@nuvin/session 0.1.0-rc.9 → 0.1.0

package/dist/client/session-client.d.ts

@@ -1,9 +1,10 @@
 import type { AgentInput, AskUserAnswers } from "@nuvin/agent-core/shared";
-import type { AgentCatalogEntry, AgentDetail, CommandDetail, ConfigPatch, McpServerInfo, ModelCompletion, ServerEvent, SessionViewState, SetConfigResult, SkillCatalogEntry, SkillDetail, SlashCommandDescriptor } from "../protocol/types.ts";
+import type { AgentCatalogEntry, AgentDetail, ChatGptCredentialInput, CommandDetail, ConfigPatch, CustomProviderInput, GrantCapability, McpAction, McpActionResult, McpServerInfo, ModelCompletion, ServerEvent, SessionViewState, SetConfigResult, SkillCatalogEntry, SkillDetail, SlashCommandDescriptor } from "../protocol/types.ts";
 import type { ClientTransport } from "./transport.ts";
 export type ClientSubmitOptions = {
     displayText: string;
     attachmentLabels?: string[];
+    turnId?: string;
 };
 /**
  * Client-side mirror of the replicated session state. Applies every incoming
@@ -29,17 +30,14 @@ export interface SessionClient {
      * republishes through a state-reset event; this resolves on the ack.
      */
     loadHistory(historyId: string): Promise<void>;
-    /**
-     * Signal the daemon to reload provider keys / config after local onboarding
-     * wrote them to the shared config dir (spec §10/§12). Resolves on the ack.
-     */
-    reloadConfig(): Promise<void>;
     /**
      * Abort the in-flight MCP OAuth login (spec §10). Sends `cancel-auth-flow`;
      * the daemon invokes its live cancel handle, which publishes a cleared
      * `auth-flow` event. Resolves on the ack.
      */
     cancelAuthFlow(): Promise<void>;
+    /** Execute one authoritative MCP mutation in the attached daemon session. */
+    mcpAction(action: McpAction, serverName: string): Promise<McpActionResult>;
     /** Server-executed slash command descriptors from the attach snapshot. */
     serverCommands(): SlashCommandDescriptor[];
     /**
@@ -73,6 +71,21 @@ export interface SessionClient {
     getCommand(name: string): Promise<CommandDetail>;
     /** MCP servers with live status + per-server tools for the MCP tab. */
     listMcpServers(): Promise<McpServerInfo[]>;
+    /**
+     * Effective grant capabilities from the transport's latest welcome (UI hint).
+     * Empty when the transport does not expose capabilities.
+     */
+    capabilities(): readonly GrantCapability[];
+    /**
+     * Complete ChatGPT/Codex device-code login. Provider id is locked to
+     * `openai-codex`; callers cannot select another. Resolves on the ack.
+     */
+    completeProviderAuth(credential: ChatGptCredentialInput): Promise<void>;
+    /**
+     * Register a custom provider (base URL + API key + surface) on the attached
+     * host. Sends `add-custom-provider` and resolves on the ack.
+     */
+    addCustomProvider(provider: CustomProviderInput): Promise<void>;
     close(): void;
 }
 export declare function createSessionClient(transport: ClientTransport): SessionClient;

package/dist/client/session-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-client.d.ts","sourceRoot":"","sources":["../../src/client/session-client.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAa,MAAM,0BAA0B,CAAC;AAEtF,OAAO,KAAK,EACV,iBAAiB,EACjB,WAAW,EAEX,aAAa,EACb,WAAW,EACX,aAAa,EACb,eAAe,EACf,WAAW,EACX,gBAAgB,EAChB,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,sBAAsB,EACvB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEtD,MAAM,MAAM,mBAAmB,GAAG;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7B,CAAC;AAEF;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,IAAI,gBAAgB,CAAC;IAC7B,MAAM,IAAI,MAAM,CAAC;IACjB,SAAS,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC;IAC5C,6EAA6E;IAC7E,OAAO,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;IAC5D,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpE,cAAc,CACZ,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,EACzB,OAAO,CAAC,EAAE,MAAM,EAChB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3E,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,gFAAgF;IAChF,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C;;;;OAIG;IACH,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C;;;OAGG;IACH,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B;;;;OAIG;IACH,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,0EAA0E;IAC1E,cAAc,IAAI,sBAAsB,EAAE,CAAC;IAC3C;;;;OAIG;IACH,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAChD;;;;OAIG;IACH,cAAc,IAAI,OAAO,CAAC,eAAe,CAAC,CAAC;IAC3C;;;;;OAKG;IACH,SAAS,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAC5D,8DAA8D;IAC9D,UAAU,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;IAC3C,0EAA0E;IAC1E,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAChD,8DAA8D;IAC9D,UAAU,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;IAC3C,kFAAkF;IAClF,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAChD,qFAAqF;IACrF,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACjD,uEAAuE;IACvE,cAAc,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAC3C,KAAK,IAAI,IAAI,CAAC;CACf;AA+CD,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,eAAe,GAAG,aAAa,CAyN7E"}
+{"version":3,"file":"session-client.d.ts","sourceRoot":"","sources":["../../src/client/session-client.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAa,MAAM,0BAA0B,CAAC;AAEtF,OAAO,KAAK,EACV,iBAAiB,EACjB,WAAW,EACX,sBAAsB,EAEtB,aAAa,EACb,WAAW,EACX,mBAAmB,EACnB,eAAe,EACf,SAAS,EACT,eAAe,EACf,aAAa,EACb,eAAe,EACf,WAAW,EACX,gBAAgB,EAChB,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,sBAAsB,EACvB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEtD,MAAM,MAAM,mBAAmB,GAAG;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,IAAI,gBAAgB,CAAC;IAC7B,MAAM,IAAI,MAAM,CAAC;IACjB,SAAS,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC;IAC5C,6EAA6E;IAC7E,OAAO,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;IAC5D,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpE,cAAc,CACZ,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,EACzB,OAAO,CAAC,EAAE,MAAM,EAChB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3E,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,gFAAgF;IAChF,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C;;;;OAIG;IACH,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C;;;;OAIG;IACH,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,6EAA6E;IAC7E,SAAS,CAAC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAC3E,0EAA0E;IAC1E,cAAc,IAAI,sBAAsB,EAAE,CAAC;IAC3C;;;;OAIG;IACH,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAChD;;;;OAIG;IACH,cAAc,IAAI,OAAO,CAAC,eAAe,CAAC,CAAC;IAC3C;;;;;OAKG;IACH,SAAS,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAC5D,8DAA8D;IAC9D,UAAU,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;IAC3C,0EAA0E;IAC1E,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAChD,8DAA8D;IAC9D,UAAU,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;IAC3C,kFAAkF;IAClF,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAChD,qFAAqF;IACrF,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACjD,uEAAuE;IACvE,cAAc,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAC3C;;;OAGG;IACH,YAAY,IAAI,SAAS,eAAe,EAAE,CAAC;IAC3C;;;OAGG;IACH,oBAAoB,CAAC,UAAU,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxE;;;OAGG;IACH,iBAAiB,CAAC,QAAQ,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE,KAAK,IAAI,IAAI,CAAC;CACf;AA+CD,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,eAAe,GAAG,aAAa,CAmQ7E"}

package/dist/client/transport.d.ts

@@ -1,9 +1,25 @@
-import type { ClientCommand, ServerFrame } from "../protocol/types.ts";
+import type { ClientCommand, GrantCapability, ServerFrame } from "../protocol/types.ts";
 /** Client side of a session transport. Implementation: WebSocket over UDS (local) or TCP (remote). */
 export interface ClientTransport {
-    send(command: ClientCommand): void;
+    /**
+     * Send a command frame. Return `false` when the frame was dropped (not attached /
+     * not connected) so callers can fail pending promises instead of hanging forever.
+     * Returning `true` or `undefined` means the frame was handed to the socket.
+     */
+    send(command: ClientCommand): boolean | undefined;
     /** Subscribe to frames. The transport MUST deliver a snapshot frame first (attach semantics). */
     onFrame(listener: (frame: ServerFrame) => void): () => void;
     close(): void;
+    /**
+     * Effective grant capabilities from the latest welcome (UI hint only). Optional
+     * so lightweight fakes and non-daemon transports need not implement it —
+     * SessionClient treats a missing reader as an empty capability set.
+     */
+    capabilities?(): readonly GrantCapability[];
+    /**
+     * Optional: notify when in-flight commands can no longer receive acks (socket
+     * drop / reconnect). SessionClient rejects pending promises on this signal.
+     */
+    onUndeliverable?(listener: () => void): () => void;
 }
 //# sourceMappingURL=transport.d.ts.map

package/dist/client/transport.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"transport.d.ts","sourceRoot":"","sources":["../../src/client/transport.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEvE,sGAAsG;AACtG,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,OAAO,EAAE,aAAa,GAAG,IAAI,CAAC;IACnC,iGAAiG;IACjG,OAAO,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;IAC5D,KAAK,IAAI,IAAI,CAAC;CACf"}
+{"version":3,"file":"transport.d.ts","sourceRoot":"","sources":["../../src/client/transport.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAExF,sGAAsG;AACtG,MAAM,WAAW,eAAe;IAC9B;;;;OAIG;IACH,IAAI,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,GAAG,SAAS,CAAC;IAClD,iGAAiG;IACjG,OAAO,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;IAC5D,KAAK,IAAI,IAAI,CAAC;IACd;;;;OAIG;IACH,YAAY,CAAC,IAAI,SAAS,eAAe,EAAE,CAAC;IAC5C;;;OAGG;IACH,eAAe,CAAC,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC;CACpD"}

package/dist/client/websocket.d.ts

@@ -1,3 +1,4 @@
+import type { GrantCapability } from "../protocol/types.ts";
 import { type GetEndpoint } from "./endpoint.ts";
 import { type TransportSocket } from "./socket.ts";
 import type { ClientTransport } from "./transport.ts";
@@ -38,6 +39,10 @@ export type WebSocketTransportOptions = {
 export interface WebSocketClientTransport extends ClientTransport {
     connectionState(): WebSocketTransportState;
     onConnectionState(listener: (state: WebSocketTransportState) => void): () => void;
+    /** Effective capabilities from the latest welcome; empty while handshake is open or closed. */
+    capabilities(): readonly GrantCapability[];
+    /** Always present on the WebSocket transport — signals dropped/reconnect undeliverable commands. */
+    onUndeliverable(listener: () => void): () => void;
 }
 /**
  * ClientTransport over a WebSocket (spec §4.6): hello/welcome handshake, then

package/dist/client/websocket.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"websocket.d.ts","sourceRoot":"","sources":["../../src/client/websocket.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,WAAW,EAAiD,MAAM,eAAe,CAAC;AAChG,OAAO,EAAwB,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEtD,YAAY,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnD;;;;;GAKG;AACH,MAAM,MAAM,uBAAuB,GAAG,QAAQ,GAAG,WAAW,GAAG,cAAc,GAAG,WAAW,CAAC;AAE5F,MAAM,MAAM,yBAAyB,GAAG;IACtC,iHAAiH;IACjH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,0GAA0G;IAC1G,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,mGAAmG;IACnG,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,eAAe,CAAC;IACjD,+CAA+C;IAC/C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,gDAAgD;IAChD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,4CAA4C;IAC5C,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,4FAA4F;IAC5F,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,KAAK,IAAI,CAAC;IAClD,qEAAqE;IACrE,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;CACvC,CAAC;AAEF,MAAM,WAAW,wBAAyB,SAAQ,eAAe;IAC/D,eAAe,IAAI,uBAAuB,CAAC;IAC3C,iBAAiB,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,uBAAuB,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;CACnF;AAyBD;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,yBAAyB,GACjC,wBAAwB,CAwO1B"}
+{"version":3,"file":"websocket.d.ts","sourceRoot":"","sources":["../../src/client/websocket.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAGV,eAAe,EAEhB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,KAAK,WAAW,EAAiD,MAAM,eAAe,CAAC;AAChG,OAAO,EAAwB,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEtD,YAAY,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnD;;;;;GAKG;AACH,MAAM,MAAM,uBAAuB,GAAG,QAAQ,GAAG,WAAW,GAAG,cAAc,GAAG,WAAW,CAAC;AAE5F,MAAM,MAAM,yBAAyB,GAAG;IACtC,iHAAiH;IACjH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,0GAA0G;IAC1G,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,mGAAmG;IACnG,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,eAAe,CAAC;IACjD,+CAA+C;IAC/C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,gDAAgD;IAChD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,4CAA4C;IAC5C,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,4FAA4F;IAC5F,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,KAAK,IAAI,CAAC;IAClD,qEAAqE;IACrE,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;CACvC,CAAC;AAEF,MAAM,WAAW,wBAAyB,SAAQ,eAAe;IAC/D,eAAe,IAAI,uBAAuB,CAAC;IAC3C,iBAAiB,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,uBAAuB,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;IAClF,+FAA+F;IAC/F,YAAY,IAAI,SAAS,eAAe,EAAE,CAAC;IAC3C,oGAAoG;IACpG,eAAe,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC;CACnD;AAyBD;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,yBAAyB,GACjC,wBAAwB,CAgR1B"}

package/dist/controller/index.js

@@ -6,8 +6,9 @@ import {
   createMessageStateFromMessages,
   createSessionViewState,
   isAutoApprovedTool,
+  isToolAutoApprovedForMode,
   reduceSessionEvent
-} from "../chunk-FR3R66RD.js";
+} from "../chunk-WAMOWOCO.js";
 
 // src/controller/agent-channel.ts
 import { EventEmitter } from "events";
@@ -67,15 +68,18 @@ var MAX_AUTO_COMPACTION_CHAIN = 10;
 function createSessionController(deps) {
   const now = deps.now ?? Date.now;
   const isAutoApproved = deps.isAutoApproved ?? isAutoApprovedTool;
-  const errorDetail = deps.errorDetail ?? ((error) => String(error));
+  const errorDetail = deps.errorDetail ?? ((error) => error instanceof Error ? error.message : String(error));
   let serverCommands = deps.serverCommands ?? [];
   let compaction = deps.compaction;
   let guardPrompt = deps.guardPrompt;
   let autoCompactionChain = 0;
   let state = createSessionViewState();
   let seq = 0;
-  let sudoMode = false;
+  let approvalMode = deps.approvalMode ?? "ask";
   let abortController = null;
+  let activeTurnId;
+  let activePolicyDenial;
+  let hostBusyCount = 0;
   let questionCounter = 0;
   const listeners = /* @__PURE__ */ new Set();
   const approvalResolvers = /* @__PURE__ */ new Map();
@@ -85,9 +89,15 @@ function createSessionController(deps) {
   let queueCounter = 0;
   const deliveryQueue = [];
   let draining = false;
-  const emit = (body) => {
+  const emit = (body, explicitTurnId) => {
     seq += 1;
-    const event = Object.assign({}, body, { seq, at: now() });
+    const turnId = explicitTurnId ?? activeTurnId;
+    const event = Object.assign(
+      {},
+      body,
+      { seq, at: now() },
+      turnId !== void 0 ? { turnId } : {}
+    );
     state = reduceSessionEvent(state, event);
     deliveryQueue.push(event);
     if (draining) return;
@@ -106,10 +116,10 @@ function createSessionController(deps) {
       draining = false;
     }
   };
-  const emitTurnStatus = (busy) => {
+  const emitTurnStatus = () => {
     emit({
       type: "turn-status",
-      busy,
+      busy: abortController !== null || hostBusyCount > 0,
       queuedCount: queue.length,
       queued: queue.map((q) => ({
         id: q.id,
@@ -123,6 +133,7 @@ function createSessionController(deps) {
     emit({ type: "agent-event", event, ...scope ? { scope } : {} });
   });
   const unsubscribeLoaded = deps.channel.onSessionLoaded((loaded) => {
+    queue.length = 0;
     abortController?.abort(new Error("Session loaded; the active turn was cancelled."));
     rejectAllPending("Session loaded; pending interactions were cancelled.");
     emit({
@@ -133,6 +144,7 @@ function createSessionController(deps) {
       // else a resumed session reverts to the empty seed meta (no model name).
       state: {
         ...createSessionViewState(),
+        busy: hostBusyCount > 0,
         meta: state.meta,
         messages: createMessageStateFromMessages(loaded.messages)
       }
@@ -142,8 +154,8 @@ function createSessionController(deps) {
     const { toolCall, agentId, parentToolCallId, dirAccess } = request;
     const scope = parentToolCallId !== void 0 ? { agentId, parentToolCallId } : void 0;
     const approvalKey = `${agentId}:${toolCall.name}`;
-    const auto = !dirAccess && (sudoMode || alwaysApproved.has(approvalKey) || isAutoApproved(toolCall.name));
-    if (dirAccess && sudoMode) {
+    const auto = !dirAccess && (alwaysApproved.has(approvalKey) || isToolAutoApprovedForMode(approvalMode, toolCall.name, isAutoApproved));
+    if (dirAccess && approvalMode === "sudo") {
       emit({
         type: "agent-event",
         event: { type: "tool_call", toolCall },
@@ -164,8 +176,13 @@ function createSessionController(deps) {
     emit({
       type: "agent-event",
       event: { type: "tool_call", toolCall },
+      ...deps.headless ? { toolStatus: "rejected" } : {},
       ...scope ? { scope } : {}
     });
+    if (deps.headless) {
+      activePolicyDenial = "Tool approval is unavailable in headless mode.";
+      return { action: "reject", reason: activePolicyDenial };
+    }
     const nickname = nicknameFor(parentToolCallId);
     const input = asJsonObject(toolCall.input);
     const descriptor = {
@@ -184,6 +201,10 @@ function createSessionController(deps) {
     });
   });
   deps.channel.setQuestionHandler((request) => {
+    if (deps.headless) {
+      activePolicyDenial = "Questions are unavailable in headless mode.";
+      return Promise.reject(new Error(activePolicyDenial));
+    }
     questionCounter += 1;
     const questionId = `question-${questionCounter}`;
     return new Promise((resolve, reject) => {
@@ -221,28 +242,39 @@ function createSessionController(deps) {
     }
     questionResolvers.clear();
   }
-  function finalizeTurn(controller, reason) {
-    if (abortController !== controller) return;
-    abortController = null;
-    rejectAllPending(reason);
-    emitTurnStatus(false);
+  function startNextQueuedSubmission() {
+    if (abortController || hostBusyCount > 0) return;
     const next = queue.shift();
-    if (next) {
-      if (!next.opts.silent) {
-        emit({
+    if (!next) return;
+    if (!next.opts.silent) {
+      emit(
+        {
           type: "user-message",
           text: next.opts.displayText,
           ...next.opts.attachmentLabels?.length ? { attachmentLabels: next.opts.attachmentLabels } : {}
-        });
-      }
-      void runTurn(next.input, {});
+        },
+        next.opts.turnId
+      );
     }
+    void runTurn(next.input, { turnId: next.opts.turnId });
+  }
+  function finalizeTurn(controller, reason) {
+    if (abortController !== controller) return false;
+    abortController = null;
+    rejectAllPending(reason);
+    emitTurnStatus();
+    return true;
   }
   async function runTurn(input, opts) {
     const controller = new AbortController();
+    const previousTurnId = activeTurnId;
+    if (opts.turnId !== void 0) activeTurnId = opts.turnId;
+    if (!opts.systemInitiated) activePolicyDenial = void 0;
     abortController = controller;
+    let terminalStatus = "completed";
+    let terminalMessage;
     try {
-      emitTurnStatus(true);
+      emitTurnStatus();
       if (!opts.systemInitiated) autoCompactionChain = 0;
       compaction?.setEnabled(true);
       let finalInput = input;
@@ -251,11 +283,15 @@ function createSessionController(deps) {
         try {
           guarded = await guardPrompt(input);
         } catch (error) {
-          emit({ type: "error", message: `Turn failed: ${errorDetail(error)}` });
+          terminalStatus = "failed";
+          terminalMessage = errorDetail(error);
+          emit({ type: "error", message: terminalMessage });
           return;
         }
         if ("blocked" in guarded) {
-          emit({ type: "error", message: `Prompt blocked: ${guarded.blocked.reason}` });
+          terminalStatus = "failed";
+          terminalMessage = `Prompt blocked: ${guarded.blocked.reason}`;
+          emit({ type: "error", message: terminalMessage });
           return;
         }
         finalInput = guarded.prompt;
@@ -281,27 +317,61 @@ function createSessionController(deps) {
         await compaction.run(compactionIo);
       };
       try {
-        await deps.agent.send(finalInput, { streaming: true, signal: controller.signal });
+        const result = await deps.agent.send(finalInput, {
+          streaming: true,
+          signal: controller.signal
+        });
+        if (typeof result === "object" && result !== null && "status" in result && result.status === "aborted") {
+          terminalStatus = "aborted";
+        }
         if (compaction && !controller.signal.aborted) {
           if (compaction.consumePendingAction() === "compact") {
             await runCompaction();
           }
         }
       } catch (error) {
+        if (controller.signal.aborted || isAbortError(error)) {
+          terminalStatus = "aborted";
+        }
         try {
           const recovered = compaction ? compaction.messagesFromError(error) : null;
           if (recovered) {
             deps.agent.messages = recovered;
             await runCompaction();
           } else if (!controller.signal.aborted && !isAbortError(error)) {
-            emit({ type: "error", message: `Turn failed: ${errorDetail(error)}` });
+            terminalStatus = "failed";
+            terminalMessage = errorDetail(error);
+            emit({ type: "error", message: terminalMessage });
           }
         } catch (recoveryError) {
-          emit({ type: "error", message: `Turn failed: ${errorDetail(recoveryError)}` });
+          terminalStatus = "failed";
+          terminalMessage = errorDetail(recoveryError);
+          emit({ type: "error", message: terminalMessage });
         }
       }
     } finally {
-      finalizeTurn(controller, "Turn ended before pending interactions could be resolved.");
+      const ownedTurn = finalizeTurn(
+        controller,
+        "Turn ended before pending interactions could be resolved."
+      );
+      if (activePolicyDenial !== void 0) {
+        terminalStatus = "failed";
+        terminalMessage = activePolicyDenial;
+      }
+      if (opts.turnId !== void 0) {
+        emit(
+          {
+            type: "turn-completed",
+            status: terminalStatus,
+            ...activePolicyDenial !== void 0 ? { reason: "policy-denied" } : {},
+            ...terminalMessage !== void 0 ? { message: terminalMessage } : {}
+          },
+          opts.turnId
+        );
+      }
+      if (!opts.systemInitiated) activePolicyDenial = void 0;
+      activeTurnId = previousTurnId;
+      if (ownedTurn) startNextQueuedSubmission();
     }
   }
   return {
@@ -340,7 +410,7 @@ function createSessionController(deps) {
       const index = queue.findIndex((q) => q.id === queuedId);
       if (index === -1) return false;
       queue.splice(index, 1);
-      emitTurnStatus(abortController !== null);
+      emitTurnStatus();
       return true;
     },
     decideApproval(toolCallId, decision, comment, grantDir) {
@@ -388,6 +458,9 @@ function createSessionController(deps) {
     getSnapshot() {
       return { seq, state, serverCommands };
     },
+    isHostBusy() {
+      return hostBusyCount > 0;
+    },
     onEvent(listener) {
       listeners.add(listener);
       return () => listeners.delete(listener);
@@ -404,37 +477,53 @@ function createSessionController(deps) {
     publishAuthFlow(flow) {
       emit({ type: "auth-flow", flow });
     },
+    publishMcpState(mcpState) {
+      emit({ type: "mcp-state", state: mcpState });
+    },
     publishWorkflowProgress(runId, delta) {
       emit({ type: "workflow-progress", runId, delta });
     },
     reset() {
       queue.length = 0;
+      hostBusyCount = 0;
       abortController?.abort(new Error("Session reset."));
       rejectAllPending("Session reset; pending interactions were cancelled.");
       alwaysApproved.clear();
-      sudoMode = false;
+      approvalMode = "ask";
       emit({
         type: "state-reset",
-        state: { ...createSessionViewState(), meta: state.meta }
+        state: { ...createSessionViewState(), meta: state.meta, mcp: state.mcp }
       });
     },
-    setSudoMode(value) {
-      sudoMode = value;
+    setApprovalMode(mode) {
+      approvalMode = mode;
+    },
+    setBusy(busy) {
+      if (busy) {
+        hostBusyCount += 1;
+      } else if (hostBusyCount > 0) {
+        hostBusyCount -= 1;
+      }
+      emitTurnStatus();
+      startNextQueuedSubmission();
     },
     async submit(input, opts) {
-      if (abortController) {
+      if (abortController || hostBusyCount > 0) {
         queue.push({ id: `q-${++queueCounter}`, input, opts });
-        emitTurnStatus(true);
+        emitTurnStatus();
         return;
       }
       if (!opts.silent) {
-        emit({
-          type: "user-message",
-          text: opts.displayText,
-          ...opts.attachmentLabels?.length ? { attachmentLabels: opts.attachmentLabels } : {}
-        });
+        emit(
+          {
+            type: "user-message",
+            text: opts.displayText,
+            ...opts.attachmentLabels?.length ? { attachmentLabels: opts.attachmentLabels } : {}
+          },
+          opts.turnId
+        );
       }
-      await runTurn(input, {});
+      await runTurn(input, { turnId: opts.turnId });
     }
   };
 }

package/dist/controller/session-controller.d.ts

@@ -1,6 +1,7 @@
 import type { AgentMetricsSnapshot } from "@nuvin/agent-core/agent";
 import { type AgentInput, type AskUserAnswers, type Message } from "@nuvin/agent-core/shared";
-import type { McpAuthFlowState, ServerEvent, SessionMeta, SessionSnapshot, SlashCommandDescriptor, WorkflowProgressDelta } from "../protocol/types.ts";
+import type { McpAuthFlowState, McpViewState, ServerEvent, SessionMeta, SessionSnapshot, SlashCommandDescriptor, WorkflowProgressDelta } from "../protocol/types.ts";
+import { type SessionApprovalMode } from "../state/approvals.ts";
 import type { AgentChannel } from "./agent-channel.ts";
 /** Subset of Agent the controller needs — structurally satisfied by @nuvin/agent-core Agent. */
 export type AgentLike = {
@@ -53,6 +54,10 @@ export interface SessionControllerDeps {
      * attach snapshot for autocomplete. Defaults to an empty list.
      */
     serverCommands?: SlashCommandDescriptor[];
+    /** Non-interactive sessions never wait for an approval or question response. */
+    headless?: boolean;
+    /** Existing approval mode to apply when the controller is created. */
+    approvalMode?: SessionApprovalMode;
 }
 export type SubmitOptions = {
     displayText: string;
@@ -62,6 +67,8 @@ export type SubmitOptions = {
      * already echoed their text). `displayText` may be `""` in that case.
      */
     silent?: boolean;
+    /** Caller identifier copied onto all events produced by this turn. */
+    turnId?: string;
 };
 export interface SessionController {
     abort(): void;
@@ -106,6 +113,8 @@ export interface SessionController {
      * mutated in place. Callers must treat the returned state as read-only.
      */
     getSnapshot(): SessionSnapshot;
+    /** Return whether a host-controlled server operation currently owns busy state. */
+    isHostBusy(): boolean;
     onEvent(listener: (event: ServerEvent) => void): () => void;
     /**
      * Replace the server-executed slash-command descriptors surfaced in the attach
@@ -128,6 +137,8 @@ export interface SessionController {
      * reduces it like any other event. `null` clears the client modal.
      */
     publishAuthFlow(flow: McpAuthFlowState): void;
+    /** Publish the authoritative MCP catalog and operation state. */
+    publishMcpState(state: McpViewState): void;
     /**
      * Publish a workflow UI progress delta (spec §8.2/§13). The WorkflowManager
      * is the sole caller. emit-only — sequences + reduces into
@@ -136,13 +147,15 @@ export interface SessionController {
     publishWorkflowProgress(runId: string, delta: WorkflowProgressDelta): void;
     /**
      * Reset session state: abort any active turn, clear queued submissions,
-     * reject pending approvals/questions, clear alwaysApproved + sudo, and emit
+     * reject pending approvals/questions, clear alwaysApproved + approvalMode, and emit
      * a state-reset with a fresh view state CARRYING OVER the last published
-     * meta. Runtime-side resets (sessionStore.startNewSession, agent system
-     * prompt, metrics) are the HOST's job — it calls those, then this.
+     * meta and authoritative MCP state. Runtime-side resets
+     * (sessionStore.startNewSession, agent system prompt, metrics) are the HOST's
+     * job — it calls those, then this.
      */
     reset(): void;
-    setSudoMode(value: boolean): void;
+    setApprovalMode(mode: SessionApprovalMode): void;
+    setBusy(busy: boolean): void;
     /**
      * Submit user input. If no turn is active, the returned promise resolves
      * when the turn completes. If a turn is already active, the submission is

package/dist/controller/session-controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-controller.d.ts","sourceRoot":"","sources":["../../src/controller/session-controller.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AACpE,OAAO,EACL,KAAK,UAAU,EACf,KAAK,cAAc,EAEnB,KAAK,OAAO,EAEb,MAAM,0BAA0B,CAAC;AAElC,OAAO,KAAK,EAEV,gBAAgB,EAChB,WAAW,EAEX,WAAW,EACX,eAAe,EACf,sBAAsB,EACtB,qBAAqB,EACtB,MAAM,sBAAsB,CAAC;AAM9B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,gGAAgG;AAChG,MAAM,MAAM,SAAS,GAAG;IACtB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE;QAAE,SAAS,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,WAAW,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC9F,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IAAE,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,UAAU,CAAA;CAAE,CAAC;AAEnF;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,+EAA+E;IAC/E,UAAU,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;IACnC,kEAAkE;IAClE,oBAAoB,IAAI,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;IACpD,iFAAiF;IACjF,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,EAAE,GAAG,IAAI,CAAC;IACpD,mFAAmF;IACnF,GAAG,CAAC,IAAI,EAAE;QACR,MAAM,EAAE,WAAW,CAAC;QACpB,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;QAClC,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;KACpC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnB,CAAC;AAEF,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,SAAS,CAAC;IACjB,OAAO,EAAE,YAAY,CAAC;IACtB,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B,wEAAwE;IACxE,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IAC1D,oDAAoD;IACpD,cAAc,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC/C,sEAAsE;IACtE,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,6EAA6E;IAC7E,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,CAAC;IACzC;;;OAGG;IACH,cAAc,CAAC,EAAE,sBAAsB,EAAE,CAAC;CAC3C;AAED,MAAM,MAAM,aAAa,GAAG;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF,MAAM,WAAW,iBAAiB;IAChC,KAAK,IAAI,IAAI,CAAC;IACd;;;;;;;OAOG;IACH,eAAe,CAAC,KAAK,EAAE;QACrB,UAAU,CAAC,EAAE,eAAe,CAAC;QAC7B,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;KAC3D,GAAG,IAAI,CAAC;IACT;;;;;;;OAOG;IACH,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC;IACrE,yDAAyD;IACzD,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,uFAAuF;IACvF,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,KAAK,IAAI,IAAI,CAAC;IACd;;;;OAIG;IACH,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;IACnC,cAAc,CACZ,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,EACzB,OAAO,CAAC,EAAE,MAAM,EAChB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC;IACX,gGAAgG;IAChG,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACjE;;;;OAIG;IACH,WAAW,IAAI,eAAe,CAAC;IAC/B,OAAO,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;IAC5D;;;;;;OAMG;IACH,iBAAiB,CAAC,QAAQ,EAAE,sBAAsB,EAAE,GAAG,IAAI,CAAC;IAC5D,+FAA+F;IAC/F,kBAAkB,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI,CAAC;IAC5C;;;OAGG;IACH,cAAc,CAAC,QAAQ,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACrD;;;;OAIG;IACH,eAAe,CAAC,IAAI,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAC9C;;;;OAIG;IACH,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,qBAAqB,GAAG,IAAI,CAAC;IAC3E;;;;;;OAMG;IACH,KAAK,IAAI,IAAI,CAAC;IACd,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;IAClC;;;;;OAKG;IACH,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/D;AAYD,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,qBAAqB,GAAG,iBAAiB,CAuetF"}
+{"version":3,"file":"session-controller.d.ts","sourceRoot":"","sources":["../../src/controller/session-controller.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AACpE,OAAO,EACL,KAAK,UAAU,EACf,KAAK,cAAc,EAEnB,KAAK,OAAO,EAGb,MAAM,0BAA0B,CAAC;AAElC,OAAO,KAAK,EAEV,gBAAgB,EAChB,YAAY,EACZ,WAAW,EAEX,WAAW,EACX,eAAe,EACf,sBAAsB,EACtB,qBAAqB,EACtB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,uBAAuB,CAAC;AAK/B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,gGAAgG;AAChG,MAAM,MAAM,SAAS,GAAG;IACtB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE;QAAE,SAAS,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,WAAW,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC9F,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IAAE,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,UAAU,CAAA;CAAE,CAAC;AAEnF;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,+EAA+E;IAC/E,UAAU,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;IACnC,kEAAkE;IAClE,oBAAoB,IAAI,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;IACpD,iFAAiF;IACjF,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,EAAE,GAAG,IAAI,CAAC;IACpD,mFAAmF;IACnF,GAAG,CAAC,IAAI,EAAE;QACR,MAAM,EAAE,WAAW,CAAC;QACpB,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;QAClC,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;KACpC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnB,CAAC;AAEF,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,SAAS,CAAC;IACjB,OAAO,EAAE,YAAY,CAAC;IACtB,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B,wEAAwE;IACxE,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IAC1D,oDAAoD;IACpD,cAAc,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC/C,sEAAsE;IACtE,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,6EAA6E;IAC7E,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,CAAC;IACzC;;;OAGG;IACH,cAAc,CAAC,EAAE,sBAAsB,EAAE,CAAC;IAC1C,gFAAgF;IAChF,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,sEAAsE;IACtE,YAAY,CAAC,EAAE,mBAAmB,CAAC;CACpC;AAED,MAAM,MAAM,aAAa,GAAG;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,sEAAsE;IACtE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,WAAW,iBAAiB;IAChC,KAAK,IAAI,IAAI,CAAC;IACd;;;;;;;OAOG;IACH,eAAe,CAAC,KAAK,EAAE;QACrB,UAAU,CAAC,EAAE,eAAe,CAAC;QAC7B,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;KAC3D,GAAG,IAAI,CAAC;IACT;;;;;;;OAOG;IACH,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC;IACrE,yDAAyD;IACzD,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,uFAAuF;IACvF,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,KAAK,IAAI,IAAI,CAAC;IACd;;;;OAIG;IACH,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;IACnC,cAAc,CACZ,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,EACzB,OAAO,CAAC,EAAE,MAAM,EAChB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC;IACX,gGAAgG;IAChG,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACjE;;;;OAIG;IACH,WAAW,IAAI,eAAe,CAAC;IAC/B,mFAAmF;IACnF,UAAU,IAAI,OAAO,CAAC;IACtB,OAAO,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;IAC5D;;;;;;OAMG;IACH,iBAAiB,CAAC,QAAQ,EAAE,sBAAsB,EAAE,GAAG,IAAI,CAAC;IAC5D,+FAA+F;IAC/F,kBAAkB,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI,CAAC;IAC5C;;;OAGG;IACH,cAAc,CAAC,QAAQ,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACrD;;;;OAIG;IACH,eAAe,CAAC,IAAI,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAC9C,iEAAiE;IACjE,eAAe,CAAC,KAAK,EAAE,YAAY,GAAG,IAAI,CAAC;IAC3C;;;;OAIG;IACH,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,qBAAqB,GAAG,IAAI,CAAC;IAC3E;;;;;;;OAOG;IACH,KAAK,IAAI,IAAI,CAAC;IACd,eAAe,CAAC,IAAI,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACjD,OAAO,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAAC;IAC7B;;;;;OAKG;IACH,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/D;AAYD,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,qBAAqB,GAAG,iBAAiB,CA4kBtF"}

package/dist/grant/index.d.ts

@@ -1,4 +1,4 @@
-import type { GrantPayload } from "../protocol/types.ts";
+import { type GrantPayload } from "../protocol/types.ts";
 /** ±5 min clock-skew tolerance on expiry/issuedAt checks (relay spec §7). */
 export declare const DEFAULT_GRANT_SKEW_MS: number;
 /** base64 DER key pair: `publicKey` SPKI (daemon.yaml), `privateKey` PKCS#8 (server secret). */

package/dist/grant/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/grant/index.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEzD,6EAA6E;AAC7E,eAAO,MAAM,qBAAqB,QAAgB,CAAC;AAEnD,gGAAgG;AAChG,MAAM,MAAM,YAAY,GAAG;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC;AAErE,MAAM,MAAM,kBAAkB,GAC1B,iBAAiB,GACjB,SAAS,GACT,WAAW,GACX,eAAe,GACf,WAAW,CAAC;AAEhB,MAAM,MAAM,iBAAiB,GACzB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,YAAY,CAAA;CAAE,GACnC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,kBAAkB,CAAA;CAAE,CAAC;AAE9C,wBAAgB,oBAAoB,IAAI,YAAY,CAMnD;AAED,mFAAmF;AACnF,wBAAgB,SAAS,CAAC,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,GAAG,MAAM,CASjF;AAcD;;;;;;GAMG;AACH,wBAAgB,WAAW,CACzB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3E,iBAAiB,CAuCnB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/grant/index.ts"],"names":[],"mappings":"AAcA,OAAO,EAAsB,KAAK,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAE7E,6EAA6E;AAC7E,eAAO,MAAM,qBAAqB,QAAgB,CAAC;AAEnD,gGAAgG;AAChG,MAAM,MAAM,YAAY,GAAG;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC;AAErE,MAAM,MAAM,kBAAkB,GAC1B,iBAAiB,GACjB,SAAS,GACT,WAAW,GACX,eAAe,GACf,WAAW,CAAC;AAEhB,MAAM,MAAM,iBAAiB,GACzB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,YAAY,CAAA;CAAE,GACnC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,kBAAkB,CAAA;CAAE,CAAC;AAE9C,wBAAgB,oBAAoB,IAAI,YAAY,CAMnD;AAED,mFAAmF;AACnF,wBAAgB,SAAS,CAAC,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,GAAG,MAAM,CASjF;AA+BD;;;;;;GAMG;AACH,wBAAgB,WAAW,CACzB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3E,iBAAiB,CAuCnB"}

package/dist/grant/index.js

@@ -3,7 +3,8 @@ import {
   generateGrantKeyPair,
   signGrant,
   verifyGrant
-} from "../chunk-3IPZO7LP.js";
+} from "../chunk-TUNCGICQ.js";
+import "../chunk-HJLRL64D.js";
 export {
   DEFAULT_GRANT_SKEW_MS,
   generateGrantKeyPair,

package/dist/protocol/data-rpc.d.ts

@@ -1,4 +1,24 @@
-import type { HistoryPage, SessionSnapshot, WorkspaceSummary } from "./types.ts";
+import type { ConfigMutationResult, HistoryPage, ProfileSummary, ProviderConfigSummary, ProviderCredentialInput, ProviderSurfaceId, SessionSnapshot, WorkspaceConfigSummary } from "./types.ts";
+export type DataRpcErrorCode = "invalid-input" | "not-found" | "conflict" | "unsupported" | "unauthorized" | "daemon-offline" | "internal";
+export type DataRpcError = {
+    code: DataRpcErrorCode;
+    message: string;
+};
+export type ProfileScope = {
+    profile?: string;
+};
+export type AddProviderInput = ProfileScope & {
+    name: string;
+    surface: ProviderSurfaceId;
+    baseUrl?: string;
+    defaultModel?: string;
+    credential: ProviderCredentialInput;
+    activate?: boolean;
+};
+export type UpdateWorkspaceInput = ProfileScope & {
+    activeProvider?: string;
+    toggles?: Record<string, boolean>;
+};
 /**
  * The read/management data plane: ONE schema, two transports into the daemon
  * (local REST via rest-http.ts, relay control RPC via daemons.controller.ts →
@@ -39,7 +59,7 @@ export type DataRpcSchema = {
         params: {
             profile?: string;
         };
-        result: WorkspaceSummary[];
+        result: WorkspaceConfigSummary[];
     };
     "create-workspace": {
         params: {
@@ -47,7 +67,54 @@ export type DataRpcSchema = {
             root?: string;
             profile?: string;
         };
-        result: WorkspaceSummary;
+        result: WorkspaceConfigSummary;
+    };
+    "list-profiles": {
+        params: Record<string, never>;
+        result: ProfileSummary[];
+    };
+    "list-providers": {
+        params: ProfileScope;
+        result: ProviderConfigSummary[];
+    };
+    "add-provider": {
+        params: AddProviderInput;
+        result: ConfigMutationResult<ProviderConfigSummary>;
+    };
+    "remove-provider": {
+        params: {
+            providerId: string;
+            profile?: string;
+        };
+        result: ConfigMutationResult<null>;
+    };
+    "set-default-provider": {
+        params: {
+            providerId: string;
+            profile?: string;
+        };
+        result: ConfigMutationResult<null>;
+    };
+    "set-provider-auth": {
+        params: {
+            providerId: string;
+            credential: ProviderCredentialInput;
+            profile?: string;
+        };
+        result: ConfigMutationResult<null>;
+    };
+    "clear-provider-auth": {
+        params: {
+            providerId: string;
+            profile?: string;
+        };
+        result: ConfigMutationResult<null>;
+    };
+    "update-workspace": {
+        params: UpdateWorkspaceInput & {
+            name: string;
+        };
+        result: ConfigMutationResult<WorkspaceConfigSummary>;
     };
 };
 export type DataRpcMethod = keyof DataRpcSchema;