@rallycry/conveyor-agent 8.4.1 → 8.5.1

package/dist/{chunk-VDH55LTT.js → chunk-6B545CHM.js}

@@ -95,22 +95,31 @@ function parseEnvelope(line) {
   }
   if (typeof parsed !== "object" || parsed === null) return null;
   const record = parsed;
+  if (record.kind === "pre_tool_use") {
+    if (typeof record.id !== "string" || typeof record.tool_name !== "string") return null;
+    const toolInput = typeof record.tool_input === "object" && record.tool_input !== null ? record.tool_input : {};
+    return {
+      kind: "pre_tool_use",
+      request: { id: record.id, tool_name: record.tool_name, tool_input: toolInput }
+    };
+  }
   const result = {};
   if (typeof record.tool_name === "string") result.tool_name = record.tool_name;
   if (typeof record.elapsed_time_seconds === "number") {
     result.elapsed_time_seconds = record.elapsed_time_seconds;
   }
-  return result;
+  return { kind: "progress", progress: result };
 }
 var HookSocketServer = class {
-  constructor(socketPath, onProgress) {
+  constructor(socketPath, onProgress, onPreToolUse) {
     this.socketPath = socketPath;
     this.onProgress = onProgress;
+    this.onPreToolUse = onPreToolUse;
   }
   socketPath;
   onProgress;
+  onPreToolUse;
   server = null;
-  buffer = "";
   _closed = false;
   async listen() {
     await unlink(this.socketPath).catch(() => void 0);
@@ -142,19 +151,41 @@ var HookSocketServer = class {
   }
   handleConnection(socket) {
     socket.on("error", () => void 0);
+    let buffer = "";
     socket.on("data", (chunk) => {
-      this.buffer += chunk.toString("utf8");
-      this.ingest();
+      buffer += chunk.toString("utf8");
+      let index = buffer.indexOf("\n");
+      while (index >= 0) {
+        const line = buffer.slice(0, index);
+        buffer = buffer.slice(index + 1);
+        this.dispatch(line, socket);
+        index = buffer.indexOf("\n");
+      }
     });
   }
-  ingest() {
-    let index = this.buffer.indexOf("\n");
-    while (index >= 0) {
-      const line = this.buffer.slice(0, index);
-      this.buffer = this.buffer.slice(index + 1);
-      const progress = parseEnvelope(line);
-      if (progress) this.onProgress(progress);
-      index = this.buffer.indexOf("\n");
+  dispatch(line, socket) {
+    const envelope = parseEnvelope(line);
+    if (!envelope) return;
+    if (envelope.kind === "progress") {
+      this.onProgress(envelope.progress);
+      return;
+    }
+    void this.respondToPreToolUse(envelope.request, socket);
+  }
+  async respondToPreToolUse(request, socket) {
+    let verdict;
+    try {
+      verdict = this.onPreToolUse ? await this.onPreToolUse(request) : { decision: "allow" };
+    } catch (err) {
+      verdict = {
+        decision: "deny",
+        reason: `Conveyor validation failed: ${err instanceof Error ? err.message : String(err)}. Fix the issue and try again.`
+      };
+    }
+    try {
+      socket.write(`${JSON.stringify({ id: request.id, ...verdict })}
+`);
+    } catch {
     }
   }
 };
@@ -380,6 +411,9 @@ function buildSpawnArgs(input) {
     args.push("--permission-mode", "plan");
   }
   args.push("--settings", input.settingsPath);
+  if (input.appendSystemPrompt) {
+    args.push("--append-system-prompt", input.appendSystemPrompt);
+  }
   if (input.mcpConfigPath) {
     args.push("--mcp-config", input.mcpConfigPath);
     if (input.strictMcpConfig) {
@@ -434,8 +468,33 @@ function projectSlug(cwd) {
 function sessionTranscriptPath(cwd, sessionId) {
   return join(claudeConfigHome(), "projects", projectSlug(cwd), `${sessionId}.jsonl`);
 }
+function configHomePlansDir() {
+  return join(claudeConfigHome(), "plans");
+}
+var ALLOW_RULES = [
+  "Bash",
+  "BashOutput",
+  "Edit",
+  "Write",
+  "Read",
+  "Glob",
+  "Grep",
+  "WebFetch",
+  "WebSearch",
+  "NotebookEdit",
+  "Task",
+  "TodoWrite",
+  "ToolSearch",
+  "KillShell",
+  "SlashCommand",
+  "Skill",
+  "mcp__conveyor__*"
+];
 var HOOK_HELPER_SOURCE = `"use strict";
 const net = require("node:net");
+const crypto = require("node:crypto");
+
+const PRE_TOOL_USE_TIMEOUT_MS = 110000;
 
 let raw = "";
 process.stdin.setEncoding("utf8");
@@ -443,17 +502,21 @@ process.stdin.on("data", (chunk) => {
   raw += chunk;
 });
 process.stdin.on("end", () => {
-  let toolName = "";
+  let payload = {};
   try {
     const parsed = JSON.parse(raw);
-    if (parsed && typeof parsed.tool_name === "string") toolName = parsed.tool_name;
+    if (parsed && typeof parsed === "object") payload = parsed;
   } catch {
-    toolName = "";
+    payload = {};
+  }
+  if (payload.hook_event_name === "PreToolUse") {
+    preToolUse(payload);
+  } else {
+    relayProgress(typeof payload.tool_name === "string" ? payload.tool_name : "");
   }
-  relay(toolName);
 });
 
-function relay(toolName) {
+function relayProgress(toolName) {
   const socketPath = process.env.CONVEYOR_HOOK_SOCKET;
   let done = false;
   const finish = () => {
@@ -485,6 +548,76 @@ function relay(toolName) {
     finish();
   });
 }
+
+function preToolUse(payload) {
+  const socketPath = process.env.CONVEYOR_HOOK_SOCKET;
+  let done = false;
+  const respond = (decision, reason) => {
+    if (done) return;
+    done = true;
+    process.stdout.write(
+      JSON.stringify({
+        hookSpecificOutput: {
+          hookEventName: "PreToolUse",
+          permissionDecision: decision,
+          ...(reason ? { permissionDecisionReason: reason } : {}),
+        },
+      }),
+    );
+    process.exit(0);
+  };
+  const denyUnavailable = () =>
+    respond(
+      "deny",
+      "Conveyor validation is unavailable right now. Wait a moment and call the tool again.",
+    );
+  if (!socketPath) {
+    denyUnavailable();
+    return;
+  }
+  const id = crypto.randomBytes(8).toString("hex");
+  const timer = setTimeout(denyUnavailable, PRE_TOOL_USE_TIMEOUT_MS);
+  const client = net.connect(socketPath, () => {
+    client.write(
+      JSON.stringify({
+        kind: "pre_tool_use",
+        id,
+        tool_name: typeof payload.tool_name === "string" ? payload.tool_name : "",
+        tool_input:
+          payload.tool_input && typeof payload.tool_input === "object" ? payload.tool_input : {},
+      }) + "\\n",
+    );
+  });
+  let buffer = "";
+  client.on("data", (chunk) => {
+    buffer += chunk.toString("utf8");
+    let index = buffer.indexOf("\\n");
+    while (index >= 0) {
+      const line = buffer.slice(0, index);
+      buffer = buffer.slice(index + 1);
+      try {
+        const verdict = JSON.parse(line);
+        if (verdict && verdict.id === id) {
+          clearTimeout(timer);
+          client.end();
+          respond(verdict.decision === "allow" ? "allow" : "deny", verdict.reason);
+          return;
+        }
+      } catch {
+        /* keep scanning */
+      }
+      index = buffer.indexOf("\\n");
+    }
+  });
+  client.on("error", () => {
+    clearTimeout(timer);
+    denyUnavailable();
+  });
+  client.on("close", () => {
+    clearTimeout(timer);
+    denyUnavailable();
+  });
+}
 `;
 async function writeHookSettings(dir) {
   const helperPath = join(dir, "hook-helper.cjs");
@@ -493,21 +626,24 @@ async function writeHookSettings(dir) {
   await writeFile(helperPath, HOOK_HELPER_SOURCE, "utf8");
   await chmod(helperPath, 493);
   const settings = {
-    // Auto-approve the Conveyor MCP tools so the interactive (PTY) agent never
-    // stops to prompt the viewer for them. `mcp__conveyor__*` is the ONLY valid
-    // allow form in Claude Code ≥2.1.170 — the glob is permitted only in the
-    // tool position after a literal `mcp__<server>__` prefix. A bare `"*"` (and
-    // an unanchored `"mcp__conveyor"`) is rejected as an invalid rule, which
-    // parks the TUI on a blocking "Settings Warning" screen.
-    // Built-in tool auto-approval is NOT carried by this list — the spawn flags
-    // handle it: discovery/plan mode passes `--permission-mode plan` (read-only,
-    // no write prompts) and build mode passes `--dangerously-skip-permissions`
-    // (which ignores the allow-list entirely). So this list only needs the MCP
-    // glob, which plan mode would otherwise prompt for.
+    // Auto-approve tool calls so the interactive (PTY) agent never stops to
+    // prompt the viewer. This only suppresses per-tool approval prompts — it
+    // does NOT relax the planning gate: in discovery/plan mode the spawn passes
+    // `--permission-mode plan`, which keeps the agent read-only (no edits/commits
+    // until it exits plan mode) regardless of this allow-list. In build mode the
+    // spawn already bypasses prompts via `--dangerously-skip-permissions`.
+    // NOTE: a bare "*" rule is INVALID (the CLI rejects it and parks the TUI on
+    // a Settings Warning dialog at boot) — hence the explicit ALLOW_RULES list.
     permissions: {
-      allow: ["mcp__conveyor__*"]
+      allow: ALLOW_RULES
     },
     hooks: {
+      PreToolUse: [
+        {
+          matcher: "ExitPlanMode",
+          hooks: [{ type: "command", command: `node ${JSON.stringify(helperPath)}`, timeout: 120 }]
+        }
+      ],
       PostToolUse: [
         {
           matcher: "*",
@@ -520,6 +656,58 @@ async function writeHookSettings(dir) {
   return { settingsPath, helperPath };
 }
 
+// src/harness/pty/output-coalescer.ts
+var DEFAULT_FLUSH_MS = 40;
+var DEFAULT_MAX_BUFFER_CHARS = 48 * 1024;
+var PtyOutputCoalescer = class {
+  constructor(sink, getDims, flushMs = DEFAULT_FLUSH_MS, maxBufferChars = DEFAULT_MAX_BUFFER_CHARS) {
+    this.sink = sink;
+    this.getDims = getDims;
+    this.flushMs = flushMs;
+    this.maxBufferChars = maxBufferChars;
+  }
+  sink;
+  getDims;
+  flushMs;
+  maxBufferChars;
+  buffer = "";
+  timer = null;
+  disposed = false;
+  /** Buffer a chunk; flushes synchronously when the size threshold is hit. */
+  write(data) {
+    if (this.disposed || data === "") return;
+    this.buffer += data;
+    if (this.buffer.length >= this.maxBufferChars) {
+      this.flush();
+      return;
+    }
+    if (!this.timer) {
+      this.timer = setTimeout(() => {
+        this.flush();
+      }, this.flushMs);
+    }
+  }
+  /** Ship the buffered bytes now (no-op when empty). Dims are read at flush
+   *  time so a mid-buffer resize stamps the frame with the dims it will render
+   *  under. */
+  flush() {
+    if (this.timer) {
+      clearTimeout(this.timer);
+      this.timer = null;
+    }
+    if (this.buffer === "") return;
+    const data = this.buffer;
+    this.buffer = "";
+    this.sink(data, this.getDims());
+  }
+  /** Final flush, then drop any future writes (session torn down). Idempotent. */
+  dispose() {
+    if (this.disposed) return;
+    this.flush();
+    this.disposed = true;
+  }
+};
+
 // src/harness/pty/tool-server.ts
 import { createServer as createServer2 } from "http";
 import { writeFile as writeFile2 } from "fs/promises";
@@ -659,9 +847,16 @@ function inheritedEnv(socketPath) {
   env.CONVEYOR_HOOK_SOCKET = socketPath;
   return env;
 }
-function buildPromptBytes(text, delivery) {
-  const paste = `\x1B[200~${text}\x1B[201~`;
-  return delivery === "prefill" ? paste : `${paste}\r`;
+function buildPromptBytes(text) {
+  return `\x1B[200~${text}\x1B[201~`;
+}
+var SUBMIT_SETTLE_MS = 300;
+var SUBMIT_NUDGE_INTERVAL_MS = 2e3;
+var SUBMIT_NUDGE_MAX_PRESSES = 5;
+function sleep(ms) {
+  return new Promise((resolve) => {
+    setTimeout(resolve, ms);
+  });
 }
 async function transcriptSize(path) {
   try {
@@ -691,6 +886,7 @@ var PtySession = class {
   // CLI exits before emitting a result (the bytes are otherwise relayed to S5
   // and never become events). Trimmed to MAX_DIAGNOSTIC_OUTPUT on every write.
   recentOutput = "";
+  coalescer = null;
   _toreDown = false;
   exitListeners = [];
   idleListeners = [];
@@ -703,6 +899,12 @@ var PtySession = class {
   // plus the path to the `--mcp-config` that points at them.
   toolServers = [];
   mcpConfigPath = null;
+  // Plan-dialog auto-accept state (see armPlanDialogAutoAccept).
+  pendingPlanApproval = false;
+  planApprovalTimer = null;
+  // Submit-nudge state (see armSubmitNudge).
+  pendingSubmitNudge = false;
+  submitNudgeTimer = null;
   onIdle(listener) {
     this.idleListeners.push(listener);
   }
@@ -731,7 +933,11 @@ var PtySession = class {
     try {
       this.tempDir = await mkdtemp(join3(tmpdir(), "conveyor-pty-"));
       const socketPath = join3(this.tempDir, "hook.sock");
-      this.socket = new HookSocketServer(socketPath, (progress) => this.handleProgress(progress));
+      this.socket = new HookSocketServer(
+        socketPath,
+        (progress) => this.handleProgress(progress),
+        (request) => this.handlePreToolUse(request)
+      );
       await this.socket.listen();
       const { settingsPath } = await writeHookSettings(this.tempDir);
       await this.setupToolServers();
@@ -777,6 +983,8 @@ var PtySession = class {
   async teardown() {
     if (this._toreDown) return;
     this._toreDown = true;
+    this.disarmPlanDialogAutoAccept();
+    this.disarmSubmitNudge();
     this.unsubInput?.();
     this.unsubInput = null;
     this.unsubResize?.();
@@ -790,6 +998,8 @@ var PtySession = class {
     } catch {
     }
     this.pty = null;
+    this.coalescer?.dispose();
+    this.coalescer = null;
     this.tailer?.close();
     this.tailer = null;
     if (this.socket) {
@@ -831,6 +1041,7 @@ var PtySession = class {
       model: this.options.model,
       permissionMode: this.options.permissionMode,
       settingsPath,
+      ...this.options.appendSystemPrompt ? { appendSystemPrompt: this.options.appendSystemPrompt } : {},
       // Only this config: ignore the user's ~/.claude.json / project .mcp.json
       // so the agent's tool set is deterministic (and a stale personal conveyor
       // server doesn't load).
@@ -844,8 +1055,17 @@ var PtySession = class {
       cwd: this.options.cwd,
       env: inheritedEnv(socketPath)
     });
+    const bridge = this.bridge;
+    if (bridge) {
+      this.coalescer = new PtyOutputCoalescer(
+        (data, dims) => {
+          bridge.sendOutput(data, dims);
+        },
+        () => ({ cols: this.cols, rows: this.rows })
+      );
+    }
     pty.onData((data) => {
-      this.bridge?.sendOutput(data, { cols: this.cols, rows: this.rows });
+      this.coalescer?.write(data);
       this.recentOutput = (this.recentOutput + data).slice(-MAX_DIAGNOSTIC_OUTPUT);
     });
     pty.onExit((event) => {
@@ -853,18 +1073,54 @@ var PtySession = class {
     });
     this.pty = pty;
   }
-  deliverPrompt(text) {
-    this.writeStdin(buildPromptBytes(text, this.options.promptDelivery));
+  async deliverPrompt(text) {
+    this.writeStdin(buildPromptBytes(text));
+    if (this.options.promptDelivery === "prefill") return;
+    await sleep(SUBMIT_SETTLE_MS);
+    if (this._toreDown) return;
+    this.writeStdin("\r");
+    this.armSubmitNudge();
   }
   async feedPrompt() {
     if (typeof this.prompt === "string") {
-      this.deliverPrompt(this.prompt);
+      await this.deliverPrompt(this.prompt);
       return;
     }
     for await (const message of this.prompt) {
       const content = message.message.content;
       const text = typeof content === "string" ? content : JSON.stringify(content);
-      this.deliverPrompt(text);
+      await this.deliverPrompt(text);
+    }
+  }
+  /**
+   * Even as a separate write, the submitting Enter can race CLI startup and
+   * be swallowed, leaving the pasted prompt parked in the input box with
+   * nothing to un-park it (the 45s parked-TUI watchdog only reports status).
+   * Until the first transcript record proves the turn started, re-press Enter
+   * on a bounded interval. Enter on an empty or mid-turn input box is a no-op.
+   * Deliberate trade-off (same as the plan-dialog auto-accept below): a press
+   * can accept the default of an unexpected startup dialog — in a headless
+   * pod that unblocks the run rather than parking it forever.
+   */
+  armSubmitNudge() {
+    if (this.submitNudgeTimer) return;
+    this.pendingSubmitNudge = true;
+    let presses = 0;
+    const press = () => {
+      if (this._toreDown || !this.pendingSubmitNudge || presses >= SUBMIT_NUDGE_MAX_PRESSES) {
+        this.disarmSubmitNudge();
+        return;
+      }
+      presses++;
+      this.writeStdin("\r");
+    };
+    this.submitNudgeTimer = setInterval(press, SUBMIT_NUDGE_INTERVAL_MS);
+  }
+  disarmSubmitNudge() {
+    this.pendingSubmitNudge = false;
+    if (this.submitNudgeTimer) {
+      clearInterval(this.submitNudgeTimer);
+      this.submitNudgeTimer = null;
     }
   }
   handleProgress(progress) {
@@ -874,7 +1130,57 @@ var PtySession = class {
       ...progress.elapsed_time_seconds === void 0 ? {} : { elapsed_time_seconds: progress.elapsed_time_seconds }
     });
   }
+  /**
+   * PreToolUse request from the hook helper → the runner's `canUseTool`
+   * verdict. Only ExitPlanMode is matched by the settings hook, so this is
+   * the Conveyor plan-exit gate (validation + identification trigger run
+   * inside the callback). Absent callback → allow (mirrors the SDK default).
+   */
+  async handlePreToolUse(request) {
+    const canUseTool = this.options.canUseTool;
+    let verdict;
+    if (canUseTool) {
+      const result = await canUseTool(request.tool_name, request.tool_input);
+      verdict = result.behavior === "allow" ? { decision: "allow" } : { decision: "deny", reason: result.message };
+    } else {
+      verdict = { decision: "allow" };
+    }
+    if (verdict.decision === "allow" && request.tool_name === "ExitPlanMode" && this.options.planDialogAutoAccept) {
+      this.armPlanDialogAutoAccept();
+    }
+    return verdict;
+  }
+  /**
+   * A hook "allow" does not bypass the CLI's plan-approval dialog — it renders
+   * right after the verdict. Press Enter (default: "Yes, auto-accept edits")
+   * until the turn resumes; the next transcript record only lands once the
+   * dialog is answered, so it doubles as the stop signal.
+   */
+  armPlanDialogAutoAccept() {
+    if (this.planApprovalTimer) return;
+    this.pendingPlanApproval = true;
+    let presses = 0;
+    const press = () => {
+      if (this._toreDown || !this.pendingPlanApproval || presses >= 6) {
+        this.disarmPlanDialogAutoAccept();
+        return;
+      }
+      presses++;
+      this.writeStdin("\r");
+    };
+    this.planApprovalTimer = setInterval(press, 1500);
+    setTimeout(press, 700);
+  }
+  disarmPlanDialogAutoAccept() {
+    this.pendingPlanApproval = false;
+    if (this.planApprovalTimer) {
+      clearInterval(this.planApprovalTimer);
+      this.planApprovalTimer = null;
+    }
+  }
   handleTranscriptEvent(event) {
+    if (this.pendingPlanApproval) this.disarmPlanDialogAutoAccept();
+    if (this.pendingSubmitNudge) this.disarmSubmitNudge();
     this.queue.push(event);
     if (event.type === "result") {
       this.sawResult = true;
@@ -883,6 +1189,7 @@ var PtySession = class {
     }
   }
   async finalizeOnExit(exitCode) {
+    this.coalescer?.flush();
     if (this._toreDown) return;
     if (this.tailer) {
       this.tailer.close();
@@ -1011,6 +1318,10 @@ function planClaudeJsonSeed(existingRaw, trustCwd) {
     config.hasCompletedOnboarding = true;
     changed = true;
   }
+  if (config.bypassPermissionsModeAccepted !== true) {
+    config.bypassPermissionsModeAccepted = true;
+    changed = true;
+  }
   if (isFresh && typeof config.theme !== "string") {
     config.theme = "dark";
     changed = true;
@@ -1113,9 +1424,10 @@ function createServiceLogger(service) {
 export {
   defineTool,
   sessionTranscriptPath,
+  configHomePlansDir,
   ensureClaudeCredentials,
   removeConveyorCredentials,
   createHarness,
   createServiceLogger
 };
-//# sourceMappingURL=chunk-VDH55LTT.js.map
+//# sourceMappingURL=chunk-6B545CHM.js.map