@maestrofrontier/frontier 1.4.5 → 1.5.0

package/bin/maestro.cjs

@@ -1,75 +1,75 @@
-#!/usr/bin/env node
-// Maestro — unified CLI. One stable `maestro` entrypoint so every tool
-// wrapper and the docs call `maestro frontier ...` instead of the raw
-// `node frontier/cli.cjs` path.
-//
-//   maestro frontier <mode|status|run|adopt> [...]
-//       Delegates verbatim to frontier/cli.cjs in a child process with
-//       inherited cwd, env, and stdio -> identical Frontier state and
-//       scope (the engine's own scope autodetect and MAESTRO_SCOPE both
-//       resolve exactly as a direct call would). The child's exit code
-//       is propagated.
-//
-//   maestro install [--target <tool>] [--dry-run] [--project <path>]
-//                   [--user] [--no-hooks]
-//       Runs the cross-tool installer (scripts/install.cjs). Loaded
-//       lazily so the bin works for `frontier` even where the installer
-//       is absent.
-//
-// Zero dependencies. Resolves siblings relative to __dirname so it works
-// whether invoked via an npm bin shim, `npx github:mbanderas/maestro`, or
-// a direct `node bin/maestro.cjs`. .cjs so Node treats it as CommonJS
-// regardless of any parent "type": "module".
-
-'use strict';
-
-const path = require('path');
-const { spawnSync } = require('child_process');
-
-const argv = process.argv.slice(2);
-const cmd = argv[0];
-const rest = argv.slice(1);
-
-function usage(code) {
-  const w = code ? process.stderr : process.stdout;
-  w.write(
-    'Maestro — unified CLI\n' +
-    '\n' +
-    'Usage:\n' +
-    '  maestro frontier <mode|status|run|adopt> [...]   run the Frontier engine\n' +
-    '  maestro install [--target <tool>] [--dry-run] [--project <path>] [--user] [--no-hooks]\n' +
-    '\n' +
-    'Examples:\n' +
-    '  maestro frontier status\n' +
-    '  maestro frontier mode fusion --preset opus-gpt\n' +
-    '  maestro frontier run "fix the failing test"\n' +
-    '  maestro install --target auto --project .\n'
-  );
-  process.exit(code);
-}
-
-if (cmd === 'frontier') {
-  const cli = path.join(__dirname, '..', 'frontier', 'cli.cjs');
-  const r = spawnSync(process.execPath, [cli, ...rest], { stdio: 'inherit' });
-  if (r.error) {
-    process.stderr.write('maestro: failed to launch frontier — ' + (r.error.message || r.error) + '\n');
-    process.exit(1);
-  }
-  process.exit(r.status === null ? 1 : r.status);
-} else if (cmd === 'install') {
-  let run;
-  try {
-    ({ run } = require(path.join(__dirname, '..', 'scripts', 'install.cjs')));
-  } catch (e) {
-    process.stderr.write('maestro: installer unavailable — ' + (e && e.message) + '\n');
-    process.exit(1);
-  }
-  Promise.resolve(run(rest))
-    .then(code => process.exit(code || 0))
-    .catch(e => { process.stderr.write(String((e && e.stack) || e) + '\n'); process.exit(1); });
-} else if (!cmd || cmd === '--help' || cmd === '-h' || cmd === 'help') {
-  usage(0);
-} else {
-  process.stderr.write('maestro: unknown command "' + cmd + '"\n');
-  usage(1);
-}
+#!/usr/bin/env node
+// Maestro — unified CLI. One stable `maestro` entrypoint so every tool
+// wrapper and the docs call `maestro frontier ...` instead of the raw
+// `node frontier/cli.cjs` path.
+//
+//   maestro frontier <mode|status|run|adopt> [...]
+//       Delegates verbatim to frontier/cli.cjs in a child process with
+//       inherited cwd, env, and stdio -> identical Frontier state and
+//       scope (the engine's own scope autodetect and MAESTRO_SCOPE both
+//       resolve exactly as a direct call would). The child's exit code
+//       is propagated.
+//
+//   maestro install [--target <tool>] [--dry-run] [--project <path>]
+//                   [--user] [--no-hooks]
+//       Runs the cross-tool installer (scripts/install.cjs). Loaded
+//       lazily so the bin works for `frontier` even where the installer
+//       is absent.
+//
+// Zero dependencies. Resolves siblings relative to __dirname so it works
+// whether invoked via an npm bin shim, `npx github:mbanderas/maestro`, or
+// a direct `node bin/maestro.cjs`. .cjs so Node treats it as CommonJS
+// regardless of any parent "type": "module".
+
+'use strict';
+
+const path = require('path');
+const { spawnSync } = require('child_process');
+
+const argv = process.argv.slice(2);
+const cmd = argv[0];
+const rest = argv.slice(1);
+
+function usage(code) {
+  const w = code ? process.stderr : process.stdout;
+  w.write(
+    'Maestro — unified CLI\n' +
+    '\n' +
+    'Usage:\n' +
+    '  maestro frontier <mode|status|run|adopt> [...]   run the Frontier engine\n' +
+    '  maestro install [--target <tool>] [--dry-run] [--project <path>] [--user] [--no-hooks]\n' +
+    '\n' +
+    'Examples:\n' +
+    '  maestro frontier status\n' +
+    '  maestro frontier mode fusion --preset opus-gpt\n' +
+    '  maestro frontier run "fix the failing test"\n' +
+    '  maestro install --target auto --project .\n'
+  );
+  process.exit(code);
+}
+
+if (cmd === 'frontier') {
+  const cli = path.join(__dirname, '..', 'frontier', 'cli.cjs');
+  const r = spawnSync(process.execPath, [cli, ...rest], { stdio: 'inherit' });
+  if (r.error) {
+    process.stderr.write('maestro: failed to launch frontier — ' + (r.error.message || r.error) + '\n');
+    process.exit(1);
+  }
+  process.exit(r.status === null ? 1 : r.status);
+} else if (cmd === 'install') {
+  let run;
+  try {
+    ({ run } = require(path.join(__dirname, '..', 'scripts', 'install.cjs')));
+  } catch (e) {
+    process.stderr.write('maestro: installer unavailable — ' + (e && e.message) + '\n');
+    process.exit(1);
+  }
+  Promise.resolve(run(rest))
+    .then(code => process.exit(code || 0))
+    .catch(e => { process.stderr.write(String((e && e.stack) || e) + '\n'); process.exit(1); });
+} else if (!cmd || cmd === '--help' || cmd === '-h' || cmd === 'help') {
+  usage(0);
+} else {
+  process.stderr.write('maestro: unknown command "' + cmd + '"\n');
+  usage(1);
+}

package/commands/compress.md

@@ -1,36 +1,36 @@
----
-description: Compress a natural-language memory file into terse format to cut input tokens (backup kept, deterministic validation)
-argument-hint: <filepath>
-allowed-tools: Bash, Read
----
-
-Compress a natural-language memory file (CLAUDE.md, todos, notes)
-into terse format. Input-token savings compound every turn the file
-is loaded (AGENTS.md S8: persistent files are token cost).
-
-Target file: `$ARGUMENTS`
-
-Steps:
-
-1. If no filepath was given, ask for one and stop.
-2. Run:
-
-   ```bash
-   node "${CLAUDE_PLUGIN_ROOT}/scripts/compress.cjs" <filepath>
-   ```
-
-3. Report the script's outcome to the user verbatim (chars saved,
-   backup location, or the refusal/abort reason).
-
-The script is self-contained and enforces its own guardrails — do
-not work around a refusal by editing or renaming files:
-
-- Sensitive-path denylist (.env, credentials, keys, .ssh/.aws paths,
-  token-ish names): hard refusal — compression sends file contents
-  to the Anthropic API.
-- Only .md/.txt/extensionless prose files; max 500 KB.
-- Original saved as `<name>.original.md`; aborts if that backup
-  already exists.
-- Deterministic validation (headings, byte-exact code blocks, URLs;
-  paths and bullet counts as warnings) with up to 2 cherry-pick fix
-  rounds; on persistent failure the original is restored untouched.
+---
+description: Compress a natural-language memory file into terse format to cut input tokens (backup kept, deterministic validation)
+argument-hint: <filepath>
+allowed-tools: Bash, Read
+---
+
+Compress a natural-language memory file (CLAUDE.md, todos, notes)
+into terse format. Input-token savings compound every turn the file
+is loaded (AGENTS.md S8: persistent files are token cost).
+
+Target file: `$ARGUMENTS`
+
+Steps:
+
+1. If no filepath was given, ask for one and stop.
+2. Run:
+
+   ```bash
+   node "${CLAUDE_PLUGIN_ROOT}/scripts/compress.cjs" <filepath>
+   ```
+
+3. Report the script's outcome to the user verbatim (chars saved,
+   backup location, or the refusal/abort reason).
+
+The script is self-contained and enforces its own guardrails — do
+not work around a refusal by editing or renaming files:
+
+- Sensitive-path denylist (.env, credentials, keys, .ssh/.aws paths,
+  token-ish names): hard refusal — compression sends file contents
+  to the Anthropic API.
+- Only .md/.txt/extensionless prose files; max 500 KB.
+- Original saved as `<name>.original.md`; aborts if that backup
+  already exists.
+- Deterministic validation (headings, byte-exact code blocks, URLs;
+  paths and bullet counts as warnings) with up to 2 cherry-pick fix
+  rounds; on persistent failure the original is restored untouched.

package/commands/frontier.md

@@ -1,124 +1,124 @@
----
-description: Maestro Frontier local multi-CLI engine: arm a mode (off/single/fusion) so it auto-runs every prompt, pick a model/preset, or run a one-off prompt
-argument-hint: "<off | single <model> | fusion <preset> | status | run <prompt> | adopt>"
-allowed-tools: Bash, Read
----
-
-Drive the Maestro Frontier engine: a zero-dependency local multi-CLI
-fusion engine (parallel panel of local CLIs -> a judge model's
-analysis -> grounded synthesis). Default mode is `off`: the engine is opt-in and
-never runs until you switch it on. Arming it (`single` or `fusion`)
-makes it **auto-run on every prompt** — a `UserPromptSubmit` hook
-(`hooks/frontier-autorun.cjs`) routes each prompt through the engine and
-the live session relays the synthesized answer. `off` disables auto-run.
-Autorun blocks the turn until the engine returns; the hook carries a
-300s timeout (`hooks/hooks.json`), and a run that exceeds it is skipped
-so the turn proceeds normally. Any engine error degrades the same way.
-
-Requested action: `$ARGUMENTS`
-
-Map the argument to one engine CLI call and run it. The engine is
-self-contained; do not edit its state file yourself.
-
-1. Mode switch (persists across sessions; default `off`):
-
-   ```bash
-   node "${CLAUDE_PLUGIN_ROOT}/bin/maestro.cjs" frontier mode off
-   node "${CLAUDE_PLUGIN_ROOT}/bin/maestro.cjs" frontier mode single --model <model>
-   node "${CLAUDE_PLUGIN_ROOT}/bin/maestro.cjs" frontier mode fusion --preset <preset>
-   node "${CLAUDE_PLUGIN_ROOT}/bin/maestro.cjs" frontier mode fusion --preset custom --models <a,b,c>
-   node "${CLAUDE_PLUGIN_ROOT}/bin/maestro.cjs" frontier mode fusion --preset <preset> --judge <model> --synth <model>
-   ```
-
-   Models: `opus` (Claude Opus 4.8), `gpt-5.5` (Codex), `gemini`
-   (Gemini 3.1 Pro). Presets: `opus-duo`, `opus-gpt`, `gpt-duo`,
-   `frontier-trio`, `custom`. The judge + synthesizer default to Opus,
-   but `gpt-duo` runs them on GPT-5.5 (a Codex-only fusion that needs no
-   `claude`), and `--judge`/`--synth` override the model for any preset,
-   so you can mix freely (e.g. `--judge opus --synth gpt-5.5`).
-
-2. Show current mode/preset:
-
-   ```bash
-   node "${CLAUDE_PLUGIN_ROOT}/bin/maestro.cjs" frontier status
-   ```
-
-3. Run a prompt through the current mode (prompt as the argument, or
-   piped on stdin). This is a manual one-off; when the engine is armed
-   (`single`/`fusion`) the autorun hook already runs every prompt for
-   you, so `run` is mainly for scripting or an explicit re-run:
-
-   ```bash
-   node "${CLAUDE_PLUGIN_ROOT}/bin/maestro.cjs" frontier run "<prompt>"
-   ```
-
-   - `off`: prints a notice and exits without spawning anything;
-     normal Maestro behavior is unchanged.
-   - `single`: dispatches the one selected CLI and prints its answer.
-   - `fusion`: runs the panel in parallel, then the judge and
-     synthesizer models; prints the final answer (a one-line run meta of
-     preset, models, analysis present, and failed models goes to stderr).
-
-4. Adopt a previously-armed **global** mode into this workspace
-   (per-workspace isolation means a workspace never inherits the old
-   global state automatically — this copies it in once, on demand):
-
-   ```bash
-   node "${CLAUDE_PLUGIN_ROOT}/bin/maestro.cjs" frontier adopt
-   node "${CLAUDE_PLUGIN_ROOT}/bin/maestro.cjs" frontier adopt --force
-   ```
-
-   Reads the legacy global `frontier-state.json` read-only and writes it
-   into this workspace's `frontier-state.cc-<hash>.json`. It refuses to
-   overwrite an existing workspace state unless `--force`, never touches
-   the legacy file, and only targets a Claude Code `cc-*` scope. If
-   there is no legacy state (`missing-legacy`) it does nothing — arm the
-   workspace with `mode` instead.
-
-5. Report the result, matched to the action:
-   - `run`: report the engine's stdout verbatim.
-   - `adopt`: confirm the adopted mode/preset, or relay the
-     `ERROR [<reason>]` (e.g. `exists` — suggest `--force`; `missing-legacy`
-     — nothing to adopt). Arming now auto-runs on every prompt.
-   - arming a mode (`single`/`fusion`): confirm the mode, then tell the
-     user plainly that the engine now **auto-runs on every prompt** —
-     they just chat normally and the synthesized answer is relayed.
-     Do NOT tell the user to call `run` manually; arming already routes
-     every prompt through the engine (`run` is only a scripted one-off).
-   - `off`: confirm auto-run is disabled and normal Maestro resumes.
-   - `status`: report the current mode/preset.
-
-   On an error the engine prints `ERROR [<failure_reason>]: <detail>`
-   to stderr and exits non-zero; relay the failure_reason.
-
-Notes:
-
-- **Arming in Claude Code is per-workspace.** State is stored in a
-  workspace-scoped file (`frontier-state.cc-<hash>.json`, keyed to the
-  git project root). Arming in one workspace does not affect any other.
-  After upgrading Maestro, each Claude Code workspace starts `off` and
-  must be re-armed — no automatic migration into workspace scopes.
-  `adopt` (step 4) is the explicit opt-in to copy a prior global mode in.
-- Real `single`/`fusion` runs spawn local CLIs and cost tokens; each
-  cold `claude -p` panel/judge/synth call is non-trivial. Use small
-  prompts. `off` is free.
-- Headless web access varies per CLI (Codex confirmed; Claude and
-  Gemini gated off in this build). The engine sets a per-adapter
-  `webTools` flag accordingly; see the risk burndown.
-- `gemini` works well as a panel member, but on Windows it is a poor
-  `--judge`/`--synth` choice: it takes its prompt as an argument and the
-  judge/synth prompts contain newlines, which the win32 arg-safety guard
-  refuses, so the stage then degrades (judge omitted, synth falls back).
-  Use `opus` or `gpt-5.5` for judge/synth on Windows. (No such limit on
-  macOS/Linux, where args are passed directly.)
-
-## Binary overrides
-
-The engine is zero-dependency CommonJS under `frontier/`. Each CLI is
-resolved from your `PATH`: `claude` (Opus 4.8), `codex` (GPT-5.5), and
-`gemini` (Gemini 3.1 Pro). When a binary is not on `PATH`, or you want a
-specific build, point at it with an environment variable:
-
-- `MAESTRO_CLAUDE_BIN` sets the `claude` binary path.
-- `MAESTRO_CODEX_BIN` sets the `codex` binary path.
-- `MAESTRO_GEMINI_BIN` sets the `gemini` binary path.
+---
+description: Maestro Frontier local multi-CLI engine: arm a mode (off/single/fusion) so it auto-runs every prompt, pick a model/preset, or run a one-off prompt
+argument-hint: "<off | single <model> | fusion <preset> | status | run <prompt> | adopt>"
+allowed-tools: Bash, Read
+---
+
+Drive the Maestro Frontier engine: a zero-dependency local multi-CLI
+fusion engine (parallel panel of local CLIs -> a judge model's
+analysis -> grounded synthesis). Default mode is `off`: the engine is opt-in and
+never runs until you switch it on. Arming it (`single` or `fusion`)
+makes it **auto-run on every prompt** — a `UserPromptSubmit` hook
+(`hooks/frontier-autorun.cjs`) routes each prompt through the engine and
+the live session relays the synthesized answer. `off` disables auto-run.
+Autorun blocks the turn until the engine returns; the hook carries a
+300s timeout (`hooks/hooks.json`), and a run that exceeds it is skipped
+so the turn proceeds normally. Any engine error degrades the same way.
+
+Requested action: `$ARGUMENTS`
+
+Map the argument to one engine CLI call and run it. The engine is
+self-contained; do not edit its state file yourself.
+
+1. Mode switch (persists across sessions; default `off`):
+
+   ```bash
+   node "${CLAUDE_PLUGIN_ROOT}/bin/maestro.cjs" frontier mode off
+   node "${CLAUDE_PLUGIN_ROOT}/bin/maestro.cjs" frontier mode single --model <model>
+   node "${CLAUDE_PLUGIN_ROOT}/bin/maestro.cjs" frontier mode fusion --preset <preset>
+   node "${CLAUDE_PLUGIN_ROOT}/bin/maestro.cjs" frontier mode fusion --preset custom --models <a,b,c>
+   node "${CLAUDE_PLUGIN_ROOT}/bin/maestro.cjs" frontier mode fusion --preset <preset> --judge <model> --synth <model>
+   ```
+
+   Models: `opus` (Claude Opus 4.8), `gpt-5.5` (Codex), `gemini`
+   (Gemini 3.1 Pro). Presets: `opus-duo`, `opus-gpt`, `gpt-duo`,
+   `frontier-trio`, `custom`. The judge + synthesizer default to Opus,
+   but `gpt-duo` runs them on GPT-5.5 (a Codex-only fusion that needs no
+   `claude`), and `--judge`/`--synth` override the model for any preset,
+   so you can mix freely (e.g. `--judge opus --synth gpt-5.5`).
+
+2. Show current mode/preset:
+
+   ```bash
+   node "${CLAUDE_PLUGIN_ROOT}/bin/maestro.cjs" frontier status
+   ```
+
+3. Run a prompt through the current mode (prompt as the argument, or
+   piped on stdin). This is a manual one-off; when the engine is armed
+   (`single`/`fusion`) the autorun hook already runs every prompt for
+   you, so `run` is mainly for scripting or an explicit re-run:
+
+   ```bash
+   node "${CLAUDE_PLUGIN_ROOT}/bin/maestro.cjs" frontier run "<prompt>"
+   ```
+
+   - `off`: prints a notice and exits without spawning anything;
+     normal Maestro behavior is unchanged.
+   - `single`: dispatches the one selected CLI and prints its answer.
+   - `fusion`: runs the panel in parallel, then the judge and
+     synthesizer models; prints the final answer (a one-line run meta of
+     preset, models, analysis present, and failed models goes to stderr).
+
+4. Adopt a previously-armed **global** mode into this workspace
+   (per-workspace isolation means a workspace never inherits the old
+   global state automatically — this copies it in once, on demand):
+
+   ```bash
+   node "${CLAUDE_PLUGIN_ROOT}/bin/maestro.cjs" frontier adopt
+   node "${CLAUDE_PLUGIN_ROOT}/bin/maestro.cjs" frontier adopt --force
+   ```
+
+   Reads the legacy global `frontier-state.json` read-only and writes it
+   into this workspace's `frontier-state.cc-<hash>.json`. It refuses to
+   overwrite an existing workspace state unless `--force`, never touches
+   the legacy file, and only targets a Claude Code `cc-*` scope. If
+   there is no legacy state (`missing-legacy`) it does nothing — arm the
+   workspace with `mode` instead.
+
+5. Report the result, matched to the action:
+   - `run`: report the engine's stdout verbatim.
+   - `adopt`: confirm the adopted mode/preset, or relay the
+     `ERROR [<reason>]` (e.g. `exists` — suggest `--force`; `missing-legacy`
+     — nothing to adopt). Arming now auto-runs on every prompt.
+   - arming a mode (`single`/`fusion`): confirm the mode, then tell the
+     user plainly that the engine now **auto-runs on every prompt** —
+     they just chat normally and the synthesized answer is relayed.
+     Do NOT tell the user to call `run` manually; arming already routes
+     every prompt through the engine (`run` is only a scripted one-off).
+   - `off`: confirm auto-run is disabled and normal Maestro resumes.
+   - `status`: report the current mode/preset.
+
+   On an error the engine prints `ERROR [<failure_reason>]: <detail>`
+   to stderr and exits non-zero; relay the failure_reason.
+
+Notes:
+
+- **Arming in Claude Code is per-workspace.** State is stored in a
+  workspace-scoped file (`frontier-state.cc-<hash>.json`, keyed to the
+  git project root). Arming in one workspace does not affect any other.
+  After upgrading Maestro, each Claude Code workspace starts `off` and
+  must be re-armed — no automatic migration into workspace scopes.
+  `adopt` (step 4) is the explicit opt-in to copy a prior global mode in.
+- Real `single`/`fusion` runs spawn local CLIs and cost tokens; each
+  cold `claude -p` panel/judge/synth call is non-trivial. Use small
+  prompts. `off` is free.
+- Headless web access varies per CLI (Codex confirmed; Claude and
+  Gemini gated off in this build). The engine sets a per-adapter
+  `webTools` flag accordingly; see the risk burndown.
+- `gemini` works well as a panel member, but on Windows it is a poor
+  `--judge`/`--synth` choice: it takes its prompt as an argument and the
+  judge/synth prompts contain newlines, which the win32 arg-safety guard
+  refuses, so the stage then degrades (judge omitted, synth falls back).
+  Use `opus` or `gpt-5.5` for judge/synth on Windows. (No such limit on
+  macOS/Linux, where args are passed directly.)
+
+## Binary overrides
+
+The engine is zero-dependency CommonJS under `frontier/`. Each CLI is
+resolved from your `PATH`: `claude` (Opus 4.8), `codex` (GPT-5.5), and
+`gemini` (Gemini 3.1 Pro). When a binary is not on `PATH`, or you want a
+specific build, point at it with an environment variable:
+
+- `MAESTRO_CLAUDE_BIN` sets the `claude` binary path.
+- `MAESTRO_CODEX_BIN` sets the `codex` binary path.
+- `MAESTRO_GEMINI_BIN` sets the `gemini` binary path.

package/commands/terse.md

@@ -1,23 +1,23 @@
----
-description: Switch Maestro terse output mode (lite|full|ultra|off)
-argument-hint: "[lite|full|ultra|off]"
----
-
-Switch the Maestro terse output level. Requested level: `$ARGUMENTS`
-
-The maestro-terse-mode hook already updated the flag file when this
-command was submitted (bare invocation activates the configured
-default, or `full`). Do not edit the flag yourself.
-
-Steps:
-
-1. Read `${CLAUDE_PLUGIN_ROOT}/skills/terse/SKILL.md` and apply the
-   ruleset for the requested level from this response onward
-   (`off`: drop terse style entirely).
-2. Confirm in one line: new level, how to switch off
-   (`/maestro:terse off`, "stop terse", "normal mode"), and that the
-   statusline badge shows `[TERSE:<LEVEL>]` next session refresh.
-
-Boundaries (always): code/commits/PRs written normal; Auto-Clarity
-escape for security warnings, irreversible-action confirmations, and
-multi-step sequences.
+---
+description: Switch Maestro terse output mode (lite|full|ultra|off)
+argument-hint: "[lite|full|ultra|off]"
+---
+
+Switch the Maestro terse output level. Requested level: `$ARGUMENTS`
+
+The maestro-terse-mode hook already updated the flag file when this
+command was submitted (bare invocation activates the configured
+default, or `full`). Do not edit the flag yourself.
+
+Steps:
+
+1. Read `${CLAUDE_PLUGIN_ROOT}/skills/terse/SKILL.md` and apply the
+   ruleset for the requested level from this response onward
+   (`off`: drop terse style entirely).
+2. Confirm in one line: new level, how to switch off
+   (`/maestro:terse off`, "stop terse", "normal mode"), and that the
+   statusline badge shows `[TERSE:<LEVEL>]` next session refresh.
+
+Boundaries (always): code/commits/PRs written normal; Auto-Clarity
+escape for security warnings, irreversible-action confirmations, and
+multi-step sequences.