@sayknow-cli/coding-agent 0.2.7 → 0.3.0

package/dist/types/setup/credential-auto-import.d.ts

@@ -0,0 +1,63 @@
+import type { AuthCredentialIfAbsentReason, AuthCredentialIfAbsentSnapshotResult, AuthStorage } from "@sayknow-cli/ai";
+import type { ModelRegistry } from "../config/model-registry";
+import { type CredentialDiscoveryResult, type CredentialOrigin, type DiscoveryOptions, type ImportableCredential } from "./credential-import";
+export declare const CREDENTIAL_AUTO_IMPORT_ROTATION_WARNING = "Refreshing in skc may log out the Claude/Codex CLI because OAuth refresh tokens can rotate.";
+export type CredentialAutoImportSourceLabel = "claude-code-file" | "claude-code-keychain" | "codex-file";
+export type CredentialAutoImportTrigger = "startup" | "bare-login" | "setup-cli";
+export declare function getCredentialAutoImportStatePath(agentDir?: string): string;
+export declare function readCredentialImportMarker(agentDir?: string): Promise<string | undefined>;
+export declare function writeCredentialImportMarker(version: string, agentDir?: string): Promise<boolean>;
+export declare enum CredentialAutoImportFailureClass {
+    DiscoveryUnavailable = "discovery-unavailable",
+    SourceUnreadable = "source-unreadable",
+    SourceMalformed = "source-malformed",
+    KeychainDenied = "keychain-denied",
+    WriteInvalid = "write-invalid",
+    WriteConflict = "write-conflict",
+    BrokerUnavailable = "broker-unavailable",
+    BrokerUnsupported = "broker-unsupported",
+    Unknown = "unknown"
+}
+export interface CredentialAutoImportSkipped {
+    credential: ImportableCredential;
+    reason: AuthCredentialIfAbsentReason;
+    entries: AuthCredentialIfAbsentSnapshotResult["entries"];
+}
+export interface CredentialAutoImportFailure {
+    credential?: ImportableCredential;
+    origin?: CredentialOrigin;
+    source?: string;
+    failureClass: CredentialAutoImportFailureClass;
+}
+export interface CredentialAutoImportResult {
+    imported: ImportableCredential[];
+    skipped: CredentialAutoImportSkipped[];
+    failures: CredentialAutoImportFailure[];
+    discovered: boolean;
+    discovery?: CredentialDiscoveryResult;
+    globalDiscoveryFailure?: CredentialAutoImportFailure;
+}
+export type CredentialAutoImportAuthStorage = Pick<AuthStorage, "importCredentialIfAbsent">;
+export interface CredentialAutoImportOptions {
+    authStorage: CredentialAutoImportAuthStorage;
+    discover?: (options?: DiscoveryOptions) => Promise<CredentialDiscoveryResult>;
+    discoveryOptions?: DiscoveryOptions;
+    trigger: CredentialAutoImportTrigger;
+    sourceLabel?: CredentialAutoImportSourceLabel;
+}
+export declare function runExternalCredentialAutoImport({ authStorage, discover, discoveryOptions }: CredentialAutoImportOptions): Promise<CredentialAutoImportResult>;
+export declare function buildCredentialAutoImportNotice(result: Pick<CredentialAutoImportResult, "imported">): string | undefined;
+export declare function formatCredentialAutoImportResult(result: CredentialAutoImportResult): string[];
+export interface CredentialImportMarkerStore {
+    read: () => Promise<string | undefined> | string | undefined;
+    write: (version: string) => Promise<boolean> | boolean;
+}
+export interface StartupCredentialAutoImportOptions {
+    authStorage: CredentialAutoImportOptions["authStorage"];
+    modelRegistry: Pick<ModelRegistry, "refresh">;
+    discover?: CredentialAutoImportOptions["discover"];
+    version?: string;
+    agentDir?: string;
+    markerStore?: CredentialImportMarkerStore;
+}
+export declare function runStartupCredentialAutoImportIfNeeded({ authStorage: activeAuthStorage, modelRegistry: activeModelRegistry, discover, version, agentDir, markerStore }: StartupCredentialAutoImportOptions): Promise<string | undefined>;

package/dist/types/setup/credential-import.d.ts

@@ -3,6 +3,7 @@ import type { AuthCredential } from "@sayknow-cli/ai";
 export type ExternalProvider = "anthropic" | "openai-codex";
 /** Where a discovered credential came from. */
 export type CredentialOrigin = "claude-code-file" | "claude-code-keychain" | "codex-file";
+export declare const AUTO_IMPORT_OAUTH_PROVIDER_ORIGINS: Record<ExternalProvider, ReadonlySet<CredentialOrigin>>;
 /** Human labels for providers, used in redacted summaries. */
 export declare const EXTERNAL_PROVIDER_LABELS: Record<ExternalProvider, string>;
 /** A credential that can be safely imported into skc's store. */
@@ -72,6 +73,8 @@ export declare function discoverExternalCredentials(options?: DiscoveryOptions):
 export declare function formatCredentialSummary(credential: ImportableCredential): string;
 /** Redacted summary lines for an entire discovery result. Never includes secrets. */
 export declare function formatDiscoverySummary(result: CredentialDiscoveryResult): string[];
+export declare function isAutoImportOAuthCredential(credential: ImportableCredential): boolean;
+export declare function filterAutoImportOAuthCredentials(credentials: readonly ImportableCredential[]): ImportableCredential[];
 /**
  * Persist discovered credentials via `upsert`. Each credential is imported
  * independently; a failure on one is recorded without aborting the rest.

package/dist/types/setup/host-plugin-setup.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Host plugin setup for `skc setup claude` and `skc setup codex`.
+ *
+ * Renders install guidance and a fail-closed coordinator MCP config preview for
+ * the canonical generated plugin bundle under `plugins/`. This is intentionally
+ * render-only and fail-closed: the workdir allowlist is scoped to the project
+ * root and no mutation class is enabled until the user opts in.
+ */
+export type HostPluginKind = "claude" | "codex";
+export interface HostPluginSetupFlags {
+    json?: boolean;
+    check?: boolean;
+    root?: string[];
+    repo?: string;
+}
+export interface HostPluginSetupResult {
+    ok: true;
+    host: HostPluginKind;
+    mode: "render";
+    gated: boolean;
+    pluginPath: string;
+    manifestPath: string;
+    marketplacePath: string;
+    installGuidance: string[];
+    coordinatorConfigPreview: {
+        command: string;
+        args: string[];
+        env: Record<string, string>;
+    };
+    mutationPolicy: string;
+    notes: string[];
+    check?: {
+        ok: boolean;
+        checked: string[];
+        missing: string[];
+    };
+}
+export declare function buildHostPluginSetup(host: HostPluginKind, flags?: HostPluginSetupFlags): HostPluginSetupResult;
+export declare function formatHostPluginSetup(result: HostPluginSetupResult): string;

package/dist/types/skc-runtime/launch-tmux.d.ts

@@ -69,6 +69,7 @@ export interface SkcTmuxProfileContext {
     project?: string | null;
     sessionId?: string | null;
     sessionStateFile?: string | null;
+    version?: string | null;
 }
 export declare function applySkcTmuxProfile(context: SkcTmuxProfileContext): SkcTmuxProfileResult;
 export declare function buildSkcTmuxWindowTitle(cwd: string, branch: string | null | undefined): string;

package/dist/types/skc-runtime/state-writer.d.ts

@@ -66,10 +66,12 @@ export interface GuardedStateWriterOptions extends StateWriterOptions {
 export type GuardedWriteResult = {
     path: string;
     written: true;
+    revision: number;
 } | {
     path: string;
     written: false;
     reason: "stale-skip";
+    revision: number;
 };
 export interface StateWriterOptions {
     cwd?: string;

package/dist/types/skc-runtime/tmux-common.d.ts

@@ -10,6 +10,7 @@ export declare const SKC_TMUX_BRANCH_SLUG_OPTION = "@skc-branch-slug";
 export declare const SKC_TMUX_PROJECT_OPTION = "@skc-project";
 export declare const SKC_TMUX_SESSION_ID_OPTION = "@skc-session-id";
 export declare const SKC_TMUX_SESSION_STATE_FILE_OPTION = "@skc-session-state-file";
+export declare const SKC_TMUX_VERSION_OPTION = "@skc-version";
 export interface SkcTmuxProfileCommand {
     description: string;
     args: string[];
@@ -50,6 +51,7 @@ export declare function buildSkcTmuxRequiredProfileCommands(target: string, meta
     project?: string | null;
     sessionId?: string | null;
     sessionStateFile?: string | null;
+    version?: string | null;
 }): SkcTmuxProfileCommand[];
 export declare function buildSkcTmuxProfileCommands(target: string, env?: NodeJS.ProcessEnv, metadata?: {
     branch?: string | null;
@@ -57,5 +59,6 @@ export declare function buildSkcTmuxProfileCommands(target: string, env?: NodeJS
     project?: string | null;
     sessionId?: string | null;
     sessionStateFile?: string | null;
+    version?: string | null;
 }): SkcTmuxProfileCommand[];
 export declare function normalizeTmuxCreatedAt(raw: string): string;

package/dist/types/skc-runtime/tmux-sessions.d.ts

@@ -10,6 +10,7 @@ export interface SkcTmuxSessionStatus {
     project?: string;
     sessionId?: string;
     sessionStateFile?: string;
+    version?: string;
     panePids: number[];
     profile?: string;
 }
@@ -20,6 +21,7 @@ export interface SkcTmuxSessionTagsForGc {
     branchSlug?: string;
     sessionId?: string;
     sessionStateFile?: string;
+    version?: string;
     createdAt?: string;
     attached?: boolean;
     panePids?: number[];

package/dist/types/skc-runtime/ultragoal-guard.d.ts

@@ -27,10 +27,25 @@ export declare function validateCompletionReceipt(input: {
 export declare function readUltragoalVerificationState(input: {
     cwd: string;
     currentGoal?: CurrentGoalLike | null;
+    sessionId?: string | null;
 }): Promise<UltragoalGuardDiagnostic>;
 export declare function isUltragoalAskBlocked(cwd: string): Promise<UltragoalAskBlockDiagnostic>;
 export declare function assertCanCompleteCurrentGoal(input: {
     cwd: string;
     currentGoal?: CurrentGoalLike | null;
+    sessionId?: string | null;
 }): Promise<void>;
 export declare function isUltragoalBypassPrompt(prompt: string): boolean;
+export interface UltragoalPauseBlockDiagnostic {
+    blocked: boolean;
+    reason: string;
+}
+/**
+ * While an Ultragoal run is active, `goal({"op":"pause"})` is only allowed when the
+ * current durable Ultragoal state is readable and the latest durable ledger event
+ * classifies the current blocker as `human_blocked`. Resolvable blockers must be
+ * worked, not parked. Reads fail closed so unreadable durable state or ledger data
+ * blocks pause rather than silently allowing a give-up.
+ */
+export declare function isUltragoalPauseBlocked(cwd: string): Promise<UltragoalPauseBlockDiagnostic>;
+export declare function assertUltragoalPauseAllowed(cwd: string): Promise<void>;

package/dist/types/skc-runtime/ultragoal-runtime.d.ts

@@ -193,6 +193,19 @@ export declare function recordUltragoalReviewBlockers(input: {
     evidence: string;
     skcGoalJson?: string;
 }): Promise<UltragoalPlan>;
+export type UltragoalBlockerClassification = "human_blocked" | "resolvable";
+/**
+ * Record an audited blocker triage classification in the durable ledger. A
+ * `human_blocked` classification is the only thing that authorizes
+ * `goal({"op":"pause"})` while an Ultragoal run is active; `resolvable` is an
+ * audit note and never unblocks pause.
+ */
+export declare function recordUltragoalBlockerClassification(input: {
+    cwd: string;
+    classification: UltragoalBlockerClassification;
+    evidence: string;
+    goalId?: string;
+}): Promise<UltragoalLedgerEvent>;
 type UltragoalReviewContractStrength = "strong" | "thin-derived";
 interface UltragoalReviewFinding extends JsonObject {
     severity: "blocker";
@@ -208,6 +221,7 @@ interface UltragoalReviewResult extends JsonObject {
     weakContractCapApplied: boolean;
     blockerGoalIds?: string[];
 }
+export declare function resolveGitBase(cwd: string, branch?: string): Promise<string>;
 export declare function runUltragoalReview(cwd: string, args: readonly string[]): Promise<UltragoalReviewResult>;
 export declare function runNativeUltragoalCommand(args: string[], cwd?: string): Promise<UltragoalCommandResult>;
 export {};

package/dist/types/tools/ask-answer-registry.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Process-wide registry mapping a session id to its active {@link AskAnswerSource}.
+ *
+ * Decouples the `ask` tool (which reads the source via `AgentSession`) from the
+ * notifications extension (which registers one), without threading a new method
+ * through the extension/runner/controller wiring. A session has at most one
+ * source; registering returns a disposer.
+ */
+import type { AskAnswerSource } from "./index";
+/** Register `source` for `sessionId`. Returns a disposer that clears it. */
+export declare function registerAskAnswerSource(sessionId: string, source: AskAnswerSource): () => void;
+/** The answer source for `sessionId`, if one is registered. */
+export declare function getAskAnswerSource(sessionId: string): AskAnswerSource | undefined;

package/dist/types/tools/index.d.ts

@@ -68,6 +68,17 @@ export type ContextFileEntry = {
 };
 export type { DiscoverableMCPTool } from "../runtime-mcp/discoverable-tool-metadata";
 export type { DiscoverableTool, DiscoverableToolSearchIndex, DiscoverableToolSearchResult, DiscoverableToolSource, } from "../tool-discovery/tool-index";
+/**
+ * Source of remote answers for interactive asks (e.g. a Telegram reply routed
+ * through the notifications SDK). Lets a pending ask resolve without RPC mode.
+ */
+export interface AskAnswerSource {
+    /**
+     * Race a remote answer against the local UI for one question. Resolves with the
+     * chosen option label or free-text answer, or `undefined` to defer to local UI.
+     */
+    awaitAnswer(question: string, options: string[], signal?: AbortSignal): Promise<string | undefined>;
+}
 /** Session context for tool factories */
 export interface ToolSession {
     /** Current working directory */
@@ -167,6 +178,13 @@ export interface ToolSession {
     getGoalModeState?: () => GoalModeState | undefined;
     /** Unattended workflow-gate emitter (present only when unattended mode is negotiated). */
     getWorkflowGateEmitter?: () => WorkflowGateEmitter | undefined;
+    /**
+     * Optional remote answer source for interactive asks. When present, the ask
+     * tool races the local UI selection against a remote answer (e.g. a Telegram
+     * reply via the notifications SDK) so asks can be answered without RPC mode.
+     * No-op when undefined: the ask path behaves exactly as before.
+     */
+    getAskAnswerSource?: () => AskAnswerSource | undefined;
     /** Optional per-session restriction for goal tool operations. */
     goalToolAllowedOps?: readonly ("create" | "get" | "complete" | "resume" | "drop" | "pause")[];
     /** Goal runtime for the active agent session. */

package/dist/types/tools/subagent.d.ts

@@ -42,6 +42,9 @@ export interface SubagentSnapshot {
     outputRef?: string;
     truncated?: boolean;
     guidance?: string;
+    steerMessage?: string;
+    steerState?: "queued" | "resume_queued" | "resume_started";
+    steerPauseRequested?: boolean;
     /** Live streaming progress for the awaited subagent (await panel only; UI detail). */
     progress?: AgentProgress;
     /** True when a live in-session progress producer exists for this subagent. */

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@sayknow-cli/coding-agent",
-	"version": "0.2.7",
+	"version": "0.3.0",
 	"description": "Sayknow-CLI CLI with read, bash, edit, write tools and session management",
 	"homepage": "https://github.com/jaybeyond/Sayknow_CLI",
 	"author": "jaybeyond",
@@ -51,12 +51,12 @@
 		"@agentclientprotocol/sdk": "0.21.0",
 		"@babel/parser": "^7.29.3",
 		"@mozilla/readability": "^0.6.0",
-		"@sayknow-cli/stats": "0.2.7",
-		"@sayknow-cli/agent-core": "0.2.7",
-		"@sayknow-cli/ai": "0.2.7",
-		"@sayknow-cli/natives": "0.2.7",
-		"@sayknow-cli/tui": "0.2.7",
-		"@sayknow-cli/utils": "0.2.7",
+		"@sayknow-cli/stats": "0.3.0",
+		"@sayknow-cli/agent-core": "0.3.0",
+		"@sayknow-cli/ai": "0.3.0",
+		"@sayknow-cli/natives": "0.3.0",
+		"@sayknow-cli/tui": "0.3.0",
+		"@sayknow-cli/utils": "0.3.0",
 		"@puppeteer/browsers": "^2.13.0",
 		"@types/turndown": "5.0.6",
 		"@xterm/headless": "^6.0.0",

package/scripts/build-binary.ts

@@ -66,6 +66,9 @@ async function main(): Promise<void> {
 					"../stats/src/sync-worker.ts",
 					"./src/tools/browser/tab-worker-entry.ts",
 					"./src/eval/js/worker-entry.ts",
+					// Hidden notify daemon CLI (loaded via dynamic import from notify-cli); list it
+					// explicitly so Bun standalone keeps `skc notify daemon-internal` usable.
+					"./src/notifications/telegram-daemon-cli.ts",
 					"--outfile",
 					"dist/skc",
 				],

package/src/async/job-manager.ts

@@ -84,7 +84,11 @@ export interface SubagentLiveHandle {
 	/** Request a cooperative safe-boundary pause (never aborts the in-flight tool). */
 	requestPause(): void;
 	/** Inject a steering message into the live session. */
-	injectMessage(content: string, deliverAs: "steer" | "followUp" | "nextTurn"): Promise<void>;
+	injectMessage(
+		content: string,
+		deliverAs: "steer" | "followUp" | "nextTurn",
+		opts?: { fromAgentId?: string },
+	): Promise<void>;
 }
 
 /**

package/src/cli/daemon-cli.ts

@@ -0,0 +1,122 @@
+/**
+ * `skc daemon` command handler.
+ *
+ * Generic over the static built-in daemon controller map: lists/inspects
+ * daemons and drives cooperative stop/reload. Telegram is the only kind today.
+ */
+
+import { Settings } from "../config/settings";
+import { selectDaemonControllers } from "../daemon/builtin";
+import type {
+	BuiltInDaemonController,
+	DaemonKind,
+	DaemonOperationOptions,
+	DaemonOperationResult,
+	DaemonStatus,
+} from "../daemon/control-types";
+
+export type DaemonCliAction = "list" | "status" | "stop" | "reload";
+
+export interface DaemonCommandArgs {
+	action: DaemonCliAction;
+	kinds: DaemonKind[];
+	all: boolean;
+	json: boolean;
+	force: boolean;
+	gracefulTimeoutMs?: number;
+	killTimeoutMs?: number;
+	spawnIfStopped?: boolean;
+}
+
+export interface DaemonCommandDeps {
+	settings?: Settings;
+	controllers?: BuiltInDaemonController[];
+}
+
+const KNOWN_ACTIONS: DaemonCliAction[] = ["list", "status", "stop", "reload"];
+const KNOWN_KINDS: DaemonKind[] = ["telegram"];
+
+export function parseDaemonArgs(argv: string[]): DaemonCommandArgs | undefined {
+	if (argv.length === 0 || argv[0] !== "daemon") return undefined;
+	const rest = argv.slice(1);
+	const action = (KNOWN_ACTIONS as string[]).includes(rest[0] ?? "") ? (rest[0] as DaemonCliAction) : "status";
+	const positional = (KNOWN_ACTIONS as string[]).includes(rest[0] ?? "") ? rest.slice(1) : rest;
+	const kinds: DaemonKind[] = [];
+	let all = false;
+	let json = false;
+	let force = false;
+	let gracefulTimeoutMs: number | undefined;
+	let killTimeoutMs: number | undefined;
+	let spawnIfStopped: boolean | undefined;
+	for (let i = 0; i < positional.length; i++) {
+		const arg = positional[i];
+		if (arg === "--all") all = true;
+		else if (arg === "--json") json = true;
+		else if (arg === "--force") force = true;
+		else if (arg === "--spawn-if-stopped") spawnIfStopped = true;
+		else if (arg === "--graceful-timeout-ms") gracefulTimeoutMs = Number.parseInt(positional[++i], 10);
+		else if (arg === "--kill-timeout-ms") killTimeoutMs = Number.parseInt(positional[++i], 10);
+		else if (!arg.startsWith("--") && (KNOWN_KINDS as string[]).includes(arg)) kinds.push(arg as DaemonKind);
+	}
+	return { action, kinds, all, json, force, gracefulTimeoutMs, killTimeoutMs, spawnIfStopped };
+}
+
+function formatStatus(status: DaemonStatus): string {
+	const parts = [
+		`${status.kind}: ${status.health}`,
+		status.configured ? undefined : "(not configured)",
+		status.pid !== undefined ? `pid=${status.pid}` : undefined,
+		status.ownerId ? `owner=${status.ownerId}` : undefined,
+		status.rootCount !== undefined ? `roots=${status.rootCount}` : undefined,
+		`mode=${status.runtime.mode}`,
+	].filter(Boolean);
+	let line = parts.join(" ");
+	if (status.runtime.warning) line += `\n  warning: ${status.runtime.warning}`;
+	return line;
+}
+
+function formatResult(result: DaemonOperationResult): string {
+	const head = `${result.kind} ${result.action}: ${result.ok ? "ok" : "failed"} — ${result.message}`;
+	const warnings = result.warnings.map(w => `\n  warning: ${w}`).join("");
+	return head + warnings;
+}
+
+export async function runDaemonCommand(cmd: DaemonCommandArgs, deps: DaemonCommandDeps = {}): Promise<void> {
+	const unknownKinds = cmd.kinds.filter(kind => !(KNOWN_KINDS as string[]).includes(kind));
+	if (unknownKinds.length > 0) {
+		process.stderr.write(
+			`Unknown daemon kind(s): ${unknownKinds.join(", ")}. Known kinds: ${KNOWN_KINDS.join(", ")}.\n`,
+		);
+		process.exitCode = 1;
+		return;
+	}
+	const settings = deps.settings ?? (await Settings.init());
+	const controllers = deps.controllers ?? selectDaemonControllers(settings, cmd.kinds, cmd.all);
+
+	if (cmd.action === "list" || cmd.action === "status") {
+		const statuses = await Promise.all(controllers.map(c => c.status()));
+		if (cmd.json) {
+			process.stdout.write(`${JSON.stringify(statuses, null, 2)}\n`);
+		} else {
+			process.stdout.write(`${statuses.map(formatStatus).join("\n")}\n`);
+		}
+		return;
+	}
+
+	const opts: DaemonOperationOptions = {
+		gracefulTimeoutMs: cmd.gracefulTimeoutMs,
+		killTimeoutMs: cmd.killTimeoutMs,
+		force: cmd.force,
+		spawnIfStopped: cmd.spawnIfStopped,
+	};
+	const results: DaemonOperationResult[] = [];
+	for (const controller of controllers) {
+		results.push(cmd.action === "reload" ? await controller.reload(opts) : await controller.stop(opts));
+	}
+	if (cmd.json) {
+		process.stdout.write(`${JSON.stringify(results, null, 2)}\n`);
+	} else {
+		process.stdout.write(`${results.map(formatResult).join("\n")}\n`);
+	}
+	if (results.some(r => !r.ok)) process.exitCode = 1;
+}