@gaunt-sloth/core 2.0.0-alpha.3 → 2.0.0-alpha.30

package/dist/core/toolOutputChannel.js

@@ -0,0 +1,165 @@
+import { displayError, displayInfo, displayWarning } from '#src/utils/consoleUtils.js';
+import { stdout } from '#src/utils/systemUtils.js';
+let activeListener = null;
+/**
+ * TUI-C31 (d): true while a surface owns the terminal frame (the mounted Ink TUI) but no
+ * per-turn subscriber is attached — i.e. BETWEEN turns. In that window a straggler child that
+ * outlived the kill grace must NOT reach raw stdout (it would corrupt Ink's managed frame), so
+ * the default sink drops it instead. Off by default, so every headless surface is unaffected.
+ */
+let suppressed = false;
+/**
+ * Subscribe to live tool output, replacing the default stdout/`displayInfo` sink for as long
+ * as the subscription is active. Returns an unsubscribe function. Last subscriber wins; the
+ * returned unsubscribe only clears its OWN registration (a stale unsubscribe can never detach
+ * a newer subscriber).
+ */
+export function subscribeToolOutput(listener) {
+    activeListener = listener;
+    return () => {
+        if (activeListener === listener) {
+            activeListener = null;
+        }
+    };
+}
+/**
+ * TUI-C31 (d): mark whether a terminal-owning surface (the Ink TUI) is mounted. While mounted,
+ * the default sink SUPPRESSES output that has no per-turn subscriber (a post-turn straggler)
+ * rather than writing it raw over the managed frame. The TUI session sets this `true` around the
+ * whole session (`render()` … `waitUntilExit()`) and back to `false` on unmount, so once the TUI
+ * is gone the default (headless) stdout sink is fully restored. An active per-turn subscriber
+ * always takes precedence, so legitimate in-turn output is untouched.
+ */
+export function setToolOutputSuppressed(value) {
+    suppressed = value;
+}
+/**
+ * Emit one piece of live tool output. Routed to the active subscriber when present (the Ink
+ * TUI), otherwise to the DEFAULT SINK, which reproduces the pre-TUI-C17 behaviour exactly:
+ * the notice via `displayInfo` with its historical leading newline, chunks via `stdout.write`,
+ * a warning via `displayWarning` and an error via `displayError` (TUI-C31 a). While the TUI is
+ * mounted but no subscriber is attached (between turns), a no-subscriber emit is SUPPRESSED
+ * rather than written raw over the managed frame (TUI-C31 d).
+ */
+export function emitToolOutput(chunk) {
+    if (activeListener) {
+        activeListener(chunk);
+        return;
+    }
+    if (suppressed) {
+        // TUI mounted, between turns: drop the straggler instead of corrupting the managed frame.
+        return;
+    }
+    switch (chunk.kind) {
+        case 'notice':
+            displayInfo(`\n${chunk.text}`);
+            break;
+        case 'warning':
+            displayWarning(chunk.text);
+            break;
+        case 'error':
+            displayError(chunk.text);
+            break;
+        default:
+            stdout.write(chunk.text);
+    }
+}
+/** Convert one channel chunk into its typed {@link AgentStreamEvent} representation. */
+function toEvent(chunk) {
+    return {
+        type: 'tool_output',
+        ...(chunk.toolCallId !== undefined ? { id: chunk.toolCallId } : {}),
+        name: chunk.toolName,
+        chunk: chunk.text,
+        // A `notice` is chrome; a failure-path `warning`/`error` is also chrome relative to the child's
+        // own stdout/stderr `output`, so it lands on the view-model's separate `notice` field (never
+        // counted as a raw output line) rather than styled as command output.
+        ...(chunk.kind === 'notice' || chunk.kind === 'warning' || chunk.kind === 'error'
+            ? { isNotice: true }
+            : {}),
+    };
+}
+/**
+ * Merge live tool output into an agent event stream: subscribes to the channel for the
+ * lifetime of `inner` and yields each emitted chunk as a `tool_output` event, interleaved
+ * with `inner`'s own events in arrival order. Because tool child output arrives WHILE the
+ * graph stream is awaiting its next message, the merge is push-based (a woken queue), so a
+ * long-running command's output streams into the consumer live rather than batching until
+ * the tool finishes.
+ *
+ * Used by the TUI session around `processMessagesWithEvents`; always unsubscribes (restoring
+ * the default stdout sink) when the inner stream completes, throws, or the consumer stops
+ * early. Errors from `inner` (including aborts) propagate unchanged after the queue drains.
+ */
+export async function* mergeToolOutputIntoEvents(inner) {
+    const queue = [];
+    let wake = null;
+    let done = false;
+    let error;
+    let failed = false;
+    const notify = () => {
+        const w = wake;
+        wake = null;
+        w?.();
+    };
+    const unsubscribe = subscribeToolOutput((chunk) => {
+        queue.push(toEvent(chunk));
+        notify();
+    });
+    // Pump the inner stream into the same queue so both sources serialize in arrival order.
+    const pump = (async () => {
+        try {
+            for await (const event of inner) {
+                queue.push(event);
+                notify();
+            }
+        }
+        catch (e) {
+            failed = true;
+            error = e;
+        }
+        finally {
+            done = true;
+            notify();
+        }
+    })();
+    try {
+        for (;;) {
+            while (queue.length > 0) {
+                yield queue.shift();
+            }
+            if (done)
+                break;
+            await new Promise((resolve) => {
+                wake = resolve;
+            });
+        }
+        await pump;
+        // TUI-C31 (b): the subscriber is still attached at this point, so a straggler chunk can be
+        // pushed in the microwindow between the loop's last drain and the unsubscribe (the child
+        // flushed one final line as the turn ended). Detach the subscriber FIRST — after which no
+        // further chunk can be queued — THEN drain whatever is already queued, so nothing enqueued is
+        // silently dropped.
+        unsubscribe();
+        while (queue.length > 0) {
+            yield queue.shift();
+        }
+        if (failed)
+            throw error;
+    }
+    finally {
+        // TUI-C31 (c): also reached on early-stop — a consumer `return()`/`throw` into this generator
+        // while it is suspended (e.g. at a yield, the way a `for await` aborts). Make that path clean:
+        // unsubscribe (idempotent — a stale unsubscribe is a no-op) so the subscription never leaks,
+        // settle any pending wake resolver, and best-effort release the inner stream. This is
+        // deliberately fire-and-forget: `inner` may be parked on an await that its own `return()`
+        // cannot interrupt, and AWAITING the pump here would hang the consumer's `return()` on exactly
+        // that unresolvable inner — so we release and let go rather than block.
+        unsubscribe();
+        notify();
+        if (!done) {
+            void inner.return?.(undefined).catch(() => { });
+        }
+    }
+}
+//# sourceMappingURL=toolOutputChannel.js.map

package/dist/core/toolOutputChannel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"toolOutputChannel.js","sourceRoot":"","sources":["../../src/core/toolOutputChannel.ts"],"names":[],"mappings":"AA8BA,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACvF,OAAO,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAC;AA+BnD,IAAI,cAAc,GAAiC,IAAI,CAAC;AAExD;;;;;GAKG;AACH,IAAI,UAAU,GAAG,KAAK,CAAC;AAEvB;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAA+B;IACjE,cAAc,GAAG,QAAQ,CAAC;IAC1B,OAAO,GAAG,EAAE;QACV,IAAI,cAAc,KAAK,QAAQ,EAAE,CAAC;YAChC,cAAc,GAAG,IAAI,CAAC;QACxB,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAc;IACpD,UAAU,GAAG,KAAK,CAAC;AACrB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,KAAyB;IACtD,IAAI,cAAc,EAAE,CAAC;QACnB,cAAc,CAAC,KAAK,CAAC,CAAC;QACtB,OAAO;IACT,CAAC;IACD,IAAI,UAAU,EAAE,CAAC;QACf,0FAA0F;QAC1F,OAAO;IACT,CAAC;IACD,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,QAAQ;YACX,WAAW,CAAC,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YAC/B,MAAM;QACR,KAAK,SAAS;YACZ,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC3B,MAAM;QACR,KAAK,OAAO;YACV,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACzB,MAAM;QACR;YACE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,wFAAwF;AACxF,SAAS,OAAO,CAAC,KAAyB;IACxC,OAAO;QACL,IAAI,EAAE,aAAa;QACnB,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,IAAI,EAAE,KAAK,CAAC,QAAQ;QACpB,KAAK,EAAE,KAAK,CAAC,IAAI;QACjB,gGAAgG;QAChG,6FAA6F;QAC7F,sEAAsE;QACtE,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO;YAC/E,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE;YACpB,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,yBAAyB,CAC9C,KAAuC;IAEvC,MAAM,KAAK,GAAuB,EAAE,CAAC;IACrC,IAAI,IAAI,GAAwB,IAAI,CAAC;IACrC,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,IAAI,KAAc,CAAC;IACnB,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,MAAM,MAAM,GAAG,GAAS,EAAE;QACxB,MAAM,CAAC,GAAG,IAAI,CAAC;QACf,IAAI,GAAG,IAAI,CAAC;QACZ,CAAC,EAAE,EAAE,CAAC;IACR,CAAC,CAAC;IAEF,MAAM,WAAW,GAAG,mBAAmB,CAAC,CAAC,KAAK,EAAE,EAAE;QAChD,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3B,MAAM,EAAE,CAAC;IACX,CAAC,CAAC,CAAC;IAEH,wFAAwF;IACxF,MAAM,IAAI,GAAG,CAAC,KAAK,IAAI,EAAE;QACvB,IAAI,CAAC;YACH,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;gBAChC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAClB,MAAM,EAAE,CAAC;YACX,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,GAAG,IAAI,CAAC;YACd,KAAK,GAAG,CAAC,CAAC;QACZ,CAAC;gBAAS,CAAC;YACT,IAAI,GAAG,IAAI,CAAC;YACZ,MAAM,EAAE,CAAC;QACX,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IAEL,IAAI,CAAC;QACH,SAAS,CAAC;YACR,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,MAAM,KAAK,CAAC,KAAK,EAAG,CAAC;YACvB,CAAC;YACD,IAAI,IAAI;gBAAE,MAAM;YAChB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;gBAClC,IAAI,GAAG,OAAO,CAAC;YACjB,CAAC,CAAC,CAAC;QACL,CAAC;QACD,MAAM,IAAI,CAAC;QACX,2FAA2F;QAC3F,yFAAyF;QACzF,0FAA0F;QAC1F,8FAA8F;QAC9F,oBAAoB;QACpB,WAAW,EAAE,CAAC;QACd,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,KAAK,CAAC,KAAK,EAAG,CAAC;QACvB,CAAC;QACD,IAAI,MAAM;YAAE,MAAM,KAAK,CAAC;IAC1B,CAAC;YAAS,CAAC;QACT,8FAA8F;QAC9F,+FAA+F;QAC/F,6FAA6F;QAC7F,sFAAsF;QACtF,0FAA0F;QAC1F,+FAA+F;QAC/F,wEAAwE;QACxE,WAAW,EAAE,CAAC;QACd,MAAM,EAAE,CAAC;QACT,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/core/types.d.ts

@@ -1,5 +1,6 @@
 import type { GthConfig } from '#src/config.js';
-import type { ShellSafetyVerdict } from '#src/core/shell/judge.js';
+import type { DeclaredToolAnnotations } from '#src/core/approvals/annotations.js';
+import type { RaterNegotiationRound, ShellSafetyVerdict } from '#src/core/shell/rater.js';
 import type { BaseMessage } from '@langchain/core/messages';
 import type { RunnableConfig } from '@langchain/core/runnables';
 import type { StructuredToolInterface } from '@langchain/core/tools';
@@ -22,6 +23,45 @@ export declare enum StatusLevel {
     STREAM = 6
 }
 export type GthCommand = 'ask' | 'pr' | 'review' | 'chat' | 'code' | 'api' | 'exec';
+/**
+ * GS2-16 — per-run analytics harvested from a finished agent turn, threaded into the opt-in
+ * history recorder ({@link recordSessionSafe}) so `gth insights` reports real numbers instead of
+ * zeros. All fields are best-effort: token counts are only present when the provider actually
+ * reported `usage_metadata` (otherwise omitted so the recorder stores NULL and the insights
+ * formatter suppresses the misleading `0`), and `tools` lists the names of tools invoked during
+ * the run (deduplicated, order-insensitive). There is no `costUsd` — cost requires a reliable
+ * price table this project does not carry, so it is deliberately never invented here.
+ */
+export interface GthRunStats {
+    /** Total prompt/input tokens across the run's LLM calls, when the provider reported usage. */
+    tokensInput?: number;
+    /** Total completion/output tokens across the run's LLM calls, when the provider reported usage. */
+    tokensOutput?: number;
+    /** Names of tools invoked during the run (deduplicated); empty when no tools were used. */
+    tools: string[];
+    /**
+     * BATCH-21 — one record per executed tool result (`ToolMessage`) observed during the run, in
+     * arrival order and NOT deduplicated (a tool called twice yields two records), so `gth eval`'s
+     * tool-RESULT assertions (`must_error` / `tool_result_json_path`) can grade what a tool
+     * *returned*, not just that it was called. Optional (additive): producers that predate the field
+     * simply omit it; {@link runStats.js finalizeRunStats} always sets it.
+     */
+    toolResults?: GthToolResult[];
+}
+/**
+ * BATCH-21 — one executed tool call's result, harvested from its `ToolMessage` by the GS2-16
+ * run-stats accumulator (`core/runStats.ts`). Fail-soft like everything else there: `content` is
+ * omitted when no text payload could be derived, and is size-capped
+ * ({@link runStats.js TOOL_RESULT_CONTENT_CAP}) so a giant payload can't bloat run stats.
+ */
+export interface GthToolResult {
+    /** The tool that produced the result (`ToolMessage.name`). */
+    name: string;
+    /** `true` iff the result carried LangChain's real error signal (`ToolMessage.status === 'error'`). */
+    isError: boolean;
+    /** The result payload as text (a non-string payload is JSON-stringified), capped in length. */
+    content?: string;
+}
 /**
  * Typed events emitted by the agent's {@link GthAgentInterface#streamWithEvents} path.
  * This is the renderer contract shared by every consumer of an agent run — the AG-UI
@@ -49,10 +89,45 @@ export type AgentStreamEvent = {
 } | {
     type: 'tool_end';
     id: string;
+} | {
+    /**
+     * TUI-C17 — one live output chunk from an EXECUTING tool (a custom/dev toolkit child
+     * process's stdout/stderr, or its "Executing …" announcement), surfaced through the managed
+     * event stream instead of raw `process.stdout` so a renderer (the Ink TUI) can fold it into
+     * its view-model. Emitted by the tool-output channel merge
+     * (see `core/toolOutputChannel.js#mergeToolOutputIntoEvents`), NOT by `processEventStream`
+     * itself — consumers that don't opt into the merge (e.g. the AG-UI SSE encoder) never see it
+     * and the toolkits keep writing to stdout for them (today's headless behaviour).
+     */
+    type: 'tool_output';
+    /**
+     * The tool call this chunk belongs to (LangChain's `ToolRunnableConfig.toolCall.id`,
+     * threaded through the toolkits), so a renderer can nest output under the exact call —
+     * TUI-C30 consumes this for per-call output previews. Optional only defensively: absent
+     * when the executing framework did not supply a tool call, in which case consumers should
+     * fall back to `name` attribution.
+     */
+    id?: string;
+    /** The gth tool name (e.g. `run_shell_command`, a custom tool's name). Always known. */
+    name: string;
+    /** One verbatim streamed chunk of the child's stdout/stderr (or the notice text). */
+    chunk: string;
+    /**
+     * True when this chunk is the "🔧 Executing …" announcement rather than child output, so
+     * a richer renderer (TUI-C30) can style or strip it when previewing raw output lines.
+     */
+    isNotice?: boolean;
 } | {
     type: 'tool_result';
     id: string;
     content: string;
+    /**
+     * True when the underlying `ToolMessage.status` is `'error'` (LangChain's real
+     * tool-result error signal). Absent/undefined means success — consumers must not
+     * sniff the result text to infer failure. Optional for backward compatibility with
+     * producers that predate the field.
+     */
+    isError?: boolean;
 };
 /**
  * The minimal structural surface of a compiled LangGraph agent that the shared agent
@@ -84,29 +159,126 @@ export interface PendingToolInterrupt {
     name: string;
     args: Record<string, unknown>;
     /**
-     * EXT-10 — when the LLM-as-judge safety gate escalated this `run_shell_command` to the human
-     * (rather than auto-approving it), the judge's verdict is attached here so the approval surface
-     * can show a "safety judge flagged: <reason>" notice. Absent when the judge is disabled (the
-     * default) or when the command reached the human without going through the judge.
+     * CFG-26 — when the AI rater escalated this `run_shell_command` to the human (rather than
+     * approving it or bouncing it back to the model), the rater's verdict is attached here so the
+     * approval surface can show an "AI rater (<tier>): <reason>" notice. Absent when the rater is
+     * off, or when the command reached the human without being rated.
      */
     safetyVerdict?: ShellSafetyVerdict;
+    /**
+     * EXT-71 §3.2 — when this call reached the human because a declared `approvals.escalate` entry
+     * matched it, the entry that fired, rendered for display. It is the provenance the prompt shows:
+     * an escalation the user cannot trace to the line they wrote reads as the gate malfunctioning.
+     * Absent whenever the escalation came from the rung or the rater instead.
+     */
+    escalatedBy?: string;
+    /**
+     * EXT-71 §6 — **what a sticky choice will store**, rendered in the object form the user would
+     * write in a config file, e.g. `{ "type": "shell", "matcher": "exact", "pattern": "npm test" }`.
+     * The menu MUST show this at the moment of the choice, on every surface: the user is shown the
+     * thing they are agreeing to rather than a generalization of it, which is what makes the display
+     * honest and cheap at once.
+     *
+     * **For a tool call the stored thing is the tool, not the arguments** (§4.7.4), so this reads
+     * e.g. `{ "type": "mcpTool", "server": "fetcher", "matcher": "exact", "pattern": "fetch_url",
+     * "host": "docs.internal.example" }`. That is the one place a grant is deliberately broader than
+     * what the human was shown, which is why the display carries the most weight there.
+     *
+     * Absent exactly where no sticky grant is on offer — a `catastrophic` outcome (§4.2 withdraws
+     * the persistent grants), a rung that remembers nothing, a command that does not statically
+     * resolve, or a tool call naming more than one host (which has no honest single-host entry) — so
+     * a prompt never advertises a control that has already been withdrawn.
+     */
+    grantPreview?: string;
+    /**
+     * §6 — **the same grant in the words a menu control is written in**: `npm test` for a shell
+     * command, `tool gth_web_fetch (host docs.internal.example)` or `mcpTool jira/create_issue` for a
+     * tool call. It is what the *always approve* control names, so the control reads as
+     * *always approve this tool for this host* rather than as a bare key.
+     *
+     * It is rendered by `describeApprovalEntry` — the one-liner every other provenance message uses,
+     * including the §4.7.4 notice that later withdraws the grant. Sharing the renderer is the point:
+     * a menu that describes a grant differently from the notice that withdraws it is how a user stops
+     * trusting either.
+     *
+     * Present exactly when {@link grantPreview} is, since both are rendered from the one entry
+     * `recordApproval` would write.
+     */
+    grantSummary?: string;
+    /**
+     * [[TUI-C26]] §6 — **what the menu's *always reject* choice will record**, in the object form the
+     * user would write in a config file. The deny mirror of {@link grantPreview}, shown at the moment
+     * of the choice for the same reason: a control that does not say what it stores is one the user
+     * has to guess at.
+     *
+     * **Its availability is NOT the grant's**, and reading one off the other is the mistake this
+     * field exists to prevent. The matcher's own rule is *undecidable → no match on the allow side, a
+     * match on the deny side*, so a command the gate cannot statically resolve **can** be refused
+     * permanently even though it can never be allowed permanently. `always reject` also stays offered
+     * on a `catastrophic` verdict, where §4.2 withdraws every sticky grant: sticky refusal is safe in
+     * every direction, and it is only the grant that is ever made harder.
+     *
+     * Absent only where the entry grammar cannot hold one at all — today, an MCP call whose server
+     * could not be attributed (the grammar's `server` cannot be empty). Absent means the control is
+     * **not offered**, never offered-and-disabled.
+     */
+    denyPreview?: string;
+    /**
+     * §6 — the same deny entry in the words the control is written in, through the one-liner every
+     * other provenance message uses. Present exactly when {@link denyPreview} is, since both are
+     * rendered from the one entry the runner would record.
+     */
+    denySummary?: string;
+    /**
+     * [[EXT-29]] §6 — **every round of the §5 negotiation that preceded this escalation**, oldest
+     * first, when one did.
+     *
+     * The user is not asked to rule on the final command in isolation: *that the agent proposed
+     * `git reset --hard origin/main` three times unchanged, against two rejections that each told it
+     * what to fix, is itself the most important thing on the screen, and it is invisible if only the
+     * last attempt is shown.* `core/shell/negotiation.ts`'s `renderNegotiationTranscript` is the
+     * shared renderer, so two surfaces cannot describe one exchange two ways.
+     *
+     * Absent for every escalation that had no negotiation — `catastrophic` (§4.2 gives it no rounds
+     * at all), a declared `approvals.escalate` entry, an unrated rung, a tool subject.
+     */
+    negotiationRounds?: readonly RaterNegotiationRound[];
 }
 /**
- * Persistence scope for an `approve` decision (EXT-9 Tier-2 allow-list ergonomics):
+ * Persistence scope for an `approve` decision (spec §6):
  * - `once`    — run this single invocation only; remember nothing (the default).
- * - `session` — remember the command's classified prefix for the life of this runner
- *   instance, so flag-variants of the same operation auto-approve without re-prompting.
- * - `always`  — additionally persist the prefix to the project allow-list
+ * - `session` — remember **this command**, as an `exact` entry (§3.1), for the life of this runner
+ *   instance, so the same command stops re-prompting. A longer variant of it still asks: the menu
+ *   never widens, and breadth is something a human writes in a config file.
+ * - `always`  — additionally persist that entry to the project store
  *   (`.gsloth/.gsloth-settings/shell-allowlist.json`) so it survives across runs.
  */
 export type ToolApprovalScope = 'once' | 'session' | 'always';
+/**
+ * §6 — persistence scope for a `reject` decision, the *always reject* half of the escalation menu:
+ * - `once`    — refuse this single invocation; remember nothing (the default).
+ * - `session` — additionally record a **deny** entry for this call, in the one entry grammar, for
+ *   the life of this runner instance. The matcher consults it before anything else, so the next
+ *   identical call is refused without reaching a person at all.
+ *
+ * **There is deliberately no `always`.** An `approve` can persist because there is a project store
+ * to persist it to; there is no persisted deny store, and inventing one is a decision about a file
+ * users will have to live with rather than a rendering choice. So the scopes here are the ones the
+ * gate can actually honour, and a control that promised more would be §6's own failure mode — an
+ * affordance offered and then quietly refused.
+ */
+export type ToolRejectScope = 'once' | 'session';
 /**
  * A consumer-supplied decision on a {@link PendingToolInterrupt}: approve runs the tool,
  * reject feeds the model a tool-rejected message (with the optional reason).
  *
- * `approve` carries an optional {@link ToolApprovalScope}; when absent it means `once`
- * (backward compatible — a bare `{ type: 'approve' }` still type-checks and behaves as
- * a single-shot approval that persists nothing).
+ * Each arm carries an optional scope; when absent it means `once` (backward compatible — a bare
+ * `{ type: 'approve' }` or `{ type: 'reject' }` still type-checks and behaves as the single-shot
+ * decision that persists nothing).
+ *
+ * The two scopes are **different types on purpose**. Sharing {@link ToolApprovalScope} would let a
+ * surface send `{ type: 'reject', scope: 'always' }`, which type-checks, promises a persistence
+ * nothing implements, and degrades to a session refusal with no diagnostic.
  */
 export type ToolApprovalDecision = {
     type: 'approve';
@@ -114,6 +286,7 @@ export type ToolApprovalDecision = {
 } | {
     type: 'reject';
     message?: string;
+    scope?: ToolRejectScope;
 };
 /**
  * Callback the {@link GthAgentRunner} invokes when a run suspends on a tool-approval
@@ -122,6 +295,42 @@ export type ToolApprovalDecision = {
  * silently hang or auto-approve.
  */
 export type ToolApprovalCallback = (pending: PendingToolInterrupt) => Promise<ToolApprovalDecision> | ToolApprovalDecision;
+/**
+ * [[TUI-C68]] §6.1 — what the **attack banner** is about: the command whose own structure the
+ * rater called hostile, and the rater's explanation of what it saw. Both are untrusted text and a
+ * surface must paint them through `core/shell/framing`.
+ *
+ * A separate shape from {@link PendingToolInterrupt} because it is a separate question. An approval
+ * prompt asks *may this run*, and every control on its menu is a legitimate answer carrying a
+ * scope; this asks *do you believe the rating is wrong*, has exactly one way through, and offers no
+ * scope at all — so a surface cannot reach for a menu control that does not exist here.
+ */
+export interface PendingAttackHalt {
+    /** The command the rater rated an attack, as the model wrote it. Untrusted text. */
+    command: string;
+    /** The rater's own explanation of what the command's structure showed. Untrusted text. */
+    reason: string;
+}
+/**
+ * §6.1 — the human's answer at the attack banner.
+ *
+ * **A string union rather than a boolean, and the polarity is deliberate.** `run-anyway` is the
+ * only value that runs anything; every other value — one a future surface invents, or `undefined`
+ * from a surface that forgot to return — stops the run. A boolean would put the irreversible answer
+ * one inverted comparison away, and there is nothing here worth being one typo from.
+ */
+export type AttackHaltAnswer = 'run-anyway' | 'stop';
+/**
+ * §6.1 — callback the {@link GthAgentRunner} invokes when the rater rates a command an `attack`, so
+ * an interactive surface can show the red banner and let a human type their way past it.
+ *
+ * **Absent means halt**, exactly as an absent {@link ToolApprovalCallback} means the §6.2
+ * non-interactive exit. A surface that never wires this — a CI run, an AG-UI server, a surface
+ * nobody has written yet — keeps the halt, so forgetting fails safe. It may never block a
+ * non-interactive run, and no timeout turns waiting into a grant: waiting is something only a wired
+ * surface can cause.
+ */
+export type AttackHaltCallback = (halt: PendingAttackHalt) => Promise<AttackHaltAnswer> | AttackHaltAnswer;
 export interface GthAgentInterface {
     init(command: GthCommand | undefined, configIn: GthConfig, checkpointSaver?: BaseCheckpointSaver | undefined): Promise<void>;
     invoke(messages: Message[], runConfig: RunnableConfig): Promise<string>;
@@ -148,6 +357,38 @@ export interface GthAgentInterface {
      * approve/reject confirmation loop.
      */
     getPendingToolInterrupts?(runConfig: RunnableConfig): Promise<PendingToolInterrupt[]>;
+    /**
+     * EXT-58 (spec §4.4) — the names of the tools registered with the graph at `init`. The runner
+     * intersects them with the built-in summaries table to tell the rater which already-granted
+     * built-ins it may offer as an alternative, so a suggestion can never name a tool the model does
+     * not have. Optional: an agent that does not track its tools simply omits it, and the rater then
+     * receives no granted list (and so suggests nothing).
+     */
+    getRegisteredToolNames?(): string[];
+    /**
+     * EXT-70 (spec §4.7.1) — what the connected MCP servers declared about their own tools in their
+     * `tools/list` responses, keyed by the REGISTERED tool name (`mcp__<server>__<tool>`). The runner
+     * reads it as the `mcp` half of a declared-annotation lookup when it computes a call's effective
+     * annotation set.
+     *
+     * These are **claims, not credentials**: nothing here has been trusted, and an entry only becomes
+     * load-bearing where the user's `approvals.mcp` block believes that hint from that server.
+     * Optional — an agent that tracks no tools omits it, and every tool is then fail-closed, which is
+     * exactly what a fully distrustful configuration computes anyway.
+     */
+    getDeclaredMcpToolAnnotations?(): ReadonlyMap<string, DeclaredToolAnnotations>;
+    /**
+     * GS2-16 — reset the per-run analytics accumulator so the NEXT turn's token/tool totals start
+     * from zero. Called by {@link GthAgentRunner} at each turn boundary (the runner is reused across
+     * turns in interactive sessions). Optional: agents that don't collect stats simply omit it.
+     */
+    resetRunStats?(): void;
+    /**
+     * GS2-16 — the analytics harvested from the run(s) since the last {@link resetRunStats}. Used by
+     * the runner to thread token/tool data into the opt-in history recorder. Optional; when absent
+     * the runner records no analytics for that turn. Reading must never throw.
+     */
+    getRunStats?(): GthRunStats;
     cleanup?(): Promise<void>;
 }
 /**
@@ -161,9 +402,50 @@ export type ToolsResolver = (config: GthConfig, command?: GthCommand) => Promise
 export type ToolsCleanup = () => Promise<void>;
 export type MiddlewareResolver = (middleware: any[] | undefined, config: GthConfig) => Promise<any[]>;
 export type MiddlewareCleanup = () => Promise<void>;
+/**
+ * EXT-32 — one connected MCP server's discovery `instructions` string (from its MCP `initialize`
+ * handshake), paired with the server name it came from. Captured once during tool resolution and
+ * reused: injected (fenced + per-server-labelled) into the composed system prompt, and available
+ * for [[TUI-C20]]'s MCP debug tab to render the same captured text. Only servers that actually
+ * supplied non-empty instructions appear here.
+ */
+export interface McpServerInstruction {
+    /** The configured MCP server name (the key under `config.mcpServers`). */
+    server: string;
+    /** The server-provided instructions text (trimmed, non-empty). */
+    instructions: string;
+}
+/**
+ * A per-server MCP connection failure captured during the most recent {@link ToolsResolver} call.
+ * Recorded when a configured MCP server can't be reached (connection/handshake/auth error), so the
+ * failure — otherwise a transient `displayWarning` that scrolls away the moment the Ink TUI takes
+ * over the screen — can be re-surfaced persistently in the chrome AND named in the /debug MCP tab
+ * (which renders per configured server and would otherwise show only a bare "no tools" line, with
+ * no hint that the server never connected). Mirrors {@link McpServerInstruction}.
+ */
+export interface McpConnectionFailure {
+    /** The configured MCP server name (the key under `config.mcpServers`). */
+    server: string;
+    /** A concise, human-readable reason (the underlying connection error's message). */
+    reason: string;
+}
 export interface AgentResolvers {
     resolveTools?: ToolsResolver;
     cleanupTools?: ToolsCleanup;
     resolveMiddleware?: MiddlewareResolver;
     cleanupMiddleware?: MiddlewareCleanup;
+    /**
+     * EXT-32 — the per-server MCP discovery instructions captured during the most recent
+     * {@link ToolsResolver} call (empty when no MCP servers are configured or none supplied
+     * instructions). Optional: resolvers without MCP support simply omit it, and the prompt
+     * composition treats an absent accessor as "no instructions" (no MCP section is emitted).
+     */
+    getMcpServerInstructions?(): McpServerInstruction[];
+    /**
+     * The per-server MCP connection failures captured during the most recent {@link ToolsResolver}
+     * call (empty when every configured server connected, or none is configured). Optional: resolvers
+     * without MCP support omit it, and callers treat an absent accessor as "no failures". Read by the
+     * TUI to surface a persistent notice and to annotate the /debug MCP tab.
+     */
+    getMcpConnectionFailures?(): McpConnectionFailure[];
 }

package/dist/core/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/core/types.ts"],"names":[],"mappings":"AAYA;;;;GAIG;AACH,MAAM,CAAN,IAAY,WAQX;AARD,WAAY,WAAW;IACrB,+CAAS,CAAA;IACT,6CAAQ,CAAA;IACR,mDAAW,CAAA;IACX,mDAAW,CAAA;IACX,mDAAW,CAAA;IACX,+CAAS,CAAA;IACT,iDAAU,CAAA;AACZ,CAAC,EARW,WAAW,KAAX,WAAW,QAQtB"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/core/types.ts"],"names":[],"mappings":"AAaA;;;;GAIG;AACH,MAAM,CAAN,IAAY,WAQX;AARD,WAAY,WAAW;IACrB,+CAAS,CAAA;IACT,6CAAQ,CAAA;IACR,mDAAW,CAAA;IACX,mDAAW,CAAA;IACX,mDAAW,CAAA;IACX,+CAAS,CAAA;IACT,iDAAU,CAAA;AACZ,CAAC,EARW,WAAW,KAAX,WAAW,QAQtB"}

package/dist/history/historyFormat.d.ts

@@ -0,0 +1,28 @@
+/**
+ * @packageDocumentation
+ * GS2-7 (B20) — pure, presentation-only formatters for the history surfaces.
+ *
+ * Shared by the `gth history` / `gth insights` CLI commands AND the `/history` `/search`
+ * `/insights` TUI slash commands so both render identically and both are unit-testable without a
+ * DB or a terminal. Every function is a pure `data -> string[]` transform (one display line per
+ * element); no I/O, no colour codes.
+ */
+import type { ConversationSummary, HistoryInsights, SessionRecord, SessionSearchResult } from '#src/history/historyStore.js';
+/**
+ * Render FTS search hits: a header line per hit plus its snippet (or a prompt preview when the
+ * snippet is empty). Returns a friendly single line when there are none.
+ */
+export declare function formatSearchResults(results: SessionSearchResult[]): string[];
+/**
+ * GS2-19 — render a conversation-grained listing: one header + last-turn preview per conversation.
+ * The header carries the count / timespan / last message that make the conversation the top-level
+ * unit (`gth history list`), replacing the old flat per-turn list.
+ */
+export declare function formatConversationList(conversations: ConversationSummary[]): string[];
+/**
+ * GS2-19 — render one conversation's full thread (all turns in order) for `gth history show <id>`.
+ * Each turn shows its prompt and response preview so a search hit can be expanded into context.
+ */
+export declare function formatConversationThread(turns: SessionRecord[]): string[];
+/** Render the analytics summary: totals, top tools, per-command breakdown. */
+export declare function formatInsightsSummary(insights: HistoryInsights): string[];