | Title | Depends on | Status | Attempts | Agent | Branch | PR |\n| ---- | ----- | ---------- | ------ | -------- | ----- | ------ | -- |\n\n## In flight\n\n| Item | Agent | Asked | Since |\n| ---- | ----- | ----- | ----- |\n\n## Decisions\n\n| Item | Question | Decision | Why |\n| ---- | -------- | -------- | --- |\n```\n\nStatus is one of `waiting`, `ready`, `running`, `blocked`, `done`, `merged`, `escalated`, `skipped`. Set it back to\n`running` whenever you continue a `blocked` or `done` item\'s subagent. `Agent` is the subagent\'s `agentId`, which you\nneed to continue it after a restart.\n\n5. End the Turn with `<!-- AWAITING_APPROVAL -->` as the Journal\'s last line: the member reads your plan and\n   starts the Build. You are woken with the answer `{"choice":"start"}`: remove that line and dispatch (section 2).\n   Woken with the member\'s words instead, revise the plan to them and end with `<!-- AWAITING_APPROVAL -->` again.\n\nKeep one step block in the Journal and revise it in place as you move from `Plan` (1) to `Deliver` (2) to `Clean up`\n(3); Drisp shows the step as the Run\'s progress:\n\n```\n<!-- TURN_PROTOCOL\nstep: Deliver\nstep_index: 2\nstep_total: 3\n-->\n```\n\n## 2. Dispatch\n\nDispatch ready items at once, at most 4 running subagents at a time: one `Agent` call per item, all in one message,\nso they run in parallel. Dispatch more as running ones finish. Each call\nuses `isolation: "worktree"` and `subagent_type: "general-purpose"`, and `model` set to the subagent model the Run\'s\nprompt names, if it names one. Before the calls, add each item to `## In flight` (Agent `pending`); when they return,\nrecord each `agentId` and `worktreeBranch` in the Plan.\n\nEach subagent\'s prompt is its brief, and it has nothing else: write it in full.\n\n- The item: identifier, title, the full description and acceptance criteria, and any comments that matter.\n- The approved scope: the member\'s instructions and the decisions in your Journal that concern this item.\n- What its dependencies delivered (their branches are merged into the default branch it starts from).\n- The rules and the Report contract below, copied verbatim.\n\n### Rules for every subagent (copy into the brief)\n\n- Work only in your own worktree, which is your working directory. Never touch the main checkout or another worktree.\n- First rename your branch to `drive/<item, lowercased>` (`git branch -m drive/<item>`; the brief names\n  `drive/<item>-2` for a second attempt) and commit an empty start\n  (`git commit --allow-empty -m "chore(<item>): start"`). Claude Code deletes a worktree with no commits when its\n  subagent returns, so without it a `blocked` Report before any change would lose your worktree.\n- Build the item to its acceptance criteria. Run the project\'s checks that cover your change and keep their output\n  as evidence. Commit with a clear message.\n- When `origin` exists, push your branch: `git push -u origin HEAD`. When `origin` is on GitHub, open a pull request\n  to the default branch with `gh pr create --fill` (or a title and body that name the item), and put its URL in `pr`.\n  Never merge it yourself.\n- When you need a decision you cannot take from the issue, the scope you were given or the code, stop before\n  guessing and end with a `blocked` Report: the question, the options, and your recommendation. Do the same when a\n  tool call is denied. You will be continued with the decision and keep your context.\n- End with `failed` when you cannot deliver for a reason a decision would not fix, with the cause in `evidence`.\n- Never wait with `sleep`. Wait for CI with `gh pr checks --watch` or `Monitor`.\n- Do not start subagents of your own.\n- Your final message ends with the Report: one fenced `json` block, nothing after it.\n\n### Report contract (copy into the brief)\n\n```json\n{\n	"item": "<the item\'s identifier>",\n	"status": "done | blocked | failed",\n	"pr": "<pull request URL, or null>",\n	"evidence": ["<check run, test output, commit, screenshot path>"],\n	"question": "<the decision needed, when blocked, else null>",\n	"options": ["<option>", "\u2026"],\n	"recommendation": "<your preferred option and why, when blocked, else null>"\n}\n```\n\n## 3. Read each Report\n\nAn `Agent` call may return at once with `status: "async_launched"`: the subagent then runs in the background, and\nyou end your Turn as in section 4 until its `<task-notification>` wakes you.\n\nA subagent\'s Report is the last fenced `json` block in its final message: the Agent result when it returns one, or\nthe result inside the `<task-notification>` that wakes you. Read that, not your memory of the brief. When a result\nhas no parseable Report, `SendMessage` the subagent once: "End your reply with the Report: one fenced `json` block, as\nin your brief." Only if its next result still has none, count it as `failed` with "no Report" as the cause. Remove\nthe item from `## In flight` and act on its status:\n\n- `done`: check the evidence against the acceptance criteria (read the branch\'s diff with\n  `git diff <default>...<branch>`; run a quick check when the evidence is thin). If it falls short, continue the\n  subagent with what is missing, as for `blocked`. Otherwise record the PR and merge it (section 6).\n- `blocked`: decide it (section 4).\n- `failed`: handle it (section 5).\n\nAfter each merge, dispatch the items that became ready.\n\n## 4. Decide every `blocked` Report\n\nDecide every `blocked` Report yourself, within the approved scope; the member is not asked. Pick one of the options\n(or a better one the evidence supports) from the member\'s instructions, the issue\'s text, the repository\'s ADRs and\ndocs, and the code. Record the item, the question, the decision and the evidence it rests on in `## Decisions` before\nyou send it.\n\nThen continue the same subagent, so it keeps its context and worktree. If `SendMessage` is not loaded yet, load it\nby calling `ToolSearch` with `select:SendMessage`. Call `SendMessage` with `to` set to the subagent\'s `agentId` and a\nmessage that gives the decision, why, and "continue, then end with a Report". Put the item back in `## In flight`.\nIf the subagent\'s worktree is gone (`git worktree list`) and its branch has no commits, dispatch the item again\ninstead, with the decision in its brief. That re-dispatch does not count as an attempt.\n\n`SendMessage` returns at once; the subagent works in the background. Its reply arrives later as a\n`<task-notification>` that starts your next Turn in this same process. Do other work that is ready, then\nend your Turn. Ending a Turn while subagents run is expected: Drisp keeps the session going and you are woken by their\ncompletion. Never poll them with `sleep`.\n\nNever end a Turn waiting on nothing. Before ending one, call `ListAgents`: if no subagent is running and no\nnotification is pending, re-read `## In flight` and act on every item there (section 7) instead.\n\nEscalate instead of deciding only when the decision would change the approved scope (a new requirement, dropping an\nacceptance criterion, an irreversible or production action), and when a gate reserves it for the member: mark the\nitem `escalated` with the question, and continue the rest.\n\n## 5. Failures\n\nRe-dispatch a `failed` item once with the failure analysis: a new `Agent` call (worktree isolation) with the original\nbrief plus what failed and your analysis of why, on branch `drive/<item>-2`, or `SendMessage` to the same subagent\nwhen its worktree holds work worth keeping. Count the attempt in the Plan. On a second failure of the same item,\nstop: mark it `escalated` with both causes, mark the items that depend on it `escalated` as blocked by it, and\ncontinue every other item.\n\n## 6. Merge\n\nMerge one item at a time, in dependency order, only with this command, from the main checkout, with a Bash `timeout`\nof 600000:\n\n```\ndrisp drive merge <item> --worktree <the subagent\'s worktree> [--pr <number>]\n```\n\nIt checks whether the item is already merged, rebases, proves the checks (CI, or the project\'s own checks when there\nis none) and merges, all in code. It prints one JSON line; act on its `outcome`:\n\n- `merged` or `already_merged`: mark the item `merged`.\n- `conflict` or `checks_failed`: `SendMessage` the same subagent with `detail` and `output`: "fix your branch in\n  place (rebase onto `<default branch>`, resolve, commit or remove every file, run the checks), and report\n  again". That is not an attempt; a second `checks_failed` after its fix is a `failed` Report (section 5).\n- `checks_timeout`, or `checks_failed` whose `detail` starts "base kept moving": run the command again, at most\n  twice; then handle it as `refused`.\n- `refused`: mark the item `escalated` with `detail`, continue the rest, and end with `NEEDS_HUMAN` (section 8).\n\nNever merge any other way: Drisp refuses `gh pr merge`, a push to the default branch, and a `git merge`, `reset` or\n`rebase` that moves it, in this Run.\nIf Drisp denies the command itself (a gate), do not retry it or work around it: note it in the Journal and end your\nTurn.\n\n## 7. After a crash or kill\n\nAfter a crash or kill, the Journal is what you have. On a fresh Turn, or a `<task-notification>` with status\n`stopped`, read `## In flight`: every item there was interrupted and its in-flight step is lost; its worktree and\nthe subagent\'s context are not. For each one:\n\n- with an `agentId`: `SendMessage` it: "Your last step was interrupted. Check your worktree\'s state, redo the step\n  from your last commit, and end with a Report."\n- with Agent `pending` (the process died before the call returned): re-dispatch the item as in section 2. Check\n  `git worktree list` first and name any worktree it left in the new brief.\n\n`ListAgents` shows which subagents still run; never dispatch a second subagent for an item whose subagent runs.\n\n## 8. Clean up and complete\n\nWhen every item is `merged`, `escalated` or `skipped`:\n\n1. Remove each merged item\'s worktree and branch: `git worktree remove <worktree path>` and `git branch -D <branch>`\n   (only once `drisp drive merge` returned `merged` or `already_merged` for it; it already deleted the remote\n   branch). Then `git worktree prune`. Keep the worktrees of escalated items.\n2. Write the outcome above the marker: each item with its status, PR and evidence, the decisions taken, and each\n   escalation with what the member needs to do.\n3. If every item is `merged` or `skipped`, end the Journal with `<!-- WORKFLOW_COMPLETE -->` as its last non-empty\n   line. If any item is `escalated`, end it with `<!-- NEEDS_HUMAN: <reason> -->` instead, the reason naming the\n   escalated items and what the member must decide, so the Run parks for the member.\n\n## Linear (when the Plan is a Linear project)\n\nNever change an issue\'s status: Drisp derives In Progress, Review, Ready and Needs Input from the Run and its pull\nrequests. Write only two comments, through `linear`, each once: `PR: <url>` when an item\'s pull request opens, and,\nwhen an item is escalated, one comment that starts `**Needs input:**` and says what the member must decide. Never\nchange labels, priorities or descriptions.\n\n## Rules\n\n- You plan, decide, merge and clean up. Subagents write the code.\n- Keep the Journal current after every dispatch, Report, decision and merge: it is how a restart knows what was in\n  flight.\n- Never claim a check passed, an item is done, or the member approved something without evidence.\n';
+
+// src/core/workflows/builtins/drive/index.ts
+var DRIVE_WORKFLOW_NAME = "drive";
+var DRIVE_INSTRUCTIONS = workflow_default2;
+var DRIVE_LOOP = {
+  enabled: true,
+  completionMarker: DEFAULT_COMPLETION_MARKER,
+  needsHumanMarker: DEFAULT_NEEDS_HUMAN_MARKER,
+  maxIterations: 50,
+  maxRunTokens: 6e7
+};
+var DRIVE_ALLOWED_TOOLS = [
+  "SendMessage",
+  "ToolSearch",
+  "Monitor",
+  "TaskStop",
+  "ListAgents"
+];
+function driveWorkflow(workflowFile) {
+  return {
+    name: DRIVE_WORKFLOW_NAME,
+    description: "Builds a Plan's issues in one session: native subagents in their own worktrees, in parallel where dependencies allow, with the Orchestrator deciding their questions",
+    promptTemplate: "{input}",
+    plugins: [],
+    model: "sonnet",
+    skills: [],
+    mcpServers: ["linear"],
+    allowedTools: [...DRIVE_ALLOWED_TOOLS],
+    loop: { ...DRIVE_LOOP },
+    // The `planApproval` gate (ask by default) parks the plan Turn on this question (apps/cli docs/human-gates.md).
+    approvalQuestion: BUILD_STRINGS.approvalQuestion,
+    // The Runner bootstraps a Workflow Run under `standard`, where the Orchestrator parks at once on a Bash
+    // permission. The human gates (merge, irreversible, budget, plan approval) are drive's safety layer.
+    isolation: "autonomous",
+    workflowFile
+  };
+}
+
 // src/core/workflows/builtins/index.ts
 var DEFAULT_NEEDS_HUMAN_CLOSED_MARKER = `${DEFAULT_NEEDS_HUMAN_MARKER} -->`;
 var DEFAULT_NEEDS_HUMAN_REASON_MARKER = `${DEFAULT_NEEDS_HUMAN_MARKER}: reason -->`;
@@ -21426,6 +21661,11 @@ function ensureBuiltinFile(name, fileName, content) {
   return filePath;
 }
 function resolveBuiltinWorkflow(name) {
+  if (name === DRIVE_WORKFLOW_NAME) {
+    return driveWorkflow(
+      ensureBuiltinFile(name, "workflow.md", DRIVE_INSTRUCTIONS)
+    );
+  }
   if (name === ORCHESTRATOR_WORKFLOW_NAME) {
     return orchestratorWorkflow(
       ensureBuiltinFile(name, "workflow.md", ORCHESTRATOR_INSTRUCTIONS)
@@ -21453,7 +21693,7 @@ function resolveBuiltinWorkflow(name) {
   };
 }
 function listBuiltinWorkflows() {
-  return ["default", ORCHESTRATOR_WORKFLOW_NAME];
+  return ["default", DRIVE_WORKFLOW_NAME, ORCHESTRATOR_WORKFLOW_NAME];
 }
 
 // src/core/workflows/builtins/build-child/template.ts
@@ -22852,6 +23092,14 @@ function describeDeferral(permission) {
 }
 function protocolInterruptionFor(interruption) {
   if (interruption.kind === "question" || !interruption.permission) return null;
+  if (interruption.kind === "gate") {
+    return {
+      kind: "question",
+      message: describeInterruption(interruption),
+      requestId: interruption.permission.requestId,
+      question: gateQuestion(interruption.fingerprint)
+    };
+  }
   return {
     kind: "question",
     message: describeInterruption(interruption),
@@ -22859,8 +23107,17 @@ function protocolInterruptionFor(interruption) {
     question: `${interruption.toolName}: ${interruption.permission.inputSummary}`
   };
 }
+var GATE_PARK_PREFIX = "Drisp gate";
+var GATE_COMMAND_MAX_CHARS = 12e3;
+function clip(text, max) {
+  return text.length > max ? `${text.slice(0, max)}\u2026 (${text.length - max} more characters)` : text;
+}
 function describeInterruption(interruption) {
   switch (interruption.kind) {
+    case "gate":
+      return `${GATE_PARK_PREFIX}: a member must approve this ${interruption.toolName} call \u2014 ` + interruption.parts.map((part) => `${part.gate} is ask: ${part.reason} (${part.rule})`).join("; ") + `. Command:
+${clip(interruption.command, GATE_COMMAND_MAX_CHARS)}
+Wake with --answer=allow|deny; an answer applies only to this exact call.`;
     case "ask_rule":
       if (interruption.permission) {
         return `ask rule "${interruption.rule}" fired on ${interruption.toolName}${describeDeferral(interruption.permission)}: ${interruption.permission.inputSummary} \u2014 wake with --answer=allow|deny`;
@@ -22891,10 +23148,19 @@ ${reply}
 function buildReplayGuidance(parked) {
   if (!parked || parked.kind !== "question" || !parked.requestId) return "";
   const call = parked.question ?? "the same call";
+  if (call.startsWith("gate:")) {
+    return `Before your previous Turn ended, a call (request ${parked.requestId}) was refused by a human gate set to ask, and the run parked for a member to decide:
+${parked.message}
+If the reply approves it, re-issue that exact call now, with the same input (from a subagent, have it re-issue it): the member's answer is applied to it automatically. If the reply denies it, do not run it or work around the gate; carry on with what the reply says.
+
+`;
+  }
   return `Before your previous Turn ended, your request \`${call}\` (request ${parked.requestId}) was deferred because nobody answered it in time. Re-issue that exact call now, with the same input: if an answer was stored while this run was parked it is applied automatically, otherwise the request is held again for a human. Do not work around the deferred call or substitute a different one.
 
 `;
 }
+var PLAN_APPROVED_PROMPT = "The plan approval gate is set to auto, so your plan is approved without asking a member. Remove the `<!-- AWAITING_APPROVAL -->` line from the end of the Journal and start the work now, as the plan describes. Keep the Journal current and end by declaring a terminal marker as usual.";
+var PLAN_APPROVED_NOTICE = "plan approval gate is auto: the plan was approved without asking, and work starts now";
 function buildFailureDetail(event) {
   const parts = [];
   if (event.errorMessage) {
@@ -23238,6 +23504,44 @@ function handleTurnInFlight(phase, incoming, event, cfg) {
     };
   }
   const loop = cfg.loop;
+  if (event.outcome?.kind === "suspend" && event.outcome.stopReason === AWAITING_APPROVAL_STOP_REASON && cfg.gates?.planApproval === "auto" && event.adapterSessionId) {
+    const nextIteration2 = memoryAfterSuccess.iteration + 1;
+    const continuation2 = {
+      mode: "resume",
+      handle: event.adapterSessionId
+    };
+    const prepared2 = prepareWorkflowTurn(cfg.workflowState, {
+      prompt: cfg.initialPrompt,
+      iteration: nextIteration2,
+      configOverride: void 0
+    });
+    return {
+      phase: {
+        kind: "turn_in_flight",
+        prompt: PLAN_APPROVED_PROMPT,
+        continuation: continuation2,
+        configOverride: prepared2.configOverride
+      },
+      memory: {
+        ...memoryAfterSuccess,
+        lastJournalHash: hashJournalContent(event.journalContent),
+        iteration: nextIteration2,
+        lastStopPrompt: PLAN_APPROVED_PROMPT,
+        lastStopContinuation: continuation2
+      },
+      actions: [
+        { type: "warn", message: PLAN_APPROVED_NOTICE },
+        { type: "persist" },
+        { type: "notify_iteration_complete" },
+        {
+          type: "start_turn",
+          prompt: PLAN_APPROVED_PROMPT,
+          continuation: continuation2,
+          configOverride: prepared2.configOverride
+        }
+      ]
+    };
+  }
   if (event.outcome && (event.outcome.kind === "stop" || event.outcome.kind === "suspend")) {
     const outcome = event.outcome;
     const nextPhase = outcome.status === "completed" ? { kind: "completed" } : outcome.status === "failed" ? { kind: "failed", stopReason: outcome.stopReason } : {
@@ -23539,11 +23843,22 @@ function admitResult(result, previous, cfg) {
     },
     result.actions.filter(
       (a) => a.type === "notify_handover_completed" || a.type === "notify_iteration_complete"
-    )
+    ),
+    cfg.gates
   );
 }
-function parkResource(memory, stop, notifications = []) {
+function parkResource(memory, stop, notifications = [], gates) {
   const interruption = resourceInterruption(stop);
+  if (stop.cause === "tokens" && gates?.budget === "auto") {
+    return {
+      phase: {
+        kind: "failed",
+        stopReason: `${interruption.message} \u2014 the budget gate is auto, so the Run stopped instead of asking a member; the Journal holds the work done so far`
+      },
+      memory,
+      actions: [{ type: "persist" }, ...notifications]
+    };
+  }
   return {
     phase: {
       kind: "awaiting_attention",
@@ -23568,7 +23883,9 @@ function step(phase, memory, event, cfg) {
         ...memory,
         cumulativeTokens: event.cumulativeTokens
       },
-      { ...event.stop, checkpointPath: memory.checkpoint?.path }
+      { ...event.stop, checkpointPath: memory.checkpoint?.path },
+      [],
+      cfg.gates
     );
   return admitResult(transition(phase, memory, event, cfg), memory, cfg);
 }
@@ -23628,6 +23945,7 @@ function isQueuedSteer(value) {
 }
 
 // src/core/workflows/workflowRunner.ts
+var BUDGET_HARD_OVERRUN = 1.5;
 var NULL_TOKENS = {
   input: null,
   output: null,
@@ -23915,7 +24233,8 @@ function createWorkflowRunner(input2) {
       initialPrompt: input2.prompt,
       loop,
       journalAbsPath,
-      journalPromptPath
+      journalPromptPath,
+      ...input2.gates ? { gates: input2.gates } : {}
     };
     const initial = createInitialRun(cfg, {
       initialContinuation: input2.initialContinuation,
@@ -23926,7 +24245,11 @@ function createWorkflowRunner(input2) {
       awaitingAttentionStopReason: input2.resumedStopReason
     });
     let phase = initial.phase;
-    memory = initial.memory;
+    memory = {
+      ...initial.memory,
+      ...cfg.gates ? { gates: cfg.gates } : {},
+      ...input2.planApproved ? { planApproved: true } : {}
+    };
     persist();
     applySteer = (steer) => {
       if (persistenceFailure) return false;
@@ -23965,17 +24288,32 @@ function createWorkflowRunner(input2) {
           }
         };
       }
-      function stop(reason) {
-        if (finished || stopped || cancelled) return;
-        stopped = reason;
-        const checkpoint = journalAbsPath ? checkpointFromJournal(readJournal(journalAbsPath)) : null;
-        if (checkpoint) memory = { ...memory, checkpoint };
+      let stopEvent = null;
+      let stopFired = false;
+      const pendingStop = () => stopEvent;
+      function fireStop() {
+        if (stopFired || !stopEvent) return;
+        stopFired = true;
         input2.abortCurrentTurn?.();
-        resolveStop({
-          type: "resource_exhausted",
-          stop: reason,
-          cumulativeTokens: memory.cumulativeTokens ?? startTokens
-        });
+        resolveStop(stopEvent);
+      }
+      function stop(reason, force = false) {
+        if (finished || cancelled) return;
+        if (!stopped) {
+          stopped = reason;
+          const checkpoint = journalAbsPath ? checkpointFromJournal(readJournal(journalAbsPath)) : null;
+          if (checkpoint) memory = { ...memory, checkpoint };
+          stopEvent = {
+            type: "resource_exhausted",
+            stop: reason,
+            cumulativeTokens: memory.cumulativeTokens ?? startTokens
+          };
+        }
+        if (force || reason.cause !== "tokens" || !input2.whenQuiescent) {
+          fireStop();
+          return;
+        }
+        input2.whenQuiescent(fireStop);
       }
       function observe(usage, enforce = true) {
         if (finished) return;
@@ -23992,7 +24330,15 @@ function createWorkflowRunner(input2) {
           memory = { ...memory, usage: cumulativeTokens };
           persist();
         }
-        if (!enforce || stopped) return;
+        if (!enforce) return;
+        if (stopped) {
+          const limit2 = loop?.maxRunTokens;
+          const used = budgetTokens(memory) ?? 0;
+          if (stopped.cause === "tokens" && limit2 !== void 0 && used >= limit2 * BUDGET_HARD_OVERRUN) {
+            stop(stopped, true);
+          }
+          return;
+        }
         const limit = admitContinuation({
           loop,
           iteration: memory.iteration,
@@ -24054,7 +24400,7 @@ function createWorkflowRunner(input2) {
           return finalStop(result2);
         }
         observe(result2.tokens, false);
-        if (isStopped()) return finalStop(await stopPromise);
+        if (isStopped()) return finalStop(pendingStop() ?? await stopPromise);
         return result2;
       } finally {
         finished = true;
@@ -24391,12 +24737,32 @@ function collectMcpServersWithOptions(pluginDirs) {
 }
 
 export {
+  resolveJournalPath,
   WAITING_ON_CHILDREN_STOP_REASON,
   AWAITING_APPROVAL_STOP_REASON,
   budgetTokens,
   runUsage,
   createSteerQueue,
   DEFAULT_PERMISSION_GRACE_MS,
+  GATE_NAMES,
+  DEFAULT_GATES,
+  resolveGates,
+  tightenGates,
+  describeIgnoredGate,
+  parseGateFlags,
+  gateDenialReason,
+  isPlanStartAnswer,
+  planApprovalDenial,
+  failingChecksReason,
+  unclaimedSubagentPermissionReason,
+  directPushReason,
+  driveMergeOnlyReason,
+  driveMergeSubagentReason,
+  unverifiedChecksReason,
+  gatedCallOf,
+  gateQuestion,
+  gateHarnessCheck,
+  unknownPushTargetReason,
   serializeRunMemory,
   deserializeRunMemory,
   wakesFreshAfterHandover,
@@ -24428,8 +24794,10 @@ export {
   selectWorkflowCapabilities,
   BUILD_STRINGS,
   GATES,
+  ORCHESTRATOR_WORKFLOW_NAME,
   ORCHESTRATOR_LIMITS,
   ORCHESTRATOR_LOOP,
+  DRIVE_WORKFLOW_NAME,
   listBuiltinWorkflows,
   DESCRIPTION_TEMPLATE,
   QA_SECTIONS,
@@ -24461,4 +24829,4 @@ export {
   compileWorkflowPlan,
   collectMcpServersWithOptions
 };
-//# sourceMappingURL=chunk-SACVOS6T.js.map
+//# sourceMappingURL=chunk-GGAPZULS.js.map