@robota-sdk/agent-ui-terminal 3.0.0-beta.82 → 3.0.0-beta.84

package/src/__tests__/numbered-selection-chunk.test.tsx

@@ -0,0 +1,41 @@
+import React from 'react';
+import { render } from 'ink-testing-library';
+import { describe, expect, it, vi } from 'vitest';
+
+import MultiSelectList from '../MultiSelectList.js';
+import { ScreenReaderProvider } from '../screen-reader-context.js';
+
+const OPTIONS = [
+  { value: 'a', label: 'Alpha' },
+  { value: 'b', label: 'Beta' },
+];
+
+describe('numbered selection with chunked input', () => {
+  it('acts on the first keystroke of a chunk and leaves the checklist usable', async () => {
+    const onConfirm = vi.fn();
+    const view = render(
+      <ScreenReaderProvider enabled>
+        <MultiSelectList
+          title="Pick"
+          options={OPTIONS}
+          minSelect={1}
+          maxSelect={2}
+          onConfirm={onConfirm}
+          onCancel={() => undefined}
+        />
+      </ScreenReaderProvider>,
+    );
+    try {
+      await vi.waitFor(() => expect(view.lastFrame()).toContain('Alpha'));
+      // Toggle row 1 and commit, delivered as one chunk: the toggle lands, the rest is dropped.
+      view.stdin.write('1\r\r');
+      await new Promise((resolve) => setTimeout(resolve, 50));
+      expect(onConfirm).not.toHaveBeenCalled();
+      // A later Enter commits with the toggled row, so the checklist is not stuck.
+      view.stdin.write('\r');
+      await vi.waitFor(() => expect(onConfirm).toHaveBeenCalledExactlyOnceWith(['a']));
+    } finally {
+      view.unmount();
+    }
+  });
+});

package/src/__tests__/palette-consistency.test.ts

@@ -215,7 +215,6 @@ describe('SCREEN-006 palette consistency floor', () => {
         (line) =>
           RAW_RENDERER_SPECIFIER.test(line) && !/^\s*(?:import|export)\s+type\b/u.test(line),
       );
-  const RAW_RENDERER_IMPORT = /(?<!import type )(?:from|import\()\s*'[^']*render-markdown\.js'/u;
 
   it('SCREEN-2002: AppView feeds the theme provider all three resolved inputs', () => {
     const element = themeProviderElement(readFileSync(join(SRC_ROOT, 'AppView.tsx'), 'utf8'));

package/src/__tests__/permission-prompt-arming.test.tsx

@@ -0,0 +1,153 @@
+import React from 'react';
+import { render } from 'ink-testing-library';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+import PermissionPrompt, { PERMISSION_PROMPT_ARM_DELAY_MS } from '../PermissionPrompt.js';
+import { ScreenReaderProvider } from '../screen-reader-context.js';
+
+import type { IPendingPermissionRequest } from '../types.js';
+
+/**
+ * #3189: the permission prompt replaces the composer while the user may still be typing, and its
+ * keys are ordinary letters and digits. A key typed as it appears must not answer it; keys answer
+ * only once it is armed.
+ */
+
+function request(resolve: IPendingPermissionRequest['resolve']): IPendingPermissionRequest {
+  return { toolName: 'Bash', toolArgs: { command: 'ls' }, resolve };
+}
+
+/**
+ * Lets Ink register its input handlers, deliver the written keys and commit a render. A handler
+ * switched on by a render (the prompt arming) subscribes one tick later, hence two.
+ */
+async function settle(): Promise<void> {
+  await vi.advanceTimersByTimeAsync(0);
+  await vi.advanceTimersByTimeAsync(0);
+}
+
+async function waitOutArming(): Promise<void> {
+  await vi.advanceTimersByTimeAsync(PERMISSION_PROMPT_ARM_DELAY_MS);
+  await settle();
+}
+
+describe('the permission prompt arms before its keys answer it', () => {
+  beforeEach(() => {
+    vi.useFakeTimers();
+  });
+  afterEach(() => {
+    vi.useRealTimers();
+  });
+
+  it('a key pressed as the prompt appears does not answer it; one pressed after the delay does', async () => {
+    const resolve = vi.fn();
+    const { stdin, lastFrame, unmount } = render(<PermissionPrompt request={request(resolve)} />);
+    await settle();
+
+    stdin.write('y');
+    await settle();
+    stdin.write('1');
+    await settle();
+    stdin.write('\r');
+    await settle();
+    expect(resolve).not.toHaveBeenCalled();
+    expect(lastFrame()).toContain('keys answer in a moment');
+    expect(lastFrame()).not.toContain('> Allow [y]');
+
+    await waitOutArming();
+    expect(lastFrame()).not.toContain('keys answer in a moment');
+    expect(lastFrame()).toContain('> Allow [y]');
+    stdin.write('y');
+    await settle();
+    unmount();
+
+    expect(resolve).toHaveBeenCalledWith(true);
+  });
+
+  it('a new request arms again', async () => {
+    const first = vi.fn();
+    const second = vi.fn();
+    const { stdin, rerender, unmount } = render(<PermissionPrompt request={request(first)} />);
+    await waitOutArming();
+    stdin.write('n');
+    await settle();
+    expect(first).toHaveBeenCalledWith(false);
+
+    rerender(<PermissionPrompt request={request(second)} />);
+    await settle();
+    stdin.write('a');
+    await settle();
+    expect(second).not.toHaveBeenCalled();
+
+    await waitOutArming();
+    stdin.write('n');
+    await settle();
+    unmount();
+
+    expect(second).toHaveBeenCalledTimes(1);
+    expect(second).toHaveBeenCalledWith(false);
+  });
+
+  it('in screen-reader mode a number typed while arming is neither taken nor kept for Enter', async () => {
+    const resolve = vi.fn();
+    const { stdin, unmount } = render(
+      <ScreenReaderProvider enabled={true}>
+        <PermissionPrompt request={request(resolve)} />
+      </ScreenReaderProvider>,
+    );
+    await settle();
+
+    stdin.write('1');
+    await settle();
+    stdin.write('\r');
+    await settle();
+    expect(resolve).not.toHaveBeenCalled();
+
+    await waitOutArming();
+    stdin.write('\r');
+    await settle();
+    expect(resolve).not.toHaveBeenCalled();
+
+    stdin.write('4');
+    await settle();
+    stdin.write('\r');
+    await settle();
+    unmount();
+
+    // Option 4 is Deny.
+    expect(resolve).toHaveBeenCalledWith(false);
+  });
+
+  it('in screen-reader mode a number typed for one request is not committed on the next', async () => {
+    const first = vi.fn();
+    const second = vi.fn();
+    const { stdin, rerender, unmount } = render(
+      <ScreenReaderProvider enabled={true}>
+        <PermissionPrompt request={request(first)} />
+      </ScreenReaderProvider>,
+    );
+    await waitOutArming();
+    stdin.write('1');
+    await settle();
+
+    rerender(
+      <ScreenReaderProvider enabled={true}>
+        <PermissionPrompt request={request(second)} />
+      </ScreenReaderProvider>,
+    );
+    await waitOutArming();
+    stdin.write('\r');
+    await settle();
+    expect(first).not.toHaveBeenCalled();
+    expect(second).not.toHaveBeenCalled();
+
+    stdin.write('4');
+    await settle();
+    stdin.write('\r');
+    await settle();
+    unmount();
+
+    // Option 4 is Deny.
+    expect(second).toHaveBeenCalledWith(false);
+  });
+});

package/src/__tests__/permission-prompt-requester.test.tsx

@@ -0,0 +1,34 @@
+import React from 'react';
+import { render } from 'ink-testing-library';
+import { describe, expect, it } from 'vitest';
+
+import PermissionPrompt from '../PermissionPrompt.js';
+
+describe('issue #3288 §1: a background agent names itself on its own permission request', () => {
+  it('says which background agent is asking, instead of an unattributed prompt', () => {
+    const frame = render(
+      <PermissionPrompt
+        request={{
+          toolName: 'Glob',
+          toolArgs: { pattern: '**/*' },
+          requester: { kind: 'background-agent', label: 'general-purpose', taskId: 'agent_1' },
+          resolve: () => {},
+        }}
+      />,
+    ).lastFrame();
+
+    expect(frame).toContain('Background agent');
+    expect(frame).toContain('general-purpose');
+    expect(frame).toContain('Glob');
+  });
+
+  it('reads as an ordinary ask when no requester is present', () => {
+    const frame = render(
+      <PermissionPrompt
+        request={{ toolName: 'Bash', toolArgs: { command: 'ls' }, resolve: () => {} }}
+      />,
+    ).lastFrame();
+
+    expect(frame).not.toContain('Background agent');
+  });
+});

package/src/__tests__/pty/behavior-2437-git.ptytest.ts

@@ -224,6 +224,14 @@ async function expectCommitOnYes(session: IPtySession): Promise<void> {
   await session.waitForSince(since, /Committed: \[main [0-9a-f]{7}\] feat: add greeting/, WAIT_MS);
 }
 
+/** The fixture repository is not trusted, so the TUI asks first (issue #3268); these scenarios run Restricted. */
+async function startRestricted(session: IPtySession): Promise<void> {
+  await session.waitFor(/Trust this folder\? \[y\/N\]/, WAIT_MS);
+  await session.sendKeys('n');
+  await session.pressEnter();
+  await session.waitFor(/Type a message or \/help/, WAIT_MS);
+}
+
 async function exitTui(session: IPtySession): Promise<number> {
   await run(session, '/exit');
   await session.waitFor(/Exit the session\?/, WAIT_MS);
@@ -251,7 +259,7 @@ describe('/git through the real binary (BEHAVIOR-2437 TC-07)', () => {
     async () => {
       fixture = makeFixture(true);
       session = spawnTui({ projectDir: fixture.repo, homeDir: fixture.home });
-      await session.waitFor(/Type a message or \/help/, WAIT_MS);
+      await startRestricted(session);
       await session.waitFor(/Idle/, WAIT_MS);
 
       await expectReadSteps(session);
@@ -272,7 +280,7 @@ describe('/git through the real binary (BEHAVIOR-2437 TC-07)', () => {
     async () => {
       fixture = makeFixture(true);
       session = spawnTui({ projectDir: fixture.repo, homeDir: fixture.home });
-      await session.waitFor(/Type a message or \/help/, WAIT_MS);
+      await startRestricted(session);
       await session.waitFor(/Idle/, WAIT_MS);
 
       await expectSubjectRefusal(session, fixture);
@@ -296,7 +304,7 @@ describe('/git through the real binary (BEHAVIOR-2437 TC-07)', () => {
     async () => {
       fixture = makeFixture(false);
       session = spawnTui({ projectDir: fixture.repo, homeDir: fixture.home });
-      await session.waitFor(/Type a message or \/help/, WAIT_MS);
+      await startRestricted(session);
       await session.waitFor(/Idle/, WAIT_MS);
 
       const since = await run(session, '/git commit feat: nothing to commit');

package/src/__tests__/pty/screen-005-prompt-footers.ptytest.ts

@@ -127,7 +127,8 @@ describe('SCREEN-005 prompt footers through the real binary', () => {
     expect(afterEsc).not.toContain('AFTER_PERMISSION_FLOW');
     expect(afterEsc).toContain('Allow [y]'); // prompt still displayed, still unresolved
 
-    // Resolve explicitly (allow) → the tool runs and the turn continues.
+    // Resolve explicitly (allow) once the prompt is armed → the tool runs and the turn continues.
+    await session.waitFor(/> Allow \[y\]/, 10_000);
     await session.sendKeys('y');
     await session.waitFor(/AFTER_PERMISSION_FLOW/, 20_000);
   }, 60_000);

package/src/__tests__/pty/screen-006-no-color.ptytest.ts

@@ -108,6 +108,8 @@ describe('SCREEN-006 color/motion through the real binary', () => {
 
     // The replayed Shell call needs approval in default permission mode → allow it.
     await session.waitFor(/Permission Required/, 20_000);
+    // Its keys answer once it is armed, which the selection cursor shows.
+    await session.waitFor(/> Allow \[y\]/, 10_000);
     await session.sendKeys('y');
 
     // The turn continues: the second replayed response carries the markdown diff block,

package/src/__tests__/pty/session-attach.ptytest.ts

@@ -0,0 +1,144 @@
+/**
+ * `robota session attach` end to end on the BUILT binary, in a real terminal: start a supervised
+ * session, attach and confirm on the controlling terminal, submit, detach with `/exit`, see it still
+ * running, attach again read-only and find the earlier prompt, detach with Ctrl-C, peek from
+ * `session view` and land back in the view, then stop it.
+ *
+ * The provider points at a closed local port, so the submitted turn fails without any network call
+ * leaving this machine. `XDG_RUNTIME_DIR` is a short directory so the control socket path fits.
+ *
+ * Runs under `test:pty` against the built CLI (`pnpm --filter @robota-sdk/agent-cli build` first).
+ */
+
+import { execFileSync, spawnSync } from 'node:child_process';
+import { mkdirSync, mkdtempSync, realpathSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+import { afterEach, describe, expect, it } from 'vitest';
+
+import { createIsolatedHome, createPtyEnv } from './isolated-home.js';
+import { spawnPty } from './spawn-pty.js';
+
+import type { IPtyRunSession } from './spawn-pty.js';
+
+const REPO_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '../../../../..');
+const ROBOTA_BIN = join(REPO_ROOT, 'packages/agent-cli/bin/robota.cjs');
+const WAIT_MS = 20_000;
+
+const cleanups: (() => void)[] = [];
+afterEach(() => {
+  for (const cleanup of cleanups.splice(0).reverse()) cleanup();
+});
+
+function robota(args: readonly string[], cwd: string, env: NodeJS.ProcessEnv): { status: number | null; stdout: string; stderr: string } {
+  const result = spawnSync(process.execPath, [ROBOTA_BIN, ...args], { cwd, env, encoding: 'utf8', timeout: WAIT_MS });
+  return { status: result.status, stdout: result.stdout, stderr: result.stderr };
+}
+
+function attach(id: string, cwd: string, env: NodeJS.ProcessEnv, observe = false): IPtyRunSession {
+  const session = spawnPty({
+    command: process.execPath,
+    args: [ROBOTA_BIN, 'session', 'attach', id, ...(observe ? ['--observe'] : [])],
+    cwd,
+    env,
+  });
+  cleanups.push(() => session.dispose());
+  return session;
+}
+
+describe('robota session attach on the built binary', () => {
+  it('attaches, submits, detaches without stopping the session, and re-attaches', async () => {
+    const project = realpathSync(mkdtempSync(join(tmpdir(), 'robota-attach-pty-')));
+    // `/tmp` rather than the platform temp directory: the control socket path must stay short.
+    const runtime = mkdtempSync('/tmp/rsa-');
+    cleanups.push(() => rmSync(project, { recursive: true, force: true }));
+    cleanups.push(() => rmSync(runtime, { recursive: true, force: true }));
+    const home = createIsolatedHome();
+    mkdirSync(join(home, '.robota'), { recursive: true });
+    writeFileSync(join(home, '.robota', 'onboarded'), new Date().toISOString(), 'utf8');
+    writeFileSync(
+      join(home, '.robota', 'settings.json'),
+      JSON.stringify({
+        currentProvider: 'anthropic',
+        providers: {
+          anthropic: {
+            type: 'anthropic',
+            model: 'claude-test-model',
+            apiKey: 'pty-dummy-key',
+            baseURL: 'http://127.0.0.1:9',
+          },
+        },
+      }),
+      'utf8',
+    );
+    const env = createPtyEnv({ HOME: home, XDG_RUNTIME_DIR: runtime });
+
+    // Workspace trust is recorded for a repository, as a user would grant it before a background start.
+    const git = (...args: string[]): void => {
+      execFileSync('git', args, { cwd: project, env, stdio: ['ignore', 'ignore', 'pipe'] });
+    };
+    git('init', '-q', '-b', 'main');
+    git('config', 'user.name', 'Robota Attach');
+    git('config', 'user.email', 'attach@example.invalid');
+    writeFileSync(join(project, 'README.md'), 'fixture\n');
+    git('add', '--', 'README.md');
+    git('commit', '-q', '-m', 'chore: fixture');
+    const trusted = robota(['trust', '--yes'], project, env);
+    expect(trusted.status, trusted.stderr).toBe(0);
+    const started = robota(['session', 'start', '--background', '--name', 'pty-attach'], project, env);
+    expect(started.status, started.stderr).toBe(0);
+    const id = /Supervised session: ([0-9a-f-]{36})/u.exec(started.stdout)?.[1];
+    expect(id).toBeDefined();
+    cleanups.push(() => { robota(['session', 'stop', id!], project, env); });
+
+    const drive = attach(id!, project, env);
+    await drive.waitFor('Attach? Type yes', WAIT_MS);
+    expect(drive.snapshot()).toContain('drive (send prompts, answer its questions)');
+    await drive.sendKeys('yes');
+    await drive.pressEnter();
+    await drive.waitFor('Attached to pty-attach — drive', WAIT_MS);
+    await drive.sendKeys('hello from the pty');
+    await drive.pressEnter();
+    await drive.waitFor('Error:', WAIT_MS);
+    await drive.sendKeys('/exit');
+    await drive.pressEnter();
+    await drive.waitFor('keeps running', WAIT_MS);
+    expect(await drive.expectExit(WAIT_MS)).toBe(0);
+
+    const listed = robota(['session', 'list', '--format', 'json'], project, env);
+    const supervised = (JSON.parse(listed.stdout) as {
+      supervised: { sessions: { id: string; liveness: string; control: string }[] };
+    }).supervised.sessions;
+    expect(supervised).toContainEqual(expect.objectContaining({ id, liveness: 'alive', control: 'available' }));
+
+    const observe = attach(id!, project, env, true);
+    await observe.waitFor('Attach? Type yes', WAIT_MS);
+    expect(observe.snapshot()).toContain('observe (read only)');
+    await observe.sendKeys('yes');
+    await observe.pressEnter();
+    await observe.waitFor('Observing pty-attach — read only', WAIT_MS);
+    await observe.waitFor('hello from the pty', WAIT_MS);
+    observe.write('\x03');
+    await observe.waitFor('keeps running', WAIT_MS);
+    expect(await observe.expectExit(WAIT_MS)).toBe(0);
+
+    // From the session view: peek at the row, confirm there, detach, and land back in the view.
+    const view = spawnPty({ command: process.execPath, args: [ROBOTA_BIN, 'session', 'view'], cwd: project, env });
+    cleanups.push(() => view.dispose());
+    await view.waitFor('a Attach  p Peek', WAIT_MS);
+    view.write('p');
+    await view.waitFor('to observe (read only)?', WAIT_MS);
+    view.write('y');
+    await view.waitFor('Observing pty-attach — read only', WAIT_MS);
+    await view.waitFor('hello from the pty', WAIT_MS);
+    const beforeDetach = view.outputOffset();
+    view.write('\x1d');
+    await view.waitForSince(beforeDetach, 'Background sessions across projects', WAIT_MS);
+    view.write('q');
+    expect(await view.expectExit(WAIT_MS)).toBe(0);
+
+    expect(robota(['session', 'stop', id!], project, env).status).toBe(0);
+  }, 120_000);
+});

package/src/__tests__/pty/trust-prompt.ptytest.ts

@@ -0,0 +1,134 @@
+/**
+ * Issue #3268 — an interactive start in an untrusted repository asks whether to trust it, on the
+ * BUILT binary in a real PTY. A yes records the grant and starts Trusted, so the next start does not
+ * ask; a no starts Restricted and records nothing, so the next start asks again.
+ *
+ * Runs under `test:pty` against the built CLI (`pnpm --filter @robota-sdk/agent-cli build` first).
+ */
+
+import { execFileSync } from 'node:child_process';
+import {
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  realpathSync,
+  rmSync,
+  writeFileSync,
+} from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import { afterEach, describe, expect, it } from 'vitest';
+
+import { spawnTui } from './pty-driver.js';
+
+import type { IPtySession } from './pty-driver.js';
+
+const WAIT_MS = 20_000;
+const CASE_TIMEOUT_MS = 120_000;
+const QUESTION = /Trust this folder\? \[y\/N\]/;
+const READY = /Type a message or \/help/;
+
+interface IFixture {
+  readonly root: string;
+  readonly home: string;
+  readonly repo: string;
+}
+
+function makeFixture(): IFixture {
+  const root = realpathSync(mkdtempSync(join(tmpdir(), 'robota-trust-prompt-')));
+  const home = join(root, 'home');
+  const repo = join(root, 'repo');
+  mkdirSync(join(home, '.robota'), { recursive: true });
+  // Skip the first-run welcome and provider setup: neither is what this scenario observes.
+  writeFileSync(join(home, '.robota', 'onboarded'), new Date().toISOString(), 'utf8');
+  writeFileSync(
+    join(home, '.robota', 'settings.json'),
+    JSON.stringify({
+      currentProvider: 'anthropic',
+      providers: {
+        anthropic: { type: 'anthropic', model: 'claude-test-model', apiKey: 'pty-dummy-key' },
+      },
+    }),
+    'utf8',
+  );
+  execFileSync('git', ['init', '-q', repo]);
+  return { root, home, repo };
+}
+
+function trustedGrants(fixture: IFixture): number {
+  const store = join(fixture.home, '.robota', 'workspace-trust.json');
+  if (!existsSync(store)) return 0;
+  const parsed = JSON.parse(readFileSync(store, 'utf8')) as { grants: { state: string }[] };
+  return parsed.grants.filter((grant) => grant.state === 'trusted').length;
+}
+
+async function answerAndExit(session: IPtySession, answer: 'y' | 'n'): Promise<void> {
+  await session.waitFor(QUESTION, WAIT_MS);
+  await session.sendKeys(answer);
+  await session.pressEnter();
+  await session.waitFor(READY, WAIT_MS);
+  await session.sendKeys('/exit');
+  await session.pressEnter();
+  await session.waitFor(/Exit the session\?/, WAIT_MS);
+  await session.pressEnter();
+  await session.expectExit(WAIT_MS);
+}
+
+describe('the trust question at an interactive start (issue #3268)', () => {
+  let fixture: IFixture | undefined;
+  let session: IPtySession | undefined;
+
+  afterEach(async () => {
+    await session?.disposeAsync();
+    session = undefined;
+    if (fixture) rmSync(fixture.root, { recursive: true, force: true });
+    fixture = undefined;
+  });
+
+  it(
+    'a yes records the grant, and the next start is Trusted without asking',
+    async () => {
+      fixture = makeFixture();
+      session = spawnTui({ projectDir: fixture.repo, homeDir: fixture.home });
+      await answerAndExit(session, 'y');
+      expect(trustedGrants(fixture)).toBe(1);
+
+      session = spawnTui({ projectDir: fixture.repo, homeDir: fixture.home });
+      await session.waitFor(READY, WAIT_MS);
+      expect(session.snapshot()).not.toMatch(QUESTION);
+    },
+    CASE_TIMEOUT_MS,
+  );
+
+  it.each([
+    ['--safe-mode', ['--safe-mode']],
+    // A resumed or continued session keeps the store it was saved in, so it is not asked.
+    ['--continue', ['--continue']],
+  ])(
+    'does not ask with %s',
+    async (_case, args) => {
+      fixture = makeFixture();
+      session = spawnTui({ projectDir: fixture.repo, homeDir: fixture.home, args: [...args] });
+      await session.waitFor(READY, WAIT_MS);
+      expect(session.snapshot()).not.toMatch(QUESTION);
+      expect(trustedGrants(fixture)).toBe(0);
+    },
+    CASE_TIMEOUT_MS,
+  );
+
+  it(
+    'a no starts Restricted, records nothing, and the next start asks again',
+    async () => {
+      fixture = makeFixture();
+      session = spawnTui({ projectDir: fixture.repo, homeDir: fixture.home });
+      await answerAndExit(session, 'n');
+      expect(trustedGrants(fixture)).toBe(0);
+
+      session = spawnTui({ projectDir: fixture.repo, homeDir: fixture.home });
+      await session.waitFor(QUESTION, WAIT_MS);
+    },
+    CASE_TIMEOUT_MS,
+  );
+});

package/src/__tests__/render-channel-options.test.ts

@@ -2,7 +2,7 @@ import { describe, it, expect } from 'vitest';
 import type { IAIProvider } from '@robota-sdk/agent-core';
 import { createNodeHostSettingsSource } from '@robota-sdk/agent-framework';
 import { createNodeHostContributionSource } from '@robota-sdk/agent-framework';
-import type { EditCheckpointStore, IPromptHistoryOptions } from '@robota-sdk/agent-framework';
+import type { IPromptHistoryOptions } from '@robota-sdk/agent-framework';
 import type { ITuiCliAdapter } from '../tui-cli-adapter.js';
 import { toChannelOptions } from '../render.js';
 import { buildTuiSessionOptions } from '../tui-session-options.js';
@@ -161,16 +161,16 @@ describe('toChannelOptions', () => {
     expect(channelOptions.model).toBeUndefined();
   });
 
-  it('threads the explicit checkpoint capability without deriving it from cwd', () => {
-    const editCheckpointStore = {} as EditCheckpointStore;
+  it('carries the host external-event verifier factory to the session options', () => {
+    const factory = () => ({ verify: async () => ({ admitted: true as const }) });
     const channelOptions = toChannelOptions({
       cwd: '/tmp/project',
       provider: {} as IAIProvider,
       cliAdapter: {} as ITuiCliAdapter,
-      editCheckpointStore,
+      externalEventVerifierFactory: factory,
     });
-
-    expect(channelOptions.editCheckpointStore).toBe(editCheckpointStore);
+    expect(channelOptions.externalEventVerifierFactory).toBe(factory);
+    expect(buildTuiSessionOptions(channelOptions).externalEventVerifierFactory).toBe(factory);
   });
 
   it('SCREEN-1993: projects the prompt-history writer to the channel and on to the session options', () => {

package/src/__tests__/sandbox-reaches-the-session.test.ts

@@ -0,0 +1,37 @@
+/**
+ * Issue #3242: the TUI session consults the same sandbox the shell tools run under, so a confined
+ * command the sandbox approves runs without a prompt.
+ */
+
+import { describe, expect, it } from 'vitest';
+
+import { toChannelOptions } from '../render.js';
+import { buildTuiSessionOptions } from '../tui-session-options.js';
+
+import type { IRenderOptions } from '../render.js';
+
+type TSandboxClient = NonNullable<IRenderOptions['sandboxClient']>;
+
+const sandboxClient = { filesystem: 'shared', autoApproves: () => true } as unknown as TSandboxClient;
+
+function renderOptions(extra: Partial<IRenderOptions> = {}): IRenderOptions {
+  return { cwd: '/work', provider: {} as never, ...extra } as IRenderOptions;
+}
+
+describe('the TUI projection carries the sandbox client', () => {
+  it('passes the supplied sandbox through the channel into the session', () => {
+    const channel = toChannelOptions(renderOptions({ sandboxClient }));
+
+    expect((buildTuiSessionOptions(channel) as { sandboxClient?: unknown }).sandboxClient).toBe(
+      sandboxClient,
+    );
+  });
+
+  it('carries none when none was supplied', () => {
+    const channel = toChannelOptions(renderOptions());
+
+    expect(
+      (buildTuiSessionOptions(channel) as { sandboxClient?: unknown }).sandboxClient,
+    ).toBeUndefined();
+  });
+});

package/src/__tests__/screen-reader-menus.test.tsx

@@ -135,7 +135,7 @@ describe('TC-07: PermissionPrompt and ConfirmPrompt', () => {
   it('a typed number resolves the permission ask', async () => {
     const resolve = vi.fn();
     const { stdin, unmount } = renderInMode(
-      <PermissionPrompt request={permissionRequest(resolve)} />,
+      <PermissionPrompt request={permissionRequest(resolve)} armDelayMs={0} />,
     );
     await tick();
     stdin.write('4');