@namzu/cli 28.1.0 → 29.0.0

package/dist/tui/agent.js

@@ -1,5 +1,6 @@
 import { createCurrentCredentialReader } from '../integrations/providers/current-credential.js';
 import { createWebSearchTool, resolveWebSearch, webSearchLabel, } from '../integrations/web/search.js';
+import { countListedResults, webActivityFromInput, webActivityKind, webCallTitle, } from './web-activity.js';
 /**
  * TUI agent session — provider-direct, tool-enabled.
  *
@@ -1021,6 +1022,10 @@ export async function createAgentSession(prefs, detected, options = {}) {
     // Agent tool. Keying the review channel by the executing turn keeps two
     // concurrent sends from borrowing each other's prompt or approval latch.
     const delegatedResumeHandlers = new Map();
+    // Beside each borrowed handler, the switch that sends it the batches it
+    // would otherwise never see (`reviewAllowedCalls`): without it a child's
+    // rule-allowed or already-approved call ran past a handler in plan mode.
+    const delegatedReviewAllowedCalls = new Map();
     const goalToolNames = new Set(SESSION_GOAL_TOOL_NAMES);
     if (options.sessionGoals) {
         registry.register(buildSessionGoalTools(options.sessionGoals, (turnId) => goalAuthorities.get(turnId)));
@@ -1211,6 +1216,7 @@ export async function createAgentSession(prefs, detected, options = {}) {
             },
             sandboxWorkspace,
             resolveResumeHandler: (turnId) => delegatedResumeHandlers.get(turnId),
+            resolveReviewAllowedCalls: (turnId) => delegatedReviewAllowedCalls.get(turnId),
             resolveWaitForInbound: (turnId) => delegatedInputWaiters.get(turnId),
             ...(sandbox.provider ? { sandboxProvider: sandbox.provider } : {}),
             ...(options.sandbox?.teardownTimeoutMs !== undefined
@@ -1647,7 +1653,7 @@ export async function createAgentSession(prefs, detected, options = {}) {
      * checkpoint cannot carry. `resumeDurable` and `resumePaused` differ only
      * in where the log and its lease come from.
      */
-    const kernelResume = ({ entry, sessionLog, checkpointStore, lease, signal, checkpointId, listener, }) => operations.promise(signal, async (ownedSignal) => {
+    const kernelResume = ({ entry, sessionLog, checkpointStore, lease, signal, checkpointId, listener, permissionMode, currentPermissionMode, }) => operations.promise(signal, async (ownedSignal) => {
         const selectTaskStore = beginTaskStoreReadout();
         // The turn's own limits, as its `turn_started` recorded them.
         const resumedLimits = (await readStoredTurnGuards(sessionLog, entry.turnId)) ?? resolveTurnGuards(options.limits);
@@ -1684,12 +1690,32 @@ export async function createAgentSession(prefs, detected, options = {}) {
         ]
             .filter((s) => Boolean(s))
             .join('\n\n') || undefined;
-        const resumeHandler = makeResumeHandler(approval, undefined, options.permissionMode, (name, input) => isPromptExempt(registry, name, input), { unattendedSandboxEscape });
         if (delegatedResumeHandlers.has(entry.turnId)) {
             throw new Error(`Turn ${entry.turnId} already owns a delegated review channel.`);
         }
+        // The resumed turn is decided under the caller's mode, else the
+        // session's, read at every decision exactly as a new turn's is: the
+        // interactive terminal creates its session without a mode and hands
+        // one to each turn, so the session's alone left a TUI `/resume` in
+        // plan mode under `auto`. Plan is stricter than the rules, so while it
+        // holds a batch a rule allows, or an approval earlier in the turn
+        // covers, still reaches the handler that refuses it — in this turn and
+        // in every turn it delegates. No prompt stands behind the handler:
+        // nobody answers a drainer's terminal, and `/resume` never asked.
+        const modeControl = createLiveModeControl({
+            initial: permissionMode ?? options.permissionMode ?? 'auto',
+            ...(currentPermissionMode ? { read: currentPermissionMode } : {}),
+            ...(recordedModes.has(String(entry.sessionId))
+                ? { recorded: recordedModes.get(String(entry.sessionId)) }
+                : {}),
+            handlerFor: (mode) => makeResumeHandler(approval, undefined, mode, reviewExemptionFor(mode, registry, (input) => subagentRuntime?.launchesReadOnlyAgent(input) === true), { unattendedSandboxEscape }),
+        });
+        const resumeHandler = modeControl.handler;
+        const reviewAllowedCalls = modeControl.reviewAllowedCalls;
+        liveModeControls.add(modeControl);
         const turnScope = { ...entry, topicId: scope.topicId };
         delegatedResumeHandlers.set(entry.turnId, resumeHandler);
+        delegatedReviewAllowedCalls.set(entry.turnId, reviewAllowedCalls);
         delegationScopes.set(entry.turnId, turnScope);
         delegationLimits.set(entry.turnId, resumedLimits);
         const turnTaskStore = selectTaskStore(turnScope);
@@ -1762,6 +1788,9 @@ export async function createAgentSession(prefs, detected, options = {}) {
                 // prompt would block the pass forever on a turn nobody is watching.
                 // The gate's deny rules still apply.
                 resumeHandler,
+                approvalPolicyName: modeControl.initialName,
+                onApprovalPolicy: (box) => modeControl.attach(box),
+                reviewAllowedCalls,
                 signal: ownedSignal,
                 // Attribution comes from the ENTRY, not from this session: the turn
                 // belongs to whoever started it, and stamping the drainer's ids onto
@@ -1797,8 +1826,11 @@ export async function createAgentSession(prefs, detected, options = {}) {
             });
         }
         finally {
+            liveModeControls.delete(modeControl);
+            recordedModes.set(String(entry.sessionId), modeControl.current());
             if (delegatedResumeHandlers.get(entry.turnId) === resumeHandler) {
                 delegatedResumeHandlers.delete(entry.turnId);
+                delegatedReviewAllowedCalls.delete(entry.turnId);
                 delegationScopes.delete(entry.turnId);
                 delegationLimits.delete(entry.turnId);
                 await subagentRuntime?.releaseTurn(entry.turnId);
@@ -1811,7 +1843,7 @@ export async function createAgentSession(prefs, detected, options = {}) {
      * headless caller renders a resumed turn exactly as it rendered the first
      * segment.
      */
-    const resumePausedStream = ({ turnId, checkpointId, signal, }) => {
+    const resumePausedStream = ({ turnId, checkpointId, signal, permissionMode, currentPermissionMode, }) => {
         const queue = [];
         let wake;
         let settled = false;
@@ -1829,6 +1861,8 @@ export async function createAgentSession(prefs, detected, options = {}) {
             sessionLog,
             ...(signal ? { signal } : {}),
             ...(checkpointId !== undefined ? { checkpointId: checkpointId } : {}),
+            ...(permissionMode ? { permissionMode } : {}),
+            ...(currentPermissionMode ? { currentPermissionMode } : {}),
             listener: (event) => {
                 queue.push(event);
                 wake?.();
@@ -2023,7 +2057,7 @@ export async function createAgentSession(prefs, detected, options = {}) {
                 ...(recordedModes.has(String(turnScope.sessionId))
                     ? { recorded: recordedModes.get(String(turnScope.sessionId)) }
                     : {}),
-                handlerFor: (mode) => makeResumeHandler(approval, opts?.onPermission, mode, (name, input) => isPromptExempt(runTools, name, input), { unattendedSandboxEscape }),
+                handlerFor: (mode) => makeResumeHandler(approval, opts?.onPermission, mode, reviewExemptionFor(mode, runTools, (input) => subagentRuntime?.launchesReadOnlyAgent(input) === true), { unattendedSandboxEscape }),
             });
             const resumeHandler = modeControl.handler;
             liveModeControls.add(modeControl);
@@ -2043,6 +2077,7 @@ export async function createAgentSession(prefs, detected, options = {}) {
                 }
                 claimed.add(turnId);
                 delegatedResumeHandlers.set(turnId, resumeHandler);
+                delegatedReviewAllowedCalls.set(turnId, modeControl.reviewAllowedCalls);
                 if (opts?.onModelSwitch)
                     modelSwitchHandlers.set(turnId, opts.onModelSwitch);
                 if (opts?.waitForInbound)
@@ -2331,6 +2366,7 @@ export async function createAgentSession(prefs, detected, options = {}) {
                     if (delegatedResumeHandlers.get(turnId) !== resumeHandler)
                         continue;
                     delegatedResumeHandlers.delete(turnId);
+                    delegatedReviewAllowedCalls.delete(turnId);
                     modelSwitchHandlers.delete(turnId);
                     delegatedInputWaiters.delete(turnId);
                     delegationScopes.delete(turnId);
@@ -2986,6 +3022,27 @@ export function makeResumeHandler(approval, onPermission, mode = onPermission ?
  * registry does not know.
  */
 export const isPromptExempt = isReviewExempt;
+/** The delegation tool whose read-only launches {@link reviewExemptionFor} lets through. */
+export const AGENT_LAUNCH_TOOL = 'Agent';
+/**
+ * What skips review under `mode`: the kernel's exemption, and — in every mode
+ * but `strict` — an `Agent` call that starts a read-only child on the
+ * session's own provider and model (`launchesReadOnlyAgent`).
+ *
+ * Starting such a child changes nothing by itself: its roster holds no tool
+ * that writes, and every call it makes is reviewed under this same mode as
+ * before. What the operator stops being asked is "may I start a reader?".
+ * A launch that is not read-only, or that picks another provider, model or
+ * effort, is asked about as before. `strict` still refuses it, since no rule
+ * allowed it; `plan` lets it start, since reading is what plan mode is for.
+ * An operator who wants every launch asked about writes
+ * `permissions: { Agent: "ask" }`: an `ask` rule is an explicit review, which
+ * no exemption skips.
+ */
+export function reviewExemptionFor(mode, registry, launchesReadOnlyAgent) {
+    return (name, input) => isPromptExempt(registry, name, input) ||
+        (mode !== 'strict' && name === AGENT_LAUNCH_TOOL && launchesReadOnlyAgent(input));
+}
 /** The exempt roster, sorted, for the surface that has to NAME it. */
 export function promptExemptToolNames(registry) {
     return registry
@@ -3009,12 +3066,23 @@ export function toAgentEvent(event, presenter) {
                 toolUseId: event.tool.id,
                 toolName: 'web_search',
             };
+            // A page action names an address rather than a query, and reads as
+            // a fetch; everything else is a search, named once the provider says.
+            const web = event.tool.url && !event.tool.query
+                ? { kind: 'fetch', target: event.tool.url, hosted: true }
+                : {
+                    kind: 'search',
+                    hosted: true,
+                    ...(event.tool.query ? { target: event.tool.query } : {}),
+                    ...(event.tool.results !== undefined ? { results: event.tool.results } : {}),
+                };
             return event.tool.status === 'running'
                 ? {
                     ...common,
                     kind: 'tool-start',
-                    summary: 'Web search',
+                    summary: webCallTitle(web),
                     standalone: true,
+                    web,
                 }
                 : {
                     ...common,
@@ -3022,6 +3090,7 @@ export function toAgentEvent(event, presenter) {
                     summary: event.tool.status === 'completed' ? '' : 'Provider-hosted search failed',
                     isError: event.tool.status !== 'completed',
                     output: event.tool.status,
+                    web,
                 };
         }
         case 'text_delta':
@@ -3061,6 +3130,10 @@ export function toAgentEvent(event, presenter) {
                             : {}),
                     };
                 })(),
+                ...(() => {
+                    const web = webActivityFromInput(event.toolName, event.input);
+                    return web ? { web } : {};
+                })(),
             };
         case 'tool_progress':
             return {
@@ -3098,6 +3171,13 @@ export function toAgentEvent(event, presenter) {
                 ...(withoutRepeatedSummary && withoutRepeatedSummary.length > 0
                     ? { detail: withoutRepeatedSummary }
                     : {}),
+                ...(() => {
+                    const kind = webActivityKind(event.toolName);
+                    if (!kind)
+                        return {};
+                    const results = kind === 'search' && !event.isError ? countListedResults(event.result) : undefined;
+                    return { web: { kind, ...(results !== undefined ? { results } : {}) } };
+                })(),
             };
         }
         case 'token_usage_updated':
@@ -3113,6 +3193,7 @@ export function toAgentEvent(event, presenter) {
                 sessionId: event.sessionId,
                 ...(event.turnId ? { turnId: event.turnId } : {}),
                 totalTokens: event.usage.totalTokens,
+                outputTokens: event.usage.completionTokens,
                 ...(event.budget ? { budget: event.budget } : {}),
                 cost: event.cost,
                 ...(event.contextTokens !== undefined ? { contextTokens: event.contextTokens } : {}),