@pentoshi/clai 2.0.28 → 2.0.29

package/dist/agent/confirm-port.d.ts

@@ -0,0 +1,30 @@
+import type { ToolCall } from "../types.js";
+import type { SessionPolicy } from "./session-policy.js";
+export interface ConfirmPort {
+    confirmTool(call: ToolCall): Promise<boolean>;
+    confirmPentest(): Promise<boolean>;
+    /** Ask the user whether to continue after hitting the step budget. */
+    confirmContinue?(steps: number): Promise<boolean>;
+    /**
+     * Ask whether to leave ask mode and run an action task in agent mode.
+     * Optional so existing ports keep working; ask-mode handoff falls back to a
+     * default "no" when a port doesn't implement it.
+     */
+    confirmAgentSwitch?(info: {
+        reason: string;
+        tools: string[];
+    }): Promise<boolean>;
+}
+/**
+ * Re-assert raw mode AND resume stdin after an inquirer prompt
+ * (confirm/password). inquirer's readline interface pauses stdin and
+ * switches it to cooked mode when it closes; if we only flip raw mode back
+ * on but leave stdin paused, no `keypress`/`data` events flow to the REPL's
+ * ESC/Ctrl+C abort handler — so a long-running tool launched right after a
+ * confirmation can no longer be aborted (the user had to kill the terminal).
+ * Calling resume() restores the event flow.
+ */
+export declare function restoreInteractiveStdin(): void;
+export declare const inquirerConfirmPort: ConfirmPort;
+export declare function ensurePentestAuthorization(call: ToolCall, autoConfirm: boolean, session: SessionPolicy, confirmPort: ConfirmPort): Promise<boolean>;
+export declare function confirmToolExecution(call: ToolCall, autoConfirm: boolean, session: SessionPolicy, confirmPort: ConfirmPort): Promise<boolean>;

package/dist/agent/confirm-port.js

@@ -0,0 +1,89 @@
+import { confirm } from "@inquirer/prompts";
+import chalk from "chalk";
+import { getConfig } from "../store/config.js";
+import { isPentestToolCall } from "../safety/classifier.js";
+import { formatToolArgs } from "./tool-call-parser.js";
+/**
+ * Re-assert raw mode AND resume stdin after an inquirer prompt
+ * (confirm/password). inquirer's readline interface pauses stdin and
+ * switches it to cooked mode when it closes; if we only flip raw mode back
+ * on but leave stdin paused, no `keypress`/`data` events flow to the REPL's
+ * ESC/Ctrl+C abort handler — so a long-running tool launched right after a
+ * confirmation can no longer be aborted (the user had to kill the terminal).
+ * Calling resume() restores the event flow.
+ */
+export function restoreInteractiveStdin() {
+    if (!process.stdin.isTTY)
+        return;
+    try {
+        if (!process.stdin.isRaw) {
+            process.stdin.setRawMode(true);
+        }
+        process.stdin.resume();
+    }
+    catch {
+        /* ignore */
+    }
+}
+export const inquirerConfirmPort = {
+    async confirmTool(call) {
+        return confirm({
+            message: chalk.yellow(`  run ${call.name}: ${formatToolArgs(call)}?`),
+            default: true,
+        });
+    },
+    async confirmPentest() {
+        return confirm({
+            message: chalk.red("clai only assists with security testing on systems you own or have written permission to test. Confirm for this session?"),
+            default: false,
+        });
+    },
+    async confirmContinue(steps) {
+        return confirm({
+            message: chalk.yellow(`  ${steps} steps reached — continue?`),
+            default: true,
+        });
+    },
+    async confirmAgentSwitch(info) {
+        const tools = info.tools.length > 0 ? ` (${info.tools.join(", ")})` : "";
+        return confirm({
+            message: chalk.yellow(`  this needs agent mode${tools} — switch and run it?`),
+            default: true,
+        });
+    },
+};
+export async function ensurePentestAuthorization(call, autoConfirm, session, confirmPort) {
+    if (!isPentestToolCall(call))
+        return true;
+    // Persistent auth (via `clai authorize-pentest AGREE`) wins.
+    if (getConfig().pentestAuthorized)
+        return true;
+    // Session auth flipped earlier in this session — no re-prompt.
+    if (session.pentestAuthorized.value)
+        return true;
+    if (autoConfirm) {
+        // -y is session-scoped only. We do NOT touch the persistent config so
+        // a one-shot `-y` cannot silently authorize later interactive runs.
+        session.pentestAuthorized.value = true;
+        return true;
+    }
+    const ok = await confirmPort.confirmPentest();
+    if (!ok)
+        return false;
+    session.pentestAuthorized.value = true;
+    return true;
+}
+export async function confirmToolExecution(call, autoConfirm, session, confirmPort) {
+    const config = getConfig();
+    if (autoConfirm)
+        return true;
+    if (session.allow.has(call.name))
+        return true;
+    // Persistent allowlist kept for backwards compat with users who set it
+    // through `clai config` directly, but `/allow` only mutates the session
+    // set so authorizations never leak across processes.
+    if (config.allowAlwaysTools.includes(call.name))
+        return true;
+    return confirmPort.confirmTool(call);
+}
+//# sourceMappingURL=confirm-port.js.map

package/dist/agent/confirm-port.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"confirm-port.js","sourceRoot":"","sources":["../../src/agent/confirm-port.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAG5D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAkBvD;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB;IACrC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK;QAAE,OAAO;IACjC,IAAI,CAAC;QACH,IAAI,CAAE,OAAO,CAAC,KAAiD,CAAC,KAAK,EAAE,CAAC;YACtE,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAgB;IAC9C,KAAK,CAAC,WAAW,CAAC,IAAc;QAC9B,OAAO,OAAO,CAAC;YACb,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,IAAI,KAAK,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC;YACrE,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,cAAc;QAClB,OAAO,OAAO,CAAC;YACb,OAAO,EAAE,KAAK,CAAC,GAAG,CAChB,0HAA0H,CAC3H;YACD,OAAO,EAAE,KAAK;SACf,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,eAAe,CAAC,KAAa;QACjC,OAAO,OAAO,CAAC;YACb,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,KAAK,4BAA4B,CAAC;YAC7D,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,kBAAkB,CAAC,IAGxB;QACC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,OAAO,OAAO,CAAC;YACb,OAAO,EAAE,KAAK,CAAC,MAAM,CACnB,0BAA0B,KAAK,uBAAuB,CACvD;YACD,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;IACL,CAAC;CACF,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,IAAc,EACd,WAAoB,EACpB,OAAsB,EACtB,WAAwB;IAExB,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,6DAA6D;IAC7D,IAAI,SAAS,EAAE,CAAC,iBAAiB;QAAE,OAAO,IAAI,CAAC;IAC/C,+DAA+D;IAC/D,IAAI,OAAO,CAAC,iBAAiB,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAEjD,IAAI,WAAW,EAAE,CAAC;QAChB,sEAAsE;QACtE,oEAAoE;QACpE,OAAO,CAAC,iBAAiB,CAAC,KAAK,GAAG,IAAI,CAAC;QACvC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,EAAE,GAAG,MAAM,WAAW,CAAC,cAAc,EAAE,CAAC;IAC9C,IAAI,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IACtB,OAAO,CAAC,iBAAiB,CAAC,KAAK,GAAG,IAAI,CAAC;IACvC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAc,EACd,WAAoB,EACpB,OAAsB,EACtB,WAAwB;IAExB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,IAAI,WAAW;QAAE,OAAO,IAAI,CAAC;IAC7B,IAAI,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,uEAAuE;IACvE,wEAAwE;IACxE,qDAAqD;IACrD,IAAI,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAE7D,OAAO,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;AACvC,CAAC"}

package/dist/agent/plan-tool.d.ts

@@ -0,0 +1,26 @@
+import { type SessionPlan } from "../store/plan.js";
+import type { LoopGuard } from "./loop-guard.js";
+import type { SessionPolicy } from "./session-policy.js";
+import type { ToolCall } from "../types.js";
+/** Render the plan as a right-side pane on wide terminals, else inline. */
+export declare function renderPlanForTerminal(plan: SessionPlan): string;
+export interface PlanToolResult {
+    handled: boolean;
+    ok: boolean;
+    plan?: SessionPlan | undefined;
+    /** What to print to the user's terminal. */
+    display: string;
+    /** What to feed back to the model as the tool result. */
+    modelNote: string;
+}
+/** Build the system-context block describing the session's active plan. */
+export declare function planContextMessage(plan: SessionPlan, approved: boolean): string;
+/**
+ * Handle plan.create / task.update inline. These are session-scoped and
+ * persisted via the plan store so the user can view the plan (Ctrl+P) and
+ * the agent keeps it in context across the whole session.
+ */
+export declare function handlePlanTool(call: ToolCall, session: SessionPolicy, ctx: {
+    loopGuard: LoopGuard;
+    step: number;
+}): Promise<PlanToolResult>;

package/dist/agent/plan-tool.js

@@ -0,0 +1,188 @@
+import chalk from "chalk";
+import { createPlan, loadPlan, savePlan, markTask, } from "../store/plan.js";
+import { renderPlanChecklist, renderPlanSidePane } from "../ui/plan-pane.js";
+import { isLumpedSingleTask } from "./tool-call-parser.js";
+/** Render the plan as a right-side pane on wide terminals, else inline. */
+export function renderPlanForTerminal(plan) {
+    const cols = process.stdout.columns ?? 0;
+    const side = process.stdout.isTTY
+        ? renderPlanSidePane(plan, cols)
+        : undefined;
+    return side ?? renderPlanChecklist(plan);
+}
+/** Build the system-context block describing the session's active plan. */
+export function planContextMessage(plan, approved) {
+    const lines = [];
+    lines.push(`ACTIVE PLAN for this session (goal: ${plan.goal}, status: ${plan.status}):`);
+    if (plan.detail.trim())
+        lines.push(plan.detail.trim());
+    lines.push("Tasks:");
+    plan.tasks.forEach((t, i) => {
+        lines.push(`  ${i + 1}. [${t.id}] (${t.state}) ${t.title}`);
+    });
+    if (approved) {
+        const firstPending = plan.tasks.find((t) => t.state === "pending");
+        lines.push("The user APPROVED this plan. Execute it task by task NOW.");
+        if (firstPending) {
+            lines.push(`START WITH TASK ${firstPending.id} (${firstPending.title}). ` +
+                "Do NOT re-do tasks already marked done, and do NOT skip ahead to later tasks.");
+        }
+        lines.push("STRICT ORDER: call task.update {taskId, state:'in_progress'} → do the real work → " +
+            "call task.update {taskId, state:'done'} ONLY after the tool calls actually succeed. " +
+            "If a tool fails, mark the task 'failed' with a note, fix the problem, then retry. " +
+            "Do NOT mark a task done when its commands error out. " +
+            "Never claim something ran without a successful tool call.");
+    }
+    else {
+        lines.push("This plan is NOT yet approved, so you MUST NOT execute any of its tasks yet. " +
+            "Any new free-text message from the user right now is a PLAN REVISION, not approval — even if it " +
+            "sounds like an instruction (e.g. 'do not install new tools', 'use only X', 'also add Y', 'skip task 2'). " +
+            "Treat it as feedback: call plan.create AGAIN with the revised goal/detail/tasks to produce an updated " +
+            "plan, then STOP and wait. Do NOT call shell.exec, pkg.install, net.scan, tool.check, fs.write, or any " +
+            "other execution tool. The user will APPROVE with /implement, or CANCEL with /discard. Only after " +
+            "/implement may you begin executing.");
+    }
+    return lines.join("\n");
+}
+/**
+ * Handle plan.create / task.update inline. These are session-scoped and
+ * persisted via the plan store so the user can view the plan (Ctrl+P) and
+ * the agent keeps it in context across the whole session.
+ */
+export async function handlePlanTool(call, session, ctx) {
+    void ctx;
+    if (call.name === "plan.create") {
+        const goal = typeof call.args.goal === "string" ? call.args.goal : "";
+        const detail = typeof call.args.detail === "string" ? call.args.detail : "";
+        const kind = typeof call.args.kind === "string" ? call.args.kind : "general";
+        const rawTasks = Array.isArray(call.args.tasks) ? call.args.tasks : [];
+        const taskTitles = rawTasks
+            .map((t) => (typeof t === "string" ? t : ""))
+            .filter(Boolean);
+        if (!goal || taskTitles.length === 0) {
+            return {
+                handled: true,
+                ok: false,
+                display: chalk.red("  ✗ plan.create needs a non-empty goal and at least one task title\n"),
+                modelNote: "plan.create failed: provide a string goal and a non-empty tasks array of step titles.",
+            };
+        }
+        // Reject a low-quality "everything in one step" plan. A single task that
+        // itself enumerates many files/actions (commas, "and", slashes) is a sign
+        // the model lumped the whole build into one checkbox — split it so the
+        // user gets a real, trackable checklist and the executor works step by step.
+        if (isLumpedSingleTask(taskTitles)) {
+            return {
+                handled: true,
+                ok: false,
+                display: chalk.red("  ✗ plan.create: that single task lumps the whole build into one step\n"),
+                modelNote: "plan.create rejected: you put everything into ONE task. Break it into 3-8 SEPARATE, " +
+                    "ordered tasks — each a distinct action, e.g. 'scaffold package.json + vite config', " +
+                    "'create index.html + entry (main.jsx)', 'build App + Post components', 'add posts data + styles', " +
+                    "'install deps and run dev server to verify'. Call plan.create again with that tasks array.",
+            };
+        }
+        const plan = createPlan({
+            sessionId: session.sessionId,
+            goal,
+            detail,
+            taskTitles,
+            kind,
+        });
+        await savePlan(plan).catch(() => undefined);
+        // A freshly (re)created plan resets approval — the user must /implement.
+        session.planApproved.value = false;
+        const checklist = renderPlanForTerminal(plan);
+        const display = chalk.cyan("  ● planning\n") +
+            checklist +
+            "\n" +
+            chalk.dim("  ✦ plan created — press Ctrl+P to view it, /implement to approve and run it,\n" +
+                "    or /discard to cancel it. Any other message refines this plan.\n");
+        return {
+            handled: true,
+            ok: true,
+            plan,
+            display,
+            modelNote: `Plan saved with ${plan.tasks.length} task(s). STOP here and wait — produce NO other tool calls now. ` +
+                "Do NOT start executing tasks until the user approves with /implement. " +
+                "If the user's next message gives feedback instead of /implement, that is a REVISION: call plan.create " +
+                "again with the updated plan and STOP again. The user may cancel the whole plan with /discard. " +
+                "Only after /implement do you begin, working task by task, calling task.update to mark each " +
+                "in_progress before and done after you finish it.",
+        };
+    }
+    // task.update
+    const plan = await loadPlan(session.sessionId).catch(() => undefined);
+    if (!plan) {
+        return {
+            handled: true,
+            ok: false,
+            display: chalk.red("  ✗ task.update: no active plan — call plan.create first\n"),
+            modelNote: "task.update failed: there is no active plan. Call plan.create first.",
+        };
+    }
+    const taskId = typeof call.args.taskId === "string" ? call.args.taskId : "";
+    const stateRaw = typeof call.args.state === "string" ? call.args.state : "";
+    const note = typeof call.args.note === "string" ? call.args.note : undefined;
+    const validStates = [
+        "pending",
+        "in_progress",
+        "done",
+        "failed",
+        "skipped",
+    ];
+    if (!validStates.includes(stateRaw)) {
+        return {
+            handled: true,
+            ok: false,
+            display: chalk.red(`  ✗ task.update: state must be one of ${validStates.join(", ")}\n`),
+            modelNote: `task.update failed: state must be one of ${validStates.join(", ")}.`,
+        };
+    }
+    // Only one task may be in_progress at a time. This forces genuine
+    // task-by-task execution: the model must close (done/failed/skipped) the
+    // current task before opening the next one, instead of leaving a task
+    // "in_progress" as an umbrella while it quietly works through the rest
+    // of the plan underneath it.
+    if (stateRaw === "in_progress") {
+        const otherInProgress = plan.tasks.find((t) => t.id !== taskId && t.state === "in_progress");
+        if (otherInProgress) {
+            return {
+                handled: true,
+                ok: false,
+                display: chalk.red(`  \u2717 task.update: task [${otherInProgress.id}] "${otherInProgress.title}" is still in_progress\n`),
+                modelNote: `task.update failed: task [${otherInProgress.id}] "${otherInProgress.title}" is still in_progress. ` +
+                    "Finish it first \u2014 call task.update with state 'done' (or 'failed'/'skipped' with a note) " +
+                    `for [${otherInProgress.id}] before starting [${taskId}].`,
+            };
+        }
+    }
+    const ok = markTask(plan, taskId, stateRaw, note);
+    if (!ok) {
+        const ids = plan.tasks.map((t) => t.id).join(", ");
+        return {
+            handled: true,
+            ok: false,
+            display: chalk.red(`  ✗ task.update: unknown taskId "${taskId}" (have: ${ids})\n`),
+            modelNote: `task.update failed: unknown taskId. Valid ids: ${ids}.`,
+        };
+    }
+    if (plan.status === "draft" || plan.status === "approved") {
+        plan.status = "in_progress";
+    }
+    const allDone = plan.tasks.every((t) => t.state === "done" || t.state === "skipped" || t.state === "failed");
+    if (allDone)
+        plan.status = "completed";
+    await savePlan(plan).catch(() => undefined);
+    const checklist = renderPlanForTerminal(plan);
+    return {
+        handled: true,
+        ok: true,
+        plan,
+        display: checklist + "\n",
+        modelNote: allDone
+            ? "Task updated. ALL tasks are now finished. Verify the result and give your final summary."
+            : "Task updated. Continue with the next pending task.",
+    };
+}
+//# sourceMappingURL=plan-tool.js.map

package/dist/agent/plan-tool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan-tool.js","sourceRoot":"","sources":["../../src/agent/plan-tool.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EACL,UAAU,EACV,QAAQ,EACR,QAAQ,EACR,QAAQ,GAGT,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAG7E,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAG3D,2EAA2E;AAC3E,MAAM,UAAU,qBAAqB,CAAC,IAAiB;IACrD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK;QAC/B,CAAC,CAAC,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC;QAChC,CAAC,CAAC,SAAS,CAAC;IACd,OAAO,IAAI,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC;AAC3C,CAAC;AAYD,2EAA2E;AAC3E,MAAM,UAAU,kBAAkB,CAAC,IAAiB,EAAE,QAAiB;IACrE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CACR,uCAAuC,IAAI,CAAC,IAAI,aAAa,IAAI,CAAC,MAAM,IAAI,CAC7E,CAAC;IACF,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;QAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACvD,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACrB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAC1B,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IACH,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;QACnE,KAAK,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;QACxE,IAAI,YAAY,EAAE,CAAC;YACjB,KAAK,CAAC,IAAI,CACR,mBAAmB,YAAY,CAAC,EAAE,KAAK,YAAY,CAAC,KAAK,KAAK;gBAC5D,+EAA+E,CAClF,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,IAAI,CACR,oFAAoF;YAClF,sFAAsF;YACtF,oFAAoF;YACpF,uDAAuD;YACvD,2DAA2D,CAC9D,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CACR,+EAA+E;YAC7E,kGAAkG;YAClG,2GAA2G;YAC3G,wGAAwG;YACxG,wGAAwG;YACxG,mGAAmG;YACnG,qCAAqC,CACxC,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAAc,EACd,OAAsB,EACtB,GAA2C;IAE3C,KAAK,GAAG,CAAC;IACT,IAAI,IAAI,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,GACR,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAClE,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,MAAM,UAAU,GAAG,QAAQ;aACxB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;aAC5C,MAAM,CAAC,OAAO,CAAC,CAAC;QACnB,IAAI,CAAC,IAAI,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrC,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,KAAK,CAAC,GAAG,CAChB,sEAAsE,CACvE;gBACD,SAAS,EACP,uFAAuF;aAC1F,CAAC;QACJ,CAAC;QACD,yEAAyE;QACzE,0EAA0E;QAC1E,uEAAuE;QACvE,6EAA6E;QAC7E,IAAI,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC;YACnC,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,KAAK,CAAC,GAAG,CAChB,yEAAyE,CAC1E;gBACD,SAAS,EACP,sFAAsF;oBACtF,sFAAsF;oBACtF,oGAAoG;oBACpG,4FAA4F;aAC/F,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,UAAU,CAAC;YACtB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,IAAI;YACJ,MAAM;YACN,UAAU;YACV,IAAI;SACL,CAAC,CAAC;QACH,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5C,yEAAyE;QACzE,OAAO,CAAC,YAAY,CAAC,KAAK,GAAG,KAAK,CAAC;QACnC,MAAM,SAAS,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAC9C,MAAM,OAAO,GACX,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC;YAC5B,SAAS;YACT,IAAI;YACJ,KAAK,CAAC,GAAG,CACP,iFAAiF;gBAC/E,sEAAsE,CACzE,CAAC;QACJ,OAAO;YACL,OAAO,EAAE,IAAI;YACb,EAAE,EAAE,IAAI;YACR,IAAI;YACJ,OAAO;YACP,SAAS,EACP,mBAAmB,IAAI,CAAC,KAAK,CAAC,MAAM,kEAAkE;gBACtG,wEAAwE;gBACxE,wGAAwG;gBACxG,gGAAgG;gBAChG,6FAA6F;gBAC7F,kDAAkD;SACrD,CAAC;IACJ,CAAC;IAED,cAAc;IACd,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACtE,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO;YACL,OAAO,EAAE,IAAI;YACb,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,KAAK,CAAC,GAAG,CAChB,4DAA4D,CAC7D;YACD,SAAS,EACP,sEAAsE;SACzE,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5E,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5E,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7E,MAAM,WAAW,GAAgB;QAC/B,SAAS;QACT,aAAa;QACb,MAAM;QACN,QAAQ;QACR,SAAS;KACV,CAAC;IACF,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAqB,CAAC,EAAE,CAAC;QACjD,OAAO;YACL,OAAO,EAAE,IAAI;YACb,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,KAAK,CAAC,GAAG,CAChB,yCAAyC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CACpE;YACD,SAAS,EAAE,4CAA4C,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;SACjF,CAAC;IACJ,CAAC;IACD,kEAAkE;IAClE,yEAAyE;IACzE,sEAAsE;IACtE,uEAAuE;IACvE,6BAA6B;IAC7B,IAAI,QAAQ,KAAK,aAAa,EAAE,CAAC;QAC/B,MAAM,eAAe,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CACrC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,IAAI,CAAC,CAAC,KAAK,KAAK,aAAa,CACpD,CAAC;QACF,IAAI,eAAe,EAAE,CAAC;YACpB,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,KAAK,CAAC,GAAG,CAChB,+BAA+B,eAAe,CAAC,EAAE,MAAM,eAAe,CAAC,KAAK,0BAA0B,CACvG;gBACD,SAAS,EACP,6BAA6B,eAAe,CAAC,EAAE,MAAM,eAAe,CAAC,KAAK,0BAA0B;oBACpG,gGAAgG;oBAChG,QAAQ,eAAe,CAAC,EAAE,sBAAsB,MAAM,IAAI;aAC7D,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,QAAqB,EAAE,IAAI,CAAC,CAAC;IAC/D,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnD,OAAO;YACL,OAAO,EAAE,IAAI;YACb,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,KAAK,CAAC,GAAG,CAChB,oCAAoC,MAAM,YAAY,GAAG,KAAK,CAC/D;YACD,SAAS,EAAE,kDAAkD,GAAG,GAAG;SACpE,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QAC1D,IAAI,CAAC,MAAM,GAAG,aAAa,CAAC;IAC9B,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAC9B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,KAAK,QAAQ,CAC3E,CAAC;IACF,IAAI,OAAO;QAAE,IAAI,CAAC,MAAM,GAAG,WAAW,CAAC;IACvC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC9C,OAAO;QACL,OAAO,EAAE,IAAI;QACb,EAAE,EAAE,IAAI;QACR,IAAI;QACJ,OAAO,EAAE,SAAS,GAAG,IAAI;QACzB,SAAS,EAAE,OAAO;YAChB,CAAC,CAAC,0FAA0F;YAC5F,CAAC,CAAC,oDAAoD;KACzD,CAAC;AACJ,CAAC"}

package/dist/agent/runner.d.ts

@@ -1,35 +1,11 @@
 import type { ChatMessage, ChatImage, ProviderId, ToolCall, ToolResult } from "../types.js";
 import type { AgentEvent } from "./events.js";
-export interface SessionPolicy {
-    /** Tools the user authorized once during this REPL session. Not persisted. */
-    allow: Set<string>;
-    /** Mutable flag so the runner can flip pentest auth for this session only. */
-    pentestAuthorized: {
-        value: boolean;
-    };
-    /** Stable id used to scope the session's plan/tasks in the plan store. */
-    sessionId: string;
-    /** When true, the agent must follow its approved plan (set by /implement). */
-    planApproved: {
-        value: boolean;
-    };
-}
-export declare function createSessionPolicy(sessionId?: string): SessionPolicy;
-export interface ConfirmPort {
-    confirmTool(call: ToolCall): Promise<boolean>;
-    confirmPentest(): Promise<boolean>;
-    /** Ask the user whether to continue after hitting the step budget. */
-    confirmContinue?(steps: number): Promise<boolean>;
-    /**
-     * Ask whether to leave ask mode and run an action task in agent mode.
-     * Optional so existing ports keep working; ask-mode handoff falls back to a
-     * default "no" when a port doesn't implement it.
-     */
-    confirmAgentSwitch?(info: {
-        reason: string;
-        tools: string[];
-    }): Promise<boolean>;
-}
+import { type SessionPolicy } from "./session-policy.js";
+import { type ConfirmPort } from "./confirm-port.js";
+export * from "./tool-call-parser.js";
+export { createSessionPolicy, isPreApprovalAllowedTool, shouldEnableImageOcr, type SessionPolicy, } from "./session-policy.js";
+export { type ConfirmPort } from "./confirm-port.js";
+export declare function styleToolChatter(call: ToolCall, text: string): string;
 export interface AgentRunOptions {
     provider?: ProviderId | undefined;
     model?: string | undefined;
@@ -56,148 +32,4 @@ export interface AgentRunOptions {
     }) => Promise<string | undefined>) | undefined;
     session?: SessionPolicy | undefined;
 }
-export declare function preprocessJson(raw: string): string;
-export interface ParseToolCallOptions {
-    /**
-     * When true, only formats that are explicitly tool-call delimited are
-     * accepted: ```tool fenced JSON, <tool_call> XML, and the Kimi sentinel
-     * token format. Loose formats (any fenced block, heading-prefix, trailing
-     * JSON) are dropped — useful when models routinely emit JSON examples in
-     * prose. Default is `false` so existing free-tier models keep working.
-     */
-    strict?: boolean | undefined;
-}
-export declare function parseToolCall(text: string, options?: ParseToolCallOptions): ToolCall | undefined;
-/**
- * When a model emits a bare args object with no {"name", "args"} wrapper and
- * no ```tool fence, infer which tool it MEANT from the argument keys so we
- * can run it directly instead of nudging the model to re-emit (the user
- * should not have to type "run"). Only unambiguous key signatures map to a
- * tool; genuinely ambiguous shapes (a lone `path` could be fs.read / fs.list
- * / pdf.read / image.ocr; a lone `target` could be whois / dns / scan) return
- * undefined so the caller falls back to a re-emit nudge. Inferred calls still
- * pass through the normal safety classifier + confirmation, so inference can
- * never bypass a confirm/block gate.
- */
-export declare function inferToolFromArgs(obj: Record<string, unknown>): string | undefined;
-/**
- * When a model means to call a tool but emits ONLY a bare JSON object —
- * either a proper {"name","args"} that the strict matchers missed, or a bare
- * args object like {"path":"file.pdf"} with the wrapper/fence dropped — this
- * recognizes it. Returns:
- *   - { call } when the object is a complete {name, args} tool call, or
- *   - { argsOnly: true } when it looks like a bare args object (so the caller
- *     can nudge the model to re-emit a properly named, fenced tool call).
- * Returns undefined for anything that is plainly a normal prose/JSON answer.
- *
- * Also handles the case where a model emits prose followed by a non-`tool`
- * fenced code block (e.g. ```web\n{"url":"..."}\n```) that contains a bare
- * args object — the fence is scanned even when it's not the sole content.
- */
-export declare function recognizeBareToolJson(text: string): {
-    call?: ToolCall;
-    argsOnly?: boolean;
-} | undefined;
-/**
- * Detect an opened-but-unparseable tool call. This happens when the model's
- * output is truncated by the token limit mid-JSON: we see the ```tool fence
- * (or a bare {"name":"...","args" prefix) open, but parseToolCall returns
- * undefined because the JSON never closed. Without this, the broken block
- * leaks to the screen as a "final answer" and the requested action (e.g. a
- * multi-file fs.writeMany scaffold) silently never runs.
- */
-export declare function looksLikeTruncatedToolCall(text: string): boolean;
-/**
- * Count the number of ```tool fenced blocks in a message. Models sometimes
- * emit MULTIPLE tool calls in one response (e.g. fs.writeMany + npm install +
- * npm run dev). Only the FIRST is parsed and executed; the rest are silently
- * dropped and leak to the screen as code fences, while the model believes it
- * ran all of them — a major cause of "everything is done" fabrications. We
- * detect this so the runner can run the first and explicitly tell the model
- * the others did NOT run and must be re-sent one at a time.
- */
-export declare function countToolFences(text: string): number;
-/**
- * Parse EVERY explicitly-delimited tool call in a message, in document
- * order. Unlike parseToolCall (which returns only the first), this lets the
- * runner execute a batch the model emitted in one turn — e.g. the natural
- * "task.update in_progress → do the work → task.update done" sequence, or
- * several fs.write calls. Only the unambiguous, delimited formats are
- * collected (```tool fences, <tool_call> XML, and Kimi sentinel blocks) so a
- * worked example in prose is far less likely to be mistaken for a call.
- * The runner executes them sequentially and STOPS the batch on the first
- * failure so the model can react, mirroring how Claude Code batches reads
- * and edits but pauses when something breaks.
- */
-export declare function parseAllToolCalls(text: string): ToolCall[];
-/** Structural equality for two tool calls (name + canonical args JSON). */
-export declare function sameToolCall(a: ToolCall, b: ToolCall): boolean;
-/**
- * Partition a batch of tool calls (in document order) into execution groups.
- * A run of consecutive parallel-safe calls forms one group to be run
- * concurrently (bounded by maxGroupSize); every non-parallel-safe call is its
- * own single-element group, i.e. a sequential barrier. Because plan updates
- * and side-effecting tools are never parallel-safe, they always split the
- * batch — which keeps parallelism scoped within a single task and prevents
- * plan-state races and overlapping writes.
- */
-export declare function groupToolCallsForExecution(calls: ToolCall[], isParallelSafe: (call: ToolCall) => boolean, maxGroupSize?: number): ToolCall[][];
-/**
- * Build the conversation to hand back to the caller at turn end. Strips system
- * prompts (they're re-added each turn) but keeps the user turn plus every
- * assistant tool-call and tool result, then appends the final answer if it
- * isn't already the last message. Persisting this is what lets a resumed
- * session give the model back what it actually did — commands, outputs, and
- * results — instead of only its prose answers.
- */
-export declare function buildTurnHistory(messages: ChatMessage[], answer: string): ChatMessage[];
-/**
- * Collapse pathological repetition before a message is stored in history.
- * Some models degenerate into emitting the same short phrase hundreds of
- * times ("We need to wait.We need to wait.…"), which otherwise bloats the
- * context window and wastes tokens on every subsequent turn. We keep a few
- * copies and note the collapse so the meaning is preserved without the bulk.
- */
-export declare function collapseRepeatedText(text: string): string;
-export declare function formatToolArgs(call: ToolCall): string;
-/**
- * Detect pentest/security tasks that need the full step budget.
- * Mirrors looksLikeBuildTask but for security work.
- */
-export declare function looksLikePentestTask(prompt: string, history?: ChatMessage[] | undefined): boolean;
-/**
- * Decide whether this turn should get the build workflow (explore → plan →
- * implement) and a generous step budget. Looks at the current prompt first,
- * then falls back to recent USER turns so a terse follow-up inherits an
- * ongoing build — but NOT the agent's own (possibly mistaken) plan narration.
- */
-export declare function looksLikeBuildTask(prompt: string, history?: ChatMessage[] | undefined): boolean;
-/**
- * Detect a message that narrates an *upcoming* action ("let me explore the
- * directory", "I'll create the components") rather than an actual answer or
- * tool call. Used to catch models that describe intent but emit no tool call,
- * which would otherwise end the turn with nothing done. A real completion
- * summary (past tense, longer, or containing a code block) is NOT flagged.
- */
-export declare function looksLikeActionNarration(text: string): boolean;
-/**
- * Detect a message that narrates a PLAN as prose ("Goal: … Tasks: 1. … Please
- * approve the plan") instead of calling plan.create. Such a turn leaves no
- * real plan, so the user can't /implement it — we nudge the model to emit the
- * plan.create tool call instead.
- */
-export declare function looksLikePlanNarration(text: string): boolean;
-export declare function requiresFreshWebSearch(prompt: string): boolean;
-/**
- * Detect a low-quality "everything in one step" plan task. A single task that
- * itself enumerates many files/actions (multiple commas, an "and", several
- * slashes, or an overlong title) means the model lumped the whole build into
- * one checkbox instead of producing a real ordered checklist.
- */
-export declare function isLumpedSingleTask(taskTitles: string[]): boolean;
-export declare function shouldDimToolChatter(call: ToolCall): boolean;
-export declare function isPreApprovalAllowedTool(name: string): boolean;
-export declare function styleToolChatter(call: ToolCall, text: string): string;
-/** OCR is opt-in when real image pixels are already attached to the model. */
-export declare function shouldEnableImageOcr(prompt: string, hasAttachedImages: boolean): boolean;
 export declare function runAgentLoop(prompt: string, options?: AgentRunOptions): Promise<string>;