@hwip/cli 0.1.0 → 0.1.2

package/README.md

@@ -535,6 +535,11 @@ offers it during setup and `hwip uninstall` takes it away again.
 What you get back after a reboot is your **past sessions**, ready to
 resume from the phone — not live agents. tmux does not survive a reboot
 either, and this doesn't try to bring those sessions back to life.
+A resume starts the agent in the directory it last ran in; for Claude Code
+and OpenCode it also picks up the conversation that session last had
+(`--resume <id>` / `--session <id>`, the id this machine read off the live
+pane's own process — an id two panes both answered to is not kept). Claude Code starts fresh when that conversation is no longer on disk,
+and the other agents always start a new one.
 
 Two details worth knowing:
 
@@ -646,9 +651,28 @@ transcript, then forgotten. A session that has been quiet for a long time keeps
 state while its transcript exists, so nothing already sent is sent again (an OpenCode
 session, which has no file to check, for 30 days).
 
-When a session waits for your approval (a Bash command, a file edit or a new file),
-the listener also sends what it is waiting for — the tool, the command or the diff,
-and the numbered answers — so the app can show it and answer. It is sealed the same
+A tmux name is used again when an agent starts in the same folder, so each
+chunk also names its **run** — the tmux session it was recorded in (`runId`,
+tmux's `session_created` in epoch seconds). The app uses it to keep one run's
+conversation apart from the one before it under the same name; a chunk read
+after a restart keeps the run it was recorded in. The listener's record of past
+sessions keeps runs apart the same way: closing `hwip cc` and starting it again
+in the same folder leaves the first run as a past session of its own (the
+newest ten runs of a name are kept, 100 in all, and up to 50 are reported to
+the phone). Each run is reported with the block of chunk numbers it took — the
+first and, once it has ended, the last — kept in `run-seqs.json` next to the
+registry, so the server reads one run's conversation from that range instead of
+every chunk the name ever had. Deleting a past run from the phone forgets that
+run on this machine too, even while a later run of the same name is going; the
+run that is going is refused (`still_running`).
+
+When a session waits for your approval, the listener also sends what it is waiting
+for — the tool, the command or the diff, and the answers — so the app can show it
+and answer. That covers Claude Code (a Bash command, a file edit or a new file),
+Gemini CLI (its tool approvals), OpenCode (its permission request; the listener reads
+the screen with its colours, since only a colour marks the chosen button) and pi
+approval extensions that ask through `ctx.ui.select`. Codex's approval dialog is not
+read yet. It is sealed the same
 way as a chunk, for the same pinned devices, and turned off by the same
 `--no-turn-history`; the server stores ciphertext only. Other dialogs (a plan, a
 question, a trust prompt) send nothing beyond the state. An answer the app sends is
@@ -1245,7 +1269,7 @@ hwip notify --title "Hello" --json
 | `verify` | Check installation health across detected agents (`--ping` for a live API call, with the key and API base every command resolves: `--key`, `--base-url`, then env, then config; `--json` prints the checks as one JSON object). Reports whether tmux is on PATH and whether the listener is running — both warnings, since notifications alone need neither. A settings file it cannot parse is a `!` line, not "not registered". Shows the last failed push, if any (see *Last push failure*). Also reports the resolved WebSocket URL **and where it came from** — `--ws-url`, config, the deprecated `HWIP_WS_URL`, or the built-in default — warns when the socket and the API base are on different stages, and warns when the running listener is on a different URL than the one that resolves now (it reads the config once, at startup) |
 | `check-update` | Check whether a newer Hwip version is on npm |
 | `notify` | Send a push notification |
-| `ask` | Ask the phone a question and wait for the answer — for hooks, which cannot call the MCP `hwip_ask` tool. `--title` (required), `--body`, `--actions id:Label,…`, `--timeout <s>` (default 60), `--accepts-exit` for an agent's own ask (the phone may "send and exit", and the answer settles REMOTE like `hwip_ask`). Key and API base resolve like every command. Prints one JSON line — `{"answered":true,"actionId":…}` or `{"value":…}`, else `{"answered":false,"reason":"cancelled"\|"timeout"\|"error"}`; `"resumed":true` is added when the outcome is of a question an earlier run of the same command put up (see "A question cut short"). Exit 0 answered, 1 not. The question and the answer travel sealed, always (see Encryption); an answer that cannot be verified is an error, never an approval. With no app signed in to the account it prints `no app is signed in to this account` and exits 1 |
+| `ask` | Ask the phone a question and wait for the answer — for hooks, which cannot call the MCP `hwip_ask` tool. `--title` (required), `--body`, `--actions id:Label,…`, `--timeout <s>` (default 60), `--accepts-exit` for an agent's own ask (the phone may "send and exit" and attach files, and the answer settles REMOTE like `hwip_ask`; attached files are saved sealed-and-opened to `~/.hwip/attachments/<eventId>/`, their paths follow the text in `value` and are listed in `files`, and `missingFiles` names any not saved). Key and API base resolve like every command. Prints one JSON line — `{"answered":true,"actionId":…}` or `{"value":…}`, else `{"answered":false,"reason":"cancelled"\|"timeout"\|"error"}`; `"resumed":true` is added when the outcome is of a question an earlier run of the same command put up (see "A question cut short"). Exit 0 answered, 1 not. The question and the answer travel sealed, always (see Encryption); an answer that cannot be verified is an error, never an approval. With no app signed in to the account it prints `no app is signed in to this account` and exits 1 |
 | `ask-context [status\|on\|off\|show] [--global]` | The switch for the context a sealed question carries (a git diff against HEAD and the terminal's last lines, masked, sealed on every send — see Encryption). On unless turned off: `off` for the project the current directory is in (its repository root), `off --global` for every project, `on` to undo either; `status` says which applies. It is a state file under `$XDG_STATE_HOME/hwip` (`ask-context-off-<project hash>`, `ask-context-off-default`) and never leaves this machine; `HWIP_ASK_CONTEXT=0` switches it off for one run. A switch file that cannot be read counts as off. `show` prints one JSON line, `{"context": …}` — the summary and the masked original a question asked from the current directory would carry, `null` when there is nothing, with `"off"` naming why when the switch is off — and sends nothing (the MCP `hwip_ask` tool reads it) |
 | `file-view [status\|on\|off\|log] [--global]` | The switch for the phone browsing this computer's files (a session's repository — see Defense). On unless turned off: `off` for the project the current directory is in (its repository root), `off --global` for every project, `on` to undo either; `status` says which applies. A state file under `$XDG_STATE_HOME/hwip` (`file-view-off-<project hash>`, `file-view-off-default`) that never leaves this machine; a switch file that cannot be read counts as off. `log` prints the last 50 reads the phone made, from `~/.hwip/listener.log` (time, device, session, listing or file, path, bytes, secrets masked, result) |
 | `list` | List recent push notifications. An end-to-end encrypted push reads `[encrypted]` — this host cannot open it |

package/dist/agent-rules.default.d.ts

@@ -18,7 +18,7 @@
  *   still be working underneath, so it must not change the state.
  *
  * Every agent here carries the same rules the server manifest publishes
- * (hwip server/src/agent-rules/manifest.json, version 2026.10.15.1 — hwip#484),
+ * (hwip server/src/agent-rules/manifest.json, version 2026.10.18.1 — hwip#532, merged and deployed before this cli ships),
  * so a listener that never reaches the endpoint classifies them too. A fetched
  * manifest replaces this bundle whole for state reports; schedules read only
  * this bundle. An agent without rules here

package/dist/agent-rules.default.js

@@ -21,7 +21,7 @@ exports.DEFAULT_MANIFEST = void 0;
  *   still be working underneath, so it must not change the state.
  *
  * Every agent here carries the same rules the server manifest publishes
- * (hwip server/src/agent-rules/manifest.json, version 2026.10.15.1 — hwip#484),
+ * (hwip server/src/agent-rules/manifest.json, version 2026.10.18.1 — hwip#532, merged and deployed before this cli ships),
  * so a listener that never reaches the endpoint classifies them too. A fetched
  * manifest replaces this bundle whole for state reports; schedules read only
  * this bundle. An agent without rules here
@@ -31,7 +31,7 @@ exports.DEFAULT_MANIFEST = void 0;
 const agent_state_js_1 = require("./agent-state.js");
 exports.DEFAULT_MANIFEST = {
     engineVersion: agent_state_js_1.ENGINE_VERSION,
-    version: '2026.10.15.1',
+    version: '2026.10.18.1',
     agents: {
         claude: [
             {
@@ -185,14 +185,27 @@ exports.DEFAULT_MANIFEST = {
         ],
         gemini: [
             {
-                // KNOWN GAP — `blocked` here means the folder-trust dialog,
-                // the only blocked screen that was actually captured. Gemini's
-                // tool-approval prompt is the common blocked case in practice
-                // and has NO rule: the probe session had shell auto-approved,
-                // so it never rendered. Until someone captures it, a gemini
-                // session waiting on tool approval reports `working` (the
-                // spinner rule) or `idle`, not `blocked`. Do not read the
-                // bench matrix's green `blocked` cell as full coverage.
+                // Tool approval (Shell, Edit, WriteFile), captured 2026-10-18 on
+                // Gemini CLI v0.46.0: a rounded box whose answers start with
+                // `│ ● 1. Allow once` under a boxed question line. Keyed on
+                // both, not the bare phrase, so agent text or a tool output box
+                // printing the answer row is not a dialog. The
+                // dialog draws no footer and hides the input box; 30 lines
+                // because a long diff sits between the header and the answers
+                // and a later notice box can be drawn below it.
+                id: 'gemini-blocked-tool-approval',
+                state: 'blocked',
+                priority: 900,
+                tailLines: 30,
+                regex: ['^\\s*│\\s+(?:●\\s+)?1\\.\\s+allow once'],
+                any: [
+                    { regex: ['^\\s*│ allow execution of .*\\?\\s*│$'] },
+                    { regex: ['^\\s*│ apply this change\\?\\s*│$'] },
+                ],
+                // The input box is hidden while Gemini asks; with it on screen the box is the agent's own text.
+                not: [{ contains: ['type your message'] }],
+            },
+            {
                 // Observed on Gemini CLI v0.46.0.
                 id: 'gemini-blocked-trust-dialog',
                 state: 'blocked',
@@ -215,17 +228,17 @@ exports.DEFAULT_MANIFEST = {
             },
         ],
         opencode: [
-            // Hand-written from the screen strings recorded in the C136
-            // backlog row (opencode 1.18.35) and a user's permission screen
-            // (`Allow once   Always allow   Reject … enter confirm`), not
-            // from a pane capture, so the bench has no fixture for it and
-            // agent-state.test.ts pins the strings instead. The button
-            // wording differs between versions (`Allow always` vs `Always
-            // allow`), hence the rule keys on the `Permission required`
-            // title line, guarded by any button or footer string so the
-            // phrase in tool output or agent text alone is not a dialog. tailLines 30 because an edit request draws its diff
-            // between that line and the buttons. Other prompts (the agent
-            // asking a question) are not captured and report `unknown`.
+            // Written from the screen strings recorded in the C136 backlog
+            // row (opencode 1.18.35) and a user's permission screen, then
+            // checked against panes captured 2026-10-18 on opencode 2.0.29
+            // (harness bench: bash and edit requests). The button wording
+            // differs between versions (`Allow always` vs `Always allow`),
+            // hence the rule keys on the `Permission required` title line,
+            // guarded by any button or footer string so the phrase in tool
+            // output or agent text alone is not a dialog. tailLines 30
+            // because an edit request draws its diff between that line and
+            // the buttons. Other prompts (the agent asking a question) are
+            // not captured and report `unknown`.
             // No idle rule: at rest the footer is only `ctrl+p commands`,
             // which says nothing the absence of `esc interrupt` does not.
             {

package/dist/answer-files.d.ts

@@ -0,0 +1,39 @@
+import type { SealedFileMeta } from './crypto.js';
+/**
+ * Files attached to a sealed answer of `hwip ask`. The answer's seal names each file (`SealedFileMeta`:
+ * its real name, type and size, matched by `iv`); the response's wire `files` carry the sealed bytes'
+ * `fileKey` and one wrapped key per device. The bytes are fetched and opened by the listener's
+ * `downloadSealedEach` — the same fetch and open as a sealed command's attachments, one file at a time — into
+ * `~/.hwip/attachments/<eventId>/`.
+ */
+/** One wire file as the server keeps it for a sealed answer (hwip `server/src/functions/hooks.ts`). */
+export interface AnswerWireFile {
+    fileKey: string;
+    fileName: string;
+    fileType?: string;
+    fileSize?: number;
+    iv: string;
+    deviceKeyMap: Record<string, string>;
+}
+export interface SavedAnswerFiles {
+    /** Absolute paths of the files saved. */
+    paths: string[];
+    /** One `<name>: <why>` per file the seal names that was not saved. */
+    missing: string[];
+}
+/** Who opens the files: this machine's slot, and the phone key the answer's seal was checked against. */
+export interface AnswerFileOpener {
+    deviceId: string;
+    senderPublicKey: string;
+}
+/** The listener's per-file sealed download (`listener.ts` `downloadSealedEach`): each file saved or named with why. */
+export type DownloadSealed = (dirId: string, files: AnswerWireFile[], sealed: AnswerFileOpener & {
+    files: SealedFileMeta[];
+}) => Promise<SavedAnswerFiles>;
+/**
+ * Save what the seal names and the wire delivered for this machine. A file the seal names with no wire
+ * file, or no slot here, is reported missing; the rest go to the listener's download in the seal's
+ * order, each saved or reported on its own. A download that throws as a whole reports each file with why.
+ */
+export declare const saveAnswerFiles: (eventId: string, wire: unknown, metas: SealedFileMeta[], opener: AnswerFileOpener, download: DownloadSealed) => Promise<SavedAnswerFiles>;
+//# sourceMappingURL=answer-files.d.ts.map

package/dist/answer-files.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.saveAnswerFiles = void 0;
+/** A relay's wire file, parsed: an object with a fileKey, an iv and a key map. */
+const isWireFile = (f) => {
+    if (typeof f !== 'object' || f === null)
+        return false;
+    const { fileKey, iv, deviceKeyMap } = f; // reading an unknown object's fields, each checked here
+    return typeof fileKey === 'string' && fileKey !== '' && typeof iv === 'string' && typeof deviceKeyMap === 'object' && deviceKeyMap !== null;
+};
+/**
+ * Save what the seal names and the wire delivered for this machine. A file the seal names with no wire
+ * file, or no slot here, is reported missing; the rest go to the listener's download in the seal's
+ * order, each saved or reported on its own. A download that throws as a whole reports each file with why.
+ */
+const saveAnswerFiles = async (eventId, wire, metas, opener, download) => {
+    const given = Array.isArray(wire) ? wire.filter(isWireFile) : [];
+    const pairs = metas.map((meta) => ({
+        meta,
+        file: given.find((f) => f.iv === meta.iv && typeof f.deviceKeyMap[opener.deviceId] === 'string'),
+    }));
+    const missing = pairs.filter((p) => !p.file).map((p) => `${p.meta.name}: not delivered`);
+    const delivered = pairs.flatMap((p) => (p.file ? [{ meta: p.meta, file: p.file }] : []));
+    if (delivered.length === 0)
+        return { paths: [], missing };
+    try {
+        const saved = await download(eventId, delivered.map((d) => d.file), { ...opener, files: delivered.map((d) => d.meta) });
+        return { paths: saved.paths, missing: [...missing, ...saved.missing] };
+    }
+    catch (err) {
+        const why = err instanceof Error ? err.message : String(err);
+        return { paths: [], missing: [...missing, ...delivered.map((d) => `${d.meta.name}: ${why}`)] };
+    }
+};
+exports.saveAnswerFiles = saveAnswerFiles;

package/dist/ask-seal.d.ts

@@ -94,11 +94,15 @@ export type PreparedAsk = {
     why?: RegisterWhy;
     detail?: string;
 };
-export type OpenedAnswer = {
+export type OpenedAnswer = 
+/** `files` comes with the key that sealed them, which opens each file's slot (answer-files.ts). */
+{
     ok: true;
     actionId?: string;
     value?: string;
     exit?: true;
+    files?: SealedFileMeta[];
+    senderPublicKey?: string;
 } | {
     ok: false;
     cause: AskRefusal;

package/dist/ask-seal.js

@@ -163,13 +163,16 @@ const openAnswer = async (response, askId, offered, deps) => {
     const { actionId, exit } = opened.answer;
     if (actionId !== undefined && (offered === undefined || !offered.includes(actionId)))
         return { ok: false, cause: 'unknown-action' };
-    if (actionId === undefined && !opened.body && exit !== true)
+    // What the seal says each attached file is; the bytes come with the response's wire `files` (answer-files.ts).
+    const files = opened.files?.length ? opened.files : undefined;
+    if (actionId === undefined && !opened.body && exit !== true && !files)
         return { ok: false, cause: 'empty-answer' };
     return {
         ok: true,
         ...(actionId === undefined ? {} : { actionId }),
         ...(opened.body ? { value: opened.body } : {}),
         ...(exit === true ? { exit } : {}),
+        ...(files ? { files, senderPublicKey: sealed.senderPublicKey } : {}),
     };
 };
 exports.openAnswer = openAnswer;

package/dist/ask.d.ts

@@ -1,3 +1,5 @@
+import { type SealedFileMeta } from './crypto.js';
+import { type AnswerFileOpener, type SavedAnswerFiles } from './answer-files.js';
 import { type AskSealDeps } from './ask-seal.js';
 import { type PendingAsks } from './ask-pending.js';
 /** Poll cadence: every second for the first 30 s, when a tap is most likely
@@ -33,6 +35,11 @@ export interface AskOptions {
      * stray `exitRemote` on its answer is dropped.
      */
     acceptsExit?: boolean;
+    /**
+     * Lets the phone attach files to a typed answer; they are saved to `~/.hwip/attachments/<eventId>/`
+     * and their paths follow the text. Set with `acceptsExit`: only an agent's own ask reads a reply.
+     */
+    acceptsFiles?: boolean;
 }
 /** Injected so the poll loop is testable without a clock or a network. */
 export interface AskDeps {
@@ -43,6 +50,8 @@ export interface AskDeps {
     seal: AskSealDeps;
     /** Where a question that went up is kept, so one cut short can be taken up again. Without it, every ask is a new question. */
     pending?: PendingAsks;
+    /** Saves the files a sealed answer names (answer-files.ts). Without it they are left on the server. */
+    saveFiles?: (eventId: string, wire: unknown, metas: SealedFileMeta[], opener: AnswerFileOpener) => Promise<SavedAnswerFiles>;
 }
 /** Why an ask ended unanswered: the user cancelled it on the phone, nobody
  *  answered in time, or the server could not be reached or refused. */
@@ -54,6 +63,10 @@ export type AskOutcome = ({
     readonly answered: true;
     readonly value: string;
     readonly exitRemote?: true;
+    /** Where the answer's files were saved; their paths also follow the text in `value`. */
+    readonly files?: readonly string[];
+    /** `<name>: <why>` for each attached file that was not saved. */
+    readonly missingFiles?: readonly string[];
 } | {
     readonly answered: false;
     readonly reason: UnansweredReason;

package/dist/ask.js

@@ -29,6 +29,7 @@ const insecure_url_js_1 = require("./insecure-url.js");
 const args_js_1 = require("./args.js");
 const api_js_1 = require("./api.js");
 const crypto_js_1 = require("./crypto.js");
+const answer_files_js_1 = require("./answer-files.js");
 const listener_device_id_js_1 = require("./listener-device-id.js");
 const config_js_2 = require("./config.js");
 const self_register_js_1 = require("./self-register.js");
@@ -211,6 +212,7 @@ const trigger = async (deps, opts, deadline, prepared) => {
         agentDeviceId: opts.agentDeviceId,
         agentSessionName: opts.agentSessionName,
         ...(opts.acceptsExit ? { acceptsExit: true } : {}),
+        ...(opts.acceptsFiles ? { acceptsFiles: true } : {}),
     });
     const payload = { body, headers: { 'Idempotency-Key': (0, node_crypto_1.randomUUID)() } };
     let backoffs = 0;
@@ -238,18 +240,38 @@ const trigger = async (deps, opts, deadline, prepared) => {
         }
     }
 };
-/** What an opened answer means to the caller: the choice, or the text (with the exit when this ask offers it). */
-const sealedOutcome = (opened, acceptsExit) => {
+/**
+ * What an opened answer means to the caller: the choice, or the text (with the exit when this ask offers
+ * it). Saved files' paths follow the text, so a reader of `value` alone still finds them.
+ */
+const sealedOutcome = (opened, acceptsExit, saved) => {
     if (!opened.ok)
         return { answered: false, reason: 'error', error: (0, ask_seal_js_1.refusalMessage)(opened.cause) };
     if (opened.actionId !== undefined)
         return { answered: true, actionId: opened.actionId };
+    const value = [opened.value ?? '', ...(saved?.paths ?? [])].filter(Boolean).join('\n');
+    const files = {
+        ...(saved?.paths.length ? { files: saved.paths } : {}),
+        ...(saved?.missing.length ? { missingFiles: saved.missing } : {}),
+    };
     if (opened.exit === true && acceptsExit)
-        return { answered: true, value: opened.value ?? '', exitRemote: true };
-    if (opened.value)
-        return { answered: true, value: opened.value };
+        return { answered: true, value, exitRemote: true, ...files };
+    if (value || saved)
+        return { answered: true, value, ...files };
     return { answered: false, reason: 'error', error: (0, ask_seal_js_1.refusalMessage)('empty-answer') };
 };
+/** The answer's files, saved — when this ask took files, the answer names some, and this machine has its key. */
+const saveFilesOf = async (deps, opts, eventId, response, opened) => {
+    if (!opened.ok || !opened.files || !opened.senderPublicKey)
+        return undefined;
+    // Not offered on this ask: said, not dropped.
+    if (!opts.acceptsFiles || !deps.saveFiles)
+        return { paths: [], missing: opened.files.map((m) => `${m.name}: this ask does not take files`) };
+    const deviceId = deps.seal.self()?.deviceId;
+    if (!deviceId)
+        return { paths: [], missing: opened.files.map((m) => `${m.name}: this machine has no key`) };
+    return deps.saveFiles(eventId, response?.files, opened.files, { deviceId, senderPublicKey: opened.senderPublicKey });
+};
 /**
  * Read the question's answer until there is one, the question ends without, or `until` passes — once
  * at least, whatever the clock says: the answer may be there already.
@@ -277,7 +299,8 @@ const awaitAnswer = async (deps, opts, asked, until, unconfirmed) => {
                     lastError = new Error((0, ask_seal_js_1.refusalMessage)(opened.cause));
                 }
                 else {
-                    return { outcome: sealedOutcome(opened, opts.acceptsExit === true), end: mayPass ? 'open' : 'over' };
+                    const saved = await saveFilesOf(deps, opts, asked.eventId, event.data.response, opened);
+                    return { outcome: sealedOutcome(opened, opts.acceptsExit === true, saved), end: mayPass ? 'open' : 'over' };
                 }
             }
             if (event.data?.status === 'cancelled')
@@ -478,6 +501,13 @@ const liveDeps = (account) => ({
     sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
     seal: (0, exports.liveSealDeps)(account.apiKey, account.baseUrl, account.deadline),
     pending: (0, ask_pending_js_1.pendingAsks)((0, gate_js_1.stateDir)()),
+    saveFiles: async (eventId, wire, metas, opener) => {
+        // The listener's download, borrowed: its log is the daemon's stdout, and this command's stdout is one JSON line.
+        const { downloadSealedEach } = await import('./listener.js');
+        const { silenceListenerLog } = await import('./listener-log.js');
+        silenceListenerLog();
+        return (0, answer_files_js_1.saveAnswerFiles)(eventId, wire, metas, opener, (dirId, files, sealed) => downloadSealedEach(dirId, files, { apiKey: account.apiKey, baseUrl: account.baseUrl }, sealed));
+    },
 });
 exports.liveDeps = liveDeps;
 /**
@@ -536,6 +566,7 @@ const handleAsk = async (args) => {
         timeoutSeconds: windowSeconds,
         ...((0, agent_session_js_1.agentSessionContext)() ?? {}),
         acceptsExit,
+        acceptsFiles: acceptsExit,
     }, (0, exports.liveDeps)({ apiKey, baseUrl: baseUrl.replace(/\/+$/, ''), deadline: Date.now() + windowSeconds * 1000 }));
     // The agent's own ask settles REMOTE as mcp-server's hwip_ask does and
     // reports it in the same `hwipState` field; an approval gate leaves the

package/dist/blocked-prompt-seal.d.ts

@@ -1,4 +1,5 @@
 import type { AgentState } from './agent-state.js';
+import type { AgentKind } from './remote-agents.js';
 import type { RecorderRecipient, SealedChunk } from './turn-recorder.js';
 /** What the session report carries: the server stores it and never opens it. */
 export interface BlockedPromptWire {
@@ -23,13 +24,16 @@ export interface PromptSealerDeps {
 }
 export interface PromptSealer {
     /** The sealed prompt for this session's screen, or undefined (not blocked, not a known dialog, not sealed yet). */
-    observe: (name: string, state: AgentState | undefined, paneText: string | null) => BlockedPromptWire | undefined;
+    observe: (name: string, kind: AgentKind, state: AgentState | undefined, paneText: string | null) => BlockedPromptWire | undefined;
     /** Forget sessions that are gone. */
     prune: (live: ReadonlySet<string>) => void;
     /** Settles when the seals running now are done, or undefined when none is. */
     sealing: () => Promise<void> | undefined;
 }
 export declare const createPromptSealer: (deps: PromptSealerDeps) => PromptSealer;
-/** True when the pane shows the prompt `id` right now (a fresh capture, not the one a report was made from). */
+/**
+ * True when the pane shows the prompt `id` right now (a fresh capture, not the one a report was made from). Capture it
+ * the way `observe` was fed (`-e`): OpenCode's highlight is in the escapes, and the id with it.
+ */
 export declare const promptStillShown: (id: string, paneText: string | null) => boolean;
 //# sourceMappingURL=blocked-prompt-seal.d.ts.map

package/dist/blocked-prompt-seal.js

@@ -47,8 +47,8 @@ const createPromptSealer = (deps) => {
         })();
     };
     return {
-        observe: (name, state, paneText) => {
-            const parsed = state === 'blocked' && paneText !== null ? (0, blocked_prompt_js_1.parseBlockedDialog)(paneText) : undefined;
+        observe: (name, kind, state, paneText) => {
+            const parsed = state === 'blocked' && paneText !== null ? (0, blocked_prompt_js_1.parseBlockedDialog)(paneText, kind) : undefined;
             if (!parsed) {
                 entries.delete(name);
                 return undefined;
@@ -84,6 +84,9 @@ const createPromptSealer = (deps) => {
     };
 };
 exports.createPromptSealer = createPromptSealer;
-/** True when the pane shows the prompt `id` right now (a fresh capture, not the one a report was made from). */
-const promptStillShown = (id, paneText) => paneText !== null && (0, blocked_prompt_js_1.parseBlockedDialog)(paneText)?.id === id;
+/**
+ * True when the pane shows the prompt `id` right now (a fresh capture, not the one a report was made from). Capture it
+ * the way `observe` was fed (`-e`): OpenCode's highlight is in the escapes, and the id with it.
+ */
+const promptStillShown = (id, paneText) => paneText !== null && (0, blocked_prompt_js_1.showsPrompt)(id, paneText);
 exports.promptStillShown = promptStillShown;

package/dist/blocked-prompt.d.ts

@@ -1,3 +1,4 @@
+import type { AgentKind } from './remote-agents.js';
 /** Dialog titles whose layout was captured and is read. */
 export declare const KNOWN_TITLES: readonly string[];
 export declare const MAX_DETAIL_LINES = 12;
@@ -27,8 +28,12 @@ export interface ParsedPrompt {
     options: PromptOption[];
 }
 export declare const isPromptId: (value: unknown) => value is string;
-/** The dialog at the bottom of `pane`, or undefined when it is not one this module reads. */
-export declare const parseBlockedDialog: (pane: string) => ParsedPrompt | undefined;
+/** `pane` without terminal escapes: what `capture-pane` without `-e` gives. */
+export declare const stripEscapes: (pane: string) => string;
+/** The approval dialog at the bottom of `pane`, read the way `kind` draws it; undefined when it is not one of those. */
+export declare const parseBlockedDialog: (pane: string, kind: AgentKind) => ParsedPrompt | undefined;
+/** True when some reader finds the prompt `id` on `pane`: an id hashes the exact dialog, so the kind need not be known. */
+export declare const showsPrompt: (id: string, pane: string) => boolean;
 /** What the app opens: the prompt plus which session and listener it belongs to, and when it was first seen. */
 export interface PromptPlaintext {
     v: 1;