@nathapp/nax-agent 0.3.1 → 0.84.0

package/dist/sandbox/session-tmp.js

@@ -12,9 +12,11 @@
  * The parent is `/tmp/nax`, one shared directory that is easier to find and
  * list than a flat `/tmp/nax-<runId>`. It is shared, so it cannot be created
  * once and trusted: a `/tmp/nax` made by one OS user is not writable by
- * another. The parent is therefore re-resolved on EVERY call from three host
- * facts the `_sessionTmpDeps` seam exposes, with no cache, and anything nax
- * cannot vouch for falls back to a per-user `/tmp/nax-<uid>`.
+ * another. The parent is therefore re-resolved on EVERY call from four host
+ * facts the `_sessionTmpDeps` seam exposes — including the uid that owns it,
+ * because a world-writable directory another user created is still theirs to
+ * plant symlinks in — with no cache, and anything nax cannot vouch for falls
+ * back to a per-user `/tmp/nax-<uid>`.
  *
  * The root is the literal `/tmp` (not `os.tmpdir()`): callers record and assert
  * this machine-stable location, and the OS inherits the rest.
@@ -38,16 +40,20 @@ export const _sessionTmpDeps = {
     uid: () => process.getuid?.() ?? 0,
 };
 /**
- * True when `/tmp/nax` is a real directory the current user can write and
- * search. Absence is NOT this case: an absent parent is a usable shared parent
- * (the launcher creates it), and every other failure means the path is there in
- * a shape nax cannot vouch for.
+ * True when `/tmp/nax` is a real directory the current user OWNS and can write
+ * and search. Absence is NOT this case: an absent parent is a usable shared
+ * parent (the launcher creates it), and every other failure means the path is
+ * there in a shape nax cannot vouch for.
  */
 function isUsableSharedParent() {
     try {
         const stats = _sessionTmpDeps.lstat(SHARED_TMP_PARENT);
         if (!stats.isDirectory() || stats.isSymbolicLink())
             return false;
+        // Writability is not trust: a 0777 /tmp/nax another user created lets that user
+        // pre-create the run directories or read what sandboxed commands write there.
+        if (stats.uid !== _sessionTmpDeps.uid())
+            return false;
     }
     catch (err) {
         // ENOENT is the one failure that means "create /tmp/nax".

package/dist/session/agent-session-types.d.ts

@@ -117,6 +117,8 @@ export type SessionEventBody = {
     readonly command?: string;
     readonly reason: string;
     readonly expiresAt: string;
+    /** `false`: decided already (by the profile); informational. Absent: a person's answer is awaited. */
+    readonly answerable?: false;
 } | {
     readonly type: "approval_resolved";
     readonly requestId: string;
@@ -127,6 +129,8 @@ export type SessionEventBody = {
     readonly requestId: string;
     readonly text: string;
     readonly expiresAt: string;
+    /** `false`: informational (`noteQuestion`); `answer()` on it does nothing. Absent: an answer is awaited. */
+    readonly answerable?: false;
 } | {
     readonly type: "usage";
     readonly round: number;

package/dist/session/native-backend-options.d.ts

@@ -5,12 +5,16 @@ import type { LoopHandlerSet } from "#src/native/session/loop-events/types";
 import type { AgentSessionHostPorts, AgentSessionProfile } from "./agent-session-types.ts";
 export interface NativeBackendOptions {
     readonly model: string;
+    /** Repository instruction basename; defaults to AGENTS.md. */
+    readonly instructionFileName?: string;
     readonly credentials?: CredentialSource;
     readonly catalogOverrides?: NativeCatalogOverrides;
     readonly loopHandlers?: LoopHandlerSet;
     readonly hostPorts?: AgentSessionHostPorts;
     readonly bashApproval?: BashApprovalMode;
     readonly allowUnsandboxed?: boolean;
+    /** Keep a resumed or continued conversation when the model differs (ACP server model switch, S5-3). */
+    readonly carryHistoryAcrossModels?: boolean;
 }
 export interface ResolvedNativeOptions {
     /** The caller's object, unchanged. */

package/dist/session/native-backend-options.js

@@ -6,6 +6,7 @@
  */
 import { z } from "zod";
 import { parseNativeModel } from "#src/native/models";
+import { isInstructionFileName } from "#src/native/session/instruction-file-name";
 import { AgentSessionError } from "./agent-session-errors.js";
 function isRecord(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -16,6 +17,10 @@ function hasMethods(names) {
 const isStringArray = (value) => Array.isArray(value) && value.every((item) => typeof item === "string");
 const OptionsSchema = z.strictObject({
     model: z.string().min(1),
+    instructionFileName: z
+        .string()
+        .refine(isInstructionFileName, "must be a nonhidden Markdown basename without path separators, colon or control characters")
+        .optional(),
     credentials: z
         .custom((value) => isRecord(value) && (value.kind === "memory" || value.kind === "exec"), "must be a memory or exec source")
         .optional(),
@@ -31,6 +36,7 @@ const OptionsSchema = z.strictObject({
         .optional(),
     bashApproval: z.enum(["raw", "gated", "escalate"]).optional(),
     allowUnsandboxed: z.boolean().optional(),
+    carryHistoryAcrossModels: z.boolean().optional(),
 });
 function invalid(message, context = {}) {
     return new AgentSessionError(`Invalid agent session options: ${message}`, "AGENT_SESSION_INVALID_OPTIONS", context);

package/dist/session/native-backend.js

@@ -15,7 +15,10 @@ import { createSessionInteractionHandler, embedderToolDescriptor } from "./sessi
 import { buildSessionToolSupport, defaultProtectedPaths, resolveSessionLauncher } from "./session-tool-support.js";
 export const NATIVE_BACKEND_KIND = "native";
 /** nax's agent.native.transportRetry default (S3 spec 5.3). */
-const SESSION_TRANSPORT_RETRY = { maxAttempts: 3, baseDelayMs: 2000 };
+const SESSION_TRANSPORT_RETRY = {
+    maxAttempts: 3,
+    baseDelayMs: 2000,
+};
 function createAdapter(raw) {
     const overrides = raw.catalogOverrides ?? [];
     const owns = overrides.length > 0 || raw.credentials !== undefined;
@@ -32,10 +35,13 @@ function checkResumeModel(doc, sessionId, model) {
 }
 async function openNative(resolved, ctx) {
     const raw = resolved.raw;
-    if (ctx.resume !== undefined)
+    if (ctx.resume !== undefined && raw.carryHistoryAcrossModels !== true)
         checkResumeModel(ctx.resume.doc, ctx.sessionId, raw.model);
     const { bashApproval, allowUnsandboxed } = nativeProfileRules(ctx.profile, raw);
-    const protectedPaths = { ...defaultProtectedPaths(raw.credentials !== undefined), ...raw.hostPorts?.protectedPaths };
+    const protectedPaths = {
+        ...defaultProtectedPaths(raw.credentials !== undefined),
+        ...raw.hostPorts?.protectedPaths,
+    };
     const launcher = await resolveSessionLauncher({
         profile: ctx.profile,
         root: ctx.workdir,
@@ -68,6 +74,8 @@ async function openNative(resolved, ctx) {
     const handle = await adapter.openSession(ctx.sessionId, {
         agentName: NATIVE_AGENT,
         workdir: ctx.workdir,
+        instructionProtectedPaths: protectedPaths,
+        instructionFileName: raw.instructionFileName,
         resolvedPermissions: { mode: "default", toolGrants: grants, bashApproval },
         modelDef: { provider: resolved.provider, model: raw.model },
         timeoutSeconds: ctx.turnTimeoutSeconds,
@@ -76,6 +84,7 @@ async function openNative(resolved, ctx) {
         resume: ctx.resume !== undefined,
         spinBreaker: DEFAULT_SPIN_BREAKER_SETTINGS,
         transportRetry: SESSION_TRANSPORT_RETRY,
+        ...(raw.carryHistoryAcrossModels === true ? { carryHistoryAcrossModels: true } : {}),
         ...(ctx.instructions !== undefined && ctx.instructions !== "" ? { systemPrompt: ctx.instructions } : {}),
     });
     const codingTools = [...support.tools, ...ctx.tools.map(embedderToolDescriptor)];
@@ -102,5 +111,8 @@ async function openNative(resolved, ctx) {
 }
 export function nativeBackend(options) {
     const resolved = parseNativeBackendOptions(options);
-    return { kind: NATIVE_BACKEND_KIND, open: (ctx) => openNative(resolved, ctx) };
+    return {
+        kind: NATIVE_BACKEND_KIND,
+        open: (ctx) => openNative(resolved, ctx),
+    };
 }

package/dist/session/session-ask-port.js

@@ -41,6 +41,7 @@ export function createSessionAskPort(deps) {
                 summary: req.summary,
                 reason: req.reason,
                 expiresAt: now(),
+                answerable: false,
             });
             deps.emit({ type: "approval_resolved", requestId, decision, decidedBy: "profile" });
         },
@@ -58,7 +59,7 @@ export function createSessionAskPort(deps) {
             if (deps.turn() === undefined)
                 return;
             const { requestId } = deps.table.issue("question", ALREADY_ABORTED);
-            deps.emit({ type: "question", requestId, text, expiresAt: now() });
+            deps.emit({ type: "question", requestId, text, expiresAt: now(), answerable: false });
         },
     };
 }

package/dist/session/session-interaction.js

@@ -72,10 +72,29 @@ function runSafely(tool, input, ctx) {
         return { content: `Tool "${tool.name}" failed: ${cause}`, isError: true };
     });
 }
+/**
+ * Settle with `work`, or with `onAbort()` the moment `signal` aborts. The tool
+ * batch awaits interaction handlers with no abort race of its own, so a tool
+ * that ignores its signal would otherwise hang the turn (and `close()`, which
+ * awaits the turn). The abandoned work's late settlement is ignored.
+ */
+async function raceAbort(work, signal, onAbort) {
+    let listener = () => { };
+    const aborted = new Promise((resolve) => {
+        listener = () => resolve(onAbort());
+        signal.addEventListener("abort", listener, { once: true });
+    });
+    try {
+        return await Promise.race([work, aborted]);
+    }
+    finally {
+        signal.removeEventListener("abort", listener);
+    }
+}
 /**
  * Runs the tool, but answers at once when the turn aborts: the batch awaits
  * this handler with no abort race of its own, so a run that ignores its signal
- * would otherwise hang the turn. The abandoned run's late settlement is ignored.
+ * would otherwise hang the turn. See `raceAbort`.
  */
 async function invoke(tool, input, ctx) {
     const abandoned = {
@@ -84,17 +103,7 @@ async function invoke(tool, input, ctx) {
     };
     if (ctx.signal.aborted)
         return abandoned;
-    let onAbort = () => { };
-    const aborted = new Promise((resolve) => {
-        onAbort = () => resolve(abandoned);
-        ctx.signal.addEventListener("abort", onAbort, { once: true });
-    });
-    try {
-        return await Promise.race([runSafely(tool, input, ctx), aborted]);
-    }
-    finally {
-        ctx.signal.removeEventListener("abort", onAbort);
-    }
+    return raceAbort(runSafely(tool, input, ctx), ctx.signal, () => abandoned);
 }
 async function runEmbedderTool(deps, tool, request) {
     const toolCallId = request.toolCallId ?? "";
@@ -131,7 +140,14 @@ function toolCallContext(request) {
 async function runCodingTool(deps, request) {
     deps.setCurrentCallId(request.toolCallId);
     try {
-        const outcome = await deps.runtime.callTool(request.name, request.input ?? {}, toolCallContext(request));
+        const signal = request.signal ?? deps.turnSignal();
+        const abandoned = {
+            kind: "error",
+            content: `Tool "${request.name}" was abandoned: the turn ended.`,
+        };
+        const outcome = signal.aborted
+            ? abandoned
+            : await raceAbort(deps.runtime.callTool(request.name, request.input ?? {}, { ...toolCallContext(request), signal }), signal, () => abandoned);
         if (outcome.kind === "denied") {
             return { answer: `Denied: ${outcome.reason}`, denied: { reason: outcome.reason, breach: outcome.breach } };
         }

package/dist/session/session-types.d.ts

@@ -175,6 +175,14 @@ export interface OpenSessionOpts extends TrackedSpawnDeadlineOptions {
      * facade sets it from `instructions`; nax leaves it unset. ACP ignores it.
      */
     systemPrompt?: string;
+    /** Native: repository-relative instruction scopes, independent of the file-tool root. */
+    instructionDirectories?: readonly string[];
+    /** Native: instruction Markdown basename; defaults to AGENTS.md and its legacy fallback chain. */
+    instructionFileName?: string;
+    /** Native: repository-relative paths excluded from automatic instruction reads. */
+    instructionDenyPaths?: readonly string[];
+    /** Native: host credential and trust-store paths excluded from instruction discovery. */
+    instructionProtectedPaths?: import("#src/tools/protected-paths").ProtectedPathsPolicy;
     /**
      * Native: resolved compaction settings. A resolved primitive, never NaxConfig —
      * src/agents/native/ must not read config (check:adapter-no-config-import).
@@ -192,6 +200,8 @@ export interface OpenSessionOpts extends TrackedSpawnDeadlineOptions {
      * NaxConfig. ACP ignores it; its loop is bounded by `maxInteractions`.
      */
     spinBreaker?: import("#src/infra/spin-breaker/index").ResolvedSpinBreakerSettings;
+    /** Native: keep history written by another model (S5-3). */
+    readonly carryHistoryAcrossModels?: boolean;
 }
 /** Options for sendTurn(). */
 export interface SendTurnOpts {

package/dist/terminal-auth/index.d.ts

@@ -0,0 +1,4 @@
+/** Terminal login UI shared by `nax auth login` and `nax-agent login` (S5-4 M-28). */
+export { createTerminalAuthInteraction, type TerminalAuthOptions } from "./interaction.ts";
+export { _openUrlDeps, openUrl, spawnDetached } from "./open-url.ts";
+export { _terminalPromptDeps, PLAIN_STYLE, PromptCancelledError, type PromptStdin, promptForLine, promptForSecret, promptForSelect, type SelectChoice, type TerminalStyle, } from "./prompt.ts";

package/dist/terminal-auth/index.js

@@ -0,0 +1,4 @@
+/** Terminal login UI shared by `nax auth login` and `nax-agent login` (S5-4 M-28). */
+export { createTerminalAuthInteraction } from "./interaction.js";
+export { _openUrlDeps, openUrl, spawnDetached } from "./open-url.js";
+export { _terminalPromptDeps, PLAIN_STYLE, PromptCancelledError, promptForLine, promptForSecret, promptForSelect, } from "./prompt.js";

package/dist/terminal-auth/interaction.d.ts

@@ -0,0 +1,15 @@
+/**
+ * The terminal's side of a login (moved from nax's `terminalInteraction`, S5-4
+ * M-28). Shared by `nax auth login` and `nax-agent login`. Secrets go through
+ * the non-echoing prompt; any prompt type this mirror does not recognise is
+ * treated as a secret.
+ */
+import type { AuthInteraction } from "#src/native/auth-types";
+import { type TerminalStyle } from "#src/terminal-auth/prompt";
+export interface TerminalAuthOptions {
+    /** One line of output (no trailing newline). */
+    readonly log: (text: string) => void;
+    readonly style?: TerminalStyle;
+    readonly openUrl?: (url: string) => void;
+}
+export declare function createTerminalAuthInteraction(options: TerminalAuthOptions): AuthInteraction;

package/dist/terminal-auth/interaction.js

@@ -0,0 +1,55 @@
+import { openUrl as defaultOpenUrl } from "#src/terminal-auth/open-url";
+import { PLAIN_STYLE, promptForLine, promptForSecret, promptForSelect, } from "#src/terminal-auth/prompt";
+export function createTerminalAuthInteraction(options) {
+    const style = options.style ?? PLAIN_STYLE;
+    const open = options.openUrl ?? defaultOpenUrl;
+    // notify() is synchronous and the flow fires auth-url right before racing a
+    // manual-code prompt against its callback server, so the URL is parked and
+    // spent by the next prompt's Enter-on-empty.
+    let pendingUrl;
+    const manualCode = (message) => {
+        const url = pendingUrl;
+        if (url === undefined)
+            return promptForLine(message, undefined, style);
+        pendingUrl = undefined;
+        options.log(style.dim("Press Enter to open it in your browser."));
+        return promptForLine(message, () => {
+            options.log(style.dim("Opening your browser..."));
+            open(url);
+        }, style);
+    };
+    return {
+        prompt: async (prompt) => {
+            if (prompt.type === "manual-code")
+                return manualCode(prompt.message);
+            if (prompt.type === "text")
+                return promptForLine(prompt.message, undefined, style);
+            if (prompt.type === "select") {
+                return promptForSelect(prompt.message, prompt.options.map((option) => ({ id: option.id, label: option.label })), style);
+            }
+            return promptForSecret(prompt.message, style);
+        },
+        notify: (event) => {
+            switch (event.type) {
+                case "auth-url":
+                    // The flow's own instructions are dropped: nothing has opened a browser yet.
+                    options.log(`\n${style.bold("Open this URL to continue:")}\n  ${event.url}`);
+                    pendingUrl = event.url;
+                    return;
+                case "device-code":
+                    options.log(`\nGo to ${event.verificationUri} and enter code ${style.bold(event.userCode)}`);
+                    return;
+                case "info":
+                    options.log(event.message);
+                    for (const link of event.links ?? [])
+                        options.log(`  ${link.label ?? "Link"}: ${link.url}`);
+                    return;
+                case "progress":
+                    options.log(style.dim(event.message));
+                    return;
+                default:
+                // An event type this mirror does not recognise: say nothing.
+            }
+        },
+    };
+}

package/dist/terminal-auth/open-url.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Opening a URL in the user's browser (moved from the nax CLI, S5-4 M-28).
+ *
+ * Best-effort: the caller always prints the URL first, so a failure costs a
+ * copy-paste, not the login. The URL is its own argv entry, never a shell
+ * string. Node reports a missing opener asynchronously (an `error` event), so
+ * the child gets an error listener; without it a container with no xdg-open
+ * would crash the login (S5-4 Review Focus 2).
+ */
+import { type ChildProcess } from "node:child_process";
+export declare function spawnDetached(command: readonly string[]): ChildProcess;
+/** Test seam. */
+export declare const _openUrlDeps: {
+    spawn: (command: readonly string[]) => void;
+    platform: () => string;
+};
+export declare function openUrl(url: string): void;

package/dist/terminal-auth/open-url.js

@@ -0,0 +1,44 @@
+/**
+ * Opening a URL in the user's browser (moved from the nax CLI, S5-4 M-28).
+ *
+ * Best-effort: the caller always prints the URL first, so a failure costs a
+ * copy-paste, not the login. The URL is its own argv entry, never a shell
+ * string. Node reports a missing opener asynchronously (an `error` event), so
+ * the child gets an error listener; without it a container with no xdg-open
+ * would crash the login (S5-4 Review Focus 2).
+ */
+import { spawn } from "node:child_process";
+export function spawnDetached(command) {
+    const [file, ...args] = command;
+    // nax-git-env-allow: not git: browser opener argv
+    const child = spawn(file ?? "", args, { stdio: "ignore", detached: true, windowsHide: true });
+    child.on("error", () => {
+        // The URL is already on screen; a missing opener is not news.
+    });
+    child.unref();
+    return child;
+}
+/** Test seam. */
+export const _openUrlDeps = {
+    spawn: (command) => {
+        spawnDetached(command);
+    },
+    platform: () => process.platform,
+};
+/** The opener for a platform. Windows needs the empty "" title argument. */
+function openerFor(platform, url) {
+    if (platform === "darwin")
+        return ["open", url];
+    if (platform === "win32")
+        return ["cmd", "/c", "start", "", url];
+    return ["xdg-open", url];
+}
+export function openUrl(url) {
+    try {
+        // nax-git-env-allow: not git: browser opener argv
+        _openUrlDeps.spawn(openerFor(_openUrlDeps.platform(), url));
+    }
+    catch {
+        // Deliberately silent: the URL is already on screen.
+    }
+}

package/dist/terminal-auth/prompt.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Terminal prompts for credential entry (moved from the nax CLI, S5-4 M-28).
+ *
+ * Nothing typed into a secret prompt is echoed, and the terminal is restored on
+ * every exit path: submit, cancel, stream end and stream error. Ctrl+D cancels;
+ * it never submits (it once fell through to "submit" in nax's confirm prompt).
+ */
+/** Colours for the prompts; the caller supplies them (nax passes chalk). */
+export interface TerminalStyle {
+    accent(text: string): string;
+    dim(text: string): string;
+    bold(text: string): string;
+}
+export declare const PLAIN_STYLE: TerminalStyle;
+/** The slice of process.stdin these prompts drive. Injected so tests can stand one up. */
+export interface PromptStdin {
+    isTTY?: boolean;
+    setRawMode(mode: boolean): unknown;
+    resume(): unknown;
+    pause(): unknown;
+    setEncoding(encoding: string): unknown;
+    on(event: string, listener: (chunk: string) => void): unknown;
+    once(event: string, listener: () => void): unknown;
+    removeListener(event: string, listener: (...args: never[]) => void): unknown;
+}
+export declare class PromptCancelledError extends Error {
+    constructor();
+}
+/**
+ * Test seam. `stdin` is unset by default and resolved to `process.stdin` only
+ * when a prompt runs: this module is reachable from the public barrel, and
+ * touching `process.stdin` at import would open it for every consumer.
+ */
+export declare const _terminalPromptDeps: {
+    stdin: PromptStdin | undefined;
+    write: (text: string) => boolean;
+};
+/** Reads a secret. Nothing is echoed, not even a masking character. */
+export declare function promptForSecret(message: string, style?: TerminalStyle): Promise<string>;
+/** Reads a visible line, for non-secret answers such as a pasted auth code. */
+export declare function promptForLine(message: string, onEmptySubmit?: () => void, style?: TerminalStyle): Promise<string>;
+export interface SelectChoice {
+    readonly id: string;
+    readonly label: string;
+}
+/**
+ * Reads a choice with the arrow keys and returns the chosen option's id. The
+ * option block is redrawn in place. Enter commits the highlighted row, so a
+ * value that is not an option can never be returned.
+ */
+export declare function promptForSelect(message: string, choices: readonly SelectChoice[], style?: TerminalStyle): Promise<string>;

package/dist/terminal-auth/prompt.js

@@ -0,0 +1,196 @@
+/**
+ * Terminal prompts for credential entry (moved from the nax CLI, S5-4 M-28).
+ *
+ * Nothing typed into a secret prompt is echoed, and the terminal is restored on
+ * every exit path: submit, cancel, stream end and stream error. Ctrl+D cancels;
+ * it never submits (it once fell through to "submit" in nax's confirm prompt).
+ */
+/** Ctrl+C. */
+const ETX = "\u0003";
+/** Ctrl+D. Conventionally cancel, never submit. */
+const EOT = "\u0004";
+const CR = "\r";
+const LF = "\n";
+const BACKSPACE = "\u007F";
+const ARROW_UP = "\u001b[A";
+const ARROW_DOWN = "\u001b[B";
+const identity = (text) => text;
+export const PLAIN_STYLE = { accent: identity, dim: identity, bold: identity };
+export class PromptCancelledError extends Error {
+    constructor() {
+        super("Prompt cancelled");
+        this.name = "PromptCancelledError";
+    }
+}
+/**
+ * Test seam. `stdin` is unset by default and resolved to `process.stdin` only
+ * when a prompt runs: this module is reachable from the public barrel, and
+ * touching `process.stdin` at import would open it for every consumer.
+ */
+export const _terminalPromptDeps = {
+    stdin: undefined,
+    write: (text) => process.stdout.write(text),
+};
+function stdinOf() {
+    return _terminalPromptDeps.stdin ?? process.stdin;
+}
+/** What one typed character does to a line prompt. */
+function keyAction(char, bufferEmpty, hasEmptyHook) {
+    if (char === ETX || char === EOT)
+        return { kind: "cancel" };
+    if (char === CR || char === LF) {
+        return bufferEmpty && hasEmptyHook ? { kind: "empty-submit" } : { kind: "submit" };
+    }
+    if (char === BACKSPACE)
+        return { kind: "erase" };
+    return { kind: "append" };
+}
+/** Applies a non-terminal key to the buffer; echoes when the prompt is visible. */
+function applyEdit(action, char, buffer, echo, onEmptySubmit) {
+    if (action.kind === "empty-submit") {
+        onEmptySubmit?.();
+        return buffer;
+    }
+    if (action.kind === "erase") {
+        if (echo)
+            _terminalPromptDeps.write("\b \b");
+        return buffer.slice(0, -1);
+    }
+    if (echo)
+        _terminalPromptDeps.write(char);
+    return buffer + char;
+}
+/**
+ * `onEmptySubmit` turns Enter-on-an-empty-buffer into an action rather than a
+ * submission. An empty answer is meaningless for the prompts that use it (a
+ * pasted auth code), and spending the keystroke here keeps the whole login on a
+ * single stdin reader.
+ */
+function read(message, echo, onEmptySubmit, style) {
+    const stdin = stdinOf();
+    if (stdin.isTTY !== true)
+        return Promise.reject(new PromptCancelledError());
+    _terminalPromptDeps.write(`${style.accent("?")} ${message} `);
+    return new Promise((resolve, reject) => {
+        let buffer = "";
+        let settled = false;
+        const cleanup = () => {
+            if (settled)
+                return;
+            settled = true;
+            stdin.removeListener("data", onData);
+            stdin.removeListener("end", onEnd);
+            stdin.removeListener("error", onEnd);
+            stdin.setRawMode(false);
+            stdin.pause();
+            _terminalPromptDeps.write("\n");
+        };
+        const onEnd = () => {
+            cleanup();
+            reject(new PromptCancelledError());
+        };
+        const onData = (chunk) => {
+            for (const char of chunk) {
+                const action = keyAction(char, buffer.length === 0, onEmptySubmit !== undefined);
+                if (action.kind === "cancel") {
+                    onEnd();
+                    return;
+                }
+                if (action.kind === "submit") {
+                    cleanup();
+                    resolve(buffer);
+                    return;
+                }
+                buffer = applyEdit(action, char, buffer, echo, onEmptySubmit);
+            }
+        };
+        stdin.setRawMode(true);
+        stdin.resume();
+        stdin.setEncoding("utf8");
+        stdin.on("data", onData);
+        stdin.once("end", onEnd);
+        stdin.once("error", onEnd);
+    });
+}
+/** Reads a secret. Nothing is echoed, not even a masking character. */
+export function promptForSecret(message, style = PLAIN_STYLE) {
+    return read(message, false, undefined, style);
+}
+/** Reads a visible line, for non-secret answers such as a pasted auth code. */
+export function promptForLine(message, onEmptySubmit, style = PLAIN_STYLE) {
+    return read(message, true, onEmptySubmit, style);
+}
+/**
+ * Reads a choice with the arrow keys and returns the chosen option's id. The
+ * option block is redrawn in place. Enter commits the highlighted row, so a
+ * value that is not an option can never be returned.
+ */
+export function promptForSelect(message, choices, style = PLAIN_STYLE) {
+    const stdin = stdinOf();
+    if (stdin.isTTY !== true)
+        return Promise.reject(new PromptCancelledError());
+    // Never silently pick for the user: an empty list is a caller bug.
+    if (choices.length === 0)
+        return Promise.reject(new PromptCancelledError());
+    _terminalPromptDeps.write(`${style.accent("?")} ${message}\n`);
+    return new Promise((resolve, reject) => {
+        let index = 0;
+        let settled = false;
+        let drawn = false;
+        const render = () => {
+            if (drawn)
+                _terminalPromptDeps.write(`\u001b[${choices.length}A`);
+            drawn = true;
+            for (const [i, choice] of choices.entries()) {
+                const active = i === index;
+                const marker = active ? style.accent(">") : " ";
+                const label = active ? style.accent(choice.label) : choice.label;
+                _terminalPromptDeps.write(`\r\u001b[2K${marker} ${label}\n`);
+            }
+        };
+        const cleanup = () => {
+            if (settled)
+                return;
+            settled = true;
+            stdin.removeListener("data", onData);
+            stdin.removeListener("end", onEnd);
+            stdin.removeListener("error", onEnd);
+            stdin.setRawMode(false);
+            stdin.pause();
+        };
+        const onEnd = () => {
+            cleanup();
+            reject(new PromptCancelledError());
+        };
+        const onData = (chunk) => {
+            // Whole-chunk matching: an arrow key is a three-byte escape sequence.
+            if (chunk.includes(ETX) || chunk.includes(EOT)) {
+                onEnd();
+                return;
+            }
+            if (chunk.includes(ARROW_UP)) {
+                index = (index - 1 + choices.length) % choices.length;
+                render();
+                return;
+            }
+            if (chunk.includes(ARROW_DOWN)) {
+                index = (index + 1) % choices.length;
+                render();
+                return;
+            }
+            if (chunk.includes(CR) || chunk.includes(LF)) {
+                const chosen = choices[index];
+                cleanup();
+                // biome-ignore lint/style/noNonNullAssertion: index is held in range by the modulo above.
+                resolve(chosen.id);
+            }
+        };
+        stdin.setRawMode(true);
+        stdin.resume();
+        stdin.setEncoding("utf8");
+        stdin.on("data", onData);
+        stdin.once("end", onEnd);
+        stdin.once("error", onEnd);
+        render();
+    });
+}