@shield-agent/kya 0.1.20 → 0.1.22

package/.mcp.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "shield-kya": {
       "command": "npx",
-      "args": ["--no-install", "@shield-agent/kya@0.1.20", "serve-mcp", "--stdio"],
+      "args": ["--no-install", "@shield-agent/kya@0.1.22", "serve-mcp", "--stdio"],
       "env": {
         "KYA_BASE_URL": "https://shield-agent.com",
         "KYA_API_KEY": "${KYA_API_KEY}",

package/LIMITATIONS.md

@@ -6,8 +6,8 @@
 - If a host never wraps tools, session shrink cannot stop it. Spawn without a control plane cannot be gated.
 - `wrap` evaluates (and may open a pending ticket). It never executes the side effect. Offline wrap does not call the approval API.
 - `invoke` authorizes on a live plane after Allow or APPROVED. It never runs the customer write in the CLI. There is no `--offline` invoke.
-- The TUI (`dash`) is observational. Keys `a` / `x` print the CLI decide hint; they do not APPROVE or REJECT.
-- Human decide is `kya approve --id` / `kya reject --id` against `POST /api/v1/kya/approvals/{id}/approve|reject` (`kya.approve` scope).
+- The TUI (`dash`) can `a`/`x` decide only after `y` confirm, and only with a JWT that has `kya.approve`. Machine `sk_*` keys are refused (print the CLI hint instead).
+- Human decide is also `kya approve --id` / `kya reject --id` against `POST /api/v1/kya/approvals/{id}/approve|reject` (`kya.approve` scope).
 - Shield KYA evaluate/approve is the only policy decision point (`ALLOW` / `DENY` / `REQUIRE_APPROVE`). Scanners, `--scorecard`, `harness.agentshield`, and the ORR CLI write evidence. They never ALLOW a side effect. AgentShield is opt-in (`--producer harness.agentshield` or `--agentshield-json`). The CLI never passes `--fix`, never starts MiniClaw, and never installs `ecc-agentshield`.
 - Dialog safety belongs in a guardrails product.
 - Multi-language in-process runtimes are out of scope.

package/README.md

@@ -33,10 +33,13 @@ npx @shield-agent/kya register-agent --name solo-builder --version-hash dev-loca
 npx @shield-agent/kya eval-tool --tool-id org.sample.never.event --irreversible
 npx @shield-agent/kya serve-mcp --stdio
 
-# Terminal dashboard (free panes; --offline works without a key)
+# Terminal desk (FREE personal panes; --offline works without a key)
 npx @shield-agent/kya dash --once --offline
+# Interactive TTY: 1-8 panes, e force-eval, p auto-refresh, y confirms kill/shrink/decide
+npx @shield-agent/kya dash
 ```
 
+
 Install hub: [https://shield-agent.com/install](https://shield-agent.com/install)
 
 ## Dual plane
@@ -79,7 +82,7 @@ MCP Registry entry: `server.json` plus package `mcpName` `io.github.The-Pixel-Bo
   "mcpServers": {
     "shield-kya": {
       "command": "npx",
-      "args": ["--no-install", "@shield-agent/kya@0.1.20", "serve-mcp", "--stdio"],
+      "args": ["--no-install", "@shield-agent/kya@0.1.22", "serve-mcp", "--stdio"],
       "env": {
         "KYA_BASE_URL": "http://127.0.0.1:8090",
         "KYA_API_KEY": "${KYA_API_KEY}",
@@ -98,7 +101,7 @@ npx @shield-agent/kya approve --id <approval-id>
 npx @shield-agent/kya reject --id <approval-id>
 ```
 
-`wrap` evaluates and may open a pending ticket. It never executes the side effect. `invoke` asks the live plane to authorize after Allow or APPROVED. It does not run the write on this machine. The TUI (`dash`) is observational: keys `a` / `x` print CLI hints and do not decide.
+`wrap` evaluates and may open a pending ticket. It never executes the side effect. `invoke` asks the live plane to authorize after Allow or APPROVED. It does not run the write on this machine. The TUI (`dash`) can `a`/`x` decide only after `y` confirm with a JWT (`sk_*` refused).
 
 ## Claude connector
 
@@ -106,7 +109,7 @@ npx @shield-agent/kya reject --id <approval-id>
 
 ```bash
 # Prefer a preinstalled package (no registry auto-install):
-npx --no-install @shield-agent/kya@0.1.20 serve-mcp --stdio
+npx --no-install @shield-agent/kya@0.1.22 serve-mcp --stdio
 # Or after npm i -g / local install:
 kya serve-mcp --stdio
 ```
@@ -117,7 +120,7 @@ Copy `claude/claude_desktop_config.example.json` into Claude Desktop MCP setting
 
 ## OpenAI (Codex / Responses)
 
-**Codex CLI / IDE:** copy `openai/codex.config.example.toml` into `~/.codex/config.toml`. Local stdio uses `npx --no-install @shield-agent/kya@0.1.20 serve-mcp --stdio`. Hosted Codex uses `url = "https://shield-agent.com/mcp"` with `bearer_token_env_var = "KYA_API_KEY"`.
+**Codex CLI / IDE:** copy `openai/codex.config.example.toml` into `~/.codex/config.toml`. Local stdio uses `npx --no-install @shield-agent/kya@0.1.22 serve-mcp --stdio`. Hosted Codex uses `url = "https://shield-agent.com/mcp"` with `bearer_token_env_var = "KYA_API_KEY"`.
 
 **Responses API:** see `openai/responses-mcp.example.json` (`server_url` + `Authorization: Bearer <KYA_API_KEY>`).
 

package/claude/claude_desktop_config.example.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "shield-kya": {
       "command": "npx",
-      "args": ["--no-install", "@shield-agent/kya@0.1.20", "serve-mcp", "--stdio"],
+      "args": ["--no-install", "@shield-agent/kya@0.1.22", "serve-mcp", "--stdio"],
       "env": {
         "KYA_BASE_URL": "https://shield-agent.com",
         "KYA_API_KEY": "${KYA_API_KEY}",

package/dist/commands/dash.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dash.d.ts","sourceRoot":"","sources":["../../src/commands/dash.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAGnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnD,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAc,KAAK,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAoC1D,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,UAAU,GAAG;IACvD,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,QAAQ,CAAC;CAChB,CAkBA;AAED,wBAAsB,OAAO,CAC3B,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,UAAU,EAClB,EAAE,EAAE,MAAM,EACV,GAAG,EAAE,MAAM,CAAC,UAAU,GACrB,OAAO,CAAC,MAAM,CAAC,CAiLjB"}
+{"version":3,"file":"dash.d.ts","sourceRoot":"","sources":["../../src/commands/dash.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAGnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnD,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAc,KAAK,MAAM,EAAE,MAAM,iBAAiB,CAAC;AA0C1D,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,UAAU,GAAG;IACvD,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,QAAQ,CAAC;CAChB,CAkBA;AASD,wBAAsB,OAAO,CAC3B,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,UAAU,EAClB,EAAE,EAAE,MAAM,EACV,GAAG,EAAE,MAAM,CAAC,UAAU,GACrB,OAAO,CAAC,MAAM,CAAC,CAsZjB"}

package/dist/commands/dash.js

@@ -1,14 +1,18 @@
 import { stdin as stdinFd, stdout as stdoutFd } from "node:process";
 import { emitKeypressEvents } from "node:readline";
-import { KyaHttpClient } from "../client.js";
+import { isMachineApiKey, KyaHttpClient } from "../client.js";
 import { AuthRequiredError } from "../errors.js";
 import { flagBool, flagString } from "../parse-args.js";
 import { renderDash } from "../dash/dash.js";
 import { mapKey } from "../dash/input.js";
+import { PolicySampleCache } from "../dash/policy-cache.js";
+import { assertNoSecrets } from "../dash/render.js";
 import { runWrap, wrapExitCode } from "./wrap.js";
 import { runInvoke } from "./invoke.js";
 import { runKillAgent, runShrinkSession } from "./ops.js";
 import { runOrr } from "./orr.js";
+const AUTO_REFRESH_MS = 5_000;
+/** TUI ORR stays first_party only — Scorecard spawn is CLI-explicit (no env leak / stdin race). */
 function deskOrr(cwd) {
     return runOrr({
         path: cwd,
@@ -30,6 +34,7 @@ const PANES = [
     "sessions",
     "orr",
     "mcp",
+    "sandbox",
     "dashboard",
     "cases",
     "metrics",
@@ -57,21 +62,14 @@ export async function runDash(config, parsed, io, env) {
     const opts = dashOptionsFromArgs(parsed);
     const tty = io.isTty ?? Boolean(stdinFd.isTTY && stdoutFd.isTTY);
     const once = opts.once || !tty;
-    let client;
-    if (!opts.offline && config.apiKey) {
-        client = new KyaHttpClient({
-            baseUrl: config.baseUrl,
-            apiKey: config.apiKey,
-            host: config.host,
-            agentId: config.agentId,
-            requireApiKey: true,
-        });
-    }
-    const fetchPlane = client
-        ? async () => client.request("/api/v1/kya/entitlement", { signal: AbortSignal.timeout(5000) })
-        : undefined;
-    let pane = opts.pane;
     let offline = opts.offline;
+    let client = makeClient(config, offline);
+    const policyCache = new PolicySampleCache();
+    let forcePolicyEval = false;
+    let autoRefresh = false;
+    let pending;
+    let busy = false;
+    let pane = opts.pane;
     let cursor = 0;
     let orrSummary;
     let last = {
@@ -79,48 +77,222 @@ export async function runDash(config, parsed, io, env) {
         approvals: [],
         sessions: [],
     };
-    const paint = async () => {
+    const confirmLine = () => pending?.prompt;
+    const paint = async (optsPaint) => {
         const snap = await renderDash({ ...config, offline }, {
             once: true,
             offline,
             pane,
             client,
-            fetchPlaneEntitlement: fetchPlane,
+            fetchPlaneEntitlement: client
+                ? async () => client.request("/api/v1/kya/entitlement", { signal: AbortSignal.timeout(5000) })
+                : undefined,
             cursor,
             orrSummary,
+            policyCache,
+            forcePolicyEval,
+            confirmLine: confirmLine(),
         }, env);
+        forcePolicyEval = false;
         last = {
             agents: [...snap.agents],
             approvals: [...snap.approvals],
             sessions: [...snap.sessions],
         };
+        // Never ANSI-clear while a confirm is armed (keeps the prompt visible).
+        if (!once && tty && optsPaint?.clear !== false && !pending) {
+            try {
+                stdoutFd.write("\x1b[2J\x1b[H");
+            }
+            catch {
+                /* ignore */
+            }
+        }
         io.log(snap.frame);
         return snap;
     };
     const selected = (rows) => rows.length === 0 ? undefined : rows[Math.min(cursor, rows.length - 1)];
     if (once) {
-        await paint();
+        await paint({ clear: false });
         return 0;
     }
-    await paint();
+    await paint({ clear: false });
     emitKeypressEvents(stdinFd);
     stdinFd.setRawMode?.(true);
     stdinFd.resume();
+    // Bracketed paste: ignore paste chunks so `ay`/`ky` cannot one-shot confirm.
+    try {
+        stdoutFd.write("\x1b[?2004h");
+    }
+    catch {
+        /* ignore */
+    }
     return await new Promise((resolve) => {
-        let painting = false;
+        let refreshTimer;
+        let pasteBuf = "";
+        let inPaste = false;
+        const stopRefresh = () => {
+            if (refreshTimer) {
+                clearInterval(refreshTimer);
+                refreshTimer = undefined;
+            }
+        };
+        const startRefresh = () => {
+            stopRefresh();
+            if (!autoRefresh || offline || !client)
+                return;
+            refreshTimer = setInterval(() => {
+                if (busy || pending)
+                    return;
+                busy = true;
+                void paint()
+                    .catch((err) => {
+                    if (err instanceof AuthRequiredError)
+                        io.error(err.message);
+                    else
+                        io.error(err instanceof Error ? err.message : String(err));
+                })
+                    .finally(() => {
+                    busy = false;
+                });
+            }, AUTO_REFRESH_MS);
+        };
+        const syncClient = () => {
+            client = makeClient(config, offline);
+            if (offline)
+                policyCache.invalidate();
+            if (!offline && client && autoRefresh)
+                startRefresh();
+            else
+                stopRefresh();
+        };
+        const stillLive = () => !offline && Boolean(client);
+        const arm = (job) => {
+            pending = job;
+            void paint({ clear: false });
+        };
+        const runPaint = () => {
+            if (busy)
+                return;
+            busy = true;
+            void paint()
+                .catch((err) => {
+                if (err instanceof AuthRequiredError)
+                    io.error(err.message);
+                else
+                    io.error(err instanceof Error ? err.message : String(err));
+            })
+                .finally(() => {
+                busy = false;
+            });
+        };
         const onKey = (str, key) => {
+            const seq = key?.sequence ?? str ?? "";
+            // Bracketed paste begin/end
+            if (seq.includes("\x1b[200~") || str === "\x1b[200~") {
+                inPaste = true;
+                pasteBuf = "";
+                return;
+            }
+            if (inPaste) {
+                if (seq.includes("\x1b[201~") || str === "\x1b[201~") {
+                    inPaste = false;
+                    pasteBuf = "";
+                    if (pending) {
+                        pending = undefined;
+                        io.log("paste ignored — confirm cancelled");
+                        void paint({ clear: false });
+                    }
+                }
+                else {
+                    pasteBuf += str ?? "";
+                }
+                return;
+            }
             const raw = key?.ctrl && key.name === "c" ? "\u0003" : (str ?? key?.name ?? "");
             const action = mapKey(raw);
+            if (pending) {
+                if (action.type === "confirm-yes") {
+                    const job = pending;
+                    pending = undefined;
+                    if (!stillLive()) {
+                        io.log("Need a live plane (drop offline / set KYA_API_KEY).");
+                        void paint({ clear: false });
+                        return;
+                    }
+                    const liveClient = client;
+                    const cfg = { ...config, offline: false };
+                    busy = true;
+                    void (async () => {
+                        try {
+                            if (!stillLive()) {
+                                io.log("offline mid-flight — aborted");
+                                return;
+                            }
+                            if (job.kind === "kill") {
+                                const killed = await runKillAgent(cfg, job.id, liveClient);
+                                if (!stillLive())
+                                    return;
+                                io.log(`${killed.status ?? "PAUSED"}  ${killed.id}`);
+                            }
+                            else if (job.kind === "shrink") {
+                                const sh = await runShrinkSession(cfg, job.id, job.to, liveClient);
+                                if (!stillLive())
+                                    return;
+                                io.log(`clearance ${sh.from} → ${sh.to}`);
+                            }
+                            else if (job.kind === "decide") {
+                                // Machine sk_* keys must not decide — JWT / kya.approve only.
+                                if (isMachineApiKey(config.apiKey ?? "")) {
+                                    io.log(`Machine API keys cannot ${job.decision} from the TUI. Run: kya ${job.decision} --id ${job.id}`);
+                                    return;
+                                }
+                                const res = await liveClient.decideApproval(job.id, job.decision);
+                                if (!stillLive())
+                                    return;
+                                io.log(`${job.decision} → ${res.status}  ${res.id}`);
+                            }
+                            else if (job.kind === "invoke") {
+                                const result = await runInvoke(cfg, { toolId: job.toolId, irreversible: true }, liveClient);
+                                if (!stillLive())
+                                    return;
+                                io.log(`invoke ${result.verdict} dispatched=${result.dispatched} ${result.sideEffect} (does not run the write)`);
+                            }
+                            else if (job.kind === "wrap") {
+                                const result = await runWrap(cfg, { toolId: "org.sample.data.write", irreversible: true }, liveClient);
+                                if (!stillLive())
+                                    return;
+                                io.log(`wrap exit ${wrapExitCode(result)} ${result.eval.response.verdict}`);
+                            }
+                        }
+                        catch (err) {
+                            if (err instanceof AuthRequiredError)
+                                io.error(err.message);
+                            else
+                                io.error(err instanceof Error ? err.message : String(err));
+                        }
+                        finally {
+                            busy = false;
+                            await paint();
+                        }
+                    })();
+                    return;
+                }
+                pending = undefined;
+                io.log("cancelled");
+                void paint({ clear: false });
+                return;
+            }
             if (action.type === "quit") {
                 cleanup();
                 resolve(0);
                 return;
             }
             if (action.type === "help") {
-                io.log("1-7 panes · j/k move · w wrap · k kill · i invoke · b/R shrink · o orr · a/x approve/reject (JWT) · O offline · q");
+                io.log("1-8 panes · j/k · e eval · p auto-refresh · w wrap · k kill · i invoke · b/R shrink · o orr · t passport · a/x decide (y confirm; sk_* refused) · O offline · q");
                 return;
             }
-            if (action.type === "noop" || painting)
+            if (action.type === "noop" || busy)
                 return;
             if (action.type === "up") {
                 cursor = Math.max(0, cursor - 1);
@@ -130,6 +302,22 @@ export async function runDash(config, parsed, io, env) {
             }
             else if (action.type === "offline") {
                 offline = !offline;
+                syncClient();
+                io.log(offline ? "offline (sample PEP only)" : "live plane");
+            }
+            else if (action.type === "force-policy-eval") {
+                forcePolicyEval = true;
+                policyCache.invalidate();
+                pane = "policy";
+            }
+            else if (action.type === "toggle-auto-refresh") {
+                autoRefresh = !autoRefresh;
+                io.log(autoRefresh ? `auto-refresh ${AUTO_REFRESH_MS / 1000}s` : "auto-refresh off");
+                if (autoRefresh)
+                    startRefresh();
+                else
+                    stopRefresh();
+                return;
             }
             else if (action.type === "pane" && action.pane) {
                 pane = action.pane;
@@ -139,62 +327,108 @@ export async function runDash(config, parsed, io, env) {
                 io.log("Register: kya register-agent --name solo --version-hash dev-local");
                 return;
             }
-            else if (!opts.offline && client) {
-                const cfg = { ...config, offline: false };
-                void (async () => {
+            else if (action.type === "refresh") {
+                // fall through
+            }
+            else if (!offline && client) {
+                if (action.type === "wrap") {
+                    arm({ kind: "wrap", prompt: "wrap sample org.sample.data.write (ticket only)?" });
+                    return;
+                }
+                if (action.type === "kill") {
+                    const row = selected(last.agents);
+                    if (!row)
+                        return;
+                    arm({ kind: "kill", id: row.id, prompt: `kill agent ${row.id}?` });
+                    return;
+                }
+                if (action.type === "invoke") {
+                    const row = selected(last.approvals);
+                    if (!row)
+                        return;
+                    const toolId = String(row.action ?? "org.sample.data.write");
+                    arm({
+                        kind: "invoke",
+                        id: row.id,
+                        toolId,
+                        prompt: `invoke ${row.id} tool=${toolId}? (does not run the write)`,
+                    });
+                    return;
+                }
+                if (action.type === "shrink-build" || action.type === "shrink-read") {
+                    const row = selected(last.sessions);
+                    if (!row)
+                        return;
+                    const to = action.type === "shrink-build" ? "BUILD" : "READ";
+                    arm({ kind: "shrink", id: row.id, to, prompt: `shrink ${row.id} → ${to}?` });
+                    return;
+                }
+                if (action.type === "orr-run") {
+                    busy = true;
                     try {
-                        if (action.type === "wrap") {
-                            const result = await runWrap(cfg, { toolId: "org.sample.data.write", irreversible: true }, client);
-                            io.log(`wrap exit ${wrapExitCode(result)} ${result.eval.response.verdict}`);
-                        }
-                        else if (action.type === "kill") {
-                            const row = selected(last.agents);
-                            if (!row)
-                                return;
-                            const killed = await runKillAgent(cfg, row.id, client);
-                            io.log(`${killed.status ?? "PAUSED"}  ${killed.id}`);
-                        }
-                        else if (action.type === "invoke") {
-                            const row = selected(last.approvals);
-                            if (!row)
-                                return;
-                            const result = await runInvoke(cfg, { toolId: String(row.action ?? "org.sample.data.write"), irreversible: true }, client);
-                            io.log(`invoke ${result.verdict} dispatched=${result.dispatched} ${result.sideEffect}`);
-                        }
-                        else if (action.type === "shrink-build" || action.type === "shrink-read") {
-                            const row = selected(last.sessions);
-                            if (!row)
+                        const result = deskOrr(config.cwd);
+                        orrSummary = {
+                            overall: result.report.overall,
+                            disposition: result.report.disposition,
+                            path: result.reportJsonPath ?? result.reportMdPath,
+                        };
+                        io.log("orr producer=sa.first_party (Scorecard: use CLI --producer openssf.scorecard)");
+                    }
+                    finally {
+                        busy = false;
+                    }
+                }
+                else if (action.type === "passport") {
+                    const row = selected(last.agents);
+                    if (!row) {
+                        io.log("Select an agent (pane 3) then press t");
+                        return;
+                    }
+                    busy = true;
+                    void (async () => {
+                        try {
+                            if (!stillLive())
                                 return;
-                            const to = action.type === "shrink-build" ? "BUILD" : "READ";
-                            const sh = await runShrinkSession(cfg, row.id, to, client);
-                            io.log(`clearance ${sh.from} → ${sh.to}`);
+                            const passport = await client.getPassport(row.id);
+                            const dump = JSON.stringify(passport, null, 2);
+                            assertNoSecrets("", dump);
+                            io.log(dump);
                         }
-                        else if (action.type === "orr-run") {
-                            const result = deskOrr(config.cwd);
-                            orrSummary = {
-                                overall: result.report.overall,
-                                disposition: result.report.disposition,
-                                path: result.reportJsonPath ?? result.reportMdPath,
-                            };
+                        catch (err) {
+                            if (err instanceof AuthRequiredError)
+                                io.error(err.message);
+                            else
+                                io.error(err instanceof Error ? err.message : String(err));
                         }
-                        else if (action.type === "decide-approve" || action.type === "decide-reject") {
-                            const row = selected(last.approvals);
-                            if (!row)
-                                return;
-                            const verb = action.type === "decide-approve" ? "approve" : "reject";
-                            io.log(`kya ${verb} --id ${row.id}  (TUI does not decide)`);
+                        finally {
+                            busy = false;
+                            await paint();
                         }
+                    })();
+                    return;
+                }
+                else if (action.type === "decide-approve" || action.type === "decide-reject") {
+                    const row = selected(last.approvals);
+                    if (!row)
+                        return;
+                    const decision = action.type === "decide-approve" ? "approve" : "reject";
+                    if (isMachineApiKey(config.apiKey ?? "")) {
+                        io.log(`Machine API keys cannot ${decision} from the TUI. Run: kya ${decision} --id ${row.id}`);
+                        return;
                     }
-                    catch (err) {
-                        if (err instanceof AuthRequiredError)
-                            io.error(err.message);
-                        else
-                            io.error(err instanceof Error ? err.message : String(err));
-                    }
-                    finally {
-                        await paint();
-                    }
-                })();
+                    arm({
+                        kind: "decide",
+                        id: row.id,
+                        decision,
+                        prompt: `${decision} ${row.id}? (needs kya.approve JWT scope)`,
+                    });
+                    return;
+                }
+                else {
+                    runPaint();
+                    return;
+                }
+                runPaint();
                 return;
             }
             else if (action.type === "orr-run") {
@@ -204,20 +438,29 @@ export async function runDash(config, parsed, io, env) {
                     disposition: result.report.disposition,
                     path: result.reportJsonPath ?? result.reportMdPath,
                 };
+                io.log("orr producer=sa.first_party");
             }
-            painting = true;
-            void paint()
-                .catch((err) => {
-                if (err instanceof AuthRequiredError)
-                    io.error(err.message);
-                else
-                    io.error(err instanceof Error ? err.message : String(err));
-            })
-                .finally(() => {
-                painting = false;
-            });
+            else if (action.type === "wrap" ||
+                action.type === "kill" ||
+                action.type === "invoke" ||
+                action.type === "shrink-build" ||
+                action.type === "shrink-read" ||
+                action.type === "decide-approve" ||
+                action.type === "decide-reject" ||
+                action.type === "passport") {
+                io.log("Need a live plane (O toggles offline; set KYA_API_KEY).");
+                return;
+            }
+            runPaint();
         };
         const cleanup = () => {
+            stopRefresh();
+            try {
+                stdoutFd.write("\x1b[?2004l");
+            }
+            catch {
+                /* ignore */
+            }
             stdinFd.setRawMode?.(false);
             stdinFd.off("keypress", onKey);
             stdinFd.pause();
@@ -225,4 +468,15 @@ export async function runDash(config, parsed, io, env) {
         stdinFd.on("keypress", onKey);
     });
 }
+function makeClient(config, offline) {
+    if (offline || !config.apiKey)
+        return undefined;
+    return new KyaHttpClient({
+        baseUrl: config.baseUrl,
+        apiKey: config.apiKey,
+        host: config.host,
+        agentId: config.agentId,
+        requireApiKey: true,
+    });
+}
 //# sourceMappingURL=dash.js.map