@sideboard-ai/core 0.1.295 → 0.1.297

package/dist/index.js

@@ -19,17 +19,20 @@ import {
   agentBlockFields,
   agentGitPrompt,
   alignQueueAttachments,
+  answerToolPermission,
   appendQueuedItem,
   applyIssueListWindow,
   applyPromptCacheTtlEnv,
   applyThreadIntoMain,
   applyWorkspaceTags,
   armSchedules,
+  askToolPermission,
   assembleHomeBoard,
   boardPinIdentity,
   captureTurnBaseline,
   chatBlockedSuffix,
   claimDesktopHost,
+  clampBlockReason,
   clampMcpIssueLimit,
   classifyWorktreeColumn,
   classifyWorktreeListBadges,
@@ -160,6 +163,7 @@ import {
   reviewLabelForRepo,
   scheduleNeedsCaffeinate,
   schedulesPath,
+  setToolPermissionPublisher,
   shiftQueuedItem,
   shouldNotifyOrchestrator,
   shouldRemoveWorktreeOnTeardown,
@@ -185,8 +189,9 @@ import {
   worktreeAgentBlock,
   worktreeBoardStatus,
   worktreeCleanupSettings,
+  writeAgentBlock,
   writeWorktreeFile
-} from "./chunk-XXT3C2EF.js";
+} from "./chunk-W2A63ZOK.js";
 import {
   LEGACY_PLAN_FILE_REL,
   PLAN_FILE_NAME,
@@ -282,7 +287,7 @@ import {
   userMcpNamesToDisable,
   worktreeMcpToolNames,
   writeInjectedMcpConfig
-} from "./chunk-RWIYYFID.js";
+} from "./chunk-6GTABVNG.js";
 import {
   brightsyMcpServerName,
   connectBrightsyTeam,
@@ -410,7 +415,7 @@ import {
   workspaceAgentChatSummaries,
   worktreeRunPortsPath,
   wrapReviewSkillMarkdown
-} from "./chunk-KCP6IVRI.js";
+} from "./chunk-67BWWLEB.js";
 import {
   STDERR_EVENT_MAX_CHARS,
   STDOUT_EVENT_MAX_CHARS,
@@ -610,7 +615,7 @@ import {
   stageBuffersAsAttachments,
   syncWorkspacesFromThreads,
   takenTeamSlugsForOrchestration
-} from "./chunk-YEIPPZ5W.js";
+} from "./chunk-BGEECLKH.js";
 import {
   GITHUB_PR_BODY_MAX_CHARS,
   GITHUB_PR_BODY_SAFE_CHARS,
@@ -698,7 +703,7 @@ import {
   suggestSlug,
   switchWorktreeBranch,
   warmGithubAgentAuth
-} from "./chunk-ZEP6JIRF.js";
+} from "./chunk-JWXJXEA3.js";
 import {
   FAMOUS_SOCCER_TEAMS,
   allocateTeamName,
@@ -730,7 +735,7 @@ import {
   worktreeNameFromPath,
   worktreeSlugForTicket,
   writeThread
-} from "./chunk-QB5MDOHL.js";
+} from "./chunk-WZLV4WNS.js";
 import "./chunk-2P4XKWV2.js";
 import {
   BRIGHTSY_OAUTH_CLIENT_ID,
@@ -754,7 +759,7 @@ import {
 import {
   clipMcpToolResult,
   cursorToolErrorText
-} from "./chunk-ER6BGGME.js";
+} from "./chunk-J54UPHXZ.js";
 import "./chunk-AXQ4ZWHK.js";
 import {
   AGENT_RUNNER_MAX_OLD_SPACE_MB,
@@ -819,7 +824,7 @@ import {
   rpcNotify,
   rpcResult,
   writeAgentRuntimeMetadata
-} from "./chunk-NYBFYFK7.js";
+} from "./chunk-QDA6NXRA.js";
 import {
   AGENT_DONE_SOUNDS,
   CHAT_TEXT_SCALES,
@@ -5049,6 +5054,124 @@ function registerScheduleTools(server) {
 // src/agent-rpc/handlers.ts
 import { randomUUID as randomUUID3 } from "crypto";
 import { isAbsolute } from "path";
+
+// src/remote/phone-permission.ts
+var PHONE_CONTROL_PREFIX = "\0sb.phone\n";
+var DECISIONS = /* @__PURE__ */ new Set(["allow", "deny", "allow_session"]);
+var push = null;
+function setPhonePermissionPush(next) {
+  push = next;
+}
+function notifyPhonePermission(chatId, prompt) {
+  const id = chatId.trim();
+  if (!id) return;
+  push?.(id, prompt);
+}
+function permissionViewFromBlock(block) {
+  if (!block || block.source !== "permission") return null;
+  const prompt = block.permission;
+  if (!prompt?.id || !prompt.title) return null;
+  return {
+    id: prompt.id,
+    title: prompt.title,
+    detail: typeof prompt.detail === "string" ? prompt.detail : "",
+    ...prompt.path ? { path: prompt.path } : {},
+    allowSession: prompt.allowSession !== false,
+    ...prompt.defaultToNo ? { defaultToNo: true } : {}
+  };
+}
+function phonePermissionView(chatId) {
+  return permissionViewFromBlock(readThread(chatId)?.agentBlock);
+}
+function textField(value, key) {
+  const raw = value[key];
+  return typeof raw === "string" ? raw.trim() : "";
+}
+function takePhonePermission(text5) {
+  if (!text5.startsWith(PHONE_CONTROL_PREFIX)) return null;
+  let parsed;
+  try {
+    parsed = JSON.parse(text5.slice(PHONE_CONTROL_PREFIX.length));
+  } catch {
+    return null;
+  }
+  if (!parsed || typeof parsed !== "object") return null;
+  if (parsed.op !== "permission") return null;
+  const chatId = textField(parsed, "chatId");
+  const id = textField(parsed, "id");
+  const decision = textField(parsed, "decision");
+  if (!chatId || !id || !DECISIONS.has(decision)) return "invalid";
+  return { op: "permission", chatId, id, decision };
+}
+function dispatchPhonePermission(text5, emit) {
+  const cmd = takePhonePermission(text5);
+  if (cmd == null) return false;
+  if (cmd === "invalid") {
+    emit({ op: "error", message: "invalid phone command" });
+    return true;
+  }
+  if (!answerToolPermission(cmd.id, cmd.decision)) {
+    emit({ op: "error", chatId: cmd.chatId, message: "That request already finished." });
+    emit({ op: "permission", chatId: cmd.chatId, prompt: phonePermissionView(cmd.chatId) });
+  }
+  return true;
+}
+
+// src/agent-rpc/permission-handler.ts
+setToolPermissionPublisher({
+  show(item) {
+    const thread = readThread(item.threadId);
+    if (!thread || thread.status === "archived") return false;
+    writeAgentBlock(item.threadId, {
+      source: "permission",
+      reason: clampBlockReason(item.prompt.title),
+      at: (/* @__PURE__ */ new Date()).toISOString(),
+      permission: item.prompt
+    });
+    notifyPhonePermission(item.threadId, item.prompt);
+    return true;
+  },
+  clear(threadId, id) {
+    const thread = readThread(threadId);
+    if (thread?.agentBlock?.source === "permission" && thread.agentBlock.permission?.id === id) {
+      updateThread(threadId, { agentBlock: null });
+      notifyPhonePermission(threadId, null);
+    }
+  }
+});
+function asRecord(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return {};
+  return value;
+}
+function str(value) {
+  return typeof value === "string" ? value : "";
+}
+function invalidParams(message) {
+  return Object.assign(new Error(message), { rpcCode: -32602 });
+}
+var handlePermissionAsk = async (params, _ctx) => {
+  const rec = asRecord(params);
+  const threadId = str(rec.threadId).trim();
+  const toolName = str(rec.toolName).trim();
+  if (!threadId) throw invalidParams("threadId is required");
+  if (!toolName) throw invalidParams("toolName is required");
+  const input = asRecord(rec.input);
+  const ask = {
+    threadId,
+    toolName,
+    input: Object.keys(input).length > 0 ? input : void 0,
+    blockedPath: str(rec.blockedPath).trim() || void 0,
+    title: str(rec.title).trim() || void 0,
+    description: str(rec.description).trim() || void 0,
+    displayName: str(rec.displayName).trim() || void 0,
+    suggestions: rec.suggestions,
+    suppressAlwaysAllow: rec.suppressAlwaysAllow === true,
+    defaultToNo: rec.defaultToNo === true
+  };
+  return askToolPermission(ask);
+};
+
+// src/agent-rpc/handlers.ts
 function presentArtifactResult(input) {
   const id = input.artifact_id?.trim() || `artifact_${Date.now().toString(36)}_${randomUUID3().slice(0, 8)}`;
   return {
@@ -5062,20 +5185,20 @@ function presentArtifactResult(input) {
     message: input.type === "log" ? "Log accepted. Same artifact_id appends; send only new lines next time." : "Artifact accepted. Sideboard desktop opens it in the side column beside chat."
   };
 }
-function asRecord(value) {
+function asRecord2(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return {};
   return value;
 }
-function str(value) {
+function str2(value) {
   return typeof value === "string" ? value : "";
 }
-function invalidParams(message) {
+function invalidParams2(message) {
   return Object.assign(new Error(message), { rpcCode: -32602 });
 }
 function jobCwd(rec) {
-  const raw = str(rec.cwd).trim();
-  if (!raw) throw invalidParams("cwd is required");
-  if (!isAbsolute(raw)) throw invalidParams("cwd must be an absolute path");
+  const raw = str2(rec.cwd).trim();
+  if (!raw) throw invalidParams2("cwd is required");
+  if (!isAbsolute(raw)) throw invalidParams2("cwd must be an absolute path");
   return raw;
 }
 async function handleRuntimePing(_params, _ctx) {
@@ -5086,33 +5209,33 @@ async function handleRuntimePing(_params, _ctx) {
   };
 }
 async function handlePresentArtifact(params, _ctx) {
-  const rec = asRecord(params);
-  const title = str(rec.title).trim();
-  const type = str(rec.type).trim();
+  const rec = asRecord2(params);
+  const title = str2(rec.title).trim();
+  const type = str2(rec.type).trim();
   const allowed = ["html", "svg", "markdown", "react", "log"];
-  if (!title) throw invalidParams("title is required");
+  if (!title) throw invalidParams2("title is required");
   if (!allowed.includes(type)) {
-    throw invalidParams("type must be html, svg, markdown, react, or log");
+    throw invalidParams2("type must be html, svg, markdown, react, or log");
   }
-  const statusRaw = str(rec.status).trim();
+  const statusRaw = str2(rec.status).trim();
   const status = ["running", "ok", "failed", "idle"].includes(
     statusRaw
   ) ? statusRaw : void 0;
-  const modeRaw = str(rec.mode).trim();
+  const modeRaw = str2(rec.mode).trim();
   const mode = modeRaw === "append" || modeRaw === "replace" ? modeRaw : void 0;
   return presentArtifactResult({
     title,
     type,
-    artifact_id: str(rec.artifact_id) || void 0,
+    artifact_id: str2(rec.artifact_id) || void 0,
     status,
-    phase: str(rec.phase) || void 0,
+    phase: str2(rec.phase) || void 0,
     mode
   });
 }
 async function handleJobWait(params, ctx, waitFn = waitForDetachedJob) {
-  const rec = asRecord(params);
-  const id = str(rec.id).trim();
-  if (!id) throw invalidParams("id is required");
+  const rec = asRecord2(params);
+  const id = str2(rec.id).trim();
+  if (!id) throw invalidParams2("id is required");
   const cwd = jobCwd(rec);
   const deadline = Date.now() + AGENT_RPC_JOB_HOLD_MAX_MS;
   let last;
@@ -5134,14 +5257,14 @@ async function handleJobWait(params, ctx, waitFn = waitForDetachedJob) {
   };
 }
 async function handleJobStop(params, _ctx) {
-  const rec = asRecord(params);
-  const id = str(rec.id).trim();
-  if (!id) throw invalidParams("id is required");
-  const reason = str(rec.reason).trim() || void 0;
+  const rec = asRecord2(params);
+  const id = str2(rec.id).trim();
+  if (!id) throw invalidParams2("id is required");
+  const reason = str2(rec.reason).trim() || void 0;
   return stopDetachedJob(jobCwd(rec), id, reason ? { reason } : void 0);
 }
 async function defaultTurnWait(ref, timeoutMs) {
-  const { getOrchestrator: getOrchestrator2 } = await import("./orchestrator-VDYZSZWY.js");
+  const { getOrchestrator: getOrchestrator2 } = await import("./orchestrator-ZQU62CES.js");
   const orch = getOrchestrator2();
   const thread = await orch.waitForTurn(ref, timeoutMs, {
     resolveIfStillRunning: true
@@ -5162,9 +5285,9 @@ async function defaultTurnWait(ref, timeoutMs) {
   });
 }
 async function handleTurnWait(params, ctx, waitFn = defaultTurnWait) {
-  const rec = asRecord(params);
-  const ref = str(rec.ref).trim();
-  if (!ref) throw invalidParams("ref is required");
+  const rec = asRecord2(params);
+  const ref = str2(rec.ref).trim();
+  if (!ref) throw invalidParams2("ref is required");
   const requested = typeof rec.timeoutMs === "number" && Number.isFinite(rec.timeoutMs) ? rec.timeoutMs : void 0;
   const holdMax = requested !== void 0 ? Math.min(Math.max(1e3, Math.floor(requested)), AGENT_RPC_JOB_HOLD_MAX_MS) : AGENT_RPC_JOB_HOLD_MAX_MS;
   const deadline = Date.now() + holdMax;
@@ -5197,7 +5320,8 @@ function createAgentRpcDispatcher() {
     "ui.presentArtifact": handlePresentArtifact,
     "job.wait": handleJobWait,
     "job.stop": handleJobStop,
-    "turn.wait": handleTurnWait
+    "turn.wait": handleTurnWait,
+    "permission.ask": handlePermissionAsk
   };
 }
 
@@ -8863,7 +8987,7 @@ var BAKED_REMOTE_RELAY_URL = `wss://relay.sideboard.cloud${REMOTE_RELAY_PATH}`;
 function remoteRelayUrl() {
   return process.env.SIDEBOARD_REMOTE_RELAY_URL?.trim() || BAKED_REMOTE_RELAY_URL;
 }
-function str2(value) {
+function str3(value) {
   return typeof value === "string" ? value.trim() : "";
 }
 function questions(value) {
@@ -8872,14 +8996,14 @@ function questions(value) {
   for (const item of value) {
     if (!item || typeof item !== "object") return null;
     const row2 = item;
-    const question = str2(row2.question);
+    const question = str3(row2.question);
     if (!question || !Array.isArray(row2.options)) return null;
     const options = [];
     for (const opt of row2.options) {
       if (!opt || typeof opt !== "object") return null;
-      const label = str2(opt.label);
+      const label = str3(opt.label);
       if (!label) return null;
-      const description = str2(opt.description);
+      const description = str3(opt.description);
       options.push(description ? { label, description } : { label });
     }
     if (options.length === 0) return null;
@@ -8900,11 +9024,11 @@ function parseRemoteClientMessage(raw) {
   if (msg.type === "host_pair") return { type: "host_pair" };
   if (msg.type === "stop") return { type: "stop" };
   if (msg.type === "host_register") {
-    const deviceId = str2(parsed.deviceId);
-    const hostSecret = str2(parsed.hostSecret);
-    const deviceLabel = str2(parsed.deviceLabel);
+    const deviceId = str3(parsed.deviceId);
+    const hostSecret = str3(parsed.hostSecret);
+    const deviceLabel = str3(parsed.deviceLabel);
     if (!deviceId || !hostSecret || !deviceLabel) return null;
-    const accountToken = str2(parsed.accountToken);
+    const accountToken = str3(parsed.accountToken);
     return {
       type: "host_register",
       deviceId,
@@ -8914,12 +9038,12 @@ function parseRemoteClientMessage(raw) {
     };
   }
   if (msg.type === "pair") {
-    const code = str2(parsed.code).toUpperCase();
+    const code = str3(parsed.code).toUpperCase();
     if (!code) return null;
     return { type: "pair", code };
   }
   if (msg.type === "resume") {
-    const sessionToken = str2(parsed.sessionToken);
+    const sessionToken = str3(parsed.sessionToken);
     if (!sessionToken) return null;
     return { type: "resume", sessionToken };
   }
@@ -8930,19 +9054,19 @@ function parseRemoteClientMessage(raw) {
     return { type: "list_hosts", sessionTokens };
   }
   if (msg.type === "prompt") {
-    const text5 = str2(parsed.text);
+    const text5 = str3(parsed.text);
     if (!text5) return null;
     return { type: "prompt", text: text5 };
   }
   if (msg.type === "assistant") {
-    return { type: "assistant", text: str2(parsed.text) };
+    return { type: "assistant", text: str3(parsed.text) };
   }
   if (msg.type === "ask_user") {
     const parsedQuestions = questions(parsed.questions);
     if (!parsedQuestions?.length) return null;
     return {
       type: "ask_user",
-      text: str2(parsed.text),
+      text: str3(parsed.text),
       questions: parsedQuestions
     };
   }
@@ -8968,7 +9092,7 @@ function parseRemoteServerMessage(raw) {
     for (const item of raw2) {
       if (!item || typeof item !== "object") return null;
       const row2 = item;
-      const sessionToken = str2(row2.sessionToken);
+      const sessionToken = str3(row2.sessionToken);
       if (!sessionToken || typeof row2.deviceId !== "string" || typeof row2.deviceLabel !== "string") return null;
       if (typeof row2.online !== "boolean") return null;
       hosts.push({
@@ -8982,43 +9106,43 @@ function parseRemoteServerMessage(raw) {
   }
   if (type === "stop") return { type: "stop" };
   if (type === "registered") {
-    const deviceId = str2(parsed.deviceId);
-    const deviceLabel = str2(parsed.deviceLabel);
+    const deviceId = str3(parsed.deviceId);
+    const deviceLabel = str3(parsed.deviceLabel);
     if (!deviceId || !deviceLabel) return null;
     return { type: "registered", deviceId, deviceLabel };
   }
   if (type === "pairing_code") {
-    const code = str2(parsed.code);
+    const code = str3(parsed.code);
     const expiresAt = parsed.expiresAt;
     if (!code || typeof expiresAt !== "number") return null;
     return { type: "pairing_code", code, expiresAt };
   }
   if (type === "inbound") {
-    const text5 = str2(parsed.text);
+    const text5 = str3(parsed.text);
     if (!text5) return null;
     return { type: "inbound", text: text5 };
   }
   if (type === "paired") {
-    const deviceId = str2(parsed.deviceId);
-    const deviceLabel = str2(parsed.deviceLabel);
-    const sessionToken = str2(parsed.sessionToken);
+    const deviceId = str3(parsed.deviceId);
+    const deviceLabel = str3(parsed.deviceLabel);
+    const sessionToken = str3(parsed.sessionToken);
     if (!deviceId || !deviceLabel || !sessionToken) return null;
     return { type: "paired", deviceId, deviceLabel, sessionToken };
   }
   if (type === "assistant") {
-    return { type: "assistant", text: str2(parsed.text) };
+    return { type: "assistant", text: str3(parsed.text) };
   }
   if (type === "ask_user") {
     const parsedQuestions = questions(parsed.questions);
     if (!parsedQuestions?.length) return null;
     return {
       type: "ask_user",
-      text: str2(parsed.text),
+      text: str3(parsed.text),
       questions: parsedQuestions
     };
   }
   if (type === "error") {
-    const message = str2(parsed.message) || "remote error";
+    const message = str3(parsed.message) || "remote error";
     return { type: "error", message };
   }
   return null;
@@ -9446,10 +9570,10 @@ var MIN_MD_CHARS = 120;
 function oneLine(value, max) {
   return value.replace(/[`\r\n]/g, " ").replace(/\s+/g, " ").trim().slice(0, max);
 }
-function asRecord2(value) {
+function asRecord3(value) {
   if (typeof value === "string") {
     try {
-      return asRecord2(JSON.parse(value));
+      return asRecord3(JSON.parse(value));
     } catch {
       return void 0;
     }
@@ -9457,7 +9581,7 @@ function asRecord2(value) {
   if (value && typeof value === "object" && !Array.isArray(value)) return value;
   return void 0;
 }
-function str3(value) {
+function str4(value) {
   return typeof value === "string" ? value : "";
 }
 function normalizedBody(content) {
@@ -9524,7 +9648,7 @@ function toolContent(input) {
   if (!input) return "";
   const direct = input.content;
   if (typeof direct === "string") return direct;
-  const nested = asRecord2(direct);
+  const nested = asRecord3(direct);
   if (!nested) return "";
   for (const key of ["html", "markup", "text", "source", "content", "code"]) {
     if (typeof nested[key] === "string") return nested[key];
@@ -9547,13 +9671,13 @@ function phoneArtifactText(text5, parts, limit = Number.POSITIVE_INFINITY) {
   const extras = [];
   for (const part of parts ?? []) {
     if (part.type !== "tool" || part.parentId || !isArtifactTool(part.name)) continue;
-    const input = asRecord2(part.input);
+    const input = asRecord3(part.input);
     const content = toolContent(input);
     const hint = artifactHint(content);
     if (hint && hints.has(hint)) continue;
     const kind = kindFor("", content);
-    const title = oneLine(str3(input?.title), 80) || (kind ? titleFor(kind, content) : "Artifact");
-    if (!str3(input?.title) && content.trim().length < MIN_FENCE_CHARS) continue;
+    const title = oneLine(str4(input?.title), 80) || (kind ? titleFor(kind, content) : "Artifact");
+    if (!str4(input?.title) && content.trim().length < MIN_FENCE_CHARS) continue;
     if (hint) hints.add(hint);
     extras.push(marker(title, hint));
   }
@@ -9566,11 +9690,11 @@ function phoneArtifactText(text5, parts, limit = Number.POSITIVE_INFINITY) {
 ${tail}` : tail;
 }
 function parseOpenArtifact(value, chatId) {
-  const record = asRecord2(value);
+  const record = asRecord3(value);
   if (!record) return "invalid";
-  const title = oneLine(str3(record.title), 200);
+  const title = oneLine(str4(record.title), 200);
   if (!title) return "invalid";
-  const hint = oneLine(str3(record.hint), 200);
+  const hint = oneLine(str4(record.hint), 200);
   return { op: "open-artifact", chatId, title, ...hint ? { hint } : {} };
 }
 var PHONE_ARTIFACT_MAX_CHARS = 18e4;
@@ -9589,13 +9713,13 @@ function phoneArtifactDocuments(sources) {
     }
     for (const part of source.parts ?? []) {
       if (part.type !== "tool" || part.parentId || !isArtifactTool(part.name)) continue;
-      const input = asRecord2(part.input);
+      const input = asRecord3(part.input);
       const content = toolContent(input);
       const hint = artifactHint(content);
       if (hint && hints.has(hint)) continue;
-      const typed = kindFor(str3(input?.type), content) ?? kindFor("", content);
-      const title = oneLine(str3(input?.title), 80) || (typed ? titleFor(typed, content) : "Artifact");
-      if (!str3(input?.title) && content.trim().length < MIN_FENCE_CHARS) continue;
+      const typed = kindFor(str4(input?.type), content) ?? kindFor("", content);
+      const title = oneLine(str4(input?.title), 80) || (typed ? titleFor(typed, content) : "Artifact");
+      if (!str4(input?.title) && content.trim().length < MIN_FENCE_CHARS) continue;
       if (hint) hints.add(hint);
       docs.push({ title, content, kind: typed ?? "text" });
     }
@@ -9640,13 +9764,21 @@ function pickArtifactMatch(items, request) {
 }
 
 // src/remote/phone-panes.ts
+var PHONE_CHANGE_SCOPES = ["last_turn", "uncommitted", "staged", "unstaged", "commits"];
+var PHONE_CHANGE_SCOPE_DEFAULT = "commits";
+function phoneChangeScope(value) {
+  return typeof value === "string" && PHONE_CHANGE_SCOPES.includes(value) ? value : void 0;
+}
+function phoneCommitSha(value) {
+  return typeof value === "string" && /^[0-9a-f]{4,40}$/i.test(value) ? value : void 0;
+}
 var MAX_ROWS = 200;
 var MAX_QUERY = 200;
 function parsePhonePane(value, chatId) {
   const pane = value && typeof value === "object" ? value.pane : void 0;
   if (pane !== "files" && pane !== "changes" && pane !== "checks") return "invalid";
-  const scopeRaw = value.scope;
-  const scope = scopeRaw === "uncommitted" || scopeRaw === "commits" ? scopeRaw : void 0;
+  const scope = phoneChangeScope(value.scope);
+  const commitSha = phoneCommitSha(value.commitSha);
   const queryRaw = value.query;
   const query = typeof queryRaw === "string" ? queryRaw.trim().slice(0, MAX_QUERY) : "";
   return {
@@ -9654,6 +9786,7 @@ function parsePhonePane(value, chatId) {
     chatId,
     pane,
     ...scope && pane === "changes" ? { scope } : {},
+    ...commitSha && pane === "changes" && scope === "commits" ? { commitSha } : {},
     ...query && pane === "files" ? { query } : {}
   };
 }
@@ -9662,10 +9795,10 @@ function filterPhoneFiles(paths, query) {
   if (!q) return paths;
   return paths.filter((path2) => path2.toLowerCase().includes(q));
 }
-async function readPhonePane(thread, pane, scope, query) {
+async function readPhonePane(thread, pane, scope, query, commitSha) {
   try {
     if (pane === "files") return await readFiles(thread.id, query);
-    if (pane === "changes") return await readChanges(thread.id, scope ?? "commits");
+    if (pane === "changes") return await readChanges(thread.id, scope ?? PHONE_CHANGE_SCOPE_DEFAULT, commitSha);
     return await readChecks(thread.id);
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
@@ -9682,9 +9815,14 @@ async function readFiles(threadId, query) {
     ...note ? { note } : {}
   };
 }
-async function readChanges(threadId, scope) {
-  const diff = await getOrchestrator().diff(threadId, { includePatches: false, scope });
+async function readChanges(threadId, scope, commitSha) {
+  const diff = await getOrchestrator().diff(threadId, {
+    includePatches: false,
+    scope,
+    commitSha: scope === "commits" ? commitSha ?? null : null
+  });
   const shown = diff.files.slice(0, MAX_ROWS);
+  const selected = diff.commits.find((commit) => commit.sha === commitSha || commit.shortSha === commitSha);
   return {
     rows: shown.map((file) => {
       const detail = changeDetail(file.additions, file.deletions);
@@ -9695,7 +9833,13 @@ async function readChanges(threadId, scope) {
         ...detail ? { detail } : {}
       };
     }),
-    ...diff.files.length > shown.length ? { note: `${diff.files.length - shown.length} more changed files` } : {}
+    ...diff.files.length > shown.length ? { note: `${diff.files.length - shown.length} more changed files` } : {},
+    scope: diff.scope,
+    commitSha: selected?.sha ?? null,
+    ...diff.base ? { base: diff.base } : {},
+    hasLastTurnBase: diff.hasLastTurnBase,
+    commits: diff.commits.slice(0, 40),
+    scopeStats: diff.scopeStats
   };
 }
 function changeDetail(additions, deletions) {
@@ -9704,13 +9848,14 @@ function changeDetail(additions, deletions) {
   if (add === 0 && del === 0) return void 0;
   return `+${add} \u2212${del}`;
 }
-async function readPhoneChangePatch(threadId, path2) {
+async function readPhoneChangePatch(threadId, path2, scope = PHONE_CHANGE_SCOPE_DEFAULT, commitSha) {
   const diff = await getOrchestrator().diff(threadId, {
     path: path2,
-    scope: "commits",
+    scope,
+    commitSha: scope === "commits" ? commitSha ?? null : null,
     includePatches: true,
     includeMeta: false,
-    includeUntracked: false
+    includeUntracked: scope === "uncommitted" || scope === "unstaged" || scope === "last_turn" || scope === "commits" && !commitSha
   });
   const file = diff.files.find((row2) => row2.path === path2) ?? diff.files[0];
   if (!file) return null;
@@ -10055,7 +10200,7 @@ function listPhoneHistory(opts) {
 }
 
 // src/remote/phone-chats.ts
-var PHONE_CONTROL_PREFIX = "\0sb.phone\n";
+var PHONE_CONTROL_PREFIX2 = "\0sb.phone\n";
 var PREVIEW_LIMIT2 = 90;
 var AGENT_KINDS = /* @__PURE__ */ new Set(["claude", "codex", "opencode", "brightsy", "cursor"]);
 var MAX_PHONE_FILES = 8;
@@ -10063,13 +10208,13 @@ var MAX_PHONE_FILE_CHARS = Math.ceil(8 * 1024 * 1024 * 4 / 3);
 var MAX_PHONE_FILES_CHARS = Math.ceil(20 * 1024 * 1024 * 4 / 3);
 var MAX_DICTATION_CHARS = Math.ceil(12 * 1024 * 1024 * 4 / 3);
 function encodePhoneControl(payload) {
-  return PHONE_CONTROL_PREFIX + JSON.stringify(payload);
+  return PHONE_CONTROL_PREFIX2 + JSON.stringify(payload);
 }
 function takePhoneControl(text5) {
-  if (!text5.startsWith(PHONE_CONTROL_PREFIX)) return null;
+  if (!text5.startsWith(PHONE_CONTROL_PREFIX2)) return null;
   let parsed;
   try {
-    parsed = JSON.parse(text5.slice(PHONE_CONTROL_PREFIX.length));
+    parsed = JSON.parse(text5.slice(PHONE_CONTROL_PREFIX2.length));
   } catch {
     return "invalid";
   }
@@ -10080,14 +10225,14 @@ function parsePhoneControl(value) {
   const op = value.op;
   if (op === "list") return { op: "list" };
   if (op === "history") {
-    const query = textField(value, "query");
-    const after = textField(value, "after");
+    const query = textField2(value, "query");
+    const after = textField2(value, "after");
     return { op: "history", ...query ? { query } : {}, ...after ? { after } : {} };
   }
   if (op === "sources") {
-    const repoPath = textField(value, "repoPath");
+    const repoPath = textField2(value, "repoPath");
     if (!repoPath || !isProjectPath2(repoPath)) return "invalid";
-    const query = textField(value, "query");
+    const query = textField2(value, "query");
     return { op: "sources", repoPath, ...query ? { query } : {} };
   }
   if (op === "models") {
@@ -10096,7 +10241,7 @@ function parsePhoneControl(value) {
     return { op: "models", agent };
   }
   if (op === "dictate") {
-    const id = textField(value, "id");
+    const id = textField2(value, "id");
     const audioBase64 = base64Field(value, "audioBase64");
     if (!id || !audioBase64 || audioBase64.length > MAX_DICTATION_CHARS) return "invalid";
     return { op: "dictate", id, audioBase64 };
@@ -10108,26 +10253,30 @@ function parsePhoneControl(value) {
     return { op, chatId };
   }
   if (op === "git") {
-    const action = textField(value, "action");
+    const action = textField2(value, "action");
     if (!PHONE_HEADER_GIT_ACTIONS.includes(action)) return "invalid";
     return { op: "git", chatId, action };
   }
   if (op === "pane") return parsePhonePane(value, chatId);
   if (op === "open-artifact") return parseOpenArtifact(value, chatId);
   if (op === "open-file" || op === "media") {
-    const path2 = textField(value, "path");
+    const path2 = textField2(value, "path");
     if (!path2 || path2.length > 2e3) return "invalid";
     if (op === "media") return { op, chatId, path: path2 };
     const startLine = lineField(value, "startLine");
     const endLine = lineField(value, "endLine");
-    const view = textField(value, "view") === "diff" ? "diff" : void 0;
+    const view = textField2(value, "view") === "diff" ? "diff" : void 0;
+    const scope = phoneChangeScope(value.scope);
+    const commitSha = phoneCommitSha(value.commitSha);
     return {
       op,
       chatId,
       path: path2,
       ...startLine != null ? { startLine } : {},
       ...endLine != null ? { endLine } : {},
-      ...view ? { view } : {}
+      ...view ? { view } : {},
+      ...view && scope ? { scope } : {},
+      ...view && scope === "commits" && commitSha ? { commitSha } : {}
     };
   }
   const draft = parsePhoneDraft(value);
@@ -10141,7 +10290,7 @@ function parsePhoneControl(value) {
   }
   return "invalid";
 }
-function textField(value, key) {
+function textField2(value, key) {
   const raw = value[key];
   return typeof raw === "string" ? raw.trim() : "";
 }
@@ -10151,7 +10300,7 @@ function lineField(value, key) {
   return raw;
 }
 function agentField(value) {
-  const agent = textField(value, "agent");
+  const agent = textField2(value, "agent");
   if (!agent) return void 0;
   return AGENT_KINDS.has(agent) ? agent : void 0;
 }
@@ -10162,7 +10311,7 @@ function base64Field(value, key) {
 }
 function parsePhoneDraft(value) {
   const draft = {};
-  if (textField(value, "agent")) {
+  if (textField2(value, "agent")) {
     const agent = agentField(value);
     if (!agent) return "invalid";
     draft.agent = agent;
@@ -10202,7 +10351,7 @@ function parsePhoneDraft(value) {
   const refs = parsePhoneCodeRefs(value.refs);
   if (refs === "invalid") return "invalid";
   if (refs.length) draft.refs = refs;
-  const prompt = textField(value, "prompt");
+  const prompt = textField2(value, "prompt");
   if (prompt) draft.prompt = prompt.slice(0, 2e4);
   return draft;
 }
@@ -10213,7 +10362,7 @@ function parsePhoneFiles(value) {
   let total = 0;
   for (const item of value) {
     if (!item || typeof item !== "object") return "invalid";
-    const name = (textField(item, "name").replace(/[/\\]/g, "_") || "file").slice(0, 180);
+    const name = (textField2(item, "name").replace(/[/\\]/g, "_") || "file").slice(0, 180);
     const dataBase64 = base64Field(item, "dataBase64");
     if (!dataBase64 || !/^[A-Za-z0-9+/=]+$/.test(dataBase64)) return "invalid";
     if (dataBase64.length > MAX_PHONE_FILE_CHARS) return "invalid";
@@ -10229,10 +10378,10 @@ function parsePhoneLinks(value) {
   const links = [];
   for (const item of value) {
     if (!item || typeof item !== "object") return "invalid";
-    const ref = textField(item, "ref").slice(0, 80);
+    const ref = textField2(item, "ref").slice(0, 80);
     if (!ref) return "invalid";
-    const title = (textField(item, "title") || ref).slice(0, 200);
-    const url = textField(item, "url").slice(0, 500);
+    const title = (textField2(item, "title") || ref).slice(0, 200);
+    const url = textField2(item, "url").slice(0, 500);
     links.push({ ref, title, ...url ? { url } : {} });
   }
   return links;
@@ -10240,7 +10389,7 @@ function parsePhoneLinks(value) {
 function parsePhoneCreate(value) {
   const draft = parsePhoneDraft(value);
   if (draft === "invalid") return "invalid";
-  const goal = textField(value, "goal") || draft.prompt || "";
+  const goal = textField2(value, "goal") || draft.prompt || "";
   const where = value.where;
   if (where == null || where === "orchestration") {
     return {
@@ -10251,20 +10400,20 @@ function parsePhoneCreate(value) {
     };
   }
   if (where === "worktree") {
-    const chatId = textField(value, "chatId");
+    const chatId = textField2(value, "chatId");
     if (!chatId) return "invalid";
     return { op: "create", where: "worktree", chatId, ...draft };
   }
   if (where === "project") {
-    const repoPath = textField(value, "repoPath");
+    const repoPath = textField2(value, "repoPath");
     if (!repoPath || !isProjectPath2(repoPath)) return "invalid";
-    const sourceRaw = textField(value, "sourceType");
+    const sourceRaw = textField2(value, "sourceType");
     let sourceType;
     if (sourceRaw === "branch" || sourceRaw === "pr" || sourceRaw === "ticket") sourceType = sourceRaw;
     else if (sourceRaw) return "invalid";
-    const sourceRef = textField(value, "sourceRef");
+    const sourceRef = textField2(value, "sourceRef");
     if ((sourceType === "pr" || sourceType === "ticket") && !sourceRef) return "invalid";
-    const title = textField(value, "title").slice(0, 200);
+    const title = textField2(value, "title").slice(0, 200);
     const cowboy = value.cowboy === true;
     return {
       op: "create",
@@ -10533,14 +10682,22 @@ function dispatchPhoneWorkspace(cmd, emit, publishOpened) {
       emit({ op: "error", chatId: cmd.chatId, message: "That agent is not on this Mac." });
       return;
     }
-    void readPhonePane(thread, cmd.pane, cmd.scope, cmd.query).then((body) => {
+    void readPhonePane(thread, cmd.pane, cmd.scope, cmd.query, cmd.commitSha).then((body) => {
       emit({
         op: "pane",
         chatId: cmd.chatId,
         pane: cmd.pane,
         rows: body.rows,
         ...body.note ? { note: body.note } : {},
-        ...cmd.pane === "files" ? { query: cmd.query ?? "" } : {}
+        ...cmd.pane === "files" ? { query: cmd.query ?? "" } : {},
+        ...cmd.pane === "changes" ? {
+          scope: body.scope,
+          commitSha: body.commitSha ?? null,
+          ...body.base ? { base: body.base } : {},
+          hasLastTurnBase: body.hasLastTurnBase,
+          commits: body.commits ?? [],
+          ...body.scopeStats ? { scopeStats: body.scopeStats } : {}
+        } : {}
       });
     });
     return;
@@ -10909,7 +11066,7 @@ function beginCoordinatorPrompt(body, opts) {
 // src/remote/listen.ts
 function emitOpened(opts, opened) {
   setPhoneOpenChat(opened.chat.id);
-  emitControl(opts, { op: "opened", ...opened });
+  emitControl(opts, { op: "opened", ...opened, permission: phonePermissionView(opened.chat.id) });
 }
 function publishOpenedChat(opts, chatId) {
   const opened = openPhoneChat(chatId);
@@ -11137,7 +11294,7 @@ function handlePhoneControl(cmd, opts) {
       return;
     }
     if (cmd.view === "diff") {
-      void readPhoneChangePatch(thread.id, relative).then((body) => {
+      void readPhoneChangePatch(thread.id, relative, cmd.scope, cmd.commitSha).then((body) => {
         if (!body) {
           emitControl(opts, { op: "error", chatId: cmd.chatId, message: "That file has no changes to show." });
           return;
@@ -11291,6 +11448,7 @@ function runPhonePrompt(opts, cmd, chatId, generation) {
 }
 function handleRemoteInbound(text5, opts) {
   const body = text5.trim();
+  if (dispatchPhonePermission(body, (reply) => emitControl(opts, reply))) return;
   const control = takePhoneControl(body);
   if (control) {
     if (control === "invalid") {
@@ -11365,7 +11523,7 @@ function startPhoneBoardSync(opts) {
   let timer = null;
   let lastKey = "";
   let stopped = false;
-  const push = () => {
+  const push2 = () => {
     timer = null;
     if (stopped) return;
     let sidebar;
@@ -11382,7 +11540,7 @@ function startPhoneBoardSync(opts) {
   const schedule = () => {
     if (stopped) return;
     if (timer) clearTimeout(timer);
-    timer = setTimeout(push, debounceMs);
+    timer = setTimeout(push2, debounceMs);
   };
   const handle = (event) => {
     if (isPhoneBoardEvent(event)) schedule();
@@ -11392,13 +11550,13 @@ function startPhoneBoardSync(opts) {
   };
   const unsubscribe = (opts.subscribe ?? subscribePhoneBoard)(schedule);
   const offEvents = (opts.events ?? ((listener) => getOrchestrator().on(listener)))(handle);
-  push();
+  push2();
   let loginTimer = null;
   const refreshViewerLogin = opts.refreshViewerLogin;
   if (refreshViewerLogin) {
     const afterLogin = () => {
       void refreshViewerLogin().then(() => {
-        if (!stopped) push();
+        if (!stopped) push2();
       });
     };
     afterLogin();
@@ -11635,6 +11793,10 @@ function runRemoteHost(opts) {
     }
     send3({ type: "ask_user", text: outbound.text, questions: outbound.questions });
   };
+  setPhonePermissionPush((chatId, prompt) => {
+    if (getPhoneOpenChat() !== chatId) return;
+    emitControl({ onOutbound: emit }, { op: "permission", chatId, prompt });
+  });
   void loop();
   return {
     requestPairingCode() {
@@ -13254,7 +13416,7 @@ async function continueSourceThread(threadId, prompt) {
       await continueOnReply(threadId, prompt);
       return;
     }
-    const { getOrchestrator: getOrchestrator2 } = await import("./orchestrator-VDYZSZWY.js");
+    const { getOrchestrator: getOrchestrator2 } = await import("./orchestrator-ZQU62CES.js");
     await getOrchestrator2().send(threadId, prompt);
   } catch {
   }
@@ -13696,6 +13858,7 @@ export {
   allocateTeamName,
   allocateTeamSlug,
   annotateDevAccessRuns,
+  answerToolPermission,
   appDataDir,
   appSettingsPath,
   appendCompactedMessages,