@namzu/cli 10.0.0 → 12.0.0

package/dist/integrations/telemetry/session-export.js

@@ -0,0 +1,119 @@
+import { appendFileSync, mkdirSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+import { probeOptionalPackage } from '../../context/capabilities.js';
+/** Why a configured export could not be started. */
+export class SessionExportUnavailableError extends Error {
+    reason;
+    constructor(reason, cause) {
+        super(reason === 'absent'
+            ? 'telemetry.sessionExport is configured but "@namzu/telemetry" is not installed, so nothing would be recorded. Install it (npm i @namzu/telemetry), or remove telemetry.sessionExport from your config. Refusing rather than running a session whose export silently does not exist.'
+            : `telemetry.sessionExport is configured but "@namzu/telemetry" failed to load (${cause ?? 'no detail'}). Reinstall it, or remove telemetry.sessionExport from your config.`);
+        this.reason = reason;
+        this.name = 'SessionExportUnavailableError';
+    }
+}
+const TELEMETRY_SPECIFIER = '@namzu/telemetry';
+/**
+ * Load the optional package, separating "not installed" from "installed and
+ * unusable" the same way `context/capabilities.ts` does — and for the same
+ * reason: the two send a reader to different places.
+ *
+ * Takes the specifier so a test can drive the REAL resolution path with a
+ * name that cannot resolve. Everything else in this file is tested through
+ * an injected loader, which proves what `attachSessionExport` does with a
+ * refusal and proves nothing about where the refusal comes from — a
+ * mutation replacing this `throw` with a stub module survived until this was
+ * separated out.
+ */
+export async function loadTelemetryFrom(specifier) {
+    // Through the SAME probe the doctor and the boot narrative use, rather
+    // than a second resolution here. Two answers to "is @namzu/telemetry
+    // installed" is two chances to disagree, and the one that drifted would be
+    // the one deciding whether a session gets recorded.
+    //
+    // It also inherits the fix: `require.resolve` reports an installed
+    // ESM-only package as absent, which would have produced this refusal
+    // against a machine that was configured correctly.
+    const probe = await probeOptionalPackage(specifier);
+    if (probe.state === 'absent')
+        throw new SessionExportUnavailableError('absent');
+    if (probe.state === 'broken')
+        throw new SessionExportUnavailableError('broken', probe.error.message);
+    return (await import(specifier));
+}
+async function loadTelemetry(loader) {
+    if (loader)
+        return await loader();
+    return await loadTelemetryFrom(TELEMETRY_SPECIFIER);
+}
+/**
+ * A JSONL file, one record per line.
+ *
+ * `appendFileSync` rather than a stream, and that is a deliberate trade: a
+ * stream would not block, but a stream's buffered tail is lost when the
+ * process exits on a signal, and the whole value of an exported session is
+ * that it survives the run that produced it. The listener already never
+ * waits on `emit` — the synchronous write happens inside a call the run does
+ * not await, so the cost lands on the exporting call and not on the model
+ * loop.
+ */
+export function fileSink(destinationPath) {
+    const path = resolve(destinationPath);
+    let ensured = false;
+    return {
+        emit(record) {
+            if (!ensured) {
+                mkdirSync(dirname(path), { recursive: true });
+                ensured = true;
+            }
+            appendFileSync(path, `${JSON.stringify(record)}\n`, 'utf-8');
+        },
+        // Nothing is buffered, so there is nothing to drain — and saying so is
+        // better than an empty function that reads as an unfinished one.
+        shutdown: async () => { },
+    };
+}
+export async function attachSessionExport(options) {
+    const telemetry = await loadTelemetry(options.loader);
+    const sink = options.sink ?? fileSink(options.config.destination);
+    // Omitted means the shipped redactor; `[]` means none. A config reaches
+    // "no redaction" only by saying so.
+    const redactors = (options.config.redactors ?? ['secrets']).map((name) => {
+        switch (name) {
+            case 'secrets':
+                return telemetry.secretRedactor();
+        }
+    });
+    const exportConfig = {
+        sink,
+        destination: options.config.destination,
+        ...(options.config.eventTypes !== undefined ? { eventTypes: options.config.eventTypes } : {}),
+        redactors,
+    };
+    return {
+        listener: telemetry.createSessionExportListener(exportConfig),
+        shutdown: () => sink.shutdown(),
+        disclosure: telemetry.describeSessionExport(exportConfig),
+    };
+}
+/**
+ * The disclosure when export is NOT configured.
+ *
+ * Goes through the same function as the configured case so the two cannot
+ * drift into reading alike — which is the property
+ * `describeSessionExport`'s own test pins, and which is worth nothing if
+ * this branch hand-writes its own sentence instead.
+ */
+export async function describeSessionExportOff(loader) {
+    try {
+        const telemetry = await loadTelemetry(loader);
+        return telemetry.describeSessionExport();
+    }
+    catch {
+        // `@namzu/telemetry` absent AND export unconfigured is the ordinary
+        // case, not a problem: there is nothing to disclose because there is
+        // nothing installed that could export.
+        return null;
+    }
+}
+//# sourceMappingURL=session-export.js.map

package/dist/integrations/telemetry/session-export.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-export.js","sourceRoot":"","sources":["../../../src/integrations/telemetry/session-export.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AACnD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAI5C,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAA;AAiCpE,oDAAoD;AACpD,MAAM,OAAO,6BAA8B,SAAQ,KAAK;IAE7C;IADV,YACU,MAA2B,EACpC,KAAc;QAEd,KAAK,CACJ,MAAM,KAAK,QAAQ;YAClB,CAAC,CAAC,oRAAoR;YACtR,CAAC,CAAC,gFAAgF,KAAK,IAAI,WAAW,sEAAsE,CAC7K,CAAA;QAPQ,WAAM,GAAN,MAAM,CAAqB;QAQpC,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAA;IAC5C,CAAC;CACD;AAgBD,MAAM,mBAAmB,GAAG,kBAAkB,CAAA;AAE9C;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,SAAiB;IACxD,uEAAuE;IACvE,qEAAqE;IACrE,2EAA2E;IAC3E,oDAAoD;IACpD,EAAE;IACF,mEAAmE;IACnE,qEAAqE;IACrE,mDAAmD;IACnD,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,SAAS,CAAC,CAAA;IACnD,IAAI,KAAK,CAAC,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,6BAA6B,CAAC,QAAQ,CAAC,CAAA;IAC/E,IAAI,KAAK,CAAC,KAAK,KAAK,QAAQ;QAC3B,MAAM,IAAI,6BAA6B,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IACvE,OAAO,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,CAA+B,CAAA;AAC/D,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,MAAwB;IACpD,IAAI,MAAM;QAAE,OAAO,MAAM,MAAM,EAAE,CAAA;IACjC,OAAO,MAAM,iBAAiB,CAAC,mBAAmB,CAAC,CAAA;AACpD,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,QAAQ,CAAC,eAAuB;IAI/C,MAAM,IAAI,GAAG,OAAO,CAAC,eAAe,CAAC,CAAA;IACrC,IAAI,OAAO,GAAG,KAAK,CAAA;IACnB,OAAO;QACN,IAAI,CAAC,MAAM;YACV,IAAI,CAAC,OAAO,EAAE,CAAC;gBACd,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;gBAC7C,OAAO,GAAG,IAAI,CAAA;YACf,CAAC;YACD,cAAc,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;QAC7D,CAAC;QACD,uEAAuE;QACvE,iEAAiE;QACjE,QAAQ,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC;KACxB,CAAA;AACF,CAAC;AAUD,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,OAAmC;IAEnC,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IACrD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;IAEjE,wEAAwE;IACxE,oCAAoC;IACpC,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACxE,QAAQ,IAAI,EAAE,CAAC;YACd,KAAK,SAAS;gBACb,OAAO,SAAS,CAAC,cAAc,EAAE,CAAA;QACnC,CAAC;IACF,CAAC,CAAC,CAAA;IAEF,MAAM,YAAY,GAAG;QACpB,IAAI;QACJ,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW;QACvC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7F,SAAS;KACT,CAAA;IAED,OAAO;QACN,QAAQ,EAAE,SAAS,CAAC,2BAA2B,CAAC,YAAY,CAAC;QAC7D,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE;QAC/B,UAAU,EAAE,SAAS,CAAC,qBAAqB,CAAC,YAAY,CAAC;KACzD,CAAA;AACF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,MAAwB;IACtE,IAAI,CAAC;QACJ,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,CAAA;QAC7C,OAAO,SAAS,CAAC,qBAAqB,EAAE,CAAA;IACzC,CAAC;IAAC,MAAM,CAAC;QACR,oEAAoE;QACpE,qEAAqE;QACrE,uCAAuC;QACvC,OAAO,IAAI,CAAA;IACZ,CAAC;AACF,CAAC"}

package/dist/logging.d.ts

@@ -0,0 +1,79 @@
+/**
+ * Log level + format resolution for the CLI's five entry points that used
+ * to force the SDK logger's level to `silent` via `configureLogger` and
+ * never turn it back on: `tui/index.tsx`, `commands/run.ts`,
+ * `commands/drain.ts` and `commands/run-stream.ts` (twice — `run-stream`
+ * itself and `providers-json`). LOG-05.
+ *
+ * Kept out of `config/load.ts`'s cascade on purpose. That system merges
+ * four sources for `format`/`quiet`/`permissions`/`sandbox`, all of them
+ * either boolean or a closed enum with a config-file counterpart.
+ * `NAMZU_LOG_LEVEL` has no config-file counterpart in this increment and is
+ * not boolean-shaped — it names a level directly, string-valued, the same
+ * way `--verbose`/`--quiet` do. Precedence here is exactly what the design
+ * specifies and nothing more: an explicit flag beats the environment beats
+ * the default that used to be silence.
+ */
+import type { LevelFilter, LogSink } from '@namzu/sdk';
+export type LogFormat = 'pretty' | 'json';
+/** What every entry point installs as its process sink, resolved once per
+ *  invocation in `cli.ts#getContext()` and threaded through
+ *  `CommandContext`/`TuiContext`. */
+export interface ResolvedLogging {
+    readonly level: LevelFilter;
+    readonly format: LogFormat;
+}
+export interface LogLevelFlags {
+    /** `-v, --verbose` as Commander parsed it — `undefined` unless given. */
+    readonly verbose?: boolean;
+    /**
+     * `-q, --quiet` as Commander parsed it — `undefined` unless given.
+     * Reuses the CLI's existing global flag rather than minting a second
+     * "quiet" that means something different depending which one you typed.
+     */
+    readonly quiet?: boolean;
+}
+/**
+ * `--verbose` -> `debug`, `--quiet` -> `warn`, otherwise `NAMZU_LOG_LEVEL`
+ * if it names a real level, otherwise `info` — the floor that used to be
+ * silence.
+ *
+ * `cli.ts` declares `--verbose` and `--quiet` as a `.conflicts()`-paired
+ * pair of Commander options, so through the CLI itself at most one of
+ * `flags.verbose` / `flags.quiet` is ever true at once. The `verbose`-first
+ * check below is what a caller that builds `LogLevelFlags` by hand — every
+ * test in `logging.test.ts` — gets instead of relying on that invariant.
+ */
+export declare function resolveLogLevel(flags: LogLevelFlags, env?: NodeJS.ProcessEnv): LevelFilter;
+export interface LogFormatFlags {
+    /**
+     * `--log-format <pretty|json>`. Commander's `.choices(['pretty','json'])`
+     * already rejects anything else at parse time, so `undefined` is the
+     * only other value `cli.ts` can hand this. Re-checked below anyway
+     * because a caller building this by hand (every test in
+     * `logging.test.ts`) is not bound by what Commander would have refused.
+     */
+    readonly logFormat?: string;
+}
+export declare function resolveLogFormat(flags: LogFormatFlags, env?: NodeJS.ProcessEnv): LogFormat;
+/**
+ * The sink `run`/`drain` install, chosen by `--log-format`/
+ * `NAMZU_LOG_FORMAT`. `run-stream` does NOT use this — its stderr is a
+ * machine-read NDJSON channel regardless of the format flag, the same way
+ * its stdout protocol is unaffected by anything the operator passes. See
+ * `commands/run-stream.ts`.
+ */
+export declare function createStderrSink(format: LogFormat): LogSink;
+/**
+ * Falls back to the same resolution `cli.ts#getContext()` would have
+ * produced with no flags and the live environment, for a `ctx`/`TuiContext`
+ * a test built by hand without a `logging` field — a fixture omitting a
+ * field it does not care about must not crash the handler it exercises.
+ * Every production `ctx` carries `logging`; only a test double hits the
+ * fallback, and `test-setup.ts` defaults `NAMZU_LOG_LEVEL` to `silent` so
+ * that fallback stays quiet unless a test deliberately overrides it.
+ */
+export declare function contextLogging(ctx: {
+    readonly logging?: ResolvedLogging;
+}): ResolvedLogging;
+//# sourceMappingURL=logging.d.ts.map

package/dist/logging.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logging.d.ts","sourceRoot":"","sources":["../src/logging.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AAGtD,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,MAAM,CAAA;AAEzC;;qCAEqC;AACrC,MAAM,WAAW,eAAe;IAC/B,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAA;CAC1B;AAQD,MAAM,WAAW,aAAa;IAC7B,yEAAyE;IACzE,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CACxB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAC9B,KAAK,EAAE,aAAa,EACpB,GAAG,GAAE,MAAM,CAAC,UAAwB,GAClC,WAAW,CAIb;AAED,MAAM,WAAW,cAAc;IAC9B;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAC3B;AAED,wBAAgB,gBAAgB,CAC/B,KAAK,EAAE,cAAc,EACrB,GAAG,GAAE,MAAM,CAAC,UAAwB,GAClC,SAAS,CAGX;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,SAAS,GAAG,OAAO,CAE3D;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE;IAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,CAAA;CAAE,GAAG,eAAe,CAE3F"}

package/dist/logging.js

@@ -0,0 +1,67 @@
+/**
+ * Log level + format resolution for the CLI's five entry points that used
+ * to force the SDK logger's level to `silent` via `configureLogger` and
+ * never turn it back on: `tui/index.tsx`, `commands/run.ts`,
+ * `commands/drain.ts` and `commands/run-stream.ts` (twice — `run-stream`
+ * itself and `providers-json`). LOG-05.
+ *
+ * Kept out of `config/load.ts`'s cascade on purpose. That system merges
+ * four sources for `format`/`quiet`/`permissions`/`sandbox`, all of them
+ * either boolean or a closed enum with a config-file counterpart.
+ * `NAMZU_LOG_LEVEL` has no config-file counterpart in this increment and is
+ * not boolean-shaped — it names a level directly, string-valued, the same
+ * way `--verbose`/`--quiet` do. Precedence here is exactly what the design
+ * specifies and nothing more: an explicit flag beats the environment beats
+ * the default that used to be silence.
+ */
+import { jsonLinesSink, prettySink } from '@namzu/sdk';
+const LEVEL_FILTERS = new Set(['debug', 'info', 'warn', 'error', 'silent']);
+function isLevelFilter(value) {
+    return value !== undefined && LEVEL_FILTERS.has(value);
+}
+/**
+ * `--verbose` -> `debug`, `--quiet` -> `warn`, otherwise `NAMZU_LOG_LEVEL`
+ * if it names a real level, otherwise `info` — the floor that used to be
+ * silence.
+ *
+ * `cli.ts` declares `--verbose` and `--quiet` as a `.conflicts()`-paired
+ * pair of Commander options, so through the CLI itself at most one of
+ * `flags.verbose` / `flags.quiet` is ever true at once. The `verbose`-first
+ * check below is what a caller that builds `LogLevelFlags` by hand — every
+ * test in `logging.test.ts` — gets instead of relying on that invariant.
+ */
+export function resolveLogLevel(flags, env = process.env) {
+    if (flags.verbose)
+        return 'debug';
+    if (flags.quiet)
+        return 'warn';
+    return isLevelFilter(env.NAMZU_LOG_LEVEL) ? env.NAMZU_LOG_LEVEL : 'info';
+}
+export function resolveLogFormat(flags, env = process.env) {
+    if (flags.logFormat === 'pretty' || flags.logFormat === 'json')
+        return flags.logFormat;
+    return env.NAMZU_LOG_FORMAT === 'json' ? 'json' : 'pretty';
+}
+/**
+ * The sink `run`/`drain` install, chosen by `--log-format`/
+ * `NAMZU_LOG_FORMAT`. `run-stream` does NOT use this — its stderr is a
+ * machine-read NDJSON channel regardless of the format flag, the same way
+ * its stdout protocol is unaffected by anything the operator passes. See
+ * `commands/run-stream.ts`.
+ */
+export function createStderrSink(format) {
+    return format === 'json' ? jsonLinesSink(process.stderr) : prettySink(process.stderr);
+}
+/**
+ * Falls back to the same resolution `cli.ts#getContext()` would have
+ * produced with no flags and the live environment, for a `ctx`/`TuiContext`
+ * a test built by hand without a `logging` field — a fixture omitting a
+ * field it does not care about must not crash the handler it exercises.
+ * Every production `ctx` carries `logging`; only a test double hits the
+ * fallback, and `test-setup.ts` defaults `NAMZU_LOG_LEVEL` to `silent` so
+ * that fallback stays quiet unless a test deliberately overrides it.
+ */
+export function contextLogging(ctx) {
+    return ctx.logging ?? { level: resolveLogLevel({}), format: resolveLogFormat({}) };
+}
+//# sourceMappingURL=logging.js.map

package/dist/logging.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logging.js","sourceRoot":"","sources":["../src/logging.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAYtD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAA;AAEnF,SAAS,aAAa,CAAC,KAAyB;IAC/C,OAAO,KAAK,KAAK,SAAS,IAAI,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;AACvD,CAAC;AAaD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAC9B,KAAoB,EACpB,MAAyB,OAAO,CAAC,GAAG;IAEpC,IAAI,KAAK,CAAC,OAAO;QAAE,OAAO,OAAO,CAAA;IACjC,IAAI,KAAK,CAAC,KAAK;QAAE,OAAO,MAAM,CAAA;IAC9B,OAAO,aAAa,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,CAAA;AACzE,CAAC;AAaD,MAAM,UAAU,gBAAgB,CAC/B,KAAqB,EACrB,MAAyB,OAAO,CAAC,GAAG;IAEpC,IAAI,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC,SAAS,CAAA;IACtF,OAAO,GAAG,CAAC,gBAAgB,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAA;AAC3D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAiB;IACjD,OAAO,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;AACtF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,GAA2C;IACzE,OAAO,GAAG,CAAC,OAAO,IAAI,EAAE,KAAK,EAAE,eAAe,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,CAAC,EAAE,CAAA;AACnF,CAAC"}

package/dist/permissions/rules.d.ts

@@ -1,7 +1,7 @@
 /**
  * Operator-authored tool permissions, compiled to the kernel's rule vocabulary.
  *
- * The kernel already has the engine — `VerificationRule[]` with an
+ * The kernel already has the engine — `AuthorizationRule[]` with an
  * allow/deny/review decision, evaluated first-match-wins. What was missing was
  * any way for a person to author those rules: the CLI passed `rules: []`, so a
  * gate with seven rule types ran with none of them and every decision fell back
@@ -10,7 +10,7 @@
  * The whole surface is pure: config in, rules out. The gate stays the only
  * thing that decides anything, which is what keeps this testable without a run.
  */
-import type { VerificationRule } from '@namzu/sdk';
+import type { AuthorizationRule } from '@namzu/sdk';
 /** What the operator wants to happen when a rule matches. */
 export type PermissionEffect = 'allow' | 'ask' | 'deny';
 export declare function isPermissionEffect(value: unknown): value is PermissionEffect;
@@ -30,7 +30,7 @@ export interface CompileDiagnostic {
     readonly message: string;
 }
 export interface CompiledPermissions {
-    readonly rules: readonly VerificationRule[];
+    readonly rules: readonly AuthorizationRule[];
     /**
      * What was wrong with the config, for the caller to print.
      *

package/dist/permissions/rules.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../../src/permissions/rules.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAElD,6DAA6D;AAC7D,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,KAAK,GAAG,MAAM,CAAA;AAIvD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,gBAAgB,CAE5E;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,cAAc,GAAG,gBAAgB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAA;AAE1F,MAAM,MAAM,iBAAiB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAA;AAExE,MAAM,WAAW,iBAAiB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,KAAK,EAAE,SAAS,gBAAgB,EAAE,CAAA;IAC3C;;;;;;;OAOG;IACH,QAAQ,CAAC,WAAW,EAAE,SAAS,iBAAiB,EAAE,CAAA;CAClD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAQ7D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AACH,wBAAgB,iBAAiB,CAChC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,QAAQ,GAAE,OAAO,GAAG,MAAe,GACjC,MAAM,CASR;AAMD,oEAAoE;AACpE,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAKtE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAU1D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,iBAAiB,GAAG,SAAS,GAAG,mBAAmB,CAgD7F"}
+{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../../src/permissions/rules.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAEnD,6DAA6D;AAC7D,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,KAAK,GAAG,MAAM,CAAA;AAIvD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,gBAAgB,CAE5E;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,cAAc,GAAG,gBAAgB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAA;AAE1F,MAAM,MAAM,iBAAiB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAA;AAExE,MAAM,WAAW,iBAAiB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,KAAK,EAAE,SAAS,iBAAiB,EAAE,CAAA;IAC5C;;;;;;;OAOG;IACH,QAAQ,CAAC,WAAW,EAAE,SAAS,iBAAiB,EAAE,CAAA;CAClD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAQ7D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AACH,wBAAgB,iBAAiB,CAChC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,QAAQ,GAAE,OAAO,GAAG,MAAe,GACjC,MAAM,CASR;AAMD,oEAAoE;AACpE,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAKtE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAU1D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,iBAAiB,GAAG,SAAS,GAAG,mBAAmB,CAgD7F"}

package/dist/permissions/rules.js

@@ -1,7 +1,7 @@
 /**
  * Operator-authored tool permissions, compiled to the kernel's rule vocabulary.
  *
- * The kernel already has the engine — `VerificationRule[]` with an
+ * The kernel already has the engine — `AuthorizationRule[]` with an
  * allow/deny/review decision, evaluated first-match-wins. What was missing was
  * any way for a person to author those rules: the CLI passed `rules: []`, so a
  * gate with seven rule types ran with none of them and every decision fell back

package/dist/permissions/rules.js.map

@@ -1 +1 @@
-{"version":3,"file":"rules.js","sourceRoot":"","sources":["../../src/permissions/rules.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAOH,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAA;AAEzD,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAChD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;AACvD,CAAC;AAiCD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACpD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAChD,MAAM,OAAO,GAAG,UAAU;SACxB,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC;SACpC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC;SACpB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;IACrB,MAAM,iBAAiB,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAA;IAC7F,OAAO,IAAI,iBAAiB,GAAG,CAAA;AAChC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AACH,MAAM,UAAU,iBAAiB,CAChC,IAAY,EACZ,OAAe,EACf,WAA6B,MAAM;IAEnC,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;IACnC,MAAM,OAAO,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAC3D,wEAAwE;IACxE,yEAAyE;IACzE,wEAAwE;IACxE,qEAAqE;IACrE,MAAM,aAAa,GAAG,QAAQ,KAAK,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,EAAE,CAAA;IAChF,OAAO,aAAa,CAAC,CAAC,CAAC,IAAI,QAAQ,OAAO,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,QAAQ,MAAM,OAAO,KAAK,CAAA;AACxF,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IAClC,OAAO,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAA;AACpD,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,cAAc,CAAC,KAAa,EAAE,OAAe;IAC5D,iEAAiE;IACjE,sDAAsD;IACtD,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAA;IACvD,OAAO,IAAI,MAAM,CAAC,qBAAqB,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAA;AAC3F,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,CAAS,EAAE,CAAS;IACjD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,CAAC,CAAA;IACpC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,CAAC,CAAC,CAAA;IACrC,MAAM,OAAO,GAAG,CAAC,CAAS,EAAU,EAAE;QACrC,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAC7B,OAAO,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAA;IACrC,CAAC,CAAA;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IACpC,IAAI,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAC3B,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AAClC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAqC;IACvE,MAAM,KAAK,GAAuB,EAAE,CAAA;IACpC,MAAM,WAAW,GAAwB,EAAE,CAAA;IAC3C,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAA;IAE1C,KAAK,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACzD,IAAI,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC;YACpC,IAAI,UAAU,KAAK,OAAO;gBAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,SAAS,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YACpF,IAAI,UAAU,KAAK,MAAM;gBAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YAClF,SAAQ;QACT,CAAC;QACD,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YAC3D,WAAW,CAAC,IAAI,CAAC;gBAChB,IAAI;gBACJ,OAAO,EAAE,gEAAgE,OAAO,UAAU,EAAE;aAC5F,CAAC,CAAA;YACF,SAAQ;QACT,CAAC;QACD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;YACnE,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,CAAA;YAClC,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;gBACjC,WAAW,CAAC,IAAI,CAAC;oBAChB,IAAI;oBACJ,OAAO;oBACP,OAAO,EAAE,0CAA0C,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE;iBAC3E,CAAC,CAAA;gBACF,SAAQ;YACT,CAAC;YACD,IAAI,MAAM,KAAK,KAAK;gBAAE,SAAQ;YAC9B,IAAI,CAAC;gBACJ,IAAI,MAAM,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,CAAA;YAC3C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACd,WAAW,CAAC,IAAI,CAAC;oBAChB,IAAI;oBACJ,OAAO;oBACP,OAAO,EAAE,0BAA0B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;iBACrF,CAAC,CAAA;gBACF,SAAQ;YACT,CAAC;YACD,KAAK,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,iBAAiB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC;gBACjD,MAAM,EAAE,MAAM;gBACd,QAAQ,EAAE,MAAM;aAChB,CAAC,CAAA;QACH,CAAC;IACF,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAA;AAC9B,CAAC"}
+{"version":3,"file":"rules.js","sourceRoot":"","sources":["../../src/permissions/rules.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAOH,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAA;AAEzD,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAChD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;AACvD,CAAC;AAiCD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACpD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAChD,MAAM,OAAO,GAAG,UAAU;SACxB,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC;SACpC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC;SACpB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;IACrB,MAAM,iBAAiB,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAA;IAC7F,OAAO,IAAI,iBAAiB,GAAG,CAAA;AAChC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AACH,MAAM,UAAU,iBAAiB,CAChC,IAAY,EACZ,OAAe,EACf,WAA6B,MAAM;IAEnC,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;IACnC,MAAM,OAAO,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAC3D,wEAAwE;IACxE,yEAAyE;IACzE,wEAAwE;IACxE,qEAAqE;IACrE,MAAM,aAAa,GAAG,QAAQ,KAAK,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,EAAE,CAAA;IAChF,OAAO,aAAa,CAAC,CAAC,CAAC,IAAI,QAAQ,OAAO,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,QAAQ,MAAM,OAAO,KAAK,CAAA;AACxF,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IAClC,OAAO,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAA;AACpD,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,cAAc,CAAC,KAAa,EAAE,OAAe;IAC5D,iEAAiE;IACjE,sDAAsD;IACtD,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAA;IACvD,OAAO,IAAI,MAAM,CAAC,qBAAqB,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAA;AAC3F,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,CAAS,EAAE,CAAS;IACjD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,CAAC,CAAA;IACpC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,CAAC,CAAC,CAAA;IACrC,MAAM,OAAO,GAAG,CAAC,CAAS,EAAU,EAAE;QACrC,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAC7B,OAAO,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAA;IACrC,CAAC,CAAA;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IACpC,IAAI,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAC3B,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AAClC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAqC;IACvE,MAAM,KAAK,GAAwB,EAAE,CAAA;IACrC,MAAM,WAAW,GAAwB,EAAE,CAAA;IAC3C,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAA;IAE1C,KAAK,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACzD,IAAI,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC;YACpC,IAAI,UAAU,KAAK,OAAO;gBAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,SAAS,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YACpF,IAAI,UAAU,KAAK,MAAM;gBAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YAClF,SAAQ;QACT,CAAC;QACD,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YAC3D,WAAW,CAAC,IAAI,CAAC;gBAChB,IAAI;gBACJ,OAAO,EAAE,gEAAgE,OAAO,UAAU,EAAE;aAC5F,CAAC,CAAA;YACF,SAAQ;QACT,CAAC;QACD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;YACnE,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,CAAA;YAClC,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;gBACjC,WAAW,CAAC,IAAI,CAAC;oBAChB,IAAI;oBACJ,OAAO;oBACP,OAAO,EAAE,0CAA0C,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE;iBAC3E,CAAC,CAAA;gBACF,SAAQ;YACT,CAAC;YACD,IAAI,MAAM,KAAK,KAAK;gBAAE,SAAQ;YAC9B,IAAI,CAAC;gBACJ,IAAI,MAAM,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,CAAA;YAC3C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACd,WAAW,CAAC,IAAI,CAAC;oBAChB,IAAI;oBACJ,OAAO;oBACP,OAAO,EAAE,0BAA0B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;iBACrF,CAAC,CAAA;gBACF,SAAQ;YACT,CAAC;YACD,KAAK,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,iBAAiB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC;gBACjD,MAAM,EAAE,MAAM;gBACd,QAAQ,EAAE,MAAM;aAChB,CAAC,CAAA;QACH,CAAC;IACF,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAA;AAC9B,CAAC"}

package/dist/skills/store.d.ts

@@ -48,7 +48,7 @@ interface ParsedSkill {
  * ## Absent frontmatter is fine; broken frontmatter is not
  *
  * These were the same case here and are not the same thing. A file with no
- * frontmatter is a documented, supported shape (`docs/cli/skills.md`): the body
+ * frontmatter is a documented, supported shape: the body
  * is the skill. A file that opens a fence and then fails to parse is an author
  * who tried to write metadata and got it wrong, and answering that with "no
  * metadata, carry on" put the broken YAML into the body — and from there

package/dist/skills/store.js

@@ -34,7 +34,7 @@ export function projectSkillsDir(cwd = process.cwd()) {
  * ## Absent frontmatter is fine; broken frontmatter is not
  *
  * These were the same case here and are not the same thing. A file with no
- * frontmatter is a documented, supported shape (`docs/cli/skills.md`): the body
+ * frontmatter is a documented, supported shape: the body
  * is the skill. A file that opens a fence and then fails to parse is an author
  * who tried to write metadata and got it wrong, and answering that with "no
  * metadata, carry on" put the broken YAML into the body — and from there

package/dist/tui/App.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"App.d.ts","sourceRoot":"","sources":["../../src/tui/App.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAmEH,OAAO,KAAK,EAAqB,UAAU,EAAE,MAAM,YAAY,CAAA;AAE/D,MAAM,WAAW,QAAQ;IACxB,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAA;CACxB;AAqCD,wBAAgB,GAAG,CAAC,EAAE,GAAG,EAAE,EAAE,QAAQ,2CAinDpC"}
+{"version":3,"file":"App.d.ts","sourceRoot":"","sources":["../../src/tui/App.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAmFH,OAAO,KAAK,EAAqB,UAAU,EAAE,MAAM,YAAY,CAAA;AAE/D,MAAM,WAAW,QAAQ;IACxB,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAA;CACxB;AAqCD,wBAAgB,GAAG,CAAC,EAAE,GAAG,EAAE,EAAE,QAAQ,2CAqsDpC"}

package/dist/tui/App.js

@@ -1,6 +1,19 @@
 import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
+/**
+ * TUI root. Composes the banner, transcript, composer, status bar, and
+ * the first-run provider picker overlay.
+ *
+ * Session lifecycle:
+ *   1. Mount → probeAgentSession() (readPreferences + discoverProviders).
+ *   2. If a v2 preferences file exists → createAgentSession(prefs, detected) → ready.
+ *   3. If preferences missing OR v1 (legacy) → show <Picker/>.
+ *      After picker submit, writePreferences + hydrate session.
+ *   4. If discovery returned zero providers → show <Picker/> in
+ *      empty-state mode (explains where to put credentials).
+ */
+import { DiskMessageFeedbackStore, HostCommandRegistry, kernelHostCommands, } from '@namzu/sdk';
 import { Box, Text, useApp, useInput } from 'ink';
-import { relative } from 'node:path';
+import { join, relative } from 'node:path';
 import { useCallback, useEffect, useRef, useState } from 'react';
 import { beginSubscriptionLogin, clearStoredSubscriptionCredential, credentialsPath, primaryProvider, readStoredSubscriptionCredential, writePreferences, } from '../integrations/providers/index.js';
 import { describeLoginOutcome, describeLoginStart, describeLogout } from './login-prompt.js';
@@ -26,7 +39,7 @@ import { appendMessages, listRecent, loadConversation, openSessions, startConver
 import { createAgentSession, probeAgentSession, } from './agent.js';
 import { ResumePicker } from './ResumePicker.js';
 import { discoverUserCommands } from '../user-commands/store.js';
-import { SLASH_COMMANDS, runSlash } from './slashCommands.js';
+import { hostCommandNames, kernelCommandDescriptors, mergeHostCommands, renderOutcome, runSlash, } from './slashCommands.js';
 import { splitCompleteBlocks } from './stream-blocks.js';
 import { theme } from './theme.js';
 /**
@@ -41,6 +54,14 @@ import { theme } from './theme.js';
 const LIVE_FURNITURE_ROWS = 10;
 export function App({ ctx }) {
     const { exit } = useApp();
+    /**
+     * The last assistant message id the run reported, for `/feedback`.
+     *
+     * A ref rather than state: nothing renders it, and making it state would
+     * re-render the transcript on every delta — the exact cost the `pending`
+     * buffering two hundred lines down exists to avoid.
+     */
+    const lastAssistantMessage = useRef(null);
     const [messages, setMessages] = useState([]);
     const [history, setHistory] = useState([]);
     const [state, setState] = useState('idle');
@@ -253,7 +274,7 @@ export function App({ ctx }) {
             sessionsRef.current = sessions;
             scopeRef.current = {
                 sessionId,
-                threadId: sessions.threadId,
+                topicId: sessions.topicId,
                 projectId: sessions.projectId,
                 tenantId: sessions.tenantId,
             };
@@ -270,6 +291,7 @@ export function App({ ctx }) {
             cwd: ctx.cwd,
             rules: ctx.rules,
             ...(ctx.mcpServers ? { mcpServers: ctx.mcpServers } : {}),
+            ...(ctx.sandbox ? { sandbox: ctx.sandbox } : {}),
         });
         // Re-hydration (a provider switch via /model) builds a second session;
         // without this the first one's tool-server child processes stay alive
@@ -282,7 +304,7 @@ export function App({ ctx }) {
             // Builtins are reserved: a `help.md` must not take over `/help`.
             // Passing the names here is what lets the loader tell its author
             // the file is shadowed instead of leaving it silently unused.
-            reserved: SLASH_COMMANDS.map((c) => c.name),
+            reserved: hostCommandNames(),
         }));
         setCurrentProvider(primaryProvider(prefs).id);
         if (s.hasProvider) {
@@ -546,7 +568,15 @@ export function App({ ctx }) {
             liveRows: LIVE_FURNITURE_ROWS + window.rows,
         })
         : 0;
+    // One merged vocabulary for the session: this host's own commands plus
+    // whatever the kernel's registry reports. Built here so `/help`, the
+    // autocomplete and the dispatcher all answer from the same list — three
+    // places that used to read one hardcoded array and would otherwise
+    // disagree the moment a capability added a command.
+    const hostCommands = mergeHostCommands(kernelCommandDescriptors());
     const slashCtx = {
+        builtins: hostCommands,
+        lastAssistantMessageId: () => lastAssistantMessage.current?.messageId ?? null,
         // Called when `/tools` renders, not read here — the same shape, and the
         // same reason, as `neverPrompted` below.
         availableTools: () => session?.toolNames() ?? [],
@@ -572,7 +602,6 @@ export function App({ ctx }) {
             approvalLatched: () => session?.approvalLatched() ?? false,
             neverPrompted: () => session?.promptExemptTools() ?? [],
         },
-        agentIds: session?.agentIds ?? [],
         instructionFiles: session?.instructionFiles ?? [],
         userCommands,
     };
@@ -757,6 +786,9 @@ export function App({ ctx }) {
         switch (event.kind) {
             case 'delta': {
                 setState('thinking');
+                if (event.messageId && event.runId) {
+                    lastAssistantMessage.current = { runId: event.runId, messageId: event.messageId };
+                }
                 st.text += event.text;
                 // Held, not appended. Appending each delta is what produced text
                 // that types itself out — nothing animates it, but a few
@@ -988,7 +1020,7 @@ export function App({ ctx }) {
         // including the queue — so a command-driven turn is not a second way
         // to run one.
         let outgoing = value;
-        const slash = runSlash(value, slashCtx);
+        const slash = runSlash(value, slashCtx, hostCommands);
         if (slash) {
             switch (slash.kind) {
                 case 'message':
@@ -1166,6 +1198,61 @@ export function App({ ctx }) {
                     break;
                 case 'none':
                     return;
+                case 'host-command': {
+                    // Dispatched through the kernel's registry, built with what
+                    // THIS session can answer from. The descriptors used for
+                    // the merge above carry no store — they are names — so the
+                    // registry is rebuilt here with the live one.
+                    const registry = new HostCommandRegistry();
+                    registry.register(kernelHostCommands({ allowedAgentIds: session?.agentIds ?? [] }));
+                    void (async () => {
+                        const outcome = await registry.dispatch(`/${slash.name} ${slash.args.join(' ')}`.trim());
+                        pushMessage('system', outcome
+                            ? renderOutcome(outcome)
+                            : `/${slash.name} is registered but this session cannot run it.`);
+                    })();
+                    return;
+                }
+                case 'feedback': {
+                    const target = lastAssistantMessage.current;
+                    // Written under the same `<cwd>/.namzu` root the runs live
+                    // in, so a rating and the transcript it judges are one
+                    // directory apart and travel together.
+                    if (!target) {
+                        pushMessage('system', 'Nothing to rate yet.');
+                        return;
+                    }
+                    const store = new DiskMessageFeedbackStore({
+                        rootDir: join(ctx.cwd, '.namzu', 'feedback'),
+                        runsDir: join(ctx.cwd, '.namzu', 'runs'),
+                    });
+                    const runId = target.runId;
+                    const messageId = slash.messageId;
+                    // Fire-and-forget: this switch is synchronous, and the
+                    // transcript reports the outcome either way rather than
+                    // blocking a keystroke on a disk write.
+                    void (async () => {
+                        try {
+                            // A first rating expects nothing; a second replaces the
+                            // first, which is what a rater changing their mind does.
+                            // Read-then-write rather than blind overwrite, so two
+                            // raters on one message still collide loudly.
+                            const current = (await store.listMessageFeedback({ runId })).find((r) => r.messageId === messageId);
+                            const record = await store.putMessageFeedback({
+                                runId,
+                                messageId,
+                                rating: slash.rating,
+                                ...(slash.note ? { note: slash.note } : {}),
+                                expectedVersion: current?.ownerVersion ?? 0,
+                            });
+                            pushMessage('system', `Recorded ${record.rating} for ${record.messageId}.`);
+                        }
+                        catch (err) {
+                            pushMessage('system', `Could not record feedback: ${err instanceof Error ? err.message : String(err)}`);
+                        }
+                    })();
+                    return;
+                }
                 default: {
                     // Exhaustive on purpose. Without it a `SlashAction` kind added
                     // and not handled here falls out of the switch into the send