@hwip/cli 0.1.0 → 0.1.1

package/README.md

@@ -646,9 +646,13 @@ transcript, then forgotten. A session that has been quiet for a long time keeps
 state while its transcript exists, so nothing already sent is sent again (an OpenCode
 session, which has no file to check, for 30 days).
 
-When a session waits for your approval (a Bash command, a file edit or a new file),
-the listener also sends what it is waiting for — the tool, the command or the diff,
-and the numbered answers — so the app can show it and answer. It is sealed the same
+When a session waits for your approval, the listener also sends what it is waiting
+for — the tool, the command or the diff, and the answers — so the app can show it
+and answer. That covers Claude Code (a Bash command, a file edit or a new file),
+Gemini CLI (its tool approvals), OpenCode (its permission request; the listener reads
+the screen with its colours, since only a colour marks the chosen button) and pi
+approval extensions that ask through `ctx.ui.select`. Codex's approval dialog is not
+read yet. It is sealed the same
 way as a chunk, for the same pinned devices, and turned off by the same
 `--no-turn-history`; the server stores ciphertext only. Other dialogs (a plan, a
 question, a trust prompt) send nothing beyond the state. An answer the app sends is

package/dist/agent-rules.default.d.ts

@@ -18,7 +18,7 @@
  *   still be working underneath, so it must not change the state.
  *
  * Every agent here carries the same rules the server manifest publishes
- * (hwip server/src/agent-rules/manifest.json, version 2026.10.15.1 — hwip#484),
+ * (hwip server/src/agent-rules/manifest.json, version 2026.10.18.1 — hwip#532, merged and deployed before this cli ships),
  * so a listener that never reaches the endpoint classifies them too. A fetched
  * manifest replaces this bundle whole for state reports; schedules read only
  * this bundle. An agent without rules here

package/dist/agent-rules.default.js

@@ -21,7 +21,7 @@ exports.DEFAULT_MANIFEST = void 0;
  *   still be working underneath, so it must not change the state.
  *
  * Every agent here carries the same rules the server manifest publishes
- * (hwip server/src/agent-rules/manifest.json, version 2026.10.15.1 — hwip#484),
+ * (hwip server/src/agent-rules/manifest.json, version 2026.10.18.1 — hwip#532, merged and deployed before this cli ships),
  * so a listener that never reaches the endpoint classifies them too. A fetched
  * manifest replaces this bundle whole for state reports; schedules read only
  * this bundle. An agent without rules here
@@ -31,7 +31,7 @@ exports.DEFAULT_MANIFEST = void 0;
 const agent_state_js_1 = require("./agent-state.js");
 exports.DEFAULT_MANIFEST = {
     engineVersion: agent_state_js_1.ENGINE_VERSION,
-    version: '2026.10.15.1',
+    version: '2026.10.18.1',
     agents: {
         claude: [
             {
@@ -185,14 +185,27 @@ exports.DEFAULT_MANIFEST = {
         ],
         gemini: [
             {
-                // KNOWN GAP — `blocked` here means the folder-trust dialog,
-                // the only blocked screen that was actually captured. Gemini's
-                // tool-approval prompt is the common blocked case in practice
-                // and has NO rule: the probe session had shell auto-approved,
-                // so it never rendered. Until someone captures it, a gemini
-                // session waiting on tool approval reports `working` (the
-                // spinner rule) or `idle`, not `blocked`. Do not read the
-                // bench matrix's green `blocked` cell as full coverage.
+                // Tool approval (Shell, Edit, WriteFile), captured 2026-10-18 on
+                // Gemini CLI v0.46.0: a rounded box whose answers start with
+                // `│ ● 1. Allow once` under a boxed question line. Keyed on
+                // both, not the bare phrase, so agent text or a tool output box
+                // printing the answer row is not a dialog. The
+                // dialog draws no footer and hides the input box; 30 lines
+                // because a long diff sits between the header and the answers
+                // and a later notice box can be drawn below it.
+                id: 'gemini-blocked-tool-approval',
+                state: 'blocked',
+                priority: 900,
+                tailLines: 30,
+                regex: ['^\\s*│\\s+(?:●\\s+)?1\\.\\s+allow once'],
+                any: [
+                    { regex: ['^\\s*│ allow execution of .*\\?\\s*│$'] },
+                    { regex: ['^\\s*│ apply this change\\?\\s*│$'] },
+                ],
+                // The input box is hidden while Gemini asks; with it on screen the box is the agent's own text.
+                not: [{ contains: ['type your message'] }],
+            },
+            {
                 // Observed on Gemini CLI v0.46.0.
                 id: 'gemini-blocked-trust-dialog',
                 state: 'blocked',
@@ -215,17 +228,17 @@ exports.DEFAULT_MANIFEST = {
             },
         ],
         opencode: [
-            // Hand-written from the screen strings recorded in the C136
-            // backlog row (opencode 1.18.35) and a user's permission screen
-            // (`Allow once   Always allow   Reject … enter confirm`), not
-            // from a pane capture, so the bench has no fixture for it and
-            // agent-state.test.ts pins the strings instead. The button
-            // wording differs between versions (`Allow always` vs `Always
-            // allow`), hence the rule keys on the `Permission required`
-            // title line, guarded by any button or footer string so the
-            // phrase in tool output or agent text alone is not a dialog. tailLines 30 because an edit request draws its diff
-            // between that line and the buttons. Other prompts (the agent
-            // asking a question) are not captured and report `unknown`.
+            // Written from the screen strings recorded in the C136 backlog
+            // row (opencode 1.18.35) and a user's permission screen, then
+            // checked against panes captured 2026-10-18 on opencode 2.0.29
+            // (harness bench: bash and edit requests). The button wording
+            // differs between versions (`Allow always` vs `Always allow`),
+            // hence the rule keys on the `Permission required` title line,
+            // guarded by any button or footer string so the phrase in tool
+            // output or agent text alone is not a dialog. tailLines 30
+            // because an edit request draws its diff between that line and
+            // the buttons. Other prompts (the agent asking a question) are
+            // not captured and report `unknown`.
             // No idle rule: at rest the footer is only `ctrl+p commands`,
             // which says nothing the absence of `esc interrupt` does not.
             {

package/dist/blocked-prompt-seal.d.ts

@@ -1,4 +1,5 @@
 import type { AgentState } from './agent-state.js';
+import type { AgentKind } from './remote-agents.js';
 import type { RecorderRecipient, SealedChunk } from './turn-recorder.js';
 /** What the session report carries: the server stores it and never opens it. */
 export interface BlockedPromptWire {
@@ -23,13 +24,16 @@ export interface PromptSealerDeps {
 }
 export interface PromptSealer {
     /** The sealed prompt for this session's screen, or undefined (not blocked, not a known dialog, not sealed yet). */
-    observe: (name: string, state: AgentState | undefined, paneText: string | null) => BlockedPromptWire | undefined;
+    observe: (name: string, kind: AgentKind, state: AgentState | undefined, paneText: string | null) => BlockedPromptWire | undefined;
     /** Forget sessions that are gone. */
     prune: (live: ReadonlySet<string>) => void;
     /** Settles when the seals running now are done, or undefined when none is. */
     sealing: () => Promise<void> | undefined;
 }
 export declare const createPromptSealer: (deps: PromptSealerDeps) => PromptSealer;
-/** True when the pane shows the prompt `id` right now (a fresh capture, not the one a report was made from). */
+/**
+ * True when the pane shows the prompt `id` right now (a fresh capture, not the one a report was made from). Capture it
+ * the way `observe` was fed (`-e`): OpenCode's highlight is in the escapes, and the id with it.
+ */
 export declare const promptStillShown: (id: string, paneText: string | null) => boolean;
 //# sourceMappingURL=blocked-prompt-seal.d.ts.map

package/dist/blocked-prompt-seal.js

@@ -47,8 +47,8 @@ const createPromptSealer = (deps) => {
         })();
     };
     return {
-        observe: (name, state, paneText) => {
-            const parsed = state === 'blocked' && paneText !== null ? (0, blocked_prompt_js_1.parseBlockedDialog)(paneText) : undefined;
+        observe: (name, kind, state, paneText) => {
+            const parsed = state === 'blocked' && paneText !== null ? (0, blocked_prompt_js_1.parseBlockedDialog)(paneText, kind) : undefined;
             if (!parsed) {
                 entries.delete(name);
                 return undefined;
@@ -84,6 +84,9 @@ const createPromptSealer = (deps) => {
     };
 };
 exports.createPromptSealer = createPromptSealer;
-/** True when the pane shows the prompt `id` right now (a fresh capture, not the one a report was made from). */
-const promptStillShown = (id, paneText) => paneText !== null && (0, blocked_prompt_js_1.parseBlockedDialog)(paneText)?.id === id;
+/**
+ * True when the pane shows the prompt `id` right now (a fresh capture, not the one a report was made from). Capture it
+ * the way `observe` was fed (`-e`): OpenCode's highlight is in the escapes, and the id with it.
+ */
+const promptStillShown = (id, paneText) => paneText !== null && (0, blocked_prompt_js_1.showsPrompt)(id, paneText);
 exports.promptStillShown = promptStillShown;

package/dist/blocked-prompt.d.ts

@@ -1,3 +1,4 @@
+import type { AgentKind } from './remote-agents.js';
 /** Dialog titles whose layout was captured and is read. */
 export declare const KNOWN_TITLES: readonly string[];
 export declare const MAX_DETAIL_LINES = 12;
@@ -27,8 +28,12 @@ export interface ParsedPrompt {
     options: PromptOption[];
 }
 export declare const isPromptId: (value: unknown) => value is string;
-/** The dialog at the bottom of `pane`, or undefined when it is not one this module reads. */
-export declare const parseBlockedDialog: (pane: string) => ParsedPrompt | undefined;
+/** `pane` without terminal escapes: what `capture-pane` without `-e` gives. */
+export declare const stripEscapes: (pane: string) => string;
+/** The approval dialog at the bottom of `pane`, read the way `kind` draws it; undefined when it is not one of those. */
+export declare const parseBlockedDialog: (pane: string, kind: AgentKind) => ParsedPrompt | undefined;
+/** True when some reader finds the prompt `id` on `pane`: an id hashes the exact dialog, so the kind need not be known. */
+export declare const showsPrompt: (id: string, pane: string) => boolean;
 /** What the app opens: the prompt plus which session and listener it belongs to, and when it was first seen. */
 export interface PromptPlaintext {
     v: 1;

package/dist/blocked-prompt.js

@@ -1,15 +1,20 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.promptPlaintext = exports.parseBlockedDialog = exports.isPromptId = exports.MAX_PROMPT_BYTES = exports.MAX_OPTIONS = exports.MAX_LABEL_CHARS = exports.MAX_DETAIL_LINE_CHARS = exports.MAX_DETAIL_LINES = exports.KNOWN_TITLES = void 0;
+exports.promptPlaintext = exports.showsPrompt = exports.parseBlockedDialog = exports.stripEscapes = exports.isPromptId = exports.MAX_PROMPT_BYTES = exports.MAX_OPTIONS = exports.MAX_LABEL_CHARS = exports.MAX_DETAIL_LINE_CHARS = exports.MAX_DETAIL_LINES = exports.KNOWN_TITLES = void 0;
 /**
- * What a blocked Claude Code session is waiting for, read off its screen.
+ * What a blocked agent session is waiting for, read off its screen.
  *
  * The state detector (`agent-state.ts`) only says "blocked". The app wants to
  * draw the question: which tool, which command, which answers. This module
- * reads the approval dialog at the bottom of the pane into that summary. Pure:
- * the listener owns tmux, sealing and timing (`blocked-prompt-seal.ts`).
+ * reads the approval dialog at the bottom of the pane into that summary, with a
+ * reader per agent kind (`parseBlockedDialog`). Pure: the listener owns tmux,
+ * sealing and timing (`blocked-prompt-seal.ts`).
  *
- * Layout read (Claude Code, captured from a live session; see the fixtures in
+ * The pane may carry terminal escapes (`tmux capture-pane -e`): OpenCode marks its
+ * chosen button with a background colour only. Every other reader works on the
+ * text with them stripped, so its ids are those of a plain capture.
+ *
+ * Claude Code layout (captured from a live session; see the fixtures in
  * `blocked-prompt.test.ts`):
  *
  *     ─────────────  full-width rule: the dialog starts below the last one
@@ -30,6 +35,17 @@ exports.promptPlaintext = exports.parseBlockedDialog = exports.isPromptId = expo
  * Only the titles in `KNOWN_TITLES` are read. Another dialog (a plan, a
  * question to the user, an MCP tool) has no captured layout, so it yields
  * nothing and the session keeps reporting the bare `blocked` state.
+ *
+ * Gemini CLI layout (v0.46.0, `blocked-prompt-gemini.test.ts`): one rounded box,
+ * a `? <Tool>  <summary>` header (a right-aligned `N of M` when approvals queue),
+ * the command or diff in a nested box, the question, then `●`-highlighted
+ * numbered answers. No footer.
+ *
+ * pi has no approval dialog of its own; extensions that gate tools ask through
+ * `ctx.ui.select` (`parsePiSelect`, `blocked-prompt-pi.test.ts`).
+ *
+ * OpenCode (v2.0.29, `blocked-prompt-opencode.test.ts`): a `┃` panel, `△ Permission required`, the request, and a
+ * row of buttons whose chosen one is told apart by background colour only (`parseOpencodePermission`).
  */
 const node_crypto_1 = require("node:crypto");
 /** Dialog titles whose layout was captured and is read. */
@@ -63,8 +79,8 @@ const cut = (text, max) => {
 const idOf = (region) => (0, node_crypto_1.createHash)('sha256').update(region.join('\n')).digest('hex').slice(0, 16);
 /** `down`×k or `up`×k to reach option `to` from option `from`, then `enter`. */
 const keysFor = (from, to) => [...Array(Math.abs(to - from)).fill(to > from ? 'down' : 'up'), 'enter'];
-/** The dialog at the bottom of `pane`, or undefined when it is not one this module reads. */
-const parseBlockedDialog = (pane) => {
+/** Claude Code's dialog at the bottom of `pane`, or undefined when it is not one this module reads. */
+const parseClaudeDialog = (pane) => {
     const lines = pane.split('\n').map((l) => l.trimEnd());
     // The question is the last "…?" line whose next non-blank line is option 1.
     let qAt = -1;
@@ -118,13 +134,6 @@ const parseBlockedDialog = (pane) => {
             return undefined;
         }
     }
-    if (options.length < 2 || options.length > exports.MAX_OPTIONS)
-        return undefined;
-    if (!options.every((o, i) => o.n === i + 1))
-        return undefined;
-    const selected = options.findIndex((o) => o.selected);
-    if (selected < 0 || options.filter((o) => o.selected).length !== 1)
-        return undefined;
     // Above the question: title, subtitle, dashed rule, detail, dashed rule, note.
     const head = region.slice(0, q);
     const title = head.find((l) => l.trim() !== '')?.trim();
@@ -139,28 +148,356 @@ const parseBlockedDialog = (pane) => {
     while (detailLines.length > 0 && detailLines[detailLines.length - 1].trim() === '')
         detailLines.pop();
     const after = secondDash < 0 ? [] : rest.slice(secondDash + 1).map((l) => l.trim()).filter(Boolean);
-    const prompt = {
-        id: idOf(region),
+    return assemble({
+        region,
         title,
-        detail: detailLines.slice(0, exports.MAX_DETAIL_LINES).map((l) => cut(l, exports.MAX_DETAIL_LINE_CHARS)),
-        question: cut(region[q].trim(), exports.MAX_LABEL_CHARS),
+        subtitle: before.join(' '),
+        detail: detailLines,
+        note: after.join(' '),
+        question: region[q].trim(),
+        options,
+    });
+};
+// CSI sequences (colours and the rest) and OSC ones (OSC 8 hyperlinks, ended by BEL or ST): what `-e` adds.
+const ESCAPES = /\u001b\[[0-?]*[ -/]*[@-~]|\u001b\][^\u0007\u001b]*(?:\u0007|\u001b\\)/g;
+/** `pane` without terminal escapes: what `capture-pane` without `-e` gives. */
+const stripEscapes = (pane) => pane.replace(ESCAPES, '');
+exports.stripEscapes = stripEscapes;
+/** The inside of a line drawn as `│ … │`, without its one-space padding; undefined for any other line. */
+const boxed = (line) => {
+    const t = line.trim();
+    if (t.length < 2 || !t.startsWith('│') || !t.endsWith('│'))
+        return undefined;
+    return t.slice(1, -1).replace(/^ /, '').trimEnd();
+};
+/** `lines` without blank lines at either end. */
+const trimBlank = (lines) => {
+    let from = 0;
+    let to = lines.length;
+    while (from < to && lines[from].trim() === '')
+        from++;
+    while (to > from && lines[to - 1].trim() === '')
+        to--;
+    return lines.slice(from, to);
+};
+/** `lines` without the indent they all share. */
+const dedent = (lines) => {
+    const indent = Math.min(...lines.filter((l) => l.trim() !== '').map((l) => l.length - l.trimStart().length));
+    return Number.isFinite(indent) ? lines.map((l) => l.slice(indent)) : [...lines];
+};
+const GEMINI_OPTION = /^([●\s])\s*(\d{1,2})\.\s+(\S.*)$/;
+const GEMINI_HEADER = /^\?\s+(\S.*)$/;
+const GEMINI_QUEUE = /\s{2,}\d+ of \d+$/;
+/** Gemini CLI's tool approval box, or undefined. */
+const parseGeminiDialog = (pane) => {
+    const lines = pane.split('\n').map((l) => l.trimEnd());
+    // The question is the last boxed "…?" line whose next non-blank boxed line is option 1.
+    let qAt = -1;
+    for (let i = lines.length - 2; i >= 0 && qAt < 0; i--) {
+        const q = boxed(lines[i]);
+        if (q === undefined || !q.endsWith('?') || q.startsWith('│'))
+            continue;
+        for (let j = i + 1; j < lines.length; j++) {
+            const next = boxed(lines[j]);
+            if (next === undefined)
+                break;
+            if (next === '')
+                continue;
+            if (GEMINI_OPTION.exec(next)?.[2] === '1')
+                qAt = i;
+            break;
+        }
+    }
+    if (qAt < 0)
+        return undefined;
+    // Up to the box's top border, down to its bottom one.
+    let top = qAt - 1;
+    while (top >= 0 && boxed(lines[top]) !== undefined)
+        top--;
+    if (top < 0 || !lines[top].trim().startsWith('╭'))
+        return undefined;
+    let end = qAt + 1;
+    while (end < lines.length && boxed(lines[end]) !== undefined)
+        end++;
+    if (end >= lines.length || !lines[end].trim().startsWith('╰'))
+        return undefined;
+    // Gemini hides its input box while it asks: only blank lines and other boxes (a notice) may follow. The same box
+    // drawn in the agent's own text sits above the input box, and is not a dialog.
+    for (const line of lines.slice(end + 1)) {
+        const t = line.trim();
+        if (t !== '' && !t.startsWith('╭') && !t.startsWith('╰') && boxed(line) === undefined)
+            return undefined;
+    }
+    const header = GEMINI_HEADER.exec(boxed(lines[top + 1]).replace(GEMINI_QUEUE, ''));
+    if (!header)
+        return undefined;
+    const [title, ...rest] = header[1].split(/\s{2,}/);
+    const subtitle = rest.join(' ').trim();
+    const options = [];
+    for (const line of lines.slice(qAt + 1, end)) {
+        const text = boxed(line);
+        if (text === '')
+            continue;
+        const m = GEMINI_OPTION.exec(text);
+        if (m) {
+            options.push({ n: Number(m[2]), label: m[3].trim(), selected: m[1] === '●' });
+        }
+        else if (options.length > 0 && /^\s{4,}\S/.test(text)) {
+            const last = options[options.length - 1];
+            last.label = `${last.label} ${text.trim()}`;
+        }
+        else {
+            return undefined;
+        }
+    }
+    // Between header and question: the nested box holds the command or diff; any other text is a note.
+    const detailLines = [];
+    const noteLines = [];
+    for (const line of lines.slice(top + 2, qAt)) {
+        const text = boxed(line);
+        if (text.startsWith('╭') || text.startsWith('╰'))
+            continue;
+        const inner = boxed(text);
+        if (inner !== undefined)
+            detailLines.push(inner);
+        else if (text.trim() !== '')
+            noteLines.push(text.trim());
+    }
+    const detail = dedent(trimBlank(detailLines));
+    return assemble({
+        region: lines.slice(top, end + 1),
+        title: title.trim(),
+        subtitle,
+        detail,
+        note: noteLines.join(' '),
+        question: boxed(lines[qAt]).trim(),
+        options,
+    });
+};
+const PI_FOOTER = /^ ↑↓ navigate {2}\S.* select {2}\S.* cancel$/;
+const PI_OPTION = /^ (→| ) (\S.*)$/;
+const PI_COUNTDOWN = / \(\d+s\)$/;
+/**
+ * pi's `ctx.ui.select` dialog (`ExtensionSelectorComponent`), which approval extensions draw: a free title between
+ * full-width rules, unnumbered answers with `→` on the highlighted one, a `↑↓ navigate  … select  … cancel` footer.
+ * Title, question and detail come from the title's lines: first, last, and what is between.
+ */
+const parsePiSelect = (pane) => {
+    const lines = pane.split('\n').map((l) => l.trimEnd());
+    let footer = -1;
+    for (let i = lines.length - 1; i >= 0 && footer < 0; i--)
+        if (PI_FOOTER.test(lines[i]))
+            footer = i;
+    if (footer < 0)
+        return undefined;
+    let top = -1;
+    for (let i = footer - 1; i >= 0 && top < 0; i--)
+        if (FULL_RULE.test(lines[i]))
+            top = i;
+    if (top < 0)
+        return undefined;
+    // The select takes the editor's place, so one rule follows it. The same text in the agent's own output sits
+    // above the editor, which brings its two rules.
+    if (lines.slice(footer + 1).filter((l) => FULL_RULE.test(l)).length > 1)
+        return undefined;
+    // The answers sit right above the footer's gap, with a gap above them too.
+    let last = footer - 1;
+    while (last > top && lines[last] === '')
+        last--;
+    let first = last;
+    while (first - 1 > top && PI_OPTION.test(lines[first - 1]))
+        first--;
+    if (first - 1 <= top || lines[first - 1] !== '')
+        return undefined;
+    const options = [];
+    for (const line of lines.slice(first, last + 1)) {
+        const m = PI_OPTION.exec(line);
+        if (!m)
+            return undefined;
+        options.push({ n: options.length + 1, label: m[2].trim(), selected: m[1] === '→' });
+    }
+    // A select with a timeout redraws its title's end as ` (12s)` every second: not part of the prompt or its id.
+    for (let i = first - 1; i > top; i--) {
+        if (lines[i] === '')
+            continue;
+        lines[i] = lines[i].replace(PI_COUNTDOWN, '');
+        break;
+    }
+    const text = trimBlank(lines.slice(top + 1, first).map((l) => l.replace(/^ /, '')));
+    if (text.length === 0)
+        return undefined;
+    return assemble({
+        region: lines.slice(top, footer + 1),
+        title: text[0].trim(),
+        detail: dedent(trimBlank(text.slice(1, -1))),
+        question: text[text.length - 1].trim(),
+        options,
+    });
+};
+// One SGR sequence and its parameters; any other escape is dropped without changing the background.
+const SGR = /^\u001b\[([0-9;:]*)m/;
+const ANY_ESCAPE = new RegExp(`^(?:${ESCAPES.source})`);
+/** `line` without escapes, and the background each of its UTF-16 units is drawn on ('7' = reverse video). */
+const withBackground = (line) => {
+    let text = '';
+    const bg = [];
+    let current = '';
+    let reverse = false;
+    for (let i = 0; i < line.length;) {
+        const sgr = SGR.exec(line.slice(i));
+        if (sgr) {
+            const p = sgr[1] === '' ? ['0'] : sgr[1].split(/[;:]/);
+            for (let j = 0; j < p.length; j++) {
+                const code = Number(p[j]);
+                if (code === 0) {
+                    current = '';
+                    reverse = false;
+                }
+                else if (code === 7)
+                    reverse = true;
+                else if (code === 27)
+                    reverse = false;
+                else if (code === 49)
+                    current = '';
+                else if ((code >= 40 && code <= 47) || (code >= 100 && code <= 107))
+                    current = String(code);
+                else if (code === 38 || code === 48 || code === 58) {
+                    const span = p[j + 1] === '2' ? 3 : p[j + 1] === '5' ? 1 : 0;
+                    if (code === 48)
+                        current = p.slice(j, j + 2 + span).join(';');
+                    j += 1 + span;
+                }
+            }
+            i += sgr[0].length;
+            continue;
+        }
+        const other = ANY_ESCAPE.exec(line.slice(i));
+        if (other) {
+            i += other[0].length;
+            continue;
+        }
+        text += line[i];
+        bg.push(reverse ? '7' : current);
+        i++;
+    }
+    return { text, bg };
+};
+const OPENCODE_BAR = '┃';
+const OPENCODE_HEADER = /^\s*△ Permission required$/;
+const OPENCODE_HINTS = /ctrl\+|⇆|enter confirm/;
+const OPENCODE_SUBTITLE = /^→ (\S.*)$/;
+/**
+ * OpenCode's permission request: `△ Permission required` in a `┃` panel, the request (a `$ command`, or `→ Edit file`
+ * over its diff), then a row of buttons `Allow once   Always allow   Reject` beside `… enter confirm`. The chosen
+ * button differs from the others only by its background, so this reads the pane with its escapes: a plain capture
+ * yields nothing. Left/right move the choice; the dialog draws no question, so the question is a fixed one.
+ */
+const parseOpencodePermission = (pane) => {
+    const rows = pane.split('\n').map(withBackground);
+    // Text after the panel bar, with the bar's column, for every row drawn in the panel.
+    const inPanel = (row) => {
+        const at = row.text.indexOf(OPENCODE_BAR);
+        return at >= 0 && row.text.slice(0, at).trim() === '' ? at + 1 : -1;
+    };
+    let head = -1;
+    for (let i = rows.length - 1; i >= 0 && head < 0; i--) {
+        const at = inPanel(rows[i]);
+        if (at >= 0 && OPENCODE_HEADER.test(rows[i].text.slice(at).trimEnd()))
+            head = i;
+    }
+    if (head < 0)
+        return undefined;
+    // The panel's last row with the key hints is the button row: a request that prints the hint text sits above it.
+    let end = head + 1;
+    while (end < rows.length && inPanel(rows[end]) >= 0)
+        end++;
+    let bar = -1;
+    for (let i = end - 1; i > head && bar < 0; i--) {
+        if (/⇆ select +enter confirm/.test(rows[i].text))
+            bar = i;
+    }
+    if (bar < 0)
+        return undefined;
+    // The buttons: runs of text split by two or more spaces, up to the first key hint.
+    const row = rows[bar];
+    const from = inPanel(row);
+    const options = [];
+    const lit = [];
+    for (const m of row.text.slice(from).matchAll(/\S+(?: \S+)*/g)) {
+        if (OPENCODE_HINTS.test(m[0]))
+            break;
+        options.push({ n: options.length + 1, label: m[0], selected: false });
+        lit.push(row.bg[from + m.index]);
+    }
+    // The chosen button: the one background no other button shares, the rest all alike. A theme drawing it in
+    // reverse video (or anything else) is not a captured layout.
+    if (lit.includes('7'))
+        return undefined;
+    const odd = lit.filter((bg) => lit.filter((other) => other === bg).length === 1);
+    if (odd.length !== 1 || new Set(lit).size !== 2)
+        return undefined;
+    const selected = lit.indexOf(odd[0]);
+    options[selected].selected = true;
+    const body = rows.slice(head + 1, bar).map((r) => r.text.slice(inPanel(r)).trimEnd());
+    const first = body.findIndex((l) => l.trim() !== '');
+    const sub = first < 0 ? null : OPENCODE_SUBTITLE.exec(body[first].trim());
+    const detail = dedent(trimBlank(sub ? body.slice(first + 1) : body));
+    return assemble({
+        region: rows.slice(head, bar + 1).map((r) => r.text.trimEnd()),
+        title: 'Permission required',
+        ...(sub ? { subtitle: sub[1].trim() } : {}),
+        detail,
+        question: 'Allow this request?',
+        options,
+        keys: (at, to) => [...Array(Math.abs(to - at)).fill(to > at ? 'right' : 'left'), 'enter'],
+        idSalt: `opencode:selected=${selected}`,
+    });
+};
+/** The checks and caps every reader shares: numbering 1..n, one highlight, label and detail limits. */
+const assemble = (d) => {
+    const { options } = d;
+    if (!d.title || options.length < 2 || options.length > exports.MAX_OPTIONS)
+        return undefined;
+    if (!options.every((o, i) => o.n === i + 1))
+        return undefined;
+    const selected = options.findIndex((o) => o.selected);
+    if (selected < 0 || options.filter((o) => o.selected).length !== 1)
+        return undefined;
+    const keys = d.keys ?? keysFor;
+    const prompt = {
+        id: idOf(d.idSalt === undefined ? d.region : [...d.region, d.idSalt]),
+        title: cut(d.title, exports.MAX_LABEL_CHARS),
+        detail: d.detail.slice(0, exports.MAX_DETAIL_LINES).map((l) => cut(l, exports.MAX_DETAIL_LINE_CHARS)),
+        question: cut(d.question, exports.MAX_LABEL_CHARS),
         options: options.map((o, i) => ({
             n: o.n,
             label: cut(o.label, exports.MAX_LABEL_CHARS),
-            keys: keysFor(selected, i),
+            keys: keys(selected, i),
             ...(PERSISTENT.test(o.label) ? { persistent: true } : {}),
         })),
     };
-    if (before.length > 0)
-        prompt.subtitle = cut(before.join(' '), exports.MAX_LABEL_CHARS);
-    if (after.length > 0)
-        prompt.note = cut(after.join(' '), exports.MAX_LABEL_CHARS);
-    if (detailLines.length > exports.MAX_DETAIL_LINES || detailLines.some((l) => l.length > exports.MAX_DETAIL_LINE_CHARS)) {
+    if (d.subtitle)
+        prompt.subtitle = cut(d.subtitle, exports.MAX_LABEL_CHARS);
+    if (d.note)
+        prompt.note = cut(d.note, exports.MAX_LABEL_CHARS);
+    if (d.detail.length > exports.MAX_DETAIL_LINES || d.detail.some((l) => l.length > exports.MAX_DETAIL_LINE_CHARS)) {
         prompt.detailTruncated = true;
     }
     return prompt;
 };
+/** One reader per agent kind whose approval dialog was captured. Each takes the pane as captured, escapes and all. */
+const READERS = {
+    claude: (pane) => parseClaudeDialog((0, exports.stripEscapes)(pane)),
+    gemini: (pane) => parseGeminiDialog((0, exports.stripEscapes)(pane)),
+    pi: (pane) => parsePiSelect((0, exports.stripEscapes)(pane)),
+    opencode: parseOpencodePermission,
+};
+/** The approval dialog at the bottom of `pane`, read the way `kind` draws it; undefined when it is not one of those. */
+const parseBlockedDialog = (pane, kind) => READERS[kind]?.(pane);
 exports.parseBlockedDialog = parseBlockedDialog;
+/** True when some reader finds the prompt `id` on `pane`: an id hashes the exact dialog, so the kind need not be known. */
+const showsPrompt = (id, pane) => Object.values(READERS).some((read) => read(pane)?.id === id);
+exports.showsPrompt = showsPrompt;
 /**
  * The JSON to seal, within MAX_PROMPT_BYTES: detail lines go from the end until it fits.
  * Undefined when even a prompt without detail does not fit.

package/dist/file-crypto.js

@@ -231,12 +231,13 @@ const saveStream = async (source, nextDest, decrypt) => {
     const counter = new node_stream_1.Transform({
         transform(chunk, _enc, done) { bytes += chunk.length; done(null, chunk); },
     });
+    let sink;
     try {
         // Before the part file exists: a key or an iv the format refuses throws here.
         const opened = !decrypt ? null : decrypt.chunk === undefined
             ? (0, exports.createFileDecryptStream)(decrypt.rawKey, decrypt.iv)
             : (0, exports.createChunkedFileDecryptStream)(decrypt.rawKey, decrypt.iv, decrypt.chunk);
-        const sink = (0, node_fs_1.createWriteStream)(part, { flags: 'wx' });
+        sink = (0, node_fs_1.createWriteStream)(part, { flags: 'wx' });
         if (opened)
             await (0, promises_2.pipeline)(source, opened, counter, sink);
         else
@@ -265,6 +266,11 @@ const saveStream = async (source, nextDest, decrypt) => {
         return { path: dest, bytes };
     }
     catch (err) {
+        // A failed pipeline destroys the sink without waiting for its open: wait for
+        // the close, or the file can appear after the rm below.
+        const opening = sink;
+        if (opening && !opening.closed)
+            await new Promise((done) => opening.once('close', () => done()));
         (0, node_fs_1.rmSync)(part, { force: true });
         throw err;
     }

package/dist/listener.js

@@ -632,13 +632,13 @@ const resetSessionStates = () => {
     sessionStates.clear();
 };
 exports.resetSessionStates = resetSessionStates;
-const capturePaneText = (session, target) => {
+const capturePaneText = (session, target, escapes = false) => {
     // Explicit target for the sweep (subagent rows aren't in the recorded
     // target map yet); otherwise resolve through it.
     const resolved = target ?? (0, tmux_pane_js_1.tmuxTargetFor)(session);
     if (resolved === null)
         return null; // unresolvable subagent — never spawn
-    const r = (0, child_process_1.spawnSync)('tmux', (0, tmux_socket_js_1.tmuxArgs)(['capture-pane', '-p', '-t', resolved, '-S', `-${STATE_CAPTURE_LINES}`]), {
+    const r = (0, child_process_1.spawnSync)('tmux', (0, tmux_socket_js_1.tmuxArgs)(['capture-pane', '-p', ...(escapes ? ['-e'] : []), '-t', resolved, '-S', `-${STATE_CAPTURE_LINES}`]), {
         encoding: 'utf-8',
         stdio: ['ignore', 'pipe', 'pipe'],
     });
@@ -700,8 +700,9 @@ const withBlockedPrompts = ({ sessions, targets }) => {
         const target = targets[session.name];
         if (session.parentName !== undefined || session.agentKind === 'shell' || target === undefined)
             return session;
-        const pane = session.state === 'blocked' ? capturePaneText(session.name, target) : null;
-        const blockedPrompt = sealer.observe(session.name, session.state, pane);
+        // With escapes: OpenCode draws its chosen button as a background colour only. `deliverInput` captures the same way.
+        const pane = session.state === 'blocked' ? capturePaneText(session.name, target, true) : null;
+        const blockedPrompt = sealer.observe(session.name, session.agentKind, session.state, pane);
         return blockedPrompt ? { ...session, blockedPrompt } : session;
     });
     sealer.prune(new Set(sessions.map((s) => s.name)));
@@ -2961,7 +2962,7 @@ const deliverInput = (input) => {
     const deps = { noteRefusal: (r) => { reason ??= r; } };
     // Before anything is spent on it: a key bound to a prompt that is gone must not
     // take a rate-limit token, and must not land on whatever is on screen now.
-    const bound = input.ifPrompt === undefined || (0, blocked_prompt_seal_js_1.promptStillShown)(input.ifPrompt, capturePaneText(input.sessionName));
+    const bound = input.ifPrompt === undefined || (0, blocked_prompt_seal_js_1.promptStillShown)(input.ifPrompt, capturePaneText(input.sessionName, undefined, true));
     if (!bound)
         reason = 'prompt_changed';
     const injected = bound && hasStream(input.sessionName)
@@ -4508,7 +4509,7 @@ const handlePushInner = async (push, deps) => {
         return handleScheduleRequest(push, push.agentSessionName, addressed, deps);
     // A command bound to a blocked prompt types only while that prompt is on screen. Checked
     // before anything is downloaded or typed, and before the rate limit is spent.
-    if (push.ifPrompt !== undefined && !(0, blocked_prompt_seal_js_1.promptStillShown)(push.ifPrompt, (deps.capturePane ?? capturePaneText)(push.agentSessionName))) {
+    if (push.ifPrompt !== undefined && !(0, blocked_prompt_seal_js_1.promptStillShown)(push.ifPrompt, deps.capturePane ? deps.capturePane(push.agentSessionName) : capturePaneText(push.agentSessionName, undefined, true))) {
         (0, listener_log_js_1.log)(`! ${push.agentSessionName}: the blocked prompt this command answers is gone — drop`);
         deps.noteRefusal?.('prompt_changed');
         return false;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hwip/cli",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Hwip CLI + push notification SDK for AI agents",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",