@superjackfruitlabs/salaam 0.0.4 → 0.0.5

package/dist/src/store.js

@@ -461,8 +461,11 @@ export class Store {
             throw new ServiceError('not_found', 'Session not found', 404);
         return { ...row, capabilities: JSON.parse(row.capabilities) };
     }
-    forkLocal(id, request, expected, controller, clone) {
-        return this.request('local-operator', request, { kind: 'fork', id, expected }, () => {
+    forkLocal(id, request, expected, controller, clone, 
+    /** A rewind forks from an earlier conversation leaf. */
+    at) {
+        const input = { kind: 'fork', id, expected, ...(at ? { leaf: at.leaf } : {}) };
+        return this.request('local-operator', request, input, () => {
             this.authorizeControl(id, controller);
             const source = this.session(id);
             if (source.revision !== expected)
@@ -478,7 +481,7 @@ export class Store {
             const file = clone(source, target);
             this.db
                 .prepare('INSERT INTO sessions(id,cwd,pi_session_id,pi_session_file,pi_cursor,pi_leaf) VALUES(?,?,?,?,?,?)')
-                .run(target, source.cwd, target, file, source.pi_cursor, source.pi_leaf);
+                .run(target, source.cwd, target, file, source.pi_cursor, at ? at.leaf : source.pi_leaf);
             this.event(target, 'session.created', {
                 cwd: source.cwd,
                 local_workspace: true,
@@ -493,7 +496,13 @@ export class Store {
             this.db
                 .prepare('INSERT INTO pi_entries SELECT ?,entry_id,payload FROM pi_entries WHERE session_id=?')
                 .run(target, id);
-            this.event(target, 'session.forked', { parent: id, parent_revision: expected, leaf: source.pi_leaf, cursor: source.pi_cursor }, request);
+            this.event(target, 'session.forked', {
+                parent: id,
+                parent_revision: expected,
+                leaf: at ? at.leaf : source.pi_leaf,
+                cursor: source.pi_cursor,
+                ...(at ? { rewound: true } : {}),
+            }, request);
             return this.session(target);
         });
     }
@@ -521,6 +530,13 @@ export class Store {
     lastActivityAny() {
         return Math.max(this.openedAt, ...this.activity.values());
     }
+    /** The newest prompt submitted to a session, for the session picker. */
+    lastPrompt(id) {
+        const row = this.db
+            .prepare('SELECT text FROM submissions WHERE session_id=? ORDER BY rowid DESC LIMIT 1')
+            .get(id);
+        return row?.text ?? null;
+    }
     sessions() {
         return this.db.prepare('SELECT id FROM sessions ORDER BY rowid').all().map((x) => this.session(x.id));
     }
@@ -573,6 +589,23 @@ export class Store {
             }
         });
     }
+    /**
+     * The one sanctioned route change: an operator switching model or thinking level in an
+     * interactive session between turns. Recorded as provider.route_changed; the worker restarts on
+     * the same Pi transcript with the new route.
+     */
+    switchRoute(id, route) {
+        return this.transaction(() => {
+            const from = this.providerRoute(id);
+            if (!from || !this.localWorkspace(id))
+                throw new ServiceError('route_switch_unavailable', 'Only interactive sessions can switch model mid-session', 409);
+            this.db
+                .prepare('UPDATE session_routes SET route=? WHERE session_id=?')
+                .run(canonical(route), id);
+            this.event(id, 'provider.route_changed', { from, to: route });
+            return { from, to: route };
+        });
+    }
     providerRoute(id) {
         const row = this.db.prepare('SELECT route FROM session_routes WHERE session_id=?').get(id);
         return row ? JSON.parse(row.route) : null;
@@ -920,6 +953,9 @@ export class Store {
         const lookup = this.db.prepare('SELECT payload FROM pi_entries WHERE session_id=? AND entry_id=?');
         let remaining = 256 * 1024;
         const messages = [];
+        // Walking back from the newest entry: tool calls belong just before the message that follows
+        // them, so a turn's calls are shown in place rather than gathered at the end.
+        let trailing = [];
         while (cursor &&
             !seen.has(cursor) &&
             seen.size < 10000 &&
@@ -934,6 +970,16 @@ export class Store {
             const message = entry.message;
             if (!message || !['user', 'assistant'].includes(message.role))
                 continue;
+            if (Array.isArray(message.content)) {
+                const calls = message.content
+                    .filter((part) => part.type === 'toolCall')
+                    .map((part) => String(part.id));
+                const later = messages.at(-1);
+                if (calls.length && later)
+                    later.tool_calls = [...calls, ...(later.tool_calls ?? [])];
+                else if (calls.length)
+                    trailing = [...calls, ...trailing];
+            }
             const text = typeof message.content === 'string'
                 ? message.content
                 : message.content
@@ -964,6 +1010,7 @@ export class Store {
             attempts: boundedAttempts,
             submissions: boundedSubmissions,
             messages: messages.reverse(),
+            ...(trailing.length ? { trailing_tool_calls: trailing } : {}),
             history_truncated: cursor !== null,
             approvals: this.approvals(id),
             operations: this.operations(id),

package/dist/src/supervisor.js

@@ -1,4 +1,5 @@
 import { BoardReads } from './board-reads.js';
+import { takeImages } from './mentions.js';
 import { HostBreaker, callThroughBreaker } from './host-breaker.js';
 import { randomBytes, randomUUID, timingSafeEqual } from 'node:crypto';
 import { execFileSync } from 'node:child_process';
@@ -19,6 +20,28 @@ import { digest } from './protocol.js';
 import { readLocalWorkspace } from './local-workspace.js';
 import { repositoryPath } from './repository-snapshots.js';
 import { acpFailure, credentialStrings, parseAcpFailure, providerOutcome, redactFailureText, toolMetadata, } from './acp-outcome.js';
+/** Errors a local tool call returns to the model as feedback; any other one fails the worker.
+ * Every code src/local-edits.ts can throw belongs here (a failed replacement is not a crash). */
+export const LOCAL_TOOL_ERRORS = [
+    'local_busy',
+    'workspace_read_failed',
+    'unsafe_path',
+    'edit_mismatch',
+    'workspace_changed',
+    'workspace_busy',
+    'workspace_limit',
+    'workspace_conflict',
+    'not_found',
+    'binary_file',
+    'line_limit',
+    'invalid_field',
+    'request_conflict',
+    'command_conflict',
+    'command_limit',
+    'invalid_cursor',
+    'shell_binding',
+    'listen_unreachable',
+];
 export function processIdentity(pid) {
     if (!Number.isSafeInteger(pid) || pid < 1)
         return null;
@@ -72,6 +95,35 @@ export function processIdentity(pid) {
         return null;
     }
 }
+/**
+ * When a process started, keyed to this boot. Unlike processIdentity it survives exec, so it
+ * names a background task whose gated shell has since become the user's command.
+ */
+export function processStart(pid) {
+    if (!Number.isSafeInteger(pid) || pid < 1)
+        return null;
+    try {
+        if (process.platform === 'linux') {
+            const value = readFileSync(`/proc/${pid}/stat`, 'utf8');
+            const fields = value
+                .slice(value.lastIndexOf(') ') + 2)
+                .trim()
+                .split(/\s+/);
+            const boot = readFileSync('/proc/sys/kernel/random/boot_id', 'utf8').trim();
+            return /^\d+$/.test(fields[19] ?? '') ? `linux-start-v1:${pid}:${boot}:${fields[19]}` : null;
+        }
+        const started = execFileSync('/bin/ps', ['-p', String(pid), '-o', 'lstart='], {
+            encoding: 'utf8',
+            stdio: ['ignore', 'pipe', 'ignore'],
+            timeout: 2000,
+            killSignal: 'SIGKILL',
+        }).trim();
+        return started ? `ps-start-v1:${pid}:${started}` : null;
+    }
+    catch {
+        return null;
+    }
+}
 function groupExists(pid) {
     try {
         process.kill(-pid, 0);
@@ -87,6 +139,10 @@ export class Supervisor extends EventEmitter {
     store;
     options;
     localCoding;
+    /** Built-in web search and fetch for interactive coding (operator ruling 2026-10-31). */
+    web;
+    /** Desk-session hooks (Phase 4b); absent means none run. */
+    hooks;
     tasks;
     compactionJobs = new Set();
     fetchBreaker = new HostBreaker();
@@ -429,6 +485,16 @@ export class Supervisor extends EventEmitter {
             worker.pi.on('activity', (observation) => {
                 if (!worker.attempt || worker.stopping)
                     return;
+                // PostToolUse runs after the tool and cannot change it; it is recorded like any hook.
+                if (observation.phase === 'finished' && this.hooks) {
+                    const input = parsedInput(observation.input);
+                    void this.hook(id, 'PostToolUse', {
+                        tool_name: observation.tool,
+                        tool_input: input,
+                        tool_use_id: observation.tool_call_id,
+                        tool_response: { output: observation.output ?? '', failed: !!observation.failed },
+                    }, [observation.tool, ...hookAliases(observation.tool, input)]).catch(() => { });
+                }
                 try {
                     this.store.request(`tool-activity:${id}:${epoch}:${worker.attempt}`, `${observation.phase}:${observation.tool_call_id}`, observation, () => {
                         this.store.event(id, `tool.${observation.phase}`, {
@@ -605,6 +671,28 @@ export class Supervisor extends EventEmitter {
         return w;
     }
     /** Is this attempt a task step that has acceptance checks to decide it? */
+    /** A person's own local coding session: not a delegated child and not AgentPod-admitted work,
+     * whose strict semantics stay as they are. */
+    isInteractiveCoding(id) {
+        return this.interactiveCoding(id);
+    }
+    /** Run this desk session's hooks for `event`; other sessions (board, station, children) run none. */
+    async hook(id, event, payload, names = []) {
+        if (!this.hooks || !this.interactiveCoding(id))
+            return null;
+        return this.hooks.fire(id, event, payload, names);
+    }
+    /** A PreToolUse hook that blocks turns the tool call into an error the model reads. */
+    async preToolUse(id, tool, input, toolCallId) {
+        const out = await this.hook(id, 'PreToolUse', { tool_name: tool, tool_input: input, tool_use_id: toolCallId }, [tool, ...hookAliases(tool, input)]);
+        if (out?.blocked)
+            throw new ServiceError('hook_blocked', `Blocked by a PreToolUse hook: ${out.blocked}`);
+    }
+    interactiveCoding(id) {
+        return (this.store.localCoding(id) &&
+            !this.children?.owned(id) &&
+            !this.store.db.prepare('SELECT 1 FROM agentpod_admissions WHERE session_id=?').get(id));
+    }
     checkedStepAttempt(attempt) {
         const row = this.store.db
             .prepare('SELECT checks FROM task_steps WHERE attempt_id=?')
@@ -895,6 +983,77 @@ export class Supervisor extends EventEmitter {
                     return this.station.view(c.id);
                 throw new ServiceError('invalid_field', 'Unsupported station method');
             }
+            if (method === 'web.search' || method === 'web.fetch') {
+                if (!this.web || !this.store.localCoding(id) || this.children?.owned(id) || !w.attempt)
+                    throw new ServiceError('web_denied', 'Web search is not admitted for this session', 403);
+                this.assertActive(id, w.epoch, w.attempt);
+                const args = object(body.args);
+                const toolCallId = string(body.tool_call_id, 'tool_call_id', 512);
+                await this.preToolUse(id, method === 'web.search' ? 'salaam_web_search' : 'salaam_web_fetch', args, toolCallId);
+                if (method === 'web.search') {
+                    const out = await this.web.search({
+                        query: string(args.query, 'query', 300),
+                        ...(typeof args.kind === 'string'
+                            ? { kind: args.kind }
+                            : {}),
+                        ...(typeof args.limit === 'number' ? { limit: args.limit } : {}),
+                    });
+                    // Recorded: kind, backends tried, which answered and how long. Never a key or the query.
+                    this.store.transaction(() => this.store.event(id, 'web.search', {
+                        attempt_id: w.attempt,
+                        tool_call_id: toolCallId,
+                        kind: out.kind,
+                        cached: !!out.cached,
+                        results: out.results.length,
+                        tried: out.tried,
+                    }));
+                    return out;
+                }
+                const url = string(args.url, 'url', 2000);
+                let host = '';
+                try {
+                    host = new URL(url).hostname;
+                }
+                catch {
+                    /* fetchPage refuses it */
+                }
+                try {
+                    const page = await (await import('./web-fetch.js')).fetchPage(url);
+                    this.store.transaction(() => this.store.event(id, 'web.fetch', {
+                        attempt_id: w.attempt,
+                        tool_call_id: toolCallId,
+                        host,
+                        status: page.status,
+                        chars: page.text.length,
+                        truncated: page.truncated,
+                    }));
+                    const { renderFetched } = await import('./web-fetch.js');
+                    return { ok: true, url: page.url, text: renderFetched(page) };
+                }
+                catch (error) {
+                    const message = String(error.message ?? error).slice(0, 300);
+                    this.store.transaction(() => this.store.event(id, 'web.fetch', {
+                        attempt_id: w.attempt,
+                        tool_call_id: toolCallId,
+                        host,
+                        error: message,
+                    }));
+                    return { ok: false, url, error: message };
+                }
+            }
+            if (method.startsWith('bgtask.')) {
+                if (!this.localCoding || !this.interactiveCoding(id) || !w.attempt)
+                    throw new ServiceError('background_denied', 'Background commands are not admitted', 403);
+                this.assertActive(id, w.epoch, w.attempt);
+                if (method === 'bgtask.list')
+                    return { tasks: this.localCoding.tasks(id) };
+                const task = string(body.task_id, 'task_id', 64);
+                if (method === 'bgtask.output')
+                    return this.localCoding.taskOutput(id, task);
+                if (method === 'bgtask.stop')
+                    return this.localCoding.stopTask(id, task);
+                throw new ServiceError('invalid_field', 'Unsupported background task method');
+            }
             if (method.startsWith('local.') && method !== 'local.read') {
                 if (!this.localCoding ||
                     !this.store.localCoding(id) ||
@@ -902,8 +1061,21 @@ export class Supervisor extends EventEmitter {
                     !w.attempt)
                     throw new ServiceError('local_denied', 'Local coding is not admitted', 403);
                 this.assertActive(id, w.epoch, w.attempt);
-                if (method === 'local.prepare')
-                    return this.localCoding.prepare(id, w.epoch, w.attempt, string(body.tool_call_id, 'tool_call_id', 512), object(body.args));
+                if (method === 'local.prepare') {
+                    const toolCall = string(body.tool_call_id, 'tool_call_id', 512);
+                    const args = object(body.args);
+                    // A retried prepare returns the recorded call; its hooks already ran.
+                    const fresh = !this.localCoding.hasCall(id, w.epoch, toolCall);
+                    if (fresh)
+                        await this.preToolUse(id, 'salaam_local', args, toolCall);
+                    const prepared = await this.localCoding.prepareReviewed(id, w.epoch, w.attempt, toolCall, args);
+                    if (fresh && prepared.approval?.state === 'pending')
+                        void this.hook(id, 'Notification', {
+                            notification_type: 'permission_prompt',
+                            message: `Salaam needs your approval for a ${String(args.action ?? 'local')} request`,
+                        }).catch(() => { });
+                    return prepared;
+                }
                 const c = this.localCoding.get(string(body.call_id, 'call_id'));
                 if (c.session_id !== id || c.epoch !== w.epoch || c.attempt_id !== w.attempt)
                     throw new ServiceError('local_scope', 'Operation belongs to another invocation', 403);
@@ -919,6 +1091,7 @@ export class Supervisor extends EventEmitter {
                 this.assertActive(id, w.epoch, w.attempt);
                 this.store.taskGrantCheck?.(id);
                 const args = object(body.args);
+                await this.preToolUse(id, 'salaam_workspace', args, string(body.tool_call_id, 'tool_call_id', 512));
                 const result = readLocalWorkspace(this.store.session(id).cwd, args);
                 this.store.transaction(() => this.store.event(id, 'workspace.read', {
                     attempt_id: w.attempt,
@@ -1146,25 +1319,13 @@ export class Supervisor extends EventEmitter {
                     'request_conflict',
                 ].includes(error.code))
                 throw error;
+            // A hook that blocked a tool call is the person's policy speaking, not a broken control: the
+            // model reads the reason as the tool's result (Phase 4b).
+            if (error instanceof ServiceError && error.code === 'hook_blocked')
+                throw error;
             if ((method.startsWith('coding.') || method.startsWith('local.')) &&
                 error instanceof ServiceError &&
-                [
-                    'local_busy',
-                    'workspace_read_failed',
-                    'unsafe_path',
-                    'workspace_changed',
-                    'workspace_busy',
-                    'workspace_limit',
-                    'workspace_conflict',
-                    'not_found',
-                    'binary_file',
-                    'line_limit',
-                    'invalid_field',
-                    'request_conflict',
-                    'command_conflict',
-                    'command_limit',
-                    'invalid_cursor',
-                ].includes(error.code))
+                LOCAL_TOOL_ERRORS.includes(error.code))
                 throw error;
             if (method === 'history' &&
                 error instanceof ServiceError &&
@@ -1212,6 +1373,7 @@ export class Supervisor extends EventEmitter {
         const state = {
             ...this.store.session(id),
             provider_route: this.store.providerRoute(id) ?? undefined,
+            project_instructions: this.tasks.instructions?.summary(id) ?? undefined,
             provider_capabilities: cap === undefined
                 ? this.providerCapabilities()
                 : {
@@ -1478,10 +1640,13 @@ export class Supervisor extends EventEmitter {
             // A checked task step is decided by its checks, not by a tool error the model went on
             // to recover from (operator decision, 2026-10-23). The error stays in the journal
             // (tool.finished failed=true). A delegated child turn, whose denied probes are its
-            // boundary proof, and any attempt outside a checked step still fail on it.
+            // boundary proof, and any attempt outside a checked step still fail on it, except an
+            // interactive coding turn: at a desk a failed command is feedback, and the turn is
+            // decided by how it ends (step 0, 2026-10-31).
             if (value.type === 'tool_execution_end' &&
                 value.isError === true &&
-                (this.children?.owned(id) || !this.checkedStepAttempt(work.attempt.id)))
+                (this.children?.owned(id) ||
+                    (!this.checkedStepAttempt(work.attempt.id) && !this.interactiveCoding(id))))
                 outcome ??= {
                     version: 1,
                     stopReason: 'error',
@@ -1490,7 +1655,31 @@ export class Supervisor extends EventEmitter {
         };
         w.pi.on('record', record);
         try {
-            const response = await w.pi.command('prompt', { message: work.submission.text });
+            // Interactive sessions pick up AGENTS.md edits at the start of each turn (recorded as a new
+            // instructions.loaded revision). A discovery failure never blocks the turn.
+            try {
+                this.tasks.instructions?.refresh(id);
+            }
+            catch {
+                /* the previously loaded guidance stays in force */
+            }
+            // The folder as it was before this turn, so /rewind can return to it.
+            if (this.interactiveCoding(id))
+                this.tasks.checkpoints?.capture(id, work.attempt.id);
+            // UserPromptSubmit hooks may stop the prompt or add context to it (Phase 4b).
+            let message = work.submission.text;
+            const gate = await this.hook(id, 'UserPromptSubmit', { prompt: message });
+            if (gate?.blocked) {
+                this.store.finish(work.attempt.id, 'failed', null, 'Blocked by a UserPromptSubmit hook: ' + gate.blocked);
+                return true;
+            }
+            if (gate?.context)
+                message += '\n\n<hook-context>\n' + gate.context + '\n</hook-context>';
+            const images = takeImages(this.store.db, work.submission.id);
+            const response = await w.pi.command('prompt', {
+                message,
+                ...(images.length ? { images } : {}),
+            });
             const disposition = object(response.data ?? {}).disposition;
             if (disposition !== 'started')
                 throw new Error('Pi did not start the dispatched prompt');
@@ -1502,6 +1691,7 @@ export class Supervisor extends EventEmitter {
             const result = object((await w.pi.command('get_last_assistant_text')).data);
             this.childBoundary(id, w.epoch);
             this.store.finish(work.attempt.id, outcome ? 'failed' : 'completed', String(result.text ?? ''), outcome?.failure?.message ?? null, { epoch: w.epoch, ...entries }, outcome);
+            void this.hook(id, 'Stop', { outcome: outcome ? 'failed' : 'completed' }).catch(() => { });
         }
         catch (error) {
             const message = redactFailureText(error.message, w.secrets);
@@ -1586,3 +1776,24 @@ export function toolFailureMessage(toolName) {
         ? `Tool execution failed (tool ${toolName})`
         : 'Tool execution failed';
 }
+/** Claude Code names for Salaam's tools, so a `Bash` or `Edit|Write` matcher works unchanged. */
+export function hookAliases(tool, input) {
+    if (tool === 'salaam_local')
+        return input.action === 'command' ? ['Bash'] : input.action === 'edit' ? ['Edit', 'Write'] : [];
+    if (tool === 'salaam_web_search')
+        return ['WebSearch'];
+    if (tool === 'salaam_web_fetch')
+        return ['WebFetch'];
+    if (tool === 'salaam_workspace')
+        return ['Read'];
+    return [];
+}
+function parsedInput(input) {
+    try {
+        const value = JSON.parse(input ?? '{}');
+        return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+    }
+    catch {
+        return {};
+    }
+}

package/dist/src/task-context.js

@@ -14,6 +14,10 @@ export class TaskContext {
     artifacts;
     work;
     admitted;
+    /** Interactive sessions only: AGENTS.md guidance loaded automatically (project-instructions.ts). */
+    instructions;
+    /** Interactive sessions only: a folder checkpoint before every turn (turn-rewind.ts). */
+    checkpoints;
     constructor(store, artifacts) {
         this.store = store;
         this.artifacts = artifacts;
@@ -65,11 +69,13 @@ export class TaskContext {
         if (Buffer.byteLength(frame) > TASK_FRAME_BYTES)
             throw new ServiceError('context_capacity', 'Mandatory task state exceeds the context budget');
         const admittedContext = this.admitted?.frame(id);
-        return admittedContext
+        const projectInstructions = this.instructions?.frame(id);
+        return admittedContext || projectInstructions
             ? 'SALAAM_TASK_STATE ' +
                 canonical({
                     ...JSON.parse(frame.slice('SALAAM_TASK_STATE '.length)),
-                    admitted_context: admittedContext,
+                    ...(admittedContext ? { admitted_context: admittedContext } : {}),
+                    ...(projectInstructions ? { project_instructions: projectInstructions } : {}),
                 })
             : frame;
     }

package/dist/src/terminal-status.js

@@ -0,0 +1,88 @@
+import { execFile } from 'node:child_process';
+export function terminalState(snapshot) {
+    if (!snapshot)
+        return 'idle';
+    if ((snapshot.approvals ?? []).some((a) => a.state === 'pending'))
+        return 'blocked';
+    if ((snapshot.attempts ?? []).some((a) => ['accepted', 'dispatching', 'running'].includes(a.state)))
+        return 'working';
+    return 'idle';
+}
+export function titleFor(state, name) {
+    // eslint-disable-next-line no-control-regex
+    const clean = name
+        ?.replace(/[\x00-\x1f\x7f-\x9f]/g, '')
+        .trim()
+        .slice(0, 32);
+    if (!clean)
+        return 'Salaam';
+    const words = state === 'blocked' ? 'needs you' : state === 'working' ? 'working' : 'idle';
+    return `Salaam · ${clean} · ${words}`;
+}
+export function statusEnabled(env = process.env) {
+    return env.SALAAM_TERMINAL_STATUS !== 'off';
+}
+const run = (bin, args, done) => {
+    // Short timeout, failures ignored: Herdr must never slow Salaam down.
+    execFile(bin, args, { timeout: 2000, windowsHide: true }, () => done());
+};
+/** Reports to Herdr only inside a Herdr pane; one report in flight, newest state wins. */
+export class HerdrReporter {
+    env;
+    exec;
+    now;
+    enabled;
+    seq = 0;
+    busy = false;
+    queued;
+    last;
+    constructor(env = process.env, exec = run, now = Date.now) {
+        this.env = env;
+        this.exec = exec;
+        this.now = now;
+        this.enabled = !!(env.HERDR_ENV === '1' && env.HERDR_PANE_ID && env.HERDR_BIN_PATH);
+    }
+    nextSeq() {
+        this.seq = Math.max(this.seq + 1, this.now());
+        return String(this.seq);
+    }
+    head(verb) {
+        return ['pane', verb, this.env.HERDR_PANE_ID, '--source', 'salaam', '--agent', 'salaam'];
+    }
+    report(state, session) {
+        if (!this.enabled)
+            return;
+        const key = state + ' ' + (session ?? '');
+        if (key === this.last)
+            return;
+        this.last = key;
+        this.queued = [
+            ...this.head('report-agent'),
+            '--state',
+            state,
+            '--seq',
+            '',
+            ...(state === 'blocked' ? ['--message', 'Waiting for your approval'] : []),
+            ...(session ? ['--agent-session-id', session, '--', 'salaam', '--session', session] : []),
+        ];
+        this.flush();
+    }
+    release() {
+        if (!this.enabled)
+            return;
+        this.queued = undefined;
+        this.exec(this.env.HERDR_BIN_PATH, [...this.head('release-agent'), '--seq', this.nextSeq()], () => { });
+    }
+    flush() {
+        if (this.busy || !this.queued)
+            return;
+        const args = this.queued;
+        this.queued = undefined;
+        args[args.indexOf('--seq') + 1] = this.nextSeq();
+        this.busy = true;
+        this.exec(this.env.HERDR_BIN_PATH, args, () => {
+            this.busy = false;
+            this.flush();
+        });
+    }
+}