@gajae-code/coding-agent 0.3.1 → 0.4.0

package/dist/types/modes/shared/agent-wire/deep-interview-gate.d.ts

@@ -0,0 +1,47 @@
+import type { OpenGateInput } from "./workflow-gate-broker";
+/** "Other (type your own)" sentinel, mirroring the interactive ask tool. */
+export declare const GATE_OTHER_OPTION = "Other (type your own)";
+export interface AskGateQuestion {
+    id: string;
+    question: string;
+    options: Array<{
+        label: string;
+    }>;
+    multi?: boolean;
+    recommended?: number;
+}
+export interface AskGateResult {
+    id: string;
+    question: string;
+    options: string[];
+    multi: boolean;
+    selectedOptions: string[];
+    customInput?: string;
+}
+/**
+ * The answer shape an agent returns for a deep-interview question gate.
+ *
+ * `selected` are picked option labels; free text is conveyed by `other: true`
+ * plus `custom`, encoded separately from `selected` so a real option whose label
+ * happens to equal the display sentinel can never collide with the free-text path.
+ */
+export interface DeepInterviewGateAnswer {
+    selected: string[];
+    other?: boolean;
+    custom?: string;
+}
+export declare class DeepInterviewGateError extends Error {
+    readonly code: "invalid_answer_shape" | "unknown_option" | "multi_not_allowed" | "missing_custom" | "empty_selection" | "duplicate_selection";
+    constructor(code: "invalid_answer_shape" | "unknown_option" | "multi_not_allowed" | "missing_custom" | "empty_selection" | "duplicate_selection", message: string);
+}
+/** Build the `workflow_gate` open-input for one deep-interview question. */
+export declare function questionToGate(question: AskGateQuestion): OpenGateInput;
+/**
+ * Decode a gate answer into the QuestionResult the interactive path produces.
+ * Selections are de-duplicated (the interactive UI stores them in a Set), and
+ * free text is taken from `other`/`custom`. Throws DeepInterviewGateError on a
+ * semantically invalid answer.
+ */
+export declare function gateAnswerToResult(question: AskGateQuestion, answer: unknown): AskGateResult;
+/** Convenience: map a batch of ask questions to gate open-inputs. */
+export declare function questionsToGates(questions: AskGateQuestion[]): OpenGateInput[];

package/dist/types/modes/shared/agent-wire/event-envelope.d.ts

@@ -22,3 +22,10 @@ export declare class BridgeFrameSequencer {
 }
 /** Serialize a single `AgentSessionEvent` into an `event` wire frame. */
 export declare function toBridgeEventFrame(event: AgentSessionEvent, sequencer: BridgeFrameSequencer): BridgeEventFrame;
+/**
+ * Serialize a `workflow_gate` event into a sequenced wire frame (#321). The
+ * gate_id is stamped as the correlation id so the answer (posted to the
+ * ui-responses endpoint) can be matched, and the monotonic `seq` gives replay
+ * while `frame_id` + gate_id give idempotency.
+ */
+export declare function toBridgeWorkflowGateFrame(gate: import("../../rpc/rpc-types").RpcWorkflowGate, sequencer: BridgeFrameSequencer): import("./protocol").BridgeWorkflowGateFrame;

package/dist/types/modes/shared/agent-wire/handshake.d.ts

@@ -1,6 +1,7 @@
+import type { RpcUnattendedDeclaration } from "../../rpc/rpc-types";
 import { BRIDGE_PROTOCOL_VERSION, type BridgeFrameType } from "./protocol";
 import type { BridgeCommandScope } from "./scopes";
-export type BridgeCapability = "events" | "prompt" | "permission" | "elicitation" | "ui.declarative" | "ui.editor" | "ui.terminal_input" | "host_tools" | "host_uri" | "client_bridge.read_text_file" | "client_bridge.write_text_file" | "client_bridge.create_terminal";
+export type BridgeCapability = "events" | "prompt" | "permission" | "elicitation" | "ui.declarative" | "ui.editor" | "ui.terminal_input" | "host_tools" | "host_uri" | "client_bridge.read_text_file" | "client_bridge.write_text_file" | "client_bridge.create_terminal" | "workflow_gate";
 export interface BridgeProtocolRange {
     min: number;
     max: number;
@@ -10,6 +11,8 @@ export interface BridgeHandshakeRequest {
     capabilities: BridgeCapability[];
     requested_scopes: BridgeCommandScope[];
     last_seq?: number;
+    /** Optional unattended declaration (budget + scope + action allowlist) for #318/#319. */
+    unattended?: RpcUnattendedDeclaration;
 }
 export interface BridgeEndpointDescriptor {
     events: string;
@@ -29,6 +32,10 @@ export interface BridgeHandshakeAccepted {
     unsupported: BridgeCapability[];
     endpoints: BridgeEndpointDescriptor;
     frame_types: BridgeFrameType[];
+    /** Echoed unattended declaration when one was supplied and accepted (#321). */
+    accepted_unattended?: RpcUnattendedDeclaration;
+    /** Server-side accepted unattended mode after live negotiation, not just declaration echo. */
+    unattended_active?: boolean;
 }
 export interface BridgeHandshakeRejected {
     status: "rejected";
@@ -36,6 +43,8 @@ export interface BridgeHandshakeRejected {
     message: string;
 }
 export type BridgeHandshakeResponse = BridgeHandshakeAccepted | BridgeHandshakeRejected;
+/** Shape-validate an optional unattended declaration carried on the handshake. */
+export declare function isUnattendedDeclarationShape(value: unknown): value is RpcUnattendedDeclaration;
 export declare function isBridgeHandshakeRequest(value: unknown): value is BridgeHandshakeRequest;
 export declare function negotiateBridgeHandshake(request: BridgeHandshakeRequest, server: {
     sessionId: string;
@@ -43,4 +52,5 @@ export declare function negotiateBridgeHandshake(request: BridgeHandshakeRequest
     scopes: readonly BridgeCommandScope[];
     endpoints: BridgeEndpointDescriptor;
     frameTypes: readonly BridgeFrameType[];
+    acceptedUnattended?: RpcUnattendedDeclaration;
 }): BridgeHandshakeResponse;

package/dist/types/modes/shared/agent-wire/protocol.d.ts

@@ -15,7 +15,7 @@ export type AgentSessionEventType = AgentSessionEvent["type"];
 /** Every agent-session event type, derived from the exhaustive registry. */
 export declare const AGENT_SESSION_EVENT_TYPES: readonly AgentSessionEventType[];
 /** Top-level frame categories carried over any bridge transport. */
-export type BridgeFrameType = "ready" | "event" | "response" | "ui_request" | "permission_request" | "host_tool_call" | "host_uri_request" | "reset" | "error";
+export type BridgeFrameType = "ready" | "event" | "response" | "ui_request" | "permission_request" | "host_tool_call" | "host_uri_request" | "reset" | "workflow_gate" | "error";
 /**
  * Universal frame envelope. Every frame on every transport carries these
  * fields so clients can order (`seq`), resume (`seq` cursor), and correlate
@@ -42,3 +42,5 @@ export interface BridgeEventPayload {
 }
 /** An `AgentSessionEvent` serialized into a versioned wire frame. */
 export type BridgeEventFrame = BridgeFrameEnvelope<"event", BridgeEventPayload>;
+/** A `workflow_gate` event serialized into a versioned wire frame (#321). */
+export type BridgeWorkflowGateFrame = BridgeFrameEnvelope<"workflow_gate", import("../../rpc/rpc-types").RpcWorkflowGate>;

package/dist/types/modes/shared/agent-wire/responses.d.ts

@@ -1,4 +1,4 @@
 /** Shared RPC-compatible response helpers for agent-wire consumers. */
 import type { RpcCommand, RpcResponse } from "../../rpc/rpc-types";
 export declare function rpcSuccess<T extends RpcCommand["type"]>(id: string | undefined, command: T, data?: object | null): RpcResponse;
-export declare function rpcError(id: string | undefined, command: string, message: string): RpcResponse;
+export declare function rpcError(id: string | undefined, command: string, error: string | object): RpcResponse;

package/dist/types/modes/shared/agent-wire/unattended-action-policy.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Unattended action taxonomy + classifier (#319).
+ *
+ * Maps coarse command scopes and concrete bash commands onto the v1 action
+ * taxonomy so the controller can authorize (default-deny) BEFORE any side effect.
+ *
+ * The classifier is deliberately FAIL-CLOSED for shell evasion:
+ *  - nested execution via `$(...)`, backticks, and `<(...)` / `>(...)` is
+ *    extracted and classified recursively, so a destructive command hidden in a
+ *    substitution cannot masquerade as the harmless outer command;
+ *  - statements are split on newlines and `; && || | &`, so a second
+ *    (destructive) command on another line is classified too;
+ *  - leading environment assignments and wrappers (`sudo`, `env`, `command`,
+ *    `xargs`, …) are stripped/followed to the effective command;
+ *  - anything that is not provably read-only escalates to at least
+ *    `bash.mutating`, and clearly destructive forms escalate further, so an
+ *    undeclared destructive action is denied rather than silently allowed.
+ */
+import type { RpcUnattendedActionClass } from "../../rpc/rpc-types";
+import type { BridgeCommandScope } from "./scopes";
+/** Coarse command scope -> `command.<scope>` action class. */
+export declare function actionClassForScope(scope: BridgeCommandScope): RpcUnattendedActionClass;
+/**
+ * Classify a (possibly compound / nested) bash command into the most severe
+ * action class across all statements and nested substitutions. Fail-closed.
+ */
+export declare function classifyBashAction(command: string): RpcUnattendedActionClass;

package/dist/types/modes/shared/agent-wire/unattended-audit.d.ts

@@ -0,0 +1,68 @@
+import type { RpcBudgetExceeded, RpcWorkflowGateKind, RpcWorkflowStage } from "../../rpc/rpc-types";
+export declare const AUDIT_SCHEMA_VERSION = 1;
+export declare const AUDIT_CATEGORY = "unattended_lifecycle";
+export type AuditOutcome = "accepted" | "rejected" | "denied" | "exceeded" | "aborted" | "info";
+export interface AuditRecord {
+    event_id: string;
+    schema_version: number;
+    category: typeof AUDIT_CATEGORY;
+    run_id: string;
+    session_id?: string;
+    actor?: string;
+    timestamp: string;
+    event: string;
+    outcome: AuditOutcome;
+    dedupe_key: string;
+    gate_id?: string;
+    stage?: RpcWorkflowStage;
+    kind?: RpcWorkflowGateKind;
+    scope?: string;
+    action?: string;
+    budget?: RpcBudgetExceeded;
+    /** Full answer (omitted when redaction is enabled). */
+    answer?: unknown;
+    answer_hash?: string;
+    error?: unknown;
+}
+export interface AuditQuery {
+    run_id?: string;
+    session_id?: string;
+    actor?: string;
+    gate_id?: string;
+    outcome?: AuditOutcome;
+    event?: string;
+    since?: string;
+    until?: string;
+}
+export interface AuditLogOptions {
+    /** When true, gate answers are stored as hash + summary only. */
+    redactAnswers?: boolean;
+    /** Injectable id/clock for deterministic tests. */
+    now?(): number;
+    nextId?(): string;
+}
+export declare function defaultAuditPath(runId: string, root?: string): string;
+/** Append-only audit log writer + reader for one unattended run. */
+export declare class UnattendedAuditLog {
+    private readonly filePath;
+    private readonly seen;
+    private readonly now;
+    private readonly nextId;
+    private readonly redactAnswers;
+    constructor(filePath: string, options?: AuditLogOptions);
+    /**
+     * Append a record. Returns the written record, or `null` if a record with the
+     * same dedupe_key was already written (exactly-once).
+     */
+    record(input: Omit<AuditRecord, "event_id" | "schema_version" | "category" | "timestamp">): AuditRecord | null;
+    /** Append one line and fsync it for crash durability. */
+    private appendDurable;
+    /** Read every record (fail-closed: a corrupt line throws rather than silently dropping). */
+    readAll(): AuditRecord[];
+    /** Query records with filters (run/session/actor/gate/outcome/event + time window). */
+    query(filter?: AuditQuery): AuditRecord[];
+    /** Export the full trail as an array (for `get_unattended_audit`). */
+    export(filter?: AuditQuery): AuditRecord[];
+}
+/** SHA-256 of the canonical JSON of an answer (matches the gate broker's hash). */
+export declare function answerHash(answer: unknown): string;

package/dist/types/modes/shared/agent-wire/unattended-run-controller.d.ts

@@ -0,0 +1,161 @@
+/**
+ * Unattended run controller (#318).
+ *
+ * The single required owner of negotiated unattended state. Entering unattended
+ * mode is fail-closed: a controller can only be created via {@link
+ * UnattendedRunController.negotiate}, which rejects a missing/partial budget, an
+ * invalid declaration, or a provider that cannot account for tokens/cost.
+ *
+ * The controller owns budget accounting across metrics and phases. Scope/action
+ * authorization (#319) and the durable audit trail (#320) layer onto the same
+ * controller; this slice wires the budget floor and abort coordination.
+ *
+ * Attended mode never constructs a controller, so by construction the attended
+ * path is unaffected by everything here.
+ */
+import type { RpcActionDenied, RpcBudgetExceeded, RpcBudgetMetric, RpcScopeDenied, RpcUnattendedActionClass, RpcUnattendedBudget, RpcUnattendedRefusalCode } from "../../rpc/rpc-types";
+import type { BridgeCommandScope } from "./scopes";
+import { actionClassForScope } from "./unattended-action-policy";
+/** Coordinated abort surfaces invoked exactly once on a budget breach / abort. */
+export interface UnattendedAbortHooks {
+    abortModelStream?(): void | Promise<void>;
+    abortBash?(): void | Promise<void>;
+    cancelHostTools?(reason: string): void | Promise<void>;
+    cancelHostUris?(reason: string): void | Promise<void>;
+    stopWorkflow?(reason: string): void | Promise<void>;
+}
+export type UnattendedAuditEvent = {
+    event: "unattended_negotiated";
+    run_id: string;
+    actor: string;
+} | {
+    event: "budget_exceeded";
+    payload: RpcBudgetExceeded;
+} | {
+    event: "unattended_aborted";
+    run_id: string;
+    reason: string;
+} | {
+    event: "unattended_abort_settled";
+    run_id: string;
+    status: "aborted" | "abort_failed";
+    failures: number;
+} | {
+    event: "scope_denied";
+    payload: RpcScopeDenied;
+} | {
+    event: "action_denied";
+    payload: RpcActionDenied;
+};
+export interface NegotiateContext {
+    runId: string;
+    sessionId?: string;
+    audit?(event: UnattendedAuditEvent): void;
+    abortHooks?: UnattendedAbortHooks;
+    /**
+     * Whether the active provider can report token usage and cost. Unattended
+     * mode rejects providers without this accounting up front (fail-closed).
+     */
+    providerSupportsTokenCostMetrics?: boolean;
+    /** Injectable clock for deterministic tests. Defaults to Date.now. */
+    now?(): number;
+}
+export declare class UnattendedNegotiationError extends Error {
+    readonly code: RpcUnattendedRefusalCode;
+    constructor(code: RpcUnattendedRefusalCode, message: string);
+}
+export declare class UnattendedBudgetExceededError extends Error {
+    readonly payload: RpcBudgetExceeded;
+    constructor(payload: RpcBudgetExceeded);
+}
+/** Thrown when a provider/tool reports a non-finite usage value (fail-closed). */
+export declare class UnattendedAccountingError extends Error {
+    readonly metric: RpcBudgetMetric;
+    readonly phase: string;
+    constructor(metric: RpcBudgetMetric, phase: string, value: unknown);
+}
+/** Thrown when a command's coarse scope is outside the declared allowlist (#319). */
+export declare class ScopeDeniedError extends Error {
+    readonly payload: RpcScopeDenied;
+    constructor(payload: RpcScopeDenied);
+}
+/** Thrown when an action class is outside the declared allowlist (default-deny, #319). */
+export declare class ActionDeniedError extends Error {
+    readonly payload: RpcActionDenied;
+    constructor(payload: RpcActionDenied);
+}
+interface Usage {
+    tokens: number;
+    toolCalls: number;
+    costUsd: number;
+}
+export declare class UnattendedRunController {
+    readonly runId: string;
+    readonly sessionId?: string;
+    readonly actor: string;
+    readonly budget: RpcUnattendedBudget;
+    readonly scopes: ReadonlySet<string>;
+    readonly actionAllowlist: ReadonlySet<string>;
+    private readonly usage;
+    private readonly startedAt;
+    private readonly now;
+    private readonly audit?;
+    private readonly abortHooks;
+    private aborted;
+    private abortPromise?;
+    private constructor();
+    /** Fail-closed entry: validate the declaration + budget, or throw. */
+    static negotiate(declaration: unknown, ctx: NegotiateContext): UnattendedRunController;
+    get isAborted(): boolean;
+    usageSnapshot(): Readonly<Usage> & {
+        wallTimeMs: number;
+    };
+    remainingWallTimeMs(): number;
+    /**
+     * Authorize a command's coarse scope against the declared allowlist. Throws
+     * ScopeDeniedError (pre-side-effect) when the scope was not declared.
+     */
+    authorizeScope(scope: BridgeCommandScope, command?: string): void;
+    /**
+     * Authorize an action class against the declared allowlist. Default-deny: any
+     * class not explicitly declared is rejected with ActionDeniedError before the
+     * side effect runs.
+     */
+    authorizeAction(action: RpcUnattendedActionClass, command?: string): void;
+    /**
+     * Classify a bash command and authorize the resulting action class BEFORE the
+     * command is executed. Returns the classified action class on success.
+     */
+    authorizeBash(command: string): RpcUnattendedActionClass;
+    /** Convenience: map a coarse scope to its `command.<scope>` action class. */
+    static actionClassForScope: typeof actionClassForScope;
+    /** Pre-turn estimate: refuse to start a turn that would obviously breach. */
+    preTurnEstimate(estimate: {
+        tokens?: number;
+        costUsd?: number;
+    }): void;
+    /** Reserve one tool-call unit BEFORE any side effect; breach if it would exceed. */
+    preflightToolCall(phase?: string): void;
+    /** Post-turn reconciliation of actual token usage. Fails closed on non-finite. */
+    recordTokens(tokens: number, phase?: string): void;
+    recordCost(costUsd: number, phase?: string): void;
+    /** Combined post-turn reconciliation. */
+    reconcile(actual: {
+        tokens?: number;
+        costUsd?: number;
+    }, phase?: string): void;
+    /** Wall-time check; call before/inside long operations. */
+    checkWallTime(phase?: string): void;
+    private breach;
+    /**
+     * Idempotent abort: runs every abort hook at most once. Safe to call from the
+     * synchronous breach path (which does not await) and from callers that do; both
+     * share a single abort promise so hook completion can be awaited deterministically.
+     */
+    abort(reason: string): Promise<void>;
+    /** Returns the in-flight/settled abort completion once aborting has begun. */
+    get abortCompletion(): Promise<void> | undefined;
+    private fireAbort;
+    private runAbortHooks;
+}
+export {};

package/dist/types/modes/shared/agent-wire/unattended-session.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Session-level unattended control plane (#323 / G011 emission side).
+ *
+ * Bridges the gate EMISSION side (skill runtimes / ask tool emitting gates) to
+ * the gate ANSWER side (the external agent's `workflow_gate_response` over RPC):
+ *
+ *  - `emitGate(input)` opens a gate on the durable broker, emits the gate frame
+ *    to the transport, and returns a promise that resolves with the agent's
+ *    answer once it arrives.
+ *  - `resolveGate(response)` (called from RPC dispatch) validates + resolves the
+ *    gate on the broker; the broker's `advance` hook resolves the pending
+ *    `emitGate` promise with the answer.
+ *
+ * Also implements the dispatch-facing {@link RpcUnattendedControlPlane} so the
+ * RPC server can route `negotiate_unattended` + `workflow_gate_response` here.
+ */
+import type { RpcCommand, RpcUnattendedAccepted, RpcUnattendedDeclaration, RpcWorkflowGate, RpcWorkflowGateResolution, RpcWorkflowGateResponse } from "../../rpc/rpc-types";
+import type { RpcUnattendedControlPlane } from "./command-dispatch";
+import { type UnattendedAbortHooks, type UnattendedAuditEvent, UnattendedRunController } from "./unattended-run-controller";
+import { type GateStore, type OpenGateInput } from "./workflow-gate-broker";
+/** Minimal surface a skill runtime / ask tool uses to emit a gate and await its answer. */
+export interface WorkflowGateEmitter {
+    /** True only when unattended mode has been negotiated. */
+    isUnattended(): boolean;
+    /** Open + emit a gate; resolves with the agent's answer (from workflow_gate_response). */
+    emitGate(input: OpenGateInput): Promise<unknown>;
+}
+export interface UnattendedSessionOptions {
+    runId: string;
+    sessionId?: string;
+    /** Emit a workflow_gate frame to the transport so the agent receives it. */
+    emitFrame: (gate: RpcWorkflowGate) => void;
+    /** Durable gate store; defaults to in-memory. */
+    store?: GateStore;
+    /** Audit sink for controller + gate events. */
+    audit?: (event: UnattendedAuditEvent | {
+        event: string;
+        [k: string]: unknown;
+    }) => void;
+    abortHooks?: UnattendedAbortHooks;
+    /** Whether the active provider reports token/cost usage (fail-closed when false/omitted). */
+    providerSupportsTokenCostMetrics?: boolean;
+    /** Snapshot live cumulative usage after a dispatch or turn, for budget reconciliation. */
+    getUsageSnapshot?: () => {
+        tokens?: number;
+        costUsd?: number;
+    };
+}
+export declare class UnattendedSessionControlPlane implements RpcUnattendedControlPlane, WorkflowGateEmitter {
+    #private;
+    private readonly opts;
+    constructor(opts: UnattendedSessionOptions);
+    isUnattended(): boolean;
+    get controller(): UnattendedRunController | undefined;
+    negotiate(declaration: RpcUnattendedDeclaration): RpcUnattendedAccepted;
+    preflightCommand(command: RpcCommand): void;
+    reconcileUsage(phase?: string): void;
+    resolveGate(response: RpcWorkflowGateResponse): Promise<RpcWorkflowGateResolution>;
+    emitGate(input: OpenGateInput): Promise<unknown>;
+    recover(): Promise<void>;
+}

package/dist/types/modes/shared/agent-wire/workflow-gate-broker.d.ts

@@ -0,0 +1,114 @@
+import type { RpcWorkflowGate, RpcWorkflowGateContext, RpcWorkflowGateKind, RpcWorkflowGateOption, RpcWorkflowGateResolution, RpcWorkflowGateResponse, RpcWorkflowStage } from "../../rpc/rpc-types";
+export interface PersistedGate {
+    gate: RpcWorkflowGate;
+    status: "pending" | "accepted";
+    idempotencyKey?: string;
+    responseHash?: string;
+    /** Raw accepted answer, retained so a crashed advance can be replayed. */
+    answer?: unknown;
+    resolution?: RpcWorkflowGateResolution;
+    advanced: boolean;
+}
+export interface GateStore {
+    nextSeq(stage: RpcWorkflowStage): number;
+    put(record: PersistedGate): void;
+    get(gateId: string): PersistedGate | undefined;
+    /** All persisted gate records (used for crash recovery). */
+    list(): PersistedGate[];
+}
+export declare class MemoryGateStore implements GateStore {
+    private counters;
+    private gates;
+    nextSeq(stage: RpcWorkflowStage): number;
+    put(record: PersistedGate): void;
+    get(gateId: string): PersistedGate | undefined;
+    list(): PersistedGate[];
+}
+/** Crash-durable JSON-file backed store. Writes the full state on every mutation. */
+export declare class FileGateStore implements GateStore {
+    private readonly filePath;
+    private state;
+    constructor(filePath: string);
+    private load;
+    private flush;
+    nextSeq(stage: RpcWorkflowStage): number;
+    put(record: PersistedGate): void;
+    get(gateId: string): PersistedGate | undefined;
+    list(): PersistedGate[];
+}
+export type GateAuditEvent = {
+    event: "gate_emitted";
+    gate_id: string;
+    stage: RpcWorkflowStage;
+    kind: RpcWorkflowGateKind;
+} | {
+    event: "gate_response_accepted";
+    gate_id: string;
+    answer_hash: string;
+} | {
+    event: "gate_response_rejected";
+    gate_id: string;
+    answer_hash: string;
+} | {
+    event: "gate_response_idempotent_replay";
+    gate_id: string;
+} | {
+    event: "gate_response_idempotency_conflict";
+    gate_id: string;
+} | {
+    event: "gate_response_already_resolved";
+    gate_id: string;
+} | {
+    event: "gate_response_unknown_gate";
+    gate_id: string;
+} | {
+    event: "gate_advance_recovered";
+    gate_id: string;
+};
+export interface BrokerHooks {
+    /** Called once when a pending gate has been persisted and should be emitted. */
+    emit?(gate: RpcWorkflowGate): void;
+    /**
+     * Invoked to advance the workflow after an accepted resolution is durably
+     * committed. MUST be idempotent keyed by `gate.gate_id`: `recover()` replays
+     * it for any gate left `accepted` but not `advanced` by a crash.
+     */
+    advance?(gate: RpcWorkflowGate, answer: unknown): void | Promise<void>;
+    /** Append-only audit sink. */
+    audit?(event: GateAuditEvent): void;
+}
+export interface OpenGateInput {
+    stage: RpcWorkflowStage;
+    kind: RpcWorkflowGateKind;
+    schema: RpcWorkflowGate["schema"];
+    options?: RpcWorkflowGateOption[];
+    context?: RpcWorkflowGateContext;
+}
+export declare class WorkflowGateBrokerError extends Error {
+    readonly code: "unknown_gate" | "already_resolved" | "idempotency_conflict" | "invalid_workflow_stage";
+    constructor(code: "unknown_gate" | "already_resolved" | "idempotency_conflict" | "invalid_workflow_stage", message: string);
+}
+export declare class WorkflowGateBroker {
+    private readonly runId;
+    private readonly store;
+    private readonly hooks;
+    constructor(runId: string, store: GateStore, hooks?: BrokerHooks);
+    private runShort;
+    /** Open and emit a gate. The pending record is persisted BEFORE emission. */
+    openGate(input: OpenGateInput): RpcWorkflowGate;
+    /**
+     * Resolve a gate with an answer. Validates against the advertised schema.
+     * On success the resolution is persisted BEFORE `advance` is invoked exactly
+     * once. Invalid answers leave the gate pending (per #315 acceptance).
+     */
+    resolve(response: RpcWorkflowGateResponse): Promise<RpcWorkflowGateResolution>;
+    /**
+     * Recover any gate left `accepted` but not `advanced` by a crash between the
+     * durable accept and the advanced commit. Replays `advance` (which must be
+     * idempotent) exactly once per gate and marks it advanced. Returns the ids
+     * that were recovered.
+     */
+    recover(): Promise<string[]>;
+    /** Canonical serialization helper (exposed for callers/tests). */
+    static canonical(value: unknown): string;
+}

package/dist/types/modes/shared/agent-wire/workflow-gate-schema.d.ts

@@ -0,0 +1,39 @@
+import type { RpcJsonSchema, RpcWorkflowGateValidationError } from "../../rpc/rpc-types";
+export declare const GATE_SCHEMA_LIMITS: {
+    readonly maxSchemaBytes: number;
+    readonly maxDepth: 16;
+    readonly maxProperties: 256;
+    readonly maxEnumValues: 512;
+    readonly maxAnswerBytes: number;
+};
+/** Thrown at gate construction when a schema is unsupported or too large. */
+export declare class WorkflowGateSchemaError extends Error {
+    readonly code = "invalid_workflow_gate_schema";
+    constructor(message: string);
+}
+/** Canonical (stable-key-ordered) JSON serialization used for hashing. */
+export declare function canonicalJson(value: unknown): string;
+export declare function schemaHash(schema: RpcJsonSchema): string;
+declare function answerHashOf(answer: unknown): string;
+/** Validate the schema *shape*. Throws WorkflowGateSchemaError on any problem. */
+export declare function assertSupportedGateSchema(schema: RpcJsonSchema): void;
+type SchemaError = {
+    path: string;
+    keyword: string;
+    message: string;
+    expected?: unknown;
+};
+/** A compiled, cached validator for one schema. */
+export interface CompiledGateSchema {
+    readonly schema: RpcJsonSchema;
+    readonly hash: string;
+    validate(answer: unknown): SchemaError[];
+}
+/** Compile (and cache) a validator for a schema. Asserts shape on first compile. */
+export declare function compileGateSchema(schema: RpcJsonSchema): CompiledGateSchema;
+/**
+ * Validate an answer against a compiled gate schema. Returns `null` on success
+ * or a typed {@link RpcWorkflowGateValidationError} on mismatch.
+ */
+export declare function validateGateAnswer(compiled: CompiledGateSchema, gateId: string, answer: unknown): RpcWorkflowGateValidationError | null;
+export { answerHashOf };

package/dist/types/modes/theme/theme.d.ts

@@ -6,7 +6,7 @@ export type SymbolPreset = "unicode" | "nerd" | "ascii";
 /**
  * All available symbol keys organized by category.
  */
-export type SymbolKey = "status.success" | "status.error" | "status.warning" | "status.info" | "status.pending" | "status.disabled" | "status.enabled" | "status.running" | "status.shadowed" | "status.aborted" | "nav.cursor" | "nav.selected" | "nav.expand" | "nav.collapse" | "nav.back" | "tree.branch" | "tree.last" | "tree.vertical" | "tree.horizontal" | "tree.hook" | "boxRound.topLeft" | "boxRound.topRight" | "boxRound.bottomLeft" | "boxRound.bottomRight" | "boxRound.horizontal" | "boxRound.vertical" | "boxSharp.topLeft" | "boxSharp.topRight" | "boxSharp.bottomLeft" | "boxSharp.bottomRight" | "boxSharp.horizontal" | "boxSharp.vertical" | "boxSharp.cross" | "boxSharp.teeDown" | "boxSharp.teeUp" | "boxSharp.teeRight" | "boxSharp.teeLeft" | "sep.powerline" | "sep.powerlineThin" | "sep.powerlineLeft" | "sep.powerlineRight" | "sep.powerlineThinLeft" | "sep.powerlineThinRight" | "sep.block" | "sep.space" | "sep.asciiLeft" | "sep.asciiRight" | "sep.dot" | "sep.slash" | "sep.pipe" | "icon.model" | "icon.plan" | "icon.goal" | "icon.pause" | "icon.folder" | "icon.scratchFolder" | "icon.file" | "icon.git" | "icon.branch" | "icon.pr" | "icon.tokens" | "icon.context" | "icon.cost" | "icon.time" | "icon.pi" | "icon.agents" | "icon.cache" | "icon.input" | "icon.output" | "icon.host" | "icon.session" | "icon.package" | "icon.warning" | "icon.rewind" | "icon.auto" | "icon.fast" | "icon.extensionSkill" | "icon.extensionTool" | "icon.extensionSlashCommand" | "icon.extensionMcp" | "icon.extensionRule" | "icon.extensionHook" | "icon.extensionPrompt" | "icon.extensionContextFile" | "icon.extensionInstruction" | "icon.mic" | "thinking.minimal" | "thinking.low" | "thinking.medium" | "thinking.high" | "thinking.xhigh" | "checkbox.checked" | "checkbox.unchecked" | "format.bullet" | "format.dash" | "format.bracketLeft" | "format.bracketRight" | "md.quoteBorder" | "md.hrChar" | "md.bullet" | "lang.default" | "lang.typescript" | "lang.javascript" | "lang.python" | "lang.rust" | "lang.go" | "lang.java" | "lang.c" | "lang.cpp" | "lang.csharp" | "lang.ruby" | "lang.php" | "lang.swift" | "lang.kotlin" | "lang.shell" | "lang.html" | "lang.css" | "lang.json" | "lang.yaml" | "lang.markdown" | "lang.sql" | "lang.docker" | "lang.lua" | "lang.text" | "lang.env" | "lang.toml" | "lang.xml" | "lang.ini" | "lang.conf" | "lang.log" | "lang.csv" | "lang.tsv" | "lang.image" | "lang.pdf" | "lang.archive" | "lang.binary" | "tab.appearance" | "tab.model" | "tab.interaction" | "tab.context" | "tab.editing" | "tab.tools" | "tab.memory" | "tab.tasks" | "tab.providers";
+export type SymbolKey = "status.success" | "status.error" | "status.warning" | "status.info" | "status.pending" | "status.disabled" | "status.enabled" | "status.running" | "status.shadowed" | "status.aborted" | "nav.cursor" | "nav.selected" | "nav.expand" | "nav.collapse" | "nav.back" | "tree.branch" | "tree.last" | "tree.vertical" | "tree.horizontal" | "tree.hook" | "boxRound.topLeft" | "boxRound.topRight" | "boxRound.bottomLeft" | "boxRound.bottomRight" | "boxRound.horizontal" | "boxRound.vertical" | "boxSharp.topLeft" | "boxSharp.topRight" | "boxSharp.bottomLeft" | "boxSharp.bottomRight" | "boxSharp.horizontal" | "boxSharp.vertical" | "boxSharp.cross" | "boxSharp.teeDown" | "boxSharp.teeUp" | "boxSharp.teeRight" | "boxSharp.teeLeft" | "sep.powerline" | "sep.powerlineThin" | "sep.powerlineLeft" | "sep.powerlineRight" | "sep.powerlineThinLeft" | "sep.powerlineThinRight" | "sep.block" | "sep.space" | "sep.asciiLeft" | "sep.asciiRight" | "sep.dot" | "sep.slash" | "sep.pipe" | "icon.model" | "icon.plan" | "icon.goal" | "icon.pause" | "icon.folder" | "icon.scratchFolder" | "icon.file" | "icon.git" | "icon.branch" | "icon.pr" | "icon.tokens" | "icon.context" | "icon.cost" | "icon.time" | "icon.pi" | "icon.agents" | "icon.cache" | "icon.input" | "icon.output" | "icon.host" | "icon.session" | "icon.package" | "icon.warning" | "icon.rewind" | "icon.auto" | "icon.fast" | "icon.extensionSkill" | "icon.extensionTool" | "icon.extensionSlashCommand" | "icon.extensionMcp" | "icon.extensionRule" | "icon.extensionHook" | "icon.extensionPrompt" | "icon.extensionContextFile" | "icon.extensionInstruction" | "icon.mic" | "thinking.minimal" | "thinking.low" | "thinking.medium" | "thinking.high" | "thinking.xhigh" | "thinking.max" | "checkbox.checked" | "checkbox.unchecked" | "format.bullet" | "format.dash" | "format.bracketLeft" | "format.bracketRight" | "md.quoteBorder" | "md.hrChar" | "md.bullet" | "lang.default" | "lang.typescript" | "lang.javascript" | "lang.python" | "lang.rust" | "lang.go" | "lang.java" | "lang.c" | "lang.cpp" | "lang.csharp" | "lang.ruby" | "lang.php" | "lang.swift" | "lang.kotlin" | "lang.shell" | "lang.html" | "lang.css" | "lang.json" | "lang.yaml" | "lang.markdown" | "lang.sql" | "lang.docker" | "lang.lua" | "lang.text" | "lang.env" | "lang.toml" | "lang.xml" | "lang.ini" | "lang.conf" | "lang.log" | "lang.csv" | "lang.tsv" | "lang.image" | "lang.pdf" | "lang.archive" | "lang.binary" | "tab.appearance" | "tab.model" | "tab.interaction" | "tab.context" | "tab.editing" | "tab.tools" | "tab.memory" | "tab.tasks" | "tab.providers";
 export type SpinnerType = "status" | "activity";
 export type ThemeColor = "accent" | "border" | "borderAccent" | "borderMuted" | "success" | "error" | "warning" | "muted" | "dim" | "text" | "thinkingText" | "userMessageText" | "customMessageText" | "customMessageLabel" | "toolTitle" | "toolOutput" | "mdHeading" | "mdLink" | "mdLinkUrl" | "mdCode" | "mdCodeBlock" | "mdCodeBlockBorder" | "mdQuote" | "mdQuoteBorder" | "mdHr" | "mdListBullet" | "toolDiffAdded" | "toolDiffRemoved" | "toolDiffContext" | "syntaxComment" | "syntaxKeyword" | "syntaxFunction" | "syntaxVariable" | "syntaxString" | "syntaxNumber" | "syntaxType" | "syntaxOperator" | "syntaxPunctuation" | "thinkingOff" | "thinkingMinimal" | "thinkingLow" | "thinkingMedium" | "thinkingHigh" | "thinkingXhigh" | "bashMode" | "pythonMode" | "statusLineSep" | "statusLineModel" | "statusLinePath" | "statusLineGitClean" | "statusLineGitDirty" | "statusLineContext" | "statusLineSpend" | "statusLineStaged" | "statusLineDirty" | "statusLineUntracked" | "statusLineOutput" | "statusLineCost" | "statusLineSubagents";
 /** Check if a string is a valid ThemeColor value */
@@ -149,6 +149,7 @@ export declare class Theme {
         medium: string;
         high: string;
         xhigh: string;
+        max: string;
     };
     get checkbox(): {
         checked: string;

package/dist/types/modes/types.d.ts

@@ -123,6 +123,7 @@ export interface InteractiveModeContext {
     }): void;
     showError(message: string): void;
     showWarning(message: string): void;
+    notifyConfigChanged?: () => Promise<void> | void;
     showNewVersionNotification(newVersion: string): void;
     clearEditor(): void;
     updatePendingMessagesDisplay(): void;

package/dist/types/runtime-mcp/transports/stdio.d.ts

@@ -5,10 +5,6 @@
  * Messages are newline-delimited JSON.
  */
 import type { MCPRequestOptions, MCPStdioServerConfig, MCPTransport } from "../../runtime-mcp/types";
-/**
- * Stdio transport for MCP servers.
- * Spawns a subprocess and communicates via stdin/stdout.
- */
 export declare class StdioTransport implements MCPTransport {
     #private;
     private config;