@stratusagent/cli 0.11.2 → 0.11.4

package/README.md

@@ -7,7 +7,7 @@ put them in Slack — from one command.
 <!-- Pinned to the commit that added the asset so it renders on any ref
      (including this branch pre-merge) and on npm, which needs an absolute
      URL. Replacing the banner means updating this pin. -->
-![Stratus Labs](https://raw.githubusercontent.com/stratuslabs/agent/265bc175e60fd901b339095215439505606755bc/docs/assets/stratus-banner.png)
+![Stratus Labs](https://raw.githubusercontent.com/stratuslabs/agent/main/docs/assets/stratus-banner.png)
 
 ## Install
 
@@ -24,16 +24,16 @@ says so plainly if yours is too old. Details:
 
 `stratus setup` is the whole onboarding, as one small menu: sign in (Claude
 Pro/Max subscription or API key, ChatGPT/Codex, or any OpenAI-compatible
-service), pick default and fallback models, create your first agent,
-connect Slack, and
-install the always-on service — no config files to edit, no env vars to
-export. Walkthrough:
+service), pick default and fallback models, create your first agent, enable
+the plugins it may use, connect Slack, choose who approves gated calls while
+nobody is watching, and install the always-on service — no config files to
+edit, no env vars to export. Walkthrough:
 [Setup](https://github.com/stratuslabs/agent/blob/main/docs/start/setup.md).
 
 ## Commands
 
 ```bash
-stratus setup                          # onboarding menu: providers, models, agent, channels
+stratus setup                          # onboarding menu: providers, models, agent, plugins, channels, approvals
 stratus chat                           # talk — the conversation persists
 stratus run "say hello"                # one-shot run (works offline on the demo provider)
 stratus serve                          # stratusd: the whole roster, always on
@@ -41,14 +41,18 @@ stratus serve --approvals remote       # ask a human in Slack instead of refusin
 stratus service install                # keep stratusd running under launchd/systemd
 stratus logs -f                        # what the daemon has been doing
 stratus doctor                         # what a run would use right now, and why
-stratus update                         # stop → upgrade → migrate → repair unit → restart
+stratus update                         # stop → upgrade (CLI + its companions) → migrate → repair unit → restart
+stratus --version                      # which build this is
 stratus agent new                      # create an agent (guided on a terminal)
 stratus agents                         # who's on the team: souls, models, memory
+stratus template add owner/repo        # install an agent, its skills, and the plugins behind them — prints what it will add, then asks
 stratus skill add owner/repo           # install skills from GitHub (validated against the Agent Skills spec) — a running daemon picks them up, no restart
 stratus skill validate ./my-skill      # check a skill against the spec without installing it
+stratus plugins                        # installed → enabled → granted → what approvals does with it
 stratus restart                        # announced restart: refuse, drain, come back — what a plugin change needs
 stratus credentials                    # stored credential names (never values)
 stratus schedules                      # what the fleet has scheduled, and where it reports
+stratus grants ava                     # what ava may do unattended, and `grants revoke` to take one back
 stratus memory list ava                # every live fact, with the trust label it carries
 stratus memory reassert ava --trust user --all-unknown   # vouch for the facts with no recorded origin
 stratus session rollover <session-id>  # archive a conversation's transcript and start the same id over
@@ -75,12 +79,14 @@ Full reference with every subcommand:
 | `--no-log-file` | `serve`: do not write `~/.stratus/logs/stratusd.jsonl` |
 | `--no-api` | `serve`: do not serve the control API |
 | `--api-host`, `--api-port` | `serve`: control API bind (default `127.0.0.1:4123`) |
-| `--gateway <url>`, `--token` | `agents`, `skill reload`, `restart`, `session rollover`: a running daemon's control API |
+| `--gateway <url>`, `--token` | `agents`, `skill reload`, `restart`, `session rollover`, `grants`: a running daemon's control API |
+| `--tool`, `--scope`, `--origin` | `grants revoke`: which grant goes — exactly one |
 | `--trust <level>` | `memory list`: show only that label; `memory reassert`: the label to record (`user`, `agent`, `unknown`, `external`) |
 | `--all-unknown` | `memory reassert`: every live fact with no recorded origin |
 | `--agent <id>` | `credential set`/`remove`: that agent's own key rather than the fleet's shared one |
 | `--port`, `--host`, `--no-open` | `dashboard`: where a daemon it starts should bind; skip opening the browser |
 | `--no-login` | `service install`: install without the start-at-login trigger |
+| `--version`, `-v` | Print this build's version and exit |
 | `-f`, `-n`, `--agent`, `--session` | `logs`: follow, backlog size, and filters |
 
 Precedence: flags → `STRATUS_*` env vars → soul file hints → config file.

package/dist/approvals.d.ts

@@ -0,0 +1,93 @@
+import { type ApprovalContext, type ApprovalPolicy } from '@stratusagent/core';
+import { type ApprovalsConfig, type PrincipalsConfig, type ChannelCredentials } from '@stratusagent/state';
+import type { CliStreams, CliEnvironment } from './environment.ts';
+import type { CliApprovalMode } from './parse.ts';
+/**
+ * What a local prompt asks about: the tool, where it would act when that is
+ * a question at all, and the arguments.
+ *
+ * The origin is not in the arguments and cannot be — a `browser.act` call
+ * carries a CSS selector, and `#submit` is equally "load more results" and
+ * "confirm purchase". A prompt that showed only the selector would be
+ * asking someone to authorize an effect whose location it withheld, which
+ * is the same reason the daemon's prompt and the Slack request name it.
+ */
+export declare const describeApprovalCall: (context: ApprovalContext) => string;
+export declare const createApprovalPolicy: (mode: CliApprovalMode, streams: CliStreams, env: CliEnvironment, ask?: (prompt: string) => Promise<string>, 
+/**
+ * The mode was defaulted rather than chosen. `always` chosen with a
+ * flag needs no commentary; `always` reached because nobody could be
+ * asked gets one line, the first time a call that would have asked runs.
+ */
+defaulted?: boolean) => ApprovalPolicy;
+/** One line saying whose messages arrive as the operator's, per Slack agent. */
+export declare const describePrincipals: (principals: PrincipalsConfig, agentIds: string[]) => string;
+export declare const describeApprovers: (approvals: ApprovalsConfig, agentIds: string[]) => string;
+/**
+ * What a gated call would actually meet on this machine.
+ *
+ * The mode is not the answer on its own, in both directions. `headless`
+ * refuses a gated call *last*: the engine checks the standing tool grants,
+ * the approved command scopes, and the approved sites first, so an agent
+ * that was ever told "always allow" runs that tool unattended for good
+ * (`stratus grants <agent>` is what lists them). And `remote` only asks if
+ * somebody can be asked — with no channel to render the request a gated
+ * call waits out the timeout, and with no approver configured it is denied
+ * on arrival, which is `headless` by another name.
+ *
+ * Stating either as "gated calls are refused" or "gated calls are asked in
+ * Slack" would be wrong in exactly the configurations an operator runs this
+ * command to understand.
+ */
+/**
+ * Who can actually be asked, and what is missing for the rest. Split out of
+ * the sentence below because two surfaces need the *answer*: `stratus
+ * plugins` renders it as a paragraph, setup's Approvals row as a menu
+ * summary, and a second hand-rolled copy of "who is askable" drifted from
+ * this one within three PRs — stored tokens read as reachable agents when
+ * the package was absent, when the agent had left the roster, and when the
+ * only route left was the control API.
+ */
+export interface ApprovalReach {
+    /** Tokens stored, package installed, agent still served. */
+    askable: string[];
+    /** Of those, the ones an approver is named for — the rest are denied on arrival. */
+    covered: string[];
+    /** Of those, the ones with no conversation to ask in for a turn that did not start in Slack. */
+    noFallback: string[];
+}
+export declare const classifyApprovalReach: (approvals: ApprovalsConfig, channels: ChannelCredentials, servedAgentIds: readonly string[] | undefined, env: CliEnvironment) => ApprovalReach;
+export declare const describeUnattendedReach: (mode: "headless" | "remote", approvals: ApprovalsConfig, env: CliEnvironment, 
+/**
+ * The agents actually being served, or undefined when the roster did not
+ * load. Stored Slack tokens outlive the agent they were stored for, and
+ * the adapter skips an id the gateway is not serving — so a token with no
+ * agent behind it must not read as somebody who can be asked.
+ *
+ * `runServe` prints its own line without this intersection, and is right
+ * to: at startup the roster has not loaded yet. It reports the reverse
+ * direction separately once it has one, warning about served agents no
+ * channel can ask for. Here both are in view from the start.
+ */
+servedAgentIds: readonly string[] | undefined, 
+/**
+ * Whether the control API would be serving. It is a second way to answer
+ * a parked call — `GET /api/v1/approvals` lists them, `POST` settles one
+ * — so an agent no Slack channel can ask for is not necessarily an agent
+ * nobody can ask.
+ */
+apiReachable: boolean) => Promise<string>;
+/**
+ * The clauses above, unjoined and without reading the filesystem, so a
+ * caller holding unsaved state can render the same verdict. The first
+ * element is always the verdict itself; the rest qualify it.
+ *
+ * Split out because setup's Approvals row wrote its own version of this
+ * sentence, and every review round found it short a different clause the
+ * daemon actually applies — the headless exceptions, an explicit
+ * `timeoutMs: 0`, the control API on a mixed roster. There is one renderer
+ * now; a menu that wants a shorter line takes fewer clauses, never
+ * different words.
+ */
+export declare const unattendedReachParts: (mode: "headless" | "remote", approvals: ApprovalsConfig, channels: ChannelCredentials, servedAgentIds: readonly string[] | undefined, apiReachable: boolean, env: CliEnvironment) => string[];
+//# sourceMappingURL=approvals.d.ts.map

package/dist/approvals.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approvals.d.ts","sourceRoot":"","sources":["../src/approvals.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,KAAK,eAAe,EACpB,KAAK,cAAc,EACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAIL,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAGnE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAWlD;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,GAAI,SAAS,eAAe,KAAG,MAI/D,CAAC;AAoCF,eAAO,MAAM,oBAAoB,GAC/B,MAAM,eAAe,EACrB,SAAS,UAAU,EACnB,KAAK,cAAc,EACnB,MAAM,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC;AACzC;;;;GAIG;AACH,mBAAiB,KAChB,cA2EF,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,kBAAkB,GAAI,YAAY,gBAAgB,EAAE,UAAU,MAAM,EAAE,KAAG,MA+BrF,CAAC;AAiBF,eAAO,MAAM,iBAAiB,GAAI,WAAW,eAAe,EAAE,UAAU,MAAM,EAAE,KAAG,MAWlF,CAAC;AAgBF;;;;;;;;;;;;;;;GAeG;AACH;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC5B,4DAA4D;IAC5D,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,oFAAoF;IACpF,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,gGAAgG;IAChG,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,eAAO,MAAM,qBAAqB,GAChC,WAAW,eAAe,EAC1B,UAAU,kBAAkB,EAC5B,gBAAgB,SAAS,MAAM,EAAE,GAAG,SAAS,EAC7C,KAAK,cAAc,KAClB,aAcF,CAAC;AAEF,eAAO,MAAM,uBAAuB,GAClC,MAAM,UAAU,GAAG,QAAQ,EAC3B,WAAW,eAAe,EAC1B,KAAK,cAAc;AACnB;;;;;;;;;;GAUG;AACH,gBAAgB,SAAS,MAAM,EAAE,GAAG,SAAS;AAC7C;;;;;GAKG;AACH,cAAc,OAAO,KACpB,OAAO,CAAC,MAAM,CAGhB,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oBAAoB,GAC/B,MAAM,UAAU,GAAG,QAAQ,EAC3B,WAAW,eAAe,EAC1B,UAAU,kBAAkB,EAC5B,gBAAgB,SAAS,MAAM,EAAE,GAAG,SAAS,EAC7C,cAAc,OAAO,EACrB,KAAK,cAAc,KAClB,MAAM,EAuHR,CAAC"}

package/dist/approvals.js

@@ -0,0 +1,368 @@
+import { createInterface } from 'node:readline';
+import { AllowAllApprovalPolicy, originOf, } from '@stratusagent/core';
+import { loadChannelCredentials, resolveAgentApprovals, resolveAgentPrincipals, } from '@stratusagent/state';
+import { writeLine } from "./io.js";
+import { packageInstalled } from "./loaders.js";
+/**
+ * Where a call would act, for a tool that answers that — read through
+ * `originOf` so this and the daemon's engine compare the same thing.
+ */
+const approvalOrigin = (context) => {
+    const reported = context.tool.originFor?.(context.session);
+    return reported === undefined ? undefined : originOf(reported);
+};
+/**
+ * What a local prompt asks about: the tool, where it would act when that is
+ * a question at all, and the arguments.
+ *
+ * The origin is not in the arguments and cannot be — a `browser.act` call
+ * carries a CSS selector, and `#submit` is equally "load more results" and
+ * "confirm purchase". A prompt that showed only the selector would be
+ * asking someone to authorize an effect whose location it withheld, which
+ * is the same reason the daemon's prompt and the Slack request name it.
+ */
+export const describeApprovalCall = (context) => {
+    const origin = approvalOrigin(context);
+    return `${context.call.toolName}${origin ? ` on ${origin}` : ''}`
+        + ` with input ${JSON.stringify(context.call.input)}`;
+};
+/**
+ * Whether the conversation is still on the page the prompt named.
+ *
+ * A y/N at a terminal takes as long as it takes, and the page is live for
+ * all of it: a redirect between the question and the answer would have a
+ * yes given for one site click on another, with the prompt still showing
+ * the first. So the origin is read again and a page that moved refuses —
+ * the same check the daemon's engine makes after its own approval wait.
+ * This local policy needs its own because it is a separate policy sharing
+ * none of that code: `--approvals ask` judges the call, not a scope.
+ *
+ * Said out loud rather than failing quietly: somebody typed `y` and is owed
+ * an explanation for why nothing happened.
+ */
+const stillOnApprovedPage = (context, approved, streams) => {
+    if (context.tool.originFor === undefined) {
+        return true;
+    }
+    const now = approvalOrigin(context);
+    if (now === approved) {
+        return true;
+    }
+    writeLine(streams.stderr, `Not running ${context.call.toolName}: it was approved on ${approved ?? 'a page with no origin'}, `
+        + `and the conversation ${now === undefined ? 'no longer has that page open' : `is on ${now} now`}.`);
+    return false;
+};
+export const createApprovalPolicy = (mode, streams, env, ask, 
+/**
+ * The mode was defaulted rather than chosen. `always` chosen with a
+ * flag needs no commentary; `always` reached because nobody could be
+ * asked gets one line, the first time a call that would have asked runs.
+ */
+defaulted = false) => {
+    if (mode === 'always') {
+        if (!defaulted) {
+            return new AllowAllApprovalPolicy();
+        }
+        let noted = false;
+        return {
+            async approve(context) {
+                if (!noted && context.risk !== 'safe') {
+                    noted = true;
+                    writeLine(streams.stderr, `Note: running ${context.call.toolName} without asking — stdin is not a terminal and --approvals was not given. `
+                        + 'Pass --approvals never to refuse gated tools.');
+                }
+                return true;
+            },
+        };
+    }
+    if (mode === 'never') {
+        return {
+            async approve() {
+                return false;
+            },
+        };
+    }
+    // A caller that already owns stdin (chat's readline) supplies its own
+    // asker — two readers on one stream would race for the same bytes.
+    // `gated` is `ask` for the calls that matter: a `safe` tool is what the
+    // daemon runs unattended, and asking a person to confirm a memory read
+    // is how they learn to type `y` without reading the question. `ask`
+    // itself still asks about everything — the word says so.
+    if (mode === 'gated') {
+        const asking = createApprovalPolicy('ask', streams, env, ask);
+        return {
+            async approve(context) {
+                return context.risk === 'safe' ? true : asking.approve(context);
+            },
+        };
+    }
+    if (ask) {
+        return {
+            async approve(context) {
+                const approved = approvalOrigin(context);
+                const answer = await ask(`Approve tool call ${describeApprovalCall(context)}? [y/N] `);
+                return /^y(es)?$/i.test(answer.trim()) && stillOnApprovedPage(context, approved, streams);
+            },
+        };
+    }
+    return {
+        async approve(context) {
+            const input = env.approvalInput ?? process.stdin;
+            const readline = createInterface({ input, terminal: false });
+            const approved = approvalOrigin(context);
+            // Prompt on stderr so stdout stays parseable (e.g. --format json).
+            streams.stderr.write(`Approve tool call ${describeApprovalCall(context)}? [y/N] `);
+            try {
+                const answer = await new Promise((resolve) => {
+                    readline.once('line', resolve);
+                    readline.once('close', () => resolve(''));
+                });
+                writeLine(streams.stderr);
+                return /^y(es)?$/i.test(answer.trim()) && stillOnApprovedPage(context, approved, streams);
+            }
+            finally {
+                readline.close();
+            }
+        },
+    };
+};
+/** One line saying whose messages arrive as the operator's, per Slack agent. */
+export const describePrincipals = (principals, agentIds) => {
+    const covered = agentIds.filter((agentId) => (resolveAgentPrincipals(principals, agentId).slackUsers ?? []).length > 0);
+    // Which agents refuse the unlisted outright, so an operator reading the
+    // startup line knows whether the list is a label or a door. Worked out
+    // before the no-list case: a closed agent with nobody listed refuses
+    // everyone, which is a valid configuration and the opposite of "every
+    // sender is unknown".
+    const closed = agentIds.filter((agentId) => resolveAgentPrincipals(principals, agentId).admit === 'principals');
+    const door = closed.length === 0
+        ? '; every agent still admits unlisted senders as unknown (principals.admit: "principals" refuses them)'
+        : closed.length === agentIds.length
+            ? '; unlisted senders are refused'
+            : `; unlisted senders are refused by ${closed.join(', ')} and admitted as unknown by the rest`;
+    if (covered.length === 0) {
+        return closed.length === 0
+            ? 'no principals configured, so every Slack sender is unknown and every fact written in Slack carries that label — set principals.slackUsers in ~/.stratus/config.json'
+            : `no principals listed, so every Slack sender is unknown${door} — nobody at all can talk to ${closed.join(', ')} until principals.slackUsers names someone`;
+    }
+    // An uncovered agent's senders are all unknown only if it admits them: a
+    // closed agent with nobody listed refuses everyone, and saying its
+    // senders are "all unknown" and then "refused" in one line is a summary
+    // that contradicts itself about the one thing it exists to say.
+    const uncovered = agentIds.filter((agentId) => !covered.includes(agentId));
+    const uncoveredOpen = uncovered.filter((agentId) => !closed.includes(agentId));
+    const uncoveredClosed = uncovered.filter((agentId) => closed.includes(agentId));
+    return `principals set for ${covered.join(', ')}`
+        + (uncoveredOpen.length > 0 ? `; none for ${uncoveredOpen.join(', ')}, whose Slack senders are all unknown` : '')
+        + (uncoveredClosed.length > 0
+            ? `; none for ${uncoveredClosed.join(', ')}, who refuse every sender until principals.slackUsers names someone`
+            : '')
+        + door;
+};
+/**
+ * Which of these agents the Slack adapter would actually ask about, and
+ * which it would decline for. Separated from the sentence below because
+ * two callers need the *answer* and only one needs it as prose: a summary
+ * that says a call "asks in Slack" must not say it about an agent the
+ * adapter denies on arrival.
+ */
+const classifyApprovers = (approvals, agentIds) => {
+    const covered = agentIds.filter((agentId) => (resolveAgentApprovals(approvals, agentId).slackApprovers ?? []).length > 0);
+    return { covered, uncovered: agentIds.filter((agentId) => !covered.includes(agentId)) };
+};
+export const describeApprovers = (approvals, agentIds) => {
+    if (agentIds.length === 0) {
+        return 'but no channel is running to ask through, so gated calls will wait out the approval timeout and then be denied';
+    }
+    const { covered, uncovered } = classifyApprovers(approvals, agentIds);
+    if (covered.length === 0) {
+        return 'but no approvers are configured, so every gated call is denied on arrival';
+    }
+    return uncovered.length === 0
+        ? `approvers set for ${covered.join(', ')}`
+        : `approvers set for ${covered.join(', ')}; none for ${uncovered.join(', ')}, whose calls are denied on arrival`;
+};
+/**
+ * The ways a gated call is already authorized before either mode's decision
+ * is reached — the standing tool grants, the approved command scopes, the
+ * approved sites, and a schedule's pre-authorized destination, in the order
+ * `createPermissionPolicy` checks them.
+ *
+ * Written once because it is read twice: enumerating it separately per mode
+ * is what left the destination path out of one of them and out of the other
+ * entirely. It is prose about a rule `@stratusagent/permissions` owns, so
+ * when that engine gains a path this string is what has to follow it.
+ */
+const ALREADY_AUTHORIZED = 'standing grants, approved command scopes and sites (stratus grants <agent>), '
+    + 'and destinations pre-authorized with a schedule (stratus schedules)';
+export const classifyApprovalReach = (approvals, channels, servedAgentIds, env) => {
+    // An adapter that is not installed renders nothing, so its stored tokens
+    // are not a route — `runServe` starts without the Slack channel and says
+    // so. Undefined served ids means the roster did not load, which is not
+    // evidence that any token is orphaned.
+    const stored = packageInstalled('@stratusagent/channel-slack', env)
+        ? Object.keys(channels.slack ?? {})
+        : [];
+    const askable = servedAgentIds === undefined
+        ? stored
+        : stored.filter((agentId) => servedAgentIds.includes(agentId));
+    const { covered } = classifyApprovers(approvals, askable);
+    const noFallback = covered.filter((agentId) => resolveAgentApprovals(approvals, agentId).slackChannel === undefined);
+    return { askable, covered, noFallback };
+};
+export const describeUnattendedReach = async (mode, approvals, env, 
+/**
+ * The agents actually being served, or undefined when the roster did not
+ * load. Stored Slack tokens outlive the agent they were stored for, and
+ * the adapter skips an id the gateway is not serving — so a token with no
+ * agent behind it must not read as somebody who can be asked.
+ *
+ * `runServe` prints its own line without this intersection, and is right
+ * to: at startup the roster has not loaded yet. It reports the reverse
+ * direction separately once it has one, warning about served agents no
+ * channel can ask for. Here both are in view from the start.
+ */
+servedAgentIds, 
+/**
+ * Whether the control API would be serving. It is a second way to answer
+ * a parked call — `GET /api/v1/approvals` lists them, `POST` settles one
+ * — so an agent no Slack channel can ask for is not necessarily an agent
+ * nobody can ask.
+ */
+apiReachable) => {
+    const channels = await loadChannelCredentials(env);
+    return unattendedReachParts(mode, approvals, channels, servedAgentIds, apiReachable, env).join('; ');
+};
+/**
+ * The clauses above, unjoined and without reading the filesystem, so a
+ * caller holding unsaved state can render the same verdict. The first
+ * element is always the verdict itself; the rest qualify it.
+ *
+ * Split out because setup's Approvals row wrote its own version of this
+ * sentence, and every review round found it short a different clause the
+ * daemon actually applies — the headless exceptions, an explicit
+ * `timeoutMs: 0`, the control API on a mixed roster. There is one renderer
+ * now; a menu that wants a shorter line takes fewer clauses, never
+ * different words.
+ */
+export const unattendedReachParts = (mode, approvals, channels, servedAgentIds, apiReachable, env) => {
+    if (mode === 'headless') {
+        return [`headless — an uncovered gated call is refused. Already-authorized ones still run: ${ALREADY_AUTHORIZED}`];
+    }
+    // The same condition `runServe` reports at startup, through the same
+    // helper: an agent is askable when its tokens are stored and something is
+    // installed to render the request.
+    const { askable, covered, noFallback } = classifyApprovalReach(approvals, channels, servedAgentIds, env);
+    // Qualified the same way the headless line is: the engine allows an
+    // already-authorized call before it asks anyone, so an unqualified "asks
+    // in Slack" hides unattended capability in precisely the configuration
+    // where Slack is set up correctly.
+    //
+    // The *verdict* is composed with the control API in view rather than
+    // corrected afterwards. `describeApprovers` answers a Slack question and
+    // is right to — `runServe` asks it before anything else is known — but
+    // its no-channel and no-approver answers both end in "denied", which is
+    // false wherever `POST /api/v1/approvals` can settle the call. Appending
+    // the API as a later clause left the two halves contradicting each other.
+    const slack = describeApprovers(approvals, askable);
+    // An explicit `timeoutMs: 0` is documented as "wait indefinitely", and
+    // the gateway arms no timer for it — so a call nobody answers is not
+    // eventually denied, it is parked for the life of the daemon. Promising
+    // a denial understates that, and holding a turn open forever is the more
+    // alarming outcome to leave unsaid.
+    const expires = approvals.timeoutMs !== 0;
+    const unanswered = expires ? 'before the timeout denies it' : 'and nothing else will — this daemon\'s approval timeout is 0, so it parks indefinitely';
+    // Three verdicts, selected by what can actually receive the request.
+    //
+    // With nobody askable there is no Slack adapter in the picture at all,
+    // so neither of the first two may say the call "asks in Slack" —
+    // appending `describeApprovers` to that phrasing produced a sentence
+    // that asked Slack and then said no Slack was running.
+    //
+    // The control API is offered only where Slack leaves a request parked.
+    // The Slack adapter handles the same event synchronously and *denies*
+    // when an agent has no approvers or no conversation to ask in, so for an
+    // agent it covers there is nothing left for an API client to answer.
+    // That is only true of agents it covers: one with no tokens at all
+    // reaches no adapter, and its request stays parked.
+    const verdict = () => {
+        if (askable.length === 0) {
+            return apiReachable
+                ? `remote — an uncovered gated call parks with no Slack channel to ask through, so the control API is the only way to answer it ${unanswered}`
+                : 'remote — an uncovered gated call parks with no channel to ask through and no control API to answer it, so it '
+                    + (expires
+                        ? 'waits out the approval timeout and is denied'
+                        : 'is never answered: this daemon\'s approval timeout is 0, so it parks indefinitely');
+        }
+        // "Parks and asks" is false for an agent the adapter declines: with no
+        // approvers configured it calls `resolveApproval(deny)` synchronously
+        // (channel-slack decline()), so nothing parks and nobody is asked.
+        // Same defect as the branch above, one case over — found by auditing
+        // the rest of this function after that one, not by review.
+        if (covered.length === 0) {
+            return 'remote — an uncovered gated call reaches Slack and is denied on arrival, because no approvers are configured';
+        }
+        return `remote — an uncovered gated call parks and asks in Slack, ${slack}`;
+    };
+    const parts = [verdict()];
+    // The reverse of a stale token, and the failure that actually bites: an
+    // agent the daemon serves that no channel can ask for parks its gated
+    // calls until the timeout denies them. `runServe` warns about exactly
+    // this once its roster loads; the difference here is only that both
+    // halves are in view from the start.
+    //
+    // Named only when *some* agent is askable: with none, the verdict above
+    // has already said no Slack channel is running at all, and listing every
+    // served agent under it repeats that in more words.
+    const unreachable = askable.length === 0
+        ? []
+        : (servedAgentIds ?? []).filter((agentId) => !askable.includes(agentId));
+    if (unreachable.length > 0) {
+        // Slack is not the only way to answer. `GET /api/v1/approvals` lists
+        // what is parked and `POST` settles it, so with the control API up
+        // these calls wait for a client rather than for the timeout — a very
+        // different thing to tell an operator.
+        parts.push(apiReachable
+            ? `no Slack channel can ask for ${unreachable.join(', ')}, so their gated calls park until the control `
+                + `API answers them${expires ? ' or the timeout denies them' : ' — with a timeout of 0, nothing else ever will'}`
+            : `no channel can ask for ${unreachable.join(', ')}, so their gated calls `
+                + (expires ? 'wait out the timeout and are denied' : 'park indefinitely: this daemon\'s approval timeout is 0'));
+    }
+    // Stored tokens are a *configured* route, not a live one. The adapter
+    // pushes a connection only after `auth.test()` and `socket.start()` both
+    // succeed, and `renderApprovalRequest` denies undeliverable for a
+    // configured agent with no live connection — so a revoked token or a
+    // dead app token turns "asks in Slack" into "denies on arrival". This
+    // command reads config and manifests by design and starts no daemon, so
+    // it cannot know which; saying so is the only honest option, and the
+    // daemon log is where the answer actually is (`warn` writes there, so
+    // `slack: could not connect <agent>` is in `stratus logs`).
+    if (covered.length > 0) {
+        parts.push('whether those apps are connected is not something this command can see — it reads config, '
+            + 'and one whose token no longer authenticates denies its gated calls instead of asking; '
+            + '`stratus logs` shows which came up');
+    }
+    // Approvers with nowhere to be asked outside their own thread. A turn
+    // that did not start in Slack — the API, the dashboard, a delegation —
+    // reaches the adapter with no destination and is denied undeliverable,
+    // so "approvers set" is only half an answer without a fallback channel.
+    if (noFallback.length > 0) {
+        parts.push(`${noFallback.join(', ')} ${noFallback.length === 1 ? 'has' : 'have'} no slackChannel, `
+            + 'so only turns already in Slack can be asked');
+    }
+    // What an "always allow" answer persists depends on what the call names,
+    // and mostly it is not the session: `createPermissionPolicy` maps an
+    // unscoped gated tool to a standing grant that outlives every restart,
+    // a command to a scope, a click to a site, and only a schedule's
+    // destination to the session. Saying "for the rest of its session" flat
+    // understated durable unattended access, which is the wrong direction to
+    // be wrong about approvals in.
+    // The session case is a call scoped by *destination*, which an ordinary
+    // outbound `message.send` is — not only a scheduled one. Naming the
+    // schedule alone read as though the everyday case were durable.
+    parts.push('an "always allow" answer persists — a standing grant for an unscoped tool, a command scope, '
+        + 'or a site, all until revoked; only a call scoped by destination, such as message.send, '
+        + 'lasts just the session');
+    return parts;
+};
+//# sourceMappingURL=approvals.js.map

package/dist/approvals.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approvals.js","sourceRoot":"","sources":["../src/approvals.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EACL,sBAAsB,EACtB,QAAQ,GAGT,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,sBAAsB,GAIvB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGhD;;;GAGG;AACH,MAAM,cAAc,GAAG,CAAC,OAAwB,EAAsB,EAAE;IACtE,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3D,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACjE,CAAC,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,OAAwB,EAAU,EAAE;IACvE,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACvC,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;UAC7D,eAAe,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;AAC1D,CAAC,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,mBAAmB,GAAG,CAC1B,OAAwB,EACxB,QAA4B,EAC5B,OAAmB,EACV,EAAE;IACX,IAAI,OAAO,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,GAAG,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,SAAS,CACP,OAAO,CAAC,MAAM,EACd,eAAe,OAAO,CAAC,IAAI,CAAC,QAAQ,wBAAwB,QAAQ,IAAI,uBAAuB,IAAI;UACjG,wBAAwB,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,SAAS,GAAG,MAAM,GAAG,CACrG,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,IAAqB,EACrB,OAAmB,EACnB,GAAmB,EACnB,GAAyC;AACzC;;;;GAIG;AACH,SAAS,GAAG,KAAK,EACD,EAAE;IAClB,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,IAAI,sBAAsB,EAAE,CAAC;QACtC,CAAC;QACD,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,OAAO;YACL,KAAK,CAAC,OAAO,CAAC,OAAO;gBACnB,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;oBACtC,KAAK,GAAG,IAAI,CAAC;oBACb,SAAS,CACP,OAAO,CAAC,MAAM,EACd,iBAAiB,OAAO,CAAC,IAAI,CAAC,QAAQ,2EAA2E;0BAC/G,+CAA+C,CAClD,CAAC;gBACJ,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;SACF,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,OAAO;YACL,KAAK,CAAC,OAAO;gBACX,OAAO,KAAK,CAAC;YACf,CAAC;SACF,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,mEAAmE;IACnE,wEAAwE;IACxE,uEAAuE;IACvE,oEAAoE;IACpE,yDAAyD;IACzD,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QAC9D,OAAO;YACL,KAAK,CAAC,OAAO,CAAC,OAAO;gBACnB,OAAO,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAClE,CAAC;SACF,CAAC;IACJ,CAAC;IAED,IAAI,GAAG,EAAE,CAAC;QACR,OAAO;YACL,KAAK,CAAC,OAAO,CAAC,OAAO;gBACnB,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;gBACzC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,qBAAqB,oBAAoB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;gBACvF,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,IAAI,mBAAmB,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC5F,CAAC;SACF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,OAAO;YACnB,MAAM,KAAK,GAAG,GAAG,CAAC,aAAa,IAAI,OAAO,CAAC,KAAK,CAAC;YACjD,MAAM,QAAQ,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;YAC7D,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;YAEzC,mEAAmE;YACnE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,oBAAoB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YAEnF,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;oBACnD,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;oBAC/B,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC5C,CAAC,CAAC,CAAC;gBACH,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBAC1B,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,IAAI,mBAAmB,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC5F,CAAC;oBAAS,CAAC;gBACT,QAAQ,CAAC,KAAK,EAAE,CAAC;YACnB,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC,CAAC;AAEF,gFAAgF;AAChF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,UAA4B,EAAE,QAAkB,EAAU,EAAE;IAC7F,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,sBAAsB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACxH,wEAAwE;IACxE,uEAAuE;IACvE,qEAAqE;IACrE,sEAAsE;IACtE,sBAAsB;IACtB,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,sBAAsB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,KAAK,KAAK,YAAY,CAAC,CAAC;IAChH,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC;QAC9B,CAAC,CAAC,sGAAsG;QACxG,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;YACjC,CAAC,CAAC,gCAAgC;YAClC,CAAC,CAAC,qCAAqC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,sCAAsC,CAAC;IACnG,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC;YACxB,CAAC,CAAC,qKAAqK;YACvK,CAAC,CAAC,yDAAyD,IAAI,gCAAgC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,4CAA4C,CAAC;IACjK,CAAC;IACD,yEAAyE;IACzE,mEAAmE;IACnE,wEAAwE;IACxE,gEAAgE;IAChE,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3E,MAAM,aAAa,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/E,MAAM,eAAe,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAChF,OAAO,sBAAsB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;UAC7C,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC,CAAC,EAAE,CAAC;UAC/G,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC;YAC3B,CAAC,CAAC,cAAc,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,qEAAqE;YAC/G,CAAC,CAAC,EAAE,CAAC;UACL,IAAI,CAAC;AACX,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,iBAAiB,GAAG,CACxB,SAA0B,EAC1B,QAAkB,EAC0B,EAAE;IAC9C,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,qBAAqB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC1H,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;AAC1F,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,SAA0B,EAAE,QAAkB,EAAU,EAAE;IAC1F,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,gHAAgH,CAAC;IAC1H,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,iBAAiB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACtE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,2EAA2E,CAAC;IACrF,CAAC;IACD,OAAO,SAAS,CAAC,MAAM,KAAK,CAAC;QAC3B,CAAC,CAAC,qBAAqB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QAC3C,CAAC,CAAC,qBAAqB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,qCAAqC,CAAC;AACrH,CAAC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,kBAAkB,GAAG,+EAA+E;MACtG,qEAAqE,CAAC;AAoC1E,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,SAA0B,EAC1B,QAA4B,EAC5B,cAA6C,EAC7C,GAAmB,EACJ,EAAE;IACjB,yEAAyE;IACzE,yEAAyE;IACzE,uEAAuE;IACvE,uCAAuC;IACvC,MAAM,MAAM,GAAG,gBAAgB,CAAC,6BAA6B,EAAE,GAAG,CAAC;QACjE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC;QACnC,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,OAAO,GAAG,cAAc,KAAK,SAAS;QAC1C,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IACjE,MAAM,EAAE,OAAO,EAAE,GAAG,iBAAiB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,qBAAqB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC;IACrH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;AAC1C,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,EAC1C,IAA2B,EAC3B,SAA0B,EAC1B,GAAmB;AACnB;;;;;;;;;;GAUG;AACH,cAA6C;AAC7C;;;;;GAKG;AACH,YAAqB,EACJ,EAAE;IACnB,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,GAAG,CAAC,CAAC;IACnD,OAAO,oBAAoB,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACvG,CAAC,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,IAA2B,EAC3B,SAA0B,EAC1B,QAA4B,EAC5B,cAA6C,EAC7C,YAAqB,EACrB,GAAmB,EACT,EAAE;IACZ,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QACxB,OAAO,CAAC,qFAAqF,kBAAkB,EAAE,CAAC,CAAC;IACrH,CAAC;IACD,qEAAqE;IACrE,0EAA0E;IAC1E,mCAAmC;IACnC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,qBAAqB,CAAC,SAAS,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,CAAC,CAAC;IACzG,oEAAoE;IACpE,yEAAyE;IACzE,uEAAuE;IACvE,mCAAmC;IACnC,EAAE;IACF,qEAAqE;IACrE,yEAAyE;IACzE,uEAAuE;IACvE,wEAAwE;IACxE,yEAAyE;IACzE,0EAA0E;IAC1E,MAAM,KAAK,GAAG,iBAAiB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACpD,uEAAuE;IACvE,qEAAqE;IACrE,wEAAwE;IACxE,yEAAyE;IACzE,oCAAoC;IACpC,MAAM,OAAO,GAAG,SAAS,CAAC,SAAS,KAAK,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,wFAAwF,CAAC;IACvJ,qEAAqE;IACrE,EAAE;IACF,uEAAuE;IACvE,iEAAiE;IACjE,qEAAqE;IACrE,uDAAuD;IACvD,EAAE;IACF,uEAAuE;IACvE,sEAAsE;IACtE,yEAAyE;IACzE,qEAAqE;IACrE,mEAAmE;IACnE,oDAAoD;IACpD,MAAM,OAAO,GAAG,GAAW,EAAE;QAC3B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,YAAY;gBACjB,CAAC,CAAC,gIAAgI,UAAU,EAAE;gBAC9I,CAAC,CAAC,+GAA+G;sBAC7G,CAAC,OAAO;wBACR,CAAC,CAAC,8CAA8C;wBAChD,CAAC,CAAC,mFAAmF,CAAC,CAAC;QAC/F,CAAC;QACD,uEAAuE;QACvE,sEAAsE;QACtE,mEAAmE;QACnE,qEAAqE;QACrE,2DAA2D;QAC3D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,8GAA8G,CAAC;QACxH,CAAC;QACD,OAAO,6DAA6D,KAAK,EAAE,CAAC;IAC9E,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1B,wEAAwE;IACxE,sEAAsE;IACtE,sEAAsE;IACtE,oEAAoE;IACpE,qCAAqC;IACrC,EAAE;IACF,wEAAwE;IACxE,yEAAyE;IACzE,oDAAoD;IACpD,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,KAAK,CAAC;QACtC,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3E,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,qEAAqE;QACrE,mEAAmE;QACnE,qEAAqE;QACrE,uCAAuC;QACvC,KAAK,CAAC,IAAI,CAAC,YAAY;YACrB,CAAC,CAAC,gCAAgC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,gDAAgD;kBACpG,mBAAmB,OAAO,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,gDAAgD,EAAE;YACnH,CAAC,CAAC,0BAA0B,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB;kBACvE,CAAC,OAAO,CAAC,CAAC,CAAC,qCAAqC,CAAC,CAAC,CAAC,yDAAyD,CAAC,CAAC,CAAC;IACvH,CAAC;IACD,sEAAsE;IACtE,yEAAyE;IACzE,kEAAkE;IAClE,qEAAqE;IACrE,sEAAsE;IACtE,wEAAwE;IACxE,qEAAqE;IACrE,sEAAsE;IACtE,4DAA4D;IAC5D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,4FAA4F;cACnG,wFAAwF;cACxF,oCAAoC,CAAC,CAAC;IAC5C,CAAC;IACD,sEAAsE;IACtE,uEAAuE;IACvE,uEAAuE;IACvE,wEAAwE;IACxE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,KAAK,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,oBAAoB;cAC/F,6CAA6C,CAAC,CAAC;IACrD,CAAC;IACD,yEAAyE;IACzE,qEAAqE;IACrE,uEAAuE;IACvE,iEAAiE;IACjE,wEAAwE;IACxE,yEAAyE;IACzE,+BAA+B;IAC/B,wEAAwE;IACxE,oEAAoE;IACpE,gEAAgE;IAChE,KAAK,CAAC,IAAI,CAAC,8FAA8F;UACrG,yFAAyF;UACzF,wBAAwB,CAAC,CAAC;IAC9B,OAAO,KAAK,CAAC;AACf,CAAC,CAAC"}

package/dist/commands/agent-new.d.ts

@@ -0,0 +1,22 @@
+import { type StratusConfigFile, type StratusProviderName } from '@stratusagent/state';
+import type { CliStreams, CliEnvironment } from '../environment.ts';
+import type { ParsedAgentNewCommand } from '../parse.ts';
+/**
+ * The provider/model a newly created soul pins. Frontmatter pins what a run
+ * from this directory would actually use: env vars outrank the active
+ * config file (project-local or explicit first, global otherwise), and no
+ * provider anywhere falls back to demo — the exact precedence of stratus
+ * run. Demo produces no model at all: the soul keeps following the
+ * machine's configuration instead of demanding credentials nothing has
+ * signed in for. The active config's model was written for the provider
+ * named in that config, so it only travels into the soul when they still
+ * match; otherwise the selected provider's own default model stands in.
+ *
+ * Exported for tests: the interactive path that consumes it needs a TTY.
+ */
+export declare const soulPinForNewAgent: (activeConfig: StratusConfigFile, processEnv: NodeJS.ProcessEnv) => {
+    provider: StratusProviderName;
+    model?: string;
+};
+export declare const runAgentNew: (command: ParsedAgentNewCommand, streams: CliStreams, env?: CliEnvironment) => Promise<number>;
+//# sourceMappingURL=agent-new.d.ts.map

package/dist/commands/agent-new.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-new.d.ts","sourceRoot":"","sources":["../../src/commands/agent-new.ts"],"names":[],"mappings":"AAGA,OAAO,EAWL,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACzB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAiB,MAAM,mBAAmB,CAAC;AAEnF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAIzD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,kBAAkB,GAC7B,cAAc,iBAAiB,EAC/B,YAAY,MAAM,CAAC,UAAU,KAC5B;IAAE,QAAQ,EAAE,mBAAmB,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAyBjD,CAAC;AAEF,eAAO,MAAM,WAAW,GACtB,SAAS,qBAAqB,EAC9B,SAAS,UAAU,EACnB,MAAK,cAAmB,KACvB,OAAO,CAAC,MAAM,CAoIhB,CAAC"}