@namzu/cli 17.0.1 → 18.1.0

package/dist/tui/agent.js

@@ -20,21 +20,25 @@
  * `emptySession()` whose `send()` yields a single error event so the UI
  * renders an actionable hint rather than crashing.
  */
-import { BOOT_EVENT_NAMES, DefaultPathBuilder, DiskMemoryStore, DiskTaskStore, EVENT_NAME_ATTRIBUTE, ProviderRegistry, SESSION_GOAL_TOOL_NAMES, SearchToolsTool, ToolRegistry, asProjectId, asRunId, asSessionId, asTenantId, asTopicId, buildMemoryTools, buildSessionGoalTools, compactNow, createComputerUseTool, createMemoryPromoter, createToolPresenter, generateRunId, getBuiltinTools, isTrustedReadOnly, query, resumeRun, withProviderFallback, } from '@namzu/sdk';
+import { BOOT_EVENT_NAMES, DefaultPathBuilder, DiskMemoryStore, DiskTaskStore, EVENT_NAME_ATTRIBUTE, GuardedFetchProvider, PromptContributionRegistry, ProviderRegistry, SESSION_GOAL_TOOL_NAMES, SearchToolsTool, ToolRegistry, WebFetchTool, asProjectId, asRunId, asSessionId, asTenantId, asTopicId, buildCoordinatorTools, buildMemoryTools, buildSessionGoalTools, compactNow, createComputerUseTool, createMemoryPromoter, createToolPresenter, generateRunId, getBuiltinTools, isTrustedReadOnly, query, resumeRun, webGuidanceContribution, withProviderFallback, } from '@namzu/sdk';
 import { SubprocessComputerUseHost } from '@namzu/computer-use';
 import { realpath, stat } from 'node:fs/promises';
 import { join, parse, resolve } from 'node:path';
 import { probeCapabilities } from '../context/capabilities.js';
+import { NAMZU_DELEGATION_DOCTRINE, NAMZU_PLAN_MODE_DOCTRINE, NAMZU_WORKING_DOCTRINE, } from '../context/doctrine.js';
 import { composeEnvironmentPrompt, readEnvironmentFacts } from '../context/environment.js';
 import { ProjectInstructionTracker } from '../context/project-tracker.js';
 import { resolveSandbox, sandboxResolvedSeverity, } from '../context/sandbox.js';
+import { composeTurnSnapshot, readTurnSnapshot } from '../context/turn-snapshot.js';
 import { connectMcpServers, } from '../integrations/mcp/servers.js';
 import { createCliPluginRuntime } from '../integrations/plugins/runtime.js';
 import { CredentialRefreshRejectedError, CredentialWithdrawnError, PROVIDER_REGISTRY, chainCapabilityDisagreements, chainPositionName, describeAcceptedMismatch, describeCapabilityRefusal, discoverProviders, ensureFreshAnthropicToken, ensureFreshStoredCodexCredential, ensureRegistered, findDetected, isAnthropicOAuthToken, isRegistered, missingCredentialMessage, primaryProvider, readCodexCredentialFile, readPreferences, readSubscriptionCredential, resolveChainCapabilities, sameOAuthCredential, unresolvedMembers, unsupportedProviderMessage, } from '../integrations/providers/index.js';
 import { ensurePrivateStateDirectory } from '../integrations/state/private-directory.js';
+import { CLI_INTERACTIVE_RUN_TIMEOUT_MS } from '../integrations/subagents/policy.js';
 import { createSubagentRuntime } from '../integrations/subagents/runtime.js';
 import { cliLogger } from '../logging.js';
 import { composeMemoryPrompt, readMemory } from '../memory/store.js';
+import { ACCEPT_EDITS_TOOLS, PLAN_MODE_REFUSAL } from '../permissions/mode.js';
 import { projectRunConversation } from './conversation-history.js';
 /**
  * Let one caller stop waiting without cutting a shared queue in the middle.
@@ -788,6 +792,15 @@ export async function createAgentSession(prefs, detected, options = {}) {
     // This session passes a `taskStore` to query() below, which registers the
     // task tools deferred — so `search_tools` has something to find here.
     registry.register([SearchToolsTool]);
+    // Web reach, opted into in the config file and nowhere else. The parent's
+    // registry only: a child's config carries no provider, and a tool whose
+    // provider is missing is a tool that reports itself unwired — truthful,
+    // and noise. The guarded provider refuses private and loopback addresses
+    // and bounds redirects and body; every fetch is reviewed like a shell
+    // command (see `isPromptExempt`).
+    const webCapability = options.web?.fetch ? { fetch: new GuardedFetchProvider() } : undefined;
+    if (webCapability)
+        registry.register(WebFetchTool);
     // Native sub-agents: register the canonical `Agent` tool so the model can
     // delegate a self-contained task to a fresh sub-agent (own context window).
     // Best-effort — if the runtime can't stand up, the chat still works.
@@ -863,14 +876,62 @@ export async function createAgentSession(prefs, detected, options = {}) {
         // and got none had nothing on stderr to say why.
         cliLogger().warn('sub-agent runtime unavailable this session', exceptionAttributes(err));
     }
-    // Task store → query registers task_create / task_update / task_list as
-    // DEFERRED tools and emits task_created/task_updated, so the agent can track
-    // a plan for the current request. Tasks are run-scoped.
+    // `ask_user_question`, where somebody can answer. The SDK tool parks the
+    // run through the handler it was BUILT with, so that handler reads the
+    // turn's answerer through a holder the prelude fills: the tool is per
+    // session, the person answering is per turn. Needs the delegation
+    // gateway the tool builder requires; a session without one has no
+    // question tool either, and says nothing — it also has no `Agent`.
+    let currentOnQuestion;
+    if (options.askUser && subagentGateway) {
+        const parkQuestion = async (request) => {
+            if (request.type !== 'user_question')
+                return { action: 'continue' };
+            const ask = currentOnQuestion;
+            if (!ask)
+                return { action: 'continue' };
+            const answer = await ask(request.question);
+            switch (answer.kind) {
+                case 'answer':
+                    return {
+                        action: 'answer_question',
+                        selectedOptionIds: [...answer.selectedOptionIds],
+                        ...(answer.freeText !== undefined ? { freeText: answer.freeText } : {}),
+                        questionId: request.question.questionId,
+                    };
+                case 'abort':
+                    return { action: 'abort', reason: 'The user declined to answer.' };
+                default:
+                    return { action: 'continue' };
+            }
+        };
+        const askTool = buildCoordinatorTools({
+            gateway: subagentGateway,
+            workingDirectory: cwd,
+            allowedAgentIds: [],
+            allowDelegation: false,
+            resumeHandler: parkQuestion,
+            // The builder stamps this on the park request. The handler above
+            // routes by the question, not by the run, and no durable park
+            // recorder is supplied, so a session-scoped id is what is true: the
+            // tool is built once per session and the turn is not known yet.
+            runId: asRunId('run_namzu-interactive-question'),
+        }).find((tool) => tool.name === 'ask_user_question');
+        if (askTool)
+            registry.register(askTool);
+    }
+    // Task store → query registers task_create / task_update / task_list and
+    // emits task_created/task_updated, so the agent can track a plan for the
+    // current request. Tasks are run-scoped. The kernel's default availability
+    // for them is `deferred`; this session overrides that to `active` at the
+    // query call, because the doctrine tells the model to plan with them and a
+    // tool it must search for first is a tool it skips.
     //
-    // "Deferred" is why this session mounts `search_tools` above: these three are
-    // the roster it searches. They are registered inside query(), after this
-    // function returns, which is why the connect line reports no count of them —
-    // counting here would mean restating query's registration order in the CLI.
+    // `search_tools` stays mounted above even so: a tool server or plugin can
+    // still register a deferred roster, and that is what the search is for. The
+    // task tools are registered inside query(), after this function returns,
+    // which is why the connect line reports no count of them — counting here
+    // would mean restating query's registration order in the CLI.
     //
     // It is also why `toolNames` below reads the registry rather than a list
     // captured on this line. The count at connect time is unchanged; what
@@ -1061,8 +1122,44 @@ export async function createAgentSession(prefs, detected, options = {}) {
                     ? await currentPluginSkills(pluginRuntime.skills)
                     : undefined;
                 const memoryPrompt = composeMemoryPrompt(readMemory());
-                const environmentPrompt = composeEnvironmentPrompt(await readEnvironmentFacts(cwd));
-                const systemPrompt = [NAMZU_IDENTITY, environmentPrompt, memoryPrompt, opts?.extraSystem]
+                currentOnQuestion = opts?.onQuestion;
+                const [environmentFacts, turnSnapshot] = await Promise.all([
+                    readEnvironmentFacts(cwd),
+                    readTurnSnapshot(cwd),
+                ]);
+                const environmentPrompt = composeEnvironmentPrompt(environmentFacts);
+                // The repository as it stood when THIS turn began, through the
+                // SDK's `turn` placement — the ephemeral trailing message that is
+                // never cached and never enters history. FIRST iteration only:
+                // later iterations work from state the model itself changed, and
+                // `git status` is the honest source for that. A registry per
+                // turn, closed over this turn's snapshot, rather than one
+                // session-scoped holder every send overwrites: two overlapping
+                // sends would otherwise both render whichever ran second.
+                const turnSnapshotPrompt = turnSnapshot ? composeTurnSnapshot(turnSnapshot) : null;
+                const promptContributions = new PromptContributionRegistry();
+                promptContributions.register({
+                    id: 'namzu.turn-snapshot',
+                    placement: 'turn',
+                    render: ({ iteration }) => (iteration === 1 ? turnSnapshotPrompt : null),
+                });
+                // The citation rules that come with the web tools, only when the
+                // tools are there: guidance about a capability the turn does not
+                // have reads as a capability it should be looking for.
+                if (webCapability)
+                    promptContributions.register(webGuidanceContribution);
+                const systemPrompt = [
+                    NAMZU_IDENTITY,
+                    NAMZU_WORKING_DOCTRINE,
+                    NAMZU_DELEGATION_DOCTRINE,
+                    // Present only while the turn runs under `plan`. A mode change
+                    // is rare, so the cached prefix it re-keys is a price paid once
+                    // per switch rather than once per turn.
+                    opts?.permissionMode === 'plan' ? NAMZU_PLAN_MODE_DOCTRINE : undefined,
+                    environmentPrompt,
+                    memoryPrompt,
+                    opts?.extraSystem,
+                ]
                     .filter((s) => Boolean(s))
                     .join('\n\n') || undefined;
                 let capturedAuthority;
@@ -1122,6 +1219,16 @@ export async function createAgentSession(prefs, detected, options = {}) {
                         opts: turnOpts,
                         resumeHandler,
                         taskGateway: subagentGateway,
+                        promptContributions,
+                        ...(webCapability ? { web: webCapability } : {}),
+                        // Active, not deferred: the doctrine tells the model to open a
+                        // task list for multi-step work, and a tool it has to search
+                        // for first is a tool it will skip.
+                        runtimeToolOverrides: {
+                            task_create: 'active',
+                            task_update: 'active',
+                            task_list: 'active',
+                        },
                         onRunEvent: options.onRunEvent,
                         ...(sandbox.provider ? { sandboxProvider: sandbox.provider } : {}),
                         ...(options.sandbox?.teardownTimeoutMs !== undefined
@@ -1156,7 +1263,13 @@ export async function createAgentSession(prefs, detected, options = {}) {
                 : undefined;
             const memoryPrompt = composeMemoryPrompt(readMemory());
             const environmentPrompt = composeEnvironmentPrompt(await readEnvironmentFacts(cwd));
-            const systemPrompt = [NAMZU_IDENTITY, environmentPrompt, memoryPrompt]
+            const systemPrompt = [
+                NAMZU_IDENTITY,
+                NAMZU_WORKING_DOCTRINE,
+                NAMZU_DELEGATION_DOCTRINE,
+                environmentPrompt,
+                memoryPrompt,
+            ]
                 .filter((s) => Boolean(s))
                 .join('\n\n') || undefined;
             const resumeHandler = makeResumeHandler(approval, undefined, options.permissionMode, (name, input) => isPromptExempt(registry, name, input));
@@ -1173,6 +1286,15 @@ export async function createAgentSession(prefs, detected, options = {}) {
                     skillRegistry: pluginRuntime?.skills,
                     skills: pluginSkills,
                     taskStore,
+                    // The same availability the original run registered under.
+                    // A resumed run re-registers the task tools; leaving them at
+                    // the kernel's `deferred` default would hand the model a plan
+                    // it started with active tools and can no longer update.
+                    runtimeToolOverrides: {
+                        task_create: 'active',
+                        task_update: 'active',
+                        task_list: 'active',
+                    },
                     ...(subagentGateway ? { taskGateway: subagentGateway } : {}),
                     authorizationGate: gateFor(options.rules),
                     compactionConfig: COMPACTION_CONFIG,
@@ -1190,7 +1312,7 @@ export async function createAgentSession(prefs, detected, options = {}) {
                     runConfig: {
                         model,
                         ...(sandbox.provider ? { sandbox: { workspace: sandboxWorkspace } } : {}),
-                        timeoutMs: 600_000,
+                        timeoutMs: CLI_INTERACTIVE_RUN_TIMEOUT_MS,
                         tokenBudget: 1_000_000,
                         maxIterations: 50,
                         maxResponseTokens: 8192,
@@ -1587,7 +1709,7 @@ const COMPACTION_CONFIG = {
     maxCharsPerRequirement: 300,
     maxCharsPerTask: 400,
 };
-async function* runTurn({ provider, fallbackProviders, model, tools, pluginManager, skillRegistry, skills, scope, pathBuilder, workingDirectory, sandboxWorkspace, rules, reviewAnswer, maxAnswerReviews, promoteMemory, resumeHandler, taskStore, systemPrompt, messages, projectInstructionContext, opts, taskGateway, sandboxProvider, sandboxTeardownTimeoutMs, onRunEvent, }) {
+async function* runTurn({ provider, fallbackProviders, model, tools, pluginManager, skillRegistry, skills, scope, pathBuilder, workingDirectory, sandboxWorkspace, rules, reviewAnswer, maxAnswerReviews, promoteMemory, resumeHandler, taskStore, systemPrompt, messages, projectInstructionContext, opts, taskGateway, promptContributions, runtimeToolOverrides, web, sandboxProvider, sandboxTeardownTimeoutMs, onRunEvent, }) {
     const signal = opts?.signal;
     // One presenter for the whole stream, built from the registry this scope
     // already holds. Its absence HERE is what forced presentation to be name
@@ -1629,7 +1751,7 @@ async function* runTurn({ provider, fallbackProviders, model, tools, pluginManag
                 model,
                 ...(sandboxProvider ? { sandbox: { workspace: sandboxWorkspace } } : {}),
                 ...(opts?.effort !== undefined ? { effort: opts.effort } : {}),
-                timeoutMs: 600_000,
+                timeoutMs: CLI_INTERACTIVE_RUN_TIMEOUT_MS,
                 tokenBudget: 1_000_000,
                 maxIterations: 50,
                 maxResponseTokens: 8192,
@@ -1656,6 +1778,9 @@ async function* runTurn({ provider, fallbackProviders, model, tools, pluginManag
             // tools `query()` registers deferred below and any tool server that
             // connected after this session was built.
             resumeHandler,
+            ...(promptContributions ? { promptContributions } : {}),
+            ...(runtimeToolOverrides ? { runtimeToolOverrides } : {}),
+            ...(web ? { web } : {}),
             signal,
             ...scope,
         });
@@ -1730,6 +1855,21 @@ exempt = () => false) {
         if (!batchNeedsPrompt(request.toolCalls, exempt)) {
             return { action: 'approve_tools' };
         }
+        // A batch of nothing but non-destructive file edits is the case this
+        // mode exists for. One bash call in the same batch and the whole batch
+        // asks — the operator reviews the batch as a unit, and a prompt that
+        // showed only the shell command while the edits went through beside it
+        // would be approving something it did not show.
+        if (mode === 'accept-edits' &&
+            request.toolCalls.every((tc) => !tc.isDestructive && (ACCEPT_EDITS_TOOLS.has(tc.name) || exempt(tc.name, tc.input)))) {
+            return { action: 'approve_tools' };
+        }
+        // Reads were already approved above (they are exempt). Anything that
+        // reached here would change something, and plan mode's answer to that
+        // is the same every time: not now, tell the user what you would do.
+        if (mode === 'plan') {
+            return { action: 'reject_tools', feedback: PLAN_MODE_REFUSAL };
+        }
         if (mode === 'strict') {
             return {
                 action: 'reject_tools',
@@ -1816,6 +1956,11 @@ export function isPromptExempt(registry, name, input) {
     if (PROMPT_EXEMPT_WRITES.has(name.toLowerCase()))
         return true;
     const tool = registry.get(name) ?? registry.get(name.toLowerCase());
+    // A fetch changes nothing here and declares itself read-only, and it is
+    // still a request leaving the machine to an address the model chose. The
+    // operator sees the URL before it goes, the way they see a shell command.
+    if (tool?.category === 'network')
+        return false;
     // A connected server's own claim about its own tool cannot skip the
     // prompt. Same predicate the kernel gate and plan mode use -- three
     // doors, one rule, because fixing two would close the issue and leave
@@ -1854,6 +1999,7 @@ export function toAgentEvent(event, presenter) {
         case 'tool_executing':
             return {
                 kind: 'tool-start',
+                runId: event.runId,
                 toolUseId: event.toolUseId,
                 toolName: event.toolName,
                 ...(() => {
@@ -1870,6 +2016,7 @@ export function toAgentEvent(event, presenter) {
         case 'tool_progress':
             return {
                 kind: 'tool-progress',
+                runId: event.runId,
                 toolUseId: event.toolUseId,
                 toolName: event.toolName,
                 message: event.message,
@@ -1885,6 +2032,7 @@ export function toAgentEvent(event, presenter) {
             const withoutRepeatedSummary = view.kind === 'terminal' && detail?.[0] === summary ? detail.slice(1) : detail;
             return {
                 kind: 'tool-end',
+                runId: event.runId,
                 toolUseId: event.toolUseId,
                 toolName: event.toolName,
                 isError: event.isError,
@@ -1959,13 +2107,16 @@ export function toAgentEvent(event, presenter) {
             };
         }
         case 'task_created':
-            return { kind: 'task', subject: event.subject, status: event.status };
         case 'task_updated':
-            // Only surface completions — skip pending/in-progress churn so the
-            // transcript shows "todo added" then "todo done", not every flip.
-            return event.status === 'completed'
-                ? { kind: 'task', subject: event.subject, status: event.status }
-                : null;
+            // Every change, not only completions: the live task list needs the
+            // in-progress flips to show which step is current. The transcript
+            // decides for itself which of these it records.
+            return {
+                kind: 'task',
+                taskId: String(event.taskId),
+                subject: event.subject,
+                status: event.status,
+            };
         case 'run_paused':
             // A pause is not an error and not an invisible end. The checkpoint and
             // classification are the recovery surface; dropping this event made a