@qduc/term2 0.24.1 → 0.25.0

package/dist/providers/oauth-pkce.js

@@ -1,26 +1,22 @@
 import crypto from 'node:crypto';
-import http from 'node:http';
-import readline from 'node:readline';
-import { spawn } from 'node:child_process';
+import { awaitLoopbackCallback, bindLoopbackRedirect, closeLoopbackServer, openInBrowser, } from '../lib/oauth-loopback.js';
+/**
+ * The browser half of an OAuth 2.0 + PKCE login for a public native client.
+ *
+ * Both providers term2 logs in to (Grok and Codex) borrow the official CLI's
+ * registered client id, so the redirect URI is *their* registered value and is
+ * not negotiable — see docs/plans/provider-oauth-independence.md. The only
+ * thing that differs between them is endpoints, scopes, and how the token
+ * endpoint wants its request body encoded, so all of that is configuration and
+ * the flow itself lives here once.
+ *
+ * The loopback listener and callback handling live in `source/lib/oauth-loopback.ts`
+ * so MCP OAuth (whose redirect port is chosen at runtime) can reuse them.
+ */
+export { openInBrowser };
 function base64url(buf) {
     return buf.toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
 }
-export function openInBrowser(url) {
-    const command = process.platform === 'darwin' ? 'open' : process.platform === 'win32' ? 'cmd' : 'xdg-open';
-    const args = process.platform === 'win32' ? ['/c', 'start', '', url] : [url];
-    try {
-        const child = spawn(command, args, { stdio: 'ignore', detached: true });
-        child.on('error', () => {
-            // Ignored: opening a browser in a headless/server/minimal environment or when
-            // the browser launcher is missing (e.g. xdg-open ENOENT) is non-fatal.
-            // The caller always prints the URL, so the user can complete login manually.
-        });
-        child.unref();
-    }
-    catch {
-        // The caller always prints the URL, so a failed launcher is not fatal.
-    }
-}
 function buildAuthorizeUrl(config, redirectUri, challenge, state) {
     const url = new URL(config.authorizeEndpoint);
     url.searchParams.set('client_id', config.clientId);
@@ -35,195 +31,10 @@ function buildAuthorizeUrl(config, redirectUri, challenge, state) {
     }
     return url;
 }
-/**
- * Binds the first registered loopback port that is free.
- *
- * We may only try ports the official client registered, so an exhausted list is
- * a real failure with a real cause: another login is almost certainly holding
- * the port.
- */
-function bindLoopbackListener(config) {
-    return new Promise((resolve, reject) => {
-        const attempt = (index) => {
-            const port = config.redirectPorts[index];
-            const server = http.createServer();
-            const onError = (err) => {
-                server.close();
-                if (err.code !== 'EADDRINUSE') {
-                    reject(err);
-                    return;
-                }
-                if (index + 1 < config.redirectPorts.length) {
-                    attempt(index + 1);
-                    return;
-                }
-                reject(new Error(`${config.label} login could not bind any of its registered redirect ports (${config.redirectPorts.join(', ')}). The authorization server only accepts those exact redirects, so close whatever holds them${config.portConflictHint ? ` (${config.portConflictHint})` : ''} and retry.`));
-            };
-            server.once('error', onError);
-            server.listen(port, '127.0.0.1', () => {
-                server.off('error', onError);
-                // Port 0 asks the OS for an ephemeral port; the redirect must name the real one.
-                resolve({ server, port: server.address().port });
-            });
-        };
-        attempt(0);
-    });
-}
-function stripWrappingQuotes(value) {
-    const trimmed = value.trim();
-    if ((trimmed.startsWith('"') && trimmed.endsWith('"')) || (trimmed.startsWith("'") && trimmed.endsWith("'"))) {
-        return trimmed.slice(1, -1).trim();
-    }
-    return trimmed;
-}
-function isLoopbackHostname(hostname) {
-    const host = hostname.replace(/^\[|\]$/g, '').toLowerCase();
-    return host === 'localhost' || host === '127.0.0.1' || host === '::1';
-}
 function exampleCallbackUrl(config) {
     const port = config.redirectPorts[0];
     return `http://localhost:${port === 0 ? '<port>' : port}${config.callbackPath}?code=...`;
 }
-function interpretCallbackParams(config, expectedState, error, code, state) {
-    if (error)
-        return new Error(`${config.label} login was rejected: ${error}`);
-    if (state !== expectedState) {
-        // A mismatched state means this callback did not come from the
-        // authorization request we started; the code may be an attacker's.
-        return new Error(`${config.label} login failed: OAuth state mismatch`);
-    }
-    if (!code)
-        return new Error(`${config.label} login failed: no authorization code in callback`);
-    return code;
-}
-/** Characters an authorization code may contain, raw or percent-encoded. */
-const BARE_CODE_PATTERN = /^[A-Za-z0-9._~+/=%-]+$/;
-/**
- * Accepts the callback's query string (`code=...&state=...`) or the bare code.
- *
- * A bare code carries no state to check. That is acceptable here because the
- * user copied it from their own browser into this terminal; the state check
- * guards the loopback listener against codes injected by other pages.
- */
-function interpretPastedCodeOrQuery(raw, config, expectedState) {
-    const notUsable = {
-        kind: 'ignore',
-        message: `Paste the authorization code or the redirected localhost URL (${exampleCallbackUrl(config)}).`,
-    };
-    if (/(^|[?&])(code|error)=/.test(raw)) {
-        const params = new URLSearchParams(raw.replace(/^[?#]/, ''));
-        const result = interpretCallbackParams(config, expectedState, params.get('error'), params.get('code'), params.get('state'));
-        return result instanceof Error ? { kind: 'fail', error: result } : { kind: 'code', code: result };
-    }
-    if (!BARE_CODE_PATTERN.test(raw))
-        return notUsable;
-    try {
-        return { kind: 'code', code: decodeURIComponent(raw) };
-    }
-    catch {
-        return notUsable;
-    }
-}
-function interpretPastedOAuthRedirect(line, config, expectedState) {
-    const raw = stripWrappingQuotes(line);
-    if (!raw)
-        return { kind: 'ignore', message: '' };
-    let url;
-    try {
-        url = new URL(raw);
-    }
-    catch {
-        return interpretPastedCodeOrQuery(raw, config, expectedState);
-    }
-    if (!isLoopbackHostname(url.hostname) || url.pathname !== config.callbackPath) {
-        return {
-            kind: 'ignore',
-            message: `Paste the redirected localhost URL from the address bar (${exampleCallbackUrl(config)}).`,
-        };
-    }
-    const result = interpretCallbackParams(config, expectedState, url.searchParams.get('error'), url.searchParams.get('code'), url.searchParams.get('state'));
-    return result instanceof Error ? { kind: 'fail', error: result } : { kind: 'code', code: result };
-}
-function awaitCallback(config, server, redirectUri, expectedState, options = {}) {
-    return new Promise((resolve, reject) => {
-        let settled = false;
-        let paste;
-        const cleanup = () => {
-            options.signal?.removeEventListener('abort', onAbort);
-            server.off('error', onError);
-            paste?.close();
-        };
-        const doResolve = (value) => {
-            cleanup();
-            resolve(value);
-        };
-        const doReject = (err) => {
-            cleanup();
-            reject(err);
-        };
-        if (options.signal?.aborted) {
-            doReject(new Error(`${config.label} login cancelled`));
-            return;
-        }
-        const onAbort = () => {
-            settled = true;
-            server.close();
-            server.closeAllConnections?.();
-            doReject(new Error(`${config.label} login cancelled`));
-        };
-        options.signal?.addEventListener('abort', onAbort, { once: true });
-        // The callback is single-use. A retried or duplicated request after the
-        // socket has been torn down must not run the handler a second time.
-        server.on('request', (req, res) => {
-            if (settled) {
-                res.destroy();
-                return;
-            }
-            const requestUrl = new URL(req.url || '/', redirectUri);
-            if (requestUrl.pathname !== config.callbackPath) {
-                res.writeHead(404).end();
-                return;
-            }
-            settled = true;
-            const result = interpretCallbackParams(config, expectedState, requestUrl.searchParams.get('error'), requestUrl.searchParams.get('code'), requestUrl.searchParams.get('state'));
-            const failure = result instanceof Error ? result : null;
-            res.writeHead(200, { 'Content-Type': 'text/plain; charset=utf-8', Connection: 'close' });
-            res.end(failure ? `${failure.message}\nYou can close this tab.` : 'Login complete. You can close this tab.');
-            // Free the callback port immediately: a keep-alive browser socket would
-            // otherwise hold it and make the next login attempt fail.
-            server.close();
-            server.closeAllConnections?.();
-            if (failure)
-                doReject(failure);
-            else
-                doResolve(result);
-        });
-        if (options.pasteInput) {
-            paste = readline.createInterface({ input: options.pasteInput, crlfDelay: Infinity });
-            paste.on('line', (line) => {
-                if (settled)
-                    return;
-                const interpreted = interpretPastedOAuthRedirect(line, config, expectedState);
-                if (interpreted.kind === 'ignore') {
-                    if (interpreted.message)
-                        options.onPasteRejected?.(interpreted.message);
-                    return;
-                }
-                settled = true;
-                server.close();
-                server.closeAllConnections?.();
-                if (interpreted.kind === 'fail')
-                    doReject(interpreted.error);
-                else
-                    doResolve(interpreted.code);
-            });
-        }
-        const onError = (err) => {
-            doReject(err);
-        };
-        server.on('error', onError);
-    });
-}
 /**
  * Runs the full browser login and returns the token endpoint's raw response
  * body. Mapping that body into a provider's stored credential shape, and
@@ -240,10 +51,20 @@ export async function runPkceLoopbackLogin(config, options = {}) {
     const state = base64url(crypto.randomBytes(16));
     // Bind before building the URL: the redirect_uri we send must name the port
     // we actually got, or the authorization server will refuse the callback.
-    const { server, port } = await bindLoopbackListener(config);
+    const { server, port } = await bindLoopbackRedirect({
+        ports: config.redirectPorts,
+        label: config.label,
+        portConflictHint: config.portConflictHint,
+    });
     const redirectUri = config.redirectUriFor(port);
+    const flowConfig = {
+        label: config.label,
+        callbackPath: config.callbackPath,
+        redirectUri,
+        exampleCallbackUrl: exampleCallbackUrl(config),
+    };
     const authUrl = buildAuthorizeUrl(config, redirectUri, challenge, state).toString();
-    const callback = awaitCallback(config, server, redirectUri, state, {
+    const callback = awaitLoopbackCallback(server, flowConfig, state, {
         signal: options.signal,
         pasteInput: options.pasteInput,
         onPasteRejected: options.onPasteRejected,
@@ -255,8 +76,7 @@ export async function runPkceLoopbackLogin(config, options = {}) {
         code = await callback;
     }
     catch (error) {
-        server.close();
-        server.closeAllConnections?.();
+        closeLoopbackServer(server);
         throw error;
     }
     const params = {

package/dist/providers/oauth-pkce.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-pkce.js","sourceRoot":"","sources":["../../source/providers/oauth-pkce.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,QAAQ,MAAM,eAAe,CAAC;AACrC,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAuD3C,SAAS,SAAS,CAAC,GAAW;IAC5B,OAAO,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC3F,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC;IAC3G,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC7E,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACxE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACrB,8EAA8E;YAC9E,uEAAuE;YACvE,6EAA6E;QAC/E,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;IACzE,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAuB,EAAE,WAAmB,EAAE,SAAiB,EAAE,KAAa;IACvG,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACnD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;IAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACtD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACvD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,IAAI,EAAE,CAAC,EAAE,CAAC;QAC7E,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,SAAS,oBAAoB,CAAC,MAAuB;IACnD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,OAAO,GAAG,CAAC,KAAa,EAAE,EAAE;YAChC,MAAM,IAAI,GAAG,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;YACzC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;YACnC,MAAM,OAAO,GAAG,CAAC,GAA0B,EAAE,EAAE;gBAC7C,MAAM,CAAC,KAAK,EAAE,CAAC;gBACf,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;oBAC9B,MAAM,CAAC,GAAG,CAAC,CAAC;oBACZ,OAAO;gBACT,CAAC;gBACD,IAAI,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC;oBAC5C,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;oBACnB,OAAO;gBACT,CAAC;gBACD,MAAM,CACJ,IAAI,KAAK,CACP,GAAG,MAAM,CAAC,KAAK,+DAA+D,MAAM,CAAC,aAAa,CAAC,IAAI,CACrG,IAAI,CACL,+FACC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,gBAAgB,GAAG,CAAC,CAAC,CAAC,EAC9D,aAAa,CACd,CACF,CAAC;YACJ,CAAC,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC9B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE;gBACpC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAC7B,iFAAiF;gBACjF,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,EAAG,MAAM,CAAC,OAAO,EAAuB,CAAC,IAAI,EAAE,CAAC,CAAC;YACzE,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;QACF,OAAO,CAAC,CAAC,CAAC,CAAC;IACb,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAC7G,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAgB;IAC1C,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5D,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,CAAC;AACxE,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAuB;IACjD,MAAM,IAAI,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;IACrC,OAAO,oBAAoB,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,MAAM,CAAC,YAAY,WAAW,CAAC;AAC3F,CAAC;AAED,SAAS,uBAAuB,CAC9B,MAAuB,EACvB,aAAqB,EACrB,KAAoB,EACpB,IAAmB,EACnB,KAAoB;IAEpB,IAAI,KAAK;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,MAAM,CAAC,KAAK,wBAAwB,KAAK,EAAE,CAAC,CAAC;IAC5E,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;QAC5B,+DAA+D;QAC/D,mEAAmE;QACnE,OAAO,IAAI,KAAK,CAAC,GAAG,MAAM,CAAC,KAAK,qCAAqC,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,MAAM,CAAC,KAAK,kDAAkD,CAAC,CAAC;IAC/F,OAAO,IAAI,CAAC;AACd,CAAC;AAOD,4EAA4E;AAC5E,MAAM,iBAAiB,GAAG,wBAAwB,CAAC;AAEnD;;;;;;GAMG;AACH,SAAS,0BAA0B,CAAC,GAAW,EAAE,MAAuB,EAAE,aAAqB;IAC7F,MAAM,SAAS,GAAmB;QAChC,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,iEAAiE,kBAAkB,CAAC,MAAM,CAAC,IAAI;KACzG,CAAC;IAEF,IAAI,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,uBAAuB,CACpC,MAAM,EACN,aAAa,EACb,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EACnB,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAClB,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CACpB,CAAC;QACF,OAAO,MAAM,YAAY,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACpG,CAAC;IAED,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACnD,IAAI,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,4BAA4B,CAAC,IAAY,EAAE,MAAuB,EAAE,aAAqB;IAChG,MAAM,GAAG,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAEjD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,0BAA0B,CAAC,GAAG,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC;IAChE,CAAC;IAED,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC,YAAY,EAAE,CAAC;QAC9E,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,4DAA4D,kBAAkB,CAAC,MAAM,CAAC,IAAI;SACpG,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,uBAAuB,CACpC,MAAM,EACN,aAAa,EACb,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EAC7B,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,EAC5B,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAC9B,CAAC;IACF,OAAO,MAAM,YAAY,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AACpG,CAAC;AAED,SAAS,aAAa,CACpB,MAAuB,EACvB,MAAmB,EACnB,WAAmB,EACnB,aAAqB,EACrB,OAAO,GAIH,EAAE;IAEN,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC7C,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,KAAqC,CAAC;QAC1C,MAAM,OAAO,GAAG,GAAG,EAAE;YACnB,OAAO,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACtD,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC7B,KAAK,EAAE,KAAK,EAAE,CAAC;QACjB,CAAC,CAAC;QACF,MAAM,SAAS,GAAG,CAAC,KAAa,EAAE,EAAE;YAClC,OAAO,EAAE,CAAC;YACV,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC,CAAC;QACF,MAAM,QAAQ,GAAG,CAAC,GAAU,EAAE,EAAE;YAC9B,OAAO,EAAE,CAAC;YACV,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC;QACF,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;YAC5B,QAAQ,CAAC,IAAI,KAAK,CAAC,GAAG,MAAM,CAAC,KAAK,kBAAkB,CAAC,CAAC,CAAC;YACvD,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,GAAG,EAAE;YACnB,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,mBAAmB,EAAE,EAAE,CAAC;YAC/B,QAAQ,CAAC,IAAI,KAAK,CAAC,GAAG,MAAM,CAAC,KAAK,kBAAkB,CAAC,CAAC,CAAC;QACzD,CAAC,CAAC;QACF,OAAO,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACnE,wEAAwE;QACxE,oEAAoE;QACpE,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAChC,IAAI,OAAO,EAAE,CAAC;gBACZ,GAAG,CAAC,OAAO,EAAE,CAAC;gBACd,OAAO;YACT,CAAC;YACD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,WAAW,CAAC,CAAC;YACxD,IAAI,UAAU,CAAC,QAAQ,KAAK,MAAM,CAAC,YAAY,EAAE,CAAC;gBAChD,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;gBACzB,OAAO;YACT,CAAC;YACD,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,MAAM,GAAG,uBAAuB,CACpC,MAAM,EACN,aAAa,EACb,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EACpC,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,EACnC,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CACrC,CAAC;YACF,MAAM,OAAO,GAAG,MAAM,YAAY,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;YAExD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;YACzF,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,2BAA2B,CAAC,CAAC,CAAC,yCAAyC,CAAC,CAAC;YAC7G,wEAAwE;YACxE,0DAA0D;YAC1D,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,mBAAmB,EAAE,EAAE,CAAC;YAC/B,IAAI,OAAO;gBAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;;gBAC1B,SAAS,CAAC,MAAgB,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;QAEH,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACvB,KAAK,GAAG,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;YACrF,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;gBACxB,IAAI,OAAO;oBAAE,OAAO;gBACpB,MAAM,WAAW,GAAG,4BAA4B,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC;gBAC9E,IAAI,WAAW,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAClC,IAAI,WAAW,CAAC,OAAO;wBAAE,OAAO,CAAC,eAAe,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;oBACxE,OAAO;gBACT,CAAC;gBACD,OAAO,GAAG,IAAI,CAAC;gBACf,MAAM,CAAC,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,mBAAmB,EAAE,EAAE,CAAC;gBAC/B,IAAI,WAAW,CAAC,IAAI,KAAK,MAAM;oBAAE,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;;oBACxD,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YACnC,CAAC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,OAAO,GAAG,CAAC,GAAU,EAAE,EAAE;YAC7B,QAAQ,CAAC,GAAG,CAAC,CAAC;QAChB,CAAC,CAAC;QACF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,MAAuB,EAAE,OAAO,GAAqB,EAAE;IAChG,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;IACxD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,aAAa,CAAC;IAEzD,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACnF,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IAEhD,4EAA4E;IAC5E,yEAAyE;IACzE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC5D,MAAM,WAAW,GAAG,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC;IAEpF,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE;QACjE,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,eAAe,EAAE,OAAO,CAAC,eAAe;KACzC,CAAC,CAAC;IAEH,OAAO,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC;IAC5B,WAAW,CAAC,OAAO,CAAC,CAAC;IAErB,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC;IACxB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,mBAAmB,EAAE,EAAE,CAAC;QAC/B,MAAM,KAAK,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG;QACb,UAAU,EAAE,oBAAoB;QAChC,IAAI;QACJ,YAAY,EAAE,WAAW;QACzB,aAAa,EAAE,QAAQ;QACvB,SAAS,EAAE,MAAM,CAAC,QAAQ;KAC3B,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,CAAC,oBAAoB,KAAK,MAAM,CAAC;IACvD,2EAA2E;IAC3E,0EAA0E;IAC1E,sDAAsD;IACtD,2FAA2F;IAC3F,MAAM,aAAa,GACjB,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM;QAC7B,CAAC,CAAC,SAAS;QACX,CAAC,CAAE,WAAmB,CAAC,OAAO;YAC9B,CAAC,CAAE,WAAmB,CAAC,OAAO,CAAC,MAAM,CAAC;YACtC,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM;QAChC,CAAC,CAAC,aAAa,IAAK,WAAmB,CAAC,GAAG;YACzC,CAAC,CAAE,WAAmB,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;YAC3D,CAAC,CAAC,OAAO,CAAC,MAAM;QAClB,CAAC,CAAC,aAAa,CAAC;IAClB,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,aAAa,EAAE;QACrD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,mCAAmC,EAAE;QAC/F,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;QAC/E,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,GAAG,MAAM,CAAC,KAAK,sCACb,QAAQ,CAAC,MACX,qFACE,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,qBACjE,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,CAAC,KAAK,uDAAuD,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"oauth-pkce.js","sourceRoot":"","sources":["../../source/providers/oauth-pkce.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,mBAAmB,EACnB,aAAa,GAEd,MAAM,0BAA0B,CAAC;AAElC;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,aAAa,EAAE,CAAC;AA4CzB,SAAS,SAAS,CAAC,GAAW;IAC5B,OAAO,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC3F,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAuB,EAAE,WAAmB,EAAE,SAAiB,EAAE,KAAa;IACvG,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACnD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;IAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACtD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACvD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,IAAI,EAAE,CAAC,EAAE,CAAC;QAC7E,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAuB;IACjD,MAAM,IAAI,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;IACrC,OAAO,oBAAoB,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,MAAM,CAAC,YAAY,WAAW,CAAC;AAC3F,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,MAAuB,EAAE,OAAO,GAAqB,EAAE;IAChG,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;IACxD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,aAAa,CAAC;IAEzD,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACnF,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IAEhD,4EAA4E;IAC5E,yEAAyE;IACzE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,oBAAoB,CAAC;QAClD,KAAK,EAAE,MAAM,CAAC,aAAa;QAC3B,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;KAC1C,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,UAAU,GAAuB;QACrC,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,WAAW;QACX,kBAAkB,EAAE,kBAAkB,CAAC,MAAM,CAAC;KAC/C,CAAC;IACF,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC;IAEpF,MAAM,QAAQ,GAAG,qBAAqB,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE;QAChE,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,eAAe,EAAE,OAAO,CAAC,eAAe;KACzC,CAAC,CAAC;IAEH,OAAO,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC;IAC5B,WAAW,CAAC,OAAO,CAAC,CAAC;IAErB,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC;IACxB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAC5B,MAAM,KAAK,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG;QACb,UAAU,EAAE,oBAAoB;QAChC,IAAI;QACJ,YAAY,EAAE,WAAW;QACzB,aAAa,EAAE,QAAQ;QACvB,SAAS,EAAE,MAAM,CAAC,QAAQ;KAC3B,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,CAAC,oBAAoB,KAAK,MAAM,CAAC;IACvD,2EAA2E;IAC3E,0EAA0E;IAC1E,sDAAsD;IACtD,2FAA2F;IAC3F,MAAM,aAAa,GACjB,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM;QAC7B,CAAC,CAAC,SAAS;QACX,CAAC,CAAE,WAAmB,CAAC,OAAO;YAC9B,CAAC,CAAE,WAAmB,CAAC,OAAO,CAAC,MAAM,CAAC;YACtC,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM;QAChC,CAAC,CAAC,aAAa,IAAK,WAAmB,CAAC,GAAG;YACzC,CAAC,CAAE,WAAmB,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;YAC3D,CAAC,CAAC,OAAO,CAAC,MAAM;QAClB,CAAC,CAAC,aAAa,CAAC;IAClB,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,aAAa,EAAE;QACrD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,mCAAmC,EAAE;QAC/F,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;QAC/E,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,GAAG,MAAM,CAAC,KAAK,sCACb,QAAQ,CAAC,MACX,qFACE,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,qBACjE,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,CAAC,KAAK,uDAAuD,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/providers/openrouter-decisions.d.ts

@@ -0,0 +1,15 @@
+export type DecisionQuestion = {
+    type: 'choice';
+    instructions: string;
+    criteria: Record<string, string>;
+};
+export declare function requestOpenRouterDecisions({ model, state, questions, apiKey, baseUrl, fetchImpl, timeoutMs, }: {
+    model: string;
+    state: unknown;
+    questions: Record<string, DecisionQuestion>;
+    apiKey: string;
+    baseUrl?: string;
+    fetchImpl?: typeof fetch;
+    timeoutMs?: number;
+}): Promise<unknown>;
+//# sourceMappingURL=openrouter-decisions.d.ts.map

package/dist/providers/openrouter-decisions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openrouter-decisions.d.ts","sourceRoot":"","sources":["../../source/providers/openrouter-decisions.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,EAAE,QAAQ,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC,CAAC;AAEF,wBAAsB,0BAA0B,CAAC,EAC/C,KAAK,EACL,KAAK,EACL,SAAS,EACT,MAAM,EACN,OAAwC,EACxC,SAAiB,EACjB,SAAkB,GACnB,EAAE;IACD,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC5C,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,OAAO,CAAC,CAuBnB"}

package/dist/providers/openrouter-decisions.js

@@ -0,0 +1,25 @@
+export async function requestOpenRouterDecisions({ model, state, questions, apiKey, baseUrl = 'https://openrouter.ai/api/v1', fetchImpl = fetch, timeoutMs = 10_000, }) {
+    if (!apiKey)
+        throw new Error('OpenRouter Decisions requires an API key');
+    const endpoint = new URL(baseUrl);
+    const basePath = endpoint.pathname.replace(/\/+$/, '');
+    endpoint.pathname = `${basePath.replace(/\/api\/v1$/, '')}/api/alpha/decisions`;
+    const url = endpoint.toString();
+    const controller = new AbortController();
+    const deadline = setTimeout(() => controller.abort(new Error('OpenRouter Decisions shadow deadline exceeded')), timeoutMs);
+    try {
+        const response = await fetchImpl(url, {
+            method: 'POST',
+            headers: { Authorization: `Bearer ${apiKey}`, 'Content-Type': 'application/json' },
+            body: JSON.stringify({ model, state, questions }),
+            signal: controller.signal,
+        });
+        if (!response.ok)
+            throw new Error(`OpenRouter Decisions returned HTTP ${response.status}`);
+        return await response.json();
+    }
+    finally {
+        clearTimeout(deadline);
+    }
+}
+//# sourceMappingURL=openrouter-decisions.js.map

package/dist/providers/openrouter-decisions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openrouter-decisions.js","sourceRoot":"","sources":["../../source/providers/openrouter-decisions.ts"],"names":[],"mappings":"AAMA,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,EAC/C,KAAK,EACL,KAAK,EACL,SAAS,EACT,MAAM,EACN,OAAO,GAAG,8BAA8B,EACxC,SAAS,GAAG,KAAK,EACjB,SAAS,GAAG,MAAM,GASnB;IACC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IACzE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvD,QAAQ,CAAC,QAAQ,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,sBAAsB,CAAC;IAChF,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC;IAChC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAG,UAAU,CACzB,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC,EAClF,SAAS,CACV,CAAC;IACF,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;YACpC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAClF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;YACjD,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3F,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,QAAQ,CAAC,CAAC;IACzB,CAAC;AACH,CAAC"}

package/dist/services/approval/decision-shadow.d.ts

@@ -0,0 +1,15 @@
+export type DecisionShadowResult = {
+    riskLevel: 'low' | 'medium' | 'high';
+    authorization: 'explicit' | 'implied' | 'weak' | 'unknown';
+    confidence: number;
+    wouldApprove: boolean;
+};
+export declare function evaluateDecisionShadow({ model, evidence, requestCount, apiKey, baseUrl, fetchImpl, }: {
+    model: string;
+    evidence: string;
+    requestCount: number;
+    apiKey: string;
+    baseUrl?: string;
+    fetchImpl?: typeof fetch;
+}): Promise<DecisionShadowResult[]>;
+//# sourceMappingURL=decision-shadow.d.ts.map

package/dist/services/approval/decision-shadow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decision-shadow.d.ts","sourceRoot":"","sources":["../../../source/services/approval/decision-shadow.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,oBAAoB,GAAG;IACjC,SAAS,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;IACrC,aAAa,EAAE,UAAU,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAAC;IAC3D,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,OAAO,CAAC;CACvB,CAAC;AAuCF,wBAAsB,sBAAsB,CAAC,EAC3C,KAAK,EACL,QAAQ,EACR,YAAY,EACZ,MAAM,EACN,OAAO,EACP,SAAS,GACV,EAAE;IACD,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC,CA+ClC"}

package/dist/services/approval/decision-shadow.js

@@ -0,0 +1,77 @@
+import { requestOpenRouterDecisions } from '../../providers/openrouter-decisions.js';
+import { SHELL_AUTO_APPROVAL_INSTRUCTIONS } from '../../prompts/shell-auto-approval.js';
+const RISK_CRITERIA = {
+    low: 'Read-only or easily reversible workspace work',
+    medium: 'Bounded workspace mutation or local process change',
+    high: 'Destructive, external, credential-related, network, or hard-to-verify effect',
+};
+const AUTHORIZATION_CRITERIA = {
+    explicit: 'The user directly requested this action or effect',
+    implied: 'The action is clearly necessary for the requested task',
+    weak: 'The connection to the requested task is tenuous',
+    unknown: 'The available context does not establish user intent',
+};
+function readChoice(answers, key, allowed) {
+    const answer = answers[key];
+    if (!answer || typeof answer !== 'object')
+        throw new Error(`Missing decision answer ${key}`);
+    const record = answer;
+    if (record.type !== 'choice' || !allowed.includes(record.choice)) {
+        throw new Error(`Invalid decision answer ${key}`);
+    }
+    if (typeof record.confidence !== 'number' ||
+        !Number.isFinite(record.confidence) ||
+        record.confidence < 0 ||
+        record.confidence > 1) {
+        throw new Error(`Invalid decision confidence ${key}`);
+    }
+    return { choice: record.choice, confidence: record.confidence };
+}
+export async function evaluateDecisionShadow({ model, evidence, requestCount, apiKey, baseUrl, fetchImpl, }) {
+    const questions = {};
+    for (let index = 0; index < requestCount; index++) {
+        const requestNumber = index + 1;
+        questions[`risk_${index}`] = {
+            type: 'choice',
+            instructions: `Classify the risk of approval request ${requestNumber} in the evidence using the policy.`,
+            criteria: RISK_CRITERIA,
+        };
+        questions[`authorization_${index}`] = {
+            type: 'choice',
+            instructions: `Classify user authorization for approval request ${requestNumber} in the evidence using the policy.`,
+            criteria: AUTHORIZATION_CRITERIA,
+        };
+    }
+    const response = await requestOpenRouterDecisions({
+        model,
+        state: { policy: SHELL_AUTO_APPROVAL_INSTRUCTIONS, evidence },
+        questions,
+        apiKey,
+        ...(baseUrl ? { baseUrl } : {}),
+        ...(fetchImpl ? { fetchImpl } : {}),
+    });
+    if (!response || typeof response !== 'object' || !('answers' in response)) {
+        throw new Error('OpenRouter Decisions response has no answers');
+    }
+    const answers = response.answers;
+    if (!answers || typeof answers !== 'object' || Array.isArray(answers)) {
+        throw new Error('OpenRouter Decisions response has invalid answers');
+    }
+    const answerMap = answers;
+    return Array.from({ length: requestCount }, (_, index) => {
+        const risk = readChoice(answerMap, `risk_${index}`, ['low', 'medium', 'high']);
+        const authorization = readChoice(answerMap, `authorization_${index}`, [
+            'explicit',
+            'implied',
+            'weak',
+            'unknown',
+        ]);
+        return {
+            riskLevel: risk.choice,
+            authorization: authorization.choice,
+            confidence: Math.min(risk.confidence, authorization.confidence),
+            wouldApprove: risk.choice !== 'high' && (authorization.choice === 'explicit' || authorization.choice === 'implied'),
+        };
+    });
+}
+//# sourceMappingURL=decision-shadow.js.map

package/dist/services/approval/decision-shadow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decision-shadow.js","sourceRoot":"","sources":["../../../source/services/approval/decision-shadow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAyB,MAAM,yCAAyC,CAAC;AAC5G,OAAO,EAAE,gCAAgC,EAAE,MAAM,sCAAsC,CAAC;AASxF,MAAM,aAAa,GAAG;IACpB,GAAG,EAAE,+CAA+C;IACpD,MAAM,EAAE,oDAAoD;IAC5D,IAAI,EAAE,8EAA8E;CACrF,CAAC;AACF,MAAM,sBAAsB,GAAG;IAC7B,QAAQ,EAAE,mDAAmD;IAC7D,OAAO,EAAE,wDAAwD;IACjE,IAAI,EAAE,iDAAiD;IACvD,OAAO,EAAE,sDAAsD;CAChE,CAAC;AAEF,SAAS,UAAU,CACjB,OAAgC,EAChC,GAAW,EACX,OAAqB;IAKrB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,EAAE,CAAC,CAAC;IAC7F,MAAM,MAAM,GAAG,MAAiC,CAAC;IACjD,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAW,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,EAAE,CAAC,CAAC;IACpD,CAAC;IACD,IACE,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ;QACrC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC;QACnC,MAAM,CAAC,UAAU,GAAG,CAAC;QACrB,MAAM,CAAC,UAAU,GAAG,CAAC,EACrB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,+BAA+B,GAAG,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAW,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;AACvE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,EAC3C,KAAK,EACL,QAAQ,EACR,YAAY,EACZ,MAAM,EACN,OAAO,EACP,SAAS,GAQV;IACC,MAAM,SAAS,GAAqC,EAAE,CAAC;IACvD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,YAAY,EAAE,KAAK,EAAE,EAAE,CAAC;QAClD,MAAM,aAAa,GAAG,KAAK,GAAG,CAAC,CAAC;QAChC,SAAS,CAAC,QAAQ,KAAK,EAAE,CAAC,GAAG;YAC3B,IAAI,EAAE,QAAQ;YACd,YAAY,EAAE,yCAAyC,aAAa,oCAAoC;YACxG,QAAQ,EAAE,aAAa;SACxB,CAAC;QACF,SAAS,CAAC,iBAAiB,KAAK,EAAE,CAAC,GAAG;YACpC,IAAI,EAAE,QAAQ;YACd,YAAY,EAAE,oDAAoD,aAAa,oCAAoC;YACnH,QAAQ,EAAE,sBAAsB;SACjC,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,0BAA0B,CAAC;QAChD,KAAK;QACL,KAAK,EAAE,EAAE,MAAM,EAAE,gCAAgC,EAAE,QAAQ,EAAE;QAC7D,SAAS;QACT,MAAM;QACN,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpC,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,IAAI,QAAQ,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;IACjC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,SAAS,GAAG,OAAkC,CAAC;IACrD,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE;QACvD,MAAM,IAAI,GAAG,UAAU,CAAC,SAAS,EAAE,QAAQ,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAU,CAAC,CAAC;QACxF,MAAM,aAAa,GAAG,UAAU,CAAC,SAAS,EAAE,iBAAiB,KAAK,EAAE,EAAE;YACpE,UAAU;YACV,SAAS;YACT,MAAM;YACN,SAAS;SACD,CAAC,CAAC;QACZ,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,MAAM;YACtB,aAAa,EAAE,aAAa,CAAC,MAAM;YACnC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,UAAU,CAAC;YAC/D,YAAY,EACV,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,KAAK,UAAU,IAAI,aAAa,CAAC,MAAM,KAAK,SAAS,CAAC;SACxG,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/services/approval/non-interactive-approval-policy.d.ts

@@ -1,6 +1,7 @@
 import type { ApprovalDescriptor } from '../../contracts/conversation.js';
 import type { ConversationAgentClient } from '../conversation-agent-client.js';
 import type { ILoggingService, ISettingsService, ISessionContextService } from '../service-interfaces.js';
+import type { evaluateDecisionShadow } from './decision-shadow.js';
 export declare const NON_INTERACTIVE_REJECTION_REASON = "Non-interactive mode: use --auto-approve to allow tool execution";
 export type NonInteractiveApprovalDecision = {
     answer: 'y';
@@ -15,6 +16,10 @@ export interface NonInteractiveApprovalPolicyDeps {
     agentClient?: ConversationAgentClient;
     logger?: ILoggingService;
     sessionContextService: ISessionContextService;
+    mcpAllowlist?: readonly string[];
+    isMcpTool?: (name: string) => boolean;
+    isMcpAllowed?: (name: string, allowlist: readonly string[]) => boolean;
+    decisionShadow?: typeof evaluateDecisionShadow;
 }
 /**
  * Decides whether a tool approval paused in a non-interactive session can be

package/dist/services/approval/non-interactive-approval-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"non-interactive-approval-policy.d.ts","sourceRoot":"","sources":["../../../source/services/approval/non-interactive-approval-policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAE1E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC/E,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAM1G,eAAO,MAAM,gCAAgC,qEAAqE,CAAC;AAEnH,MAAM,MAAM,8BAA8B,GACtC;IAAE,MAAM,EAAE,GAAG,CAAA;CAAE,GACf;IACE,MAAM,EAAE,GAAG,CAAC;IACZ,eAAe,EAAE,MAAM,CAAC;IACxB,wEAAwE;IACxE,eAAe,EAAE,OAAO,CAAC;CAC1B,CAAC;AAEN,MAAM,WAAW,gCAAgC;IAC/C,eAAe,CAAC,EAAE,gBAAgB,CAAC;IACnC,WAAW,CAAC,EAAE,uBAAuB,CAAC;IACtC,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB,qBAAqB,EAAE,sBAAsB,CAAC;CAC/C;AAaD;;;;GAIG;AACH,qBAAa,4BAA4B;IAC3B,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAjC,YAA6B,IAAI,EAAE,gCAAgC,EAAI;IAEjE,MAAM,CAAC,KAAK,EAAE;QAClB,WAAW,EAAE,OAAO,CAAC;QACrB,QAAQ,EAAE,kBAAkB,CAAC;QAC7B,UAAU,CAAC,EAAE,MAAM,OAAO,EAAE,CAAC;KAC9B,GAAG,OAAO,CAAC,8BAA8B,CAAC,CAiE1C;CACF"}
+{"version":3,"file":"non-interactive-approval-policy.d.ts","sourceRoot":"","sources":["../../../source/services/approval/non-interactive-approval-policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAE1E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC/E,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAK1G,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAEnE,eAAO,MAAM,gCAAgC,qEAAqE,CAAC;AAEnH,MAAM,MAAM,8BAA8B,GACtC;IAAE,MAAM,EAAE,GAAG,CAAA;CAAE,GACf;IACE,MAAM,EAAE,GAAG,CAAC;IACZ,eAAe,EAAE,MAAM,CAAC;IACxB,wEAAwE;IACxE,eAAe,EAAE,OAAO,CAAC;CAC1B,CAAC;AAEN,MAAM,WAAW,gCAAgC;IAC/C,eAAe,CAAC,EAAE,gBAAgB,CAAC;IACnC,WAAW,CAAC,EAAE,uBAAuB,CAAC;IACtC,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB,qBAAqB,EAAE,sBAAsB,CAAC;IAC9C,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IACtC,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,MAAM,EAAE,KAAK,OAAO,CAAC;IACvE,cAAc,CAAC,EAAE,OAAO,sBAAsB,CAAC;CAChD;AAaD;;;;GAIG;AACH,qBAAa,4BAA4B;IAC3B,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAjC,YAA6B,IAAI,EAAE,gCAAgC,EAAI;IAEjE,MAAM,CAAC,KAAK,EAAE;QAClB,WAAW,EAAE,OAAO,CAAC;QACrB,QAAQ,EAAE,kBAAkB,CAAC;QAC7B,UAAU,CAAC,EAAE,MAAM,OAAO,EAAE,CAAC;KAC9B,GAAG,OAAO,CAAC,8BAA8B,CAAC,CA+E1C;CACF"}

package/dist/services/approval/non-interactive-approval-policy.js

@@ -28,6 +28,18 @@ export class NonInteractiveApprovalPolicy {
             return { answer: 'n', rejectionReason: NON_INTERACTIVE_REJECTION_REASON, reportRejection: false };
         }
         const { approval } = input;
+        if (this.deps.isMcpTool?.(approval.toolName) === true) {
+            const allowed = this.deps.mcpAllowlist ?? [];
+            const member = approval.toolName;
+            const matches = this.deps.isMcpAllowed?.(member, allowed) ?? false;
+            return matches
+                ? { answer: 'y' }
+                : {
+                    answer: 'n',
+                    rejectionReason: NON_INTERACTIVE_REJECTION_REASON,
+                    reportRejection: false,
+                };
+        }
         if (approval.toolName !== 'shell' && approval.toolName !== 'bash') {
             return { answer: 'y' };
         }
@@ -63,6 +75,8 @@ export class NonInteractiveApprovalPolicy {
                 agentClient: this.deps.agentClient,
                 logger: this.deps.logger ?? noOpLogger,
                 sessionContextService: this.deps.sessionContextService,
+                awaitDecisionShadow: true,
+                decisionShadow: this.deps.decisionShadow,
             });
             const advisory = advisories.get(callId);
             if (advisory?.approved) {

package/dist/services/approval/non-interactive-approval-policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"non-interactive-approval-policy.js","sourceRoot":"","sources":["../../../source/services/approval/non-interactive-approval-policy.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,uBAAuB,EAAE,MAAM,2CAA2C,CAAC;AACpF,OAAO,EAAE,YAAY,EAAE,MAAM,+CAA+C,CAAC;AAC7E,OAAO,EAAE,mCAAmC,EAAE,MAAM,oCAAoC,CAAC;AACzF,OAAO,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAEtE,MAAM,CAAC,MAAM,gCAAgC,GAAG,kEAAkE,CAAC;AAkBnH,MAAM,UAAU,GAAoB;IAClC,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC;IACf,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC;IACd,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC;IACd,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC;IACf,QAAQ,EAAE,GAAG,EAAE,GAAE,CAAC;IAClB,gBAAgB,EAAE,GAAG,EAAE,GAAE,CAAC;IAC1B,gBAAgB,EAAE,GAAG,EAAE,CAAC,SAAS;IACjC,kBAAkB,EAAE,GAAG,EAAE,GAAE,CAAC;CAC7B,CAAC;AAEF;;;;GAIG;AACH,MAAM,OAAO,4BAA4B;IACV,IAAI;IAAjC,YAA6B,IAAsC;oBAAtC,IAAI;IAAqC,CAAC;IAEvE,KAAK,CAAC,MAAM,CAAC,KAIZ;QACC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;YACvB,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,eAAe,EAAE,gCAAgC,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;QACpG,CAAC;QAED,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;QAC3B,IAAI,QAAQ,CAAC,QAAQ,KAAK,OAAO,IAAI,QAAQ,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;YAClE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QACzB,CAAC;QAED,MAAM,OAAO,GAAG,QAAQ,CAAC,aAAa,CAAC;QACvC,MAAM,cAAc,GAAG,uBAAuB,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1E,IAAI,cAAc,CAAC,MAAM,KAAK,YAAY,CAAC,GAAG,EAAE,CAAC;YAC/C,OAAO;gBACL,MAAM,EAAE,GAAG;gBACX,eAAe,EAAE,iGAAiG,OAAO,EAAE;gBAC3H,eAAe,EAAE,IAAI;aACtB,CAAC;QACJ,CAAC;QAED,IAAI,cAAc,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM,EAAE,CAAC;YAClD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QACzB,CAAC;QAED,MAAM,gBAAgB,GACpB,IAAI,CAAC,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW;YAChD,CAAC,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;YACzD,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,OAAO;gBACL,MAAM,EAAE,GAAG;gBACX,eAAe,EAAE,wGAAwG,OAAO,EAAE;gBAClI,eAAe,EAAE,IAAI;aACtB,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,CAAwB,CAAC;QACpE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,IAAI,YAAY,CAAC;YAC/C,MAAM,UAAU,GAAG,MAAM,mCAAmC,CAAC;gBAC3D,QAAQ,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;gBACnC,OAAO;gBACP,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe;gBAC1C,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAY;gBACnC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,UAAU;gBACtC,qBAAqB,EAAE,IAAI,CAAC,IAAI,CAAC,qBAAqB;aACvD,CAAC,CAAC;YACH,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACxC,IAAI,QAAQ,EAAE,QAAQ,EAAE,CAAC;gBACvB,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;YACzB,CAAC;YACD,OAAO;gBACL,MAAM,EAAE,GAAG;gBACX,eAAe,EAAE,wCAAwC,QAAQ,EAAE,SAAS,IAAI,uBAAuB,EAAE;gBACzG,eAAe,EAAE,IAAI;aACtB,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,MAAM,EAAE,GAAG;gBACX,eAAe,EAAE,wCACf,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE;gBACF,eAAe,EAAE,IAAI;aACtB,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"non-interactive-approval-policy.js","sourceRoot":"","sources":["../../../source/services/approval/non-interactive-approval-policy.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,uBAAuB,EAAE,MAAM,2CAA2C,CAAC;AACpF,OAAO,EAAE,YAAY,EAAE,MAAM,+CAA+C,CAAC;AAC7E,OAAO,EAAE,mCAAmC,EAAE,MAAM,oCAAoC,CAAC;AACzF,OAAO,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAGtE,MAAM,CAAC,MAAM,gCAAgC,GAAG,kEAAkE,CAAC;AAsBnH,MAAM,UAAU,GAAoB;IAClC,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC;IACf,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC;IACd,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC;IACd,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC;IACf,QAAQ,EAAE,GAAG,EAAE,GAAE,CAAC;IAClB,gBAAgB,EAAE,GAAG,EAAE,GAAE,CAAC;IAC1B,gBAAgB,EAAE,GAAG,EAAE,CAAC,SAAS;IACjC,kBAAkB,EAAE,GAAG,EAAE,GAAE,CAAC;CAC7B,CAAC;AAEF;;;;GAIG;AACH,MAAM,OAAO,4BAA4B;IACV,IAAI;IAAjC,YAA6B,IAAsC;oBAAtC,IAAI;IAAqC,CAAC;IAEvE,KAAK,CAAC,MAAM,CAAC,KAIZ;QACC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;YACvB,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,eAAe,EAAE,gCAAgC,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;QACpG,CAAC;QAED,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;QAC3B,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC;YACtD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC;YAC7C,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC;YACjC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,KAAK,CAAC;YACnE,OAAO,OAAO;gBACZ,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE;gBACjB,CAAC,CAAC;oBACE,MAAM,EAAE,GAAG;oBACX,eAAe,EAAE,gCAAgC;oBACjD,eAAe,EAAE,KAAK;iBACvB,CAAC;QACR,CAAC;QACD,IAAI,QAAQ,CAAC,QAAQ,KAAK,OAAO,IAAI,QAAQ,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;YAClE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QACzB,CAAC;QAED,MAAM,OAAO,GAAG,QAAQ,CAAC,aAAa,CAAC;QACvC,MAAM,cAAc,GAAG,uBAAuB,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1E,IAAI,cAAc,CAAC,MAAM,KAAK,YAAY,CAAC,GAAG,EAAE,CAAC;YAC/C,OAAO;gBACL,MAAM,EAAE,GAAG;gBACX,eAAe,EAAE,iGAAiG,OAAO,EAAE;gBAC3H,eAAe,EAAE,IAAI;aACtB,CAAC;QACJ,CAAC;QAED,IAAI,cAAc,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM,EAAE,CAAC;YAClD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QACzB,CAAC;QAED,MAAM,gBAAgB,GACpB,IAAI,CAAC,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW;YAChD,CAAC,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;YACzD,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,OAAO;gBACL,MAAM,EAAE,GAAG;gBACX,eAAe,EAAE,wGAAwG,OAAO,EAAE;gBAClI,eAAe,EAAE,IAAI;aACtB,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,CAAwB,CAAC;QACpE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,IAAI,YAAY,CAAC;YAC/C,MAAM,UAAU,GAAG,MAAM,mCAAmC,CAAC;gBAC3D,QAAQ,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;gBACnC,OAAO;gBACP,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe;gBAC1C,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAY;gBACnC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,UAAU;gBACtC,qBAAqB,EAAE,IAAI,CAAC,IAAI,CAAC,qBAAqB;gBACtD,mBAAmB,EAAE,IAAI;gBACzB,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,cAAc;aACzC,CAAC,CAAC;YACH,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACxC,IAAI,QAAQ,EAAE,QAAQ,EAAE,CAAC;gBACvB,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;YACzB,CAAC;YACD,OAAO;gBACL,MAAM,EAAE,GAAG;gBACX,eAAe,EAAE,wCAAwC,QAAQ,EAAE,SAAS,IAAI,uBAAuB,EAAE;gBACzG,eAAe,EAAE,IAAI;aACtB,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,MAAM,EAAE,GAAG;gBACX,eAAe,EAAE,wCACf,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE;gBACF,eAAe,EAAE,IAAI;aACtB,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/services/approval/shell-auto-approval-evaluator.d.ts

@@ -4,6 +4,7 @@ import type { ILoggingService, ISettingsService, ISessionContextService } from '
 import { SHELL_AUTO_APPROVAL_PROMPT_VERSION } from '../../prompts/shell-auto-approval.js';
 import type { ShellAutoApprovalAgentClient } from '../conversation-agent-client.js';
 import type { SessionAccessState } from '../session/session-access-state.js';
+import { evaluateDecisionShadow } from './decision-shadow.js';
 export type ShellAutoApprovalCommand = {
     id: string;
     command?: string;
@@ -20,7 +21,7 @@ export type ShellAutoApprovalManualDecision = {
 };
 export type ShellAutoApprovalAdvisory = LLMAdvisory;
 export { SHELL_AUTO_APPROVAL_PROMPT_VERSION };
-export declare function evaluateShellAutoApprovalAdvisories({ commands, history, manualDecisions, settingsService, agentClient, logger, sessionContextService, sessionAccess, throwOnError, retryOptions, }: {
+export declare function evaluateShellAutoApprovalAdvisories({ commands, history, manualDecisions, settingsService, agentClient, logger, sessionContextService, sessionAccess, throwOnError, retryOptions, decisionShadow, awaitDecisionShadow, }: {
     commands: ShellAutoApprovalCommand[];
     history: ProviderInputItem[];
     /** Recent manual approve/reject decisions this session, offered as precedent. */
@@ -35,5 +36,8 @@ export declare function evaluateShellAutoApprovalAdvisories({ commands, history,
         sleep?: (ms: number) => Promise<void>;
         random?: () => number;
     };
+    decisionShadow?: typeof evaluateDecisionShadow;
+    /** Non-interactive callers wait for comparison telemetry before process exit. */
+    awaitDecisionShadow?: boolean;
 }): Promise<Map<string, ShellAutoApprovalAdvisory>>;
 //# sourceMappingURL=shell-auto-approval-evaluator.d.ts.map

package/dist/services/approval/shell-auto-approval-evaluator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shell-auto-approval-evaluator.d.ts","sourceRoot":"","sources":["../../../source/services/approval/shell-auto-approval-evaluator.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAC3E,OAAO,KAAK,EACV,WAAW,EAKZ,MAAM,iCAAiC,CAAC;AAEzC,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAC1G,OAAO,EAEL,kCAAkC,EACnC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,iCAAiC,CAAC;AACpF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAK7E,MAAM,MAAM,wBAAwB,GAAG;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,+BAA+B,GAAG;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,UAAU,GAAG,UAAU,CAAC;CACnC,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG,WAAW,CAAC;AAEpD,OAAO,EAAE,kCAAkC,EAAE,CAAC;AAqX9C,wBAAsB,mCAAmC,CAAC,EACxD,QAAQ,EACR,OAAO,EACP,eAAe,EACf,eAAe,EACf,WAAW,EACX,MAAM,EACN,qBAAqB,EACrB,aAAa,EACb,YAAoB,EACpB,YAAY,GACb,EAAE;IACD,QAAQ,EAAE,wBAAwB,EAAE,CAAC;IACrC,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,iFAAiF;IACjF,eAAe,CAAC,EAAE,+BAA+B,EAAE,CAAC;IACpD,eAAe,CAAC,EAAE,gBAAgB,CAAC;IACnC,WAAW,EAAE,4BAA4B,CAAC;IAC1C,MAAM,EAAE,eAAe,CAAC;IACxB,qBAAqB,EAAE,sBAAsB,CAAC;IAC9C,aAAa,CAAC,EAAE,kBAAkB,CAAC;IACnC,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,YAAY,CAAC,EAAE;QACb,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC;KACvB,CAAC;CACH,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC,CAmPlD"}
+{"version":3,"file":"shell-auto-approval-evaluator.d.ts","sourceRoot":"","sources":["../../../source/services/approval/shell-auto-approval-evaluator.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAC3E,OAAO,KAAK,EACV,WAAW,EAKZ,MAAM,iCAAiC,CAAC;AAEzC,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAC1G,OAAO,EAEL,kCAAkC,EACnC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,iCAAiC,CAAC;AACpF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAI7E,OAAO,EAAE,sBAAsB,EAA6B,MAAM,sBAAsB,CAAC;AAEzF,MAAM,MAAM,wBAAwB,GAAG;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,+BAA+B,GAAG;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,UAAU,GAAG,UAAU,CAAC;CACnC,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG,WAAW,CAAC;AAEpD,OAAO,EAAE,kCAAkC,EAAE,CAAC;AAuX9C,wBAAsB,mCAAmC,CAAC,EACxD,QAAQ,EACR,OAAO,EACP,eAAe,EACf,eAAe,EACf,WAAW,EACX,MAAM,EACN,qBAAqB,EACrB,aAAa,EACb,YAAoB,EACpB,YAAY,EACZ,cAAuC,EACvC,mBAA2B,GAC5B,EAAE;IACD,QAAQ,EAAE,wBAAwB,EAAE,CAAC;IACrC,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,iFAAiF;IACjF,eAAe,CAAC,EAAE,+BAA+B,EAAE,CAAC;IACpD,eAAe,CAAC,EAAE,gBAAgB,CAAC;IACnC,WAAW,EAAE,4BAA4B,CAAC;IAC1C,MAAM,EAAE,eAAe,CAAC;IACxB,qBAAqB,EAAE,sBAAsB,CAAC;IAC9C,aAAa,CAAC,EAAE,kBAAkB,CAAC;IACnC,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,YAAY,CAAC,EAAE;QACb,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC;KACvB,CAAC;IACF,cAAc,CAAC,EAAE,OAAO,sBAAsB,CAAC;IAC/C,iFAAiF;IACjF,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC,CA2TlD"}