@wildorder/nightshift 0.13.0 → 0.15.0

package/README.md

@@ -73,23 +73,61 @@ things only you can write:
 
 ```json
 {
-  "agent":         { "command": "claude", "args": ["-p", "--model", "sonnet", "--permission-mode", "acceptEdits", "--allowedTools", "Bash(npm run build:*)", "Bash(npm run typecheck:*)", "Bash(npm run lint:*)", "Bash(npm test:*)"], "promptMode": "stdin" },
-  "authorAgent":   { "command": "claude", "args": ["-p", "--model", "opus", "--permission-mode", "acceptEdits"], "promptMode": "stdin" },
+  "agent":         { "command": "claude", "args": ["-p", "--model", "sonnet"], "promptMode": "stdin" },
+  "authorAgent":   { "command": "claude", "args": ["-p", "--model", "opus"], "promptMode": "stdin" },
   "deciderAgent":  { "command": "codex", "args": ["exec", "--model", "gpt-5.6-sol"], "promptMode": "stdin" },
   "reviewerAgent": { "command": "codex", "args": ["exec"] },
-  "recoveryAgent": { "command": "codex", "args": ["exec", "--model", "gpt-5.6-sol", "--sandbox", "workspace-write"], "promptMode": "stdin" }
+  "recoveryAgent": { "command": "codex", "args": ["exec", "--model", "gpt-5.6-sol"], "promptMode": "stdin" },
+  "permits": {
+    "policy": "Anything inside this repository is fine, including installing dev dependencies and creating fixture files. Do not reach the network beyond npm install. Never push, publish, or change global git or npm configuration.",
+    "allow": ["Bash(git stash:*)"],
+    "deny": ["Bash(git push:*)", "Bash(npm publish:*)", "Bash(git config --global:*)", "Bash(npm config set:*)"]
+  }
 }
 ```
 
+Notice what is missing: no `--permission-mode`, no `--allowedTools`, no
+`--sandbox`. nightshift derives each role's permission posture itself — from
+the role (`agent`, `authorAgent`, and `recoveryAgent` get a workspace posture;
+`deciderAgent` and `reviewerAgent` get read-only, never edit-capable
+regardless of the host) and from the host it runs on (a claude `auto`
+classifier plus an OS sandbox on macOS/Linux, a `--sandbox workspace-write`
+grant on codex write seats and `--sandbox read-only` on its reply-only seats,
+a documented fallback when a capability cannot be detected). Any
+permission-bearing flag an operator writes anyway — `--permission-mode`,
+`--allowedTools`, `--sandbox`, and their siblings — always wins untouched,
+and that role is reported as operator-configured rather than silently
+overridden.
+
+The optional `permits` block, shown above as this repository uses it, widens
+or narrows the derived posture without hand-writing provider flags: `policy`
+is prose the implementer and recovery briefs quote verbatim (the same thing
+you would tell a contractor on day one), `allow` names commands that never
+wait on the classifier, and `deny` is the short catastrophic list that binds
+in every mode.
+
+`allow`/`deny` use Claude's rule syntax and fold into the generated settings
+file every claude spawn reads; codex has no per-command rules, so on those
+seats only the sandbox and the brief's policy apply. On a throwaway CI runner, set
+`NIGHTSHIFT_CONTAINMENT=ephemeral` in the environment to let workspace-posture
+roles skip permission prompts entirely (`ci init github`'s hosted variant sets
+this for you; never set it on a machine you or someone else works on
+directly — read-only roles ignore it regardless).
+
 Check the roster before the first run with `nightshift doctor --agents`: it
-spawns each distinct agent once (one real model call each), verifies on
-disk that the writing seats can write, and reports whether they can run
-the verify commands — the environment failures that otherwise burn a whole
-run's budget (a sandboxed shell, an untrusted workspace, a read-only
-recovery agent) show up as one labeled line each instead. Note
-`recoveryAgent`'s `--sandbox workspace-write` above: `codex exec` defaults
-to a read-only sandbox, which is the right posture for the decider and
-reviewer seats and exactly wrong for a seat that must fix a failing tree.
+spawns each distinct agent once (one real model call each) with the same
+derived posture a real run would use, verifies on disk that the writing seats
+can write, and reports whether they can run the verify commands — the
+environment failures that otherwise burn a whole run's budget (a sandboxed
+shell, an untrusted workspace, a read-only recovery agent) show up as one
+labeled line each instead. On codex, `exec` defaults to a read-only sandbox,
+which is the right posture for the decider and reviewer seats and exactly
+wrong for a seat that must fix a failing tree — so nightshift spawns
+`recoveryAgent` with `--sandbox workspace-write` and, rather than trusting the
+default, the decider and reviewer with an explicit `--sandbox read-only`. A
+codex user config can widen the default (a `sandbox = "elevated"` setting, a
+trusted-project entry), and a seat labeled read-only that can write is exactly
+the kind of quiet mismatch the posture lines exist to prevent.
 
 Only `agent` is required to run; every other role degrades loudly, not
 silently, when absent. The verify commands are the contract every
@@ -98,15 +136,6 @@ the first agent spawns and refuses to start if they are red, so the first
 failure you debug is the environment's, named as such, not eight
 workstreams' worth of budget spent on it.
 
-The implementer's `--allowedTools` grant mirrors the verify commands on
-purpose: a headless Claude invocation with only `--permission-mode
-acceptEdits` can edit files but cannot run Bash, which leaves the agent
-fixing test failures it can never re-run. Granting exactly the verify
-commands lets it run the same gate it is graded against — the runner's own
-independent verification remains the only thing that gates a commit. The
-runner warns at startup when it detects a Claude implementer without such
-a grant.
-
 **3. Plan a program** — in your agent tool (e.g. Claude Code), run:
 
 ```text
@@ -203,16 +232,25 @@ or to see the specs before a build starts:
 nightshift author <program-id>
 ```
 
-A `taskFile` that already exists is always kept, never overwritten. To
-deliberately re-author one after a plan edit, name it explicitly and force it:
+A finished `taskFile` is always kept, never overwritten, and an interrupted
+attempt — one a crash or a killed process cut off partway through — is
+re-authored automatically, without `--force`: a durable marker in the
+manifest, not the file's existence, is what proves authoring finished.
+
+Two flags select a range and a force level, independently:
 
 ```sh
-nightshift author <program-id> --only WS-03 --force
+nightshift author <program-id> --from WS-03
+nightshift author <program-id> --from WS-03 --force
 ```
 
-`--force` on its own does nothing to existing specs — it only takes effect
-for ids named in `--only`, so a bare `--force` can never silently regenerate
-a program's worth of hand-reviewed specs.
+`--from <workstream-id>` resumes from that workstream onward, in dependency
+order; everything before it is left untouched. Within the selected range,
+plain authoring (no `--force`) only writes missing or interrupted specs —
+completed and hand-authored ones are kept. Adding `--force` regenerates
+every selected spec, including already-completed ones, so `--from WS-03
+--force` regenerates WS-03 and everything after it. A bare `--force` with no
+`--from` selects the whole roster and regenerates every spec in the program.
 
 ## Flipping a decision
 

package/dist/agent-probe.d.ts

@@ -1,5 +1,6 @@
 import { type AgentRunner } from "./agent-runner.js";
 import type { AgentConfig, NightshiftConfig } from "./config.js";
+import { type ContainmentLabel, type PermitsContext } from "./permits.js";
 /**
  * The doctor's agent capability probe: spawn each configured agent role the
  * exact way a run would, ask it to write one file and run one permission-
@@ -15,12 +16,24 @@ export interface AgentProbe {
     /** Every configured role sharing this exact agent invocation. */
     roles: string[];
     agent: AgentConfig;
+    /** The containment nightshift derived for this invocation (WS-01). */
+    label: ContainmentLabel;
+    /** The settings file this invocation reads, when one applies (claude
+     *  only) — printed so doctor shows the same posture information as a
+     *  run's `permissions:` startup line (SC-07). */
+    settingsPath?: string;
     exitCode: number;
     /** Runner-verified: the probe file existed on disk with the expected token. */
     write: ProbeVerdict;
-    /** The agent's own EXEC report — the runner cannot observe a denied shell
-     *  from outside, so this verdict is the agent's claim, labeled as such. */
+    /** Runner-observed when a stream-json transcript exists for this spawn
+     *  (WS-02: `ok` when the exec command ran with no matching denial, `failed`
+     *  when it was denied or never ran); otherwise the agent's own EXEC report,
+     *  labeled as such — the runner cannot observe a denied shell from outside
+     *  a Claude spawn's transcript. See `execRunnerObserved`. */
     exec: ProbeVerdict;
+    /** True when `exec` came from the runner's observed transcript rather than
+     *  the agent's self-report (WS-02). */
+    execRunnerObserved: boolean;
     /** The command the exec step asked for, when one was derived from verify. */
     execCommand?: string;
     /** The agent's verbatim WRITE:/EXEC: lines when they carry an error. */
@@ -34,7 +47,13 @@ export interface ProbeAgentsOptions {
     cwd: string;
     config: NightshiftConfig;
     agentRunner?: AgentRunner;
+    /** Defaults to a real context built from `config`; tests inject one to
+     *  avoid a real capability-detection spawn and settings-file write. */
+    permits?: PermitsContext;
     log?: (line: string) => void;
+    /** Names the probe's transcripts under `build-logs/<programId>/` (WS-02).
+     *  The probe runs outside any one program, so this defaults to `"doctor"`. */
+    programId?: string;
 }
 export interface ProbeAgentsResult {
     probes: AgentProbe[];

package/dist/agent-probe.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-probe.d.ts","sourceRoot":"","sources":["../src/agent-probe.ts"],"names":[],"mappings":"AAGA,OAAO,EAML,KAAK,WAAW,EACjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEjE;;;;;;;;;GASG;AAEH,MAAM,MAAM,YAAY,GAAG,IAAI,GAAG,QAAQ,GAAG,SAAS,CAAC;AAEvD,MAAM,WAAW,UAAU;IACzB,iEAAiE;IACjE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,EAAE,WAAW,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,KAAK,EAAE,YAAY,CAAC;IACpB;+EAC2E;IAC3E,IAAI,EAAE,YAAY,CAAC;IACnB,6EAA6E;IAC7E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wEAAwE;IACxE,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB;qEACiE;IACjE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,gBAAgB,CAAC;IACzB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,UAAU,EAAE,CAAC;IACrB,8EAA8E;IAC9E,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,OAAO,EAAE,OAAO,CAAC;CAClB;AAmFD,wBAAsB,WAAW,CAC/B,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,iBAAiB,CAAC,CAqC5B;AA6GD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,iBAAiB,GAAG,MAAM,EAAE,CA+CrE"}
+{"version":3,"file":"agent-probe.d.ts","sourceRoot":"","sources":["../src/agent-probe.ts"],"names":[],"mappings":"AAGA,OAAO,EAML,KAAK,WAAW,EAEjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAIL,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACpB,MAAM,cAAc,CAAC;AAEtB;;;;;;;;;GASG;AAEH,MAAM,MAAM,YAAY,GAAG,IAAI,GAAG,QAAQ,GAAG,SAAS,CAAC;AAEvD,MAAM,WAAW,UAAU;IACzB,iEAAiE;IACjE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,EAAE,WAAW,CAAC;IACnB,sEAAsE;IACtE,KAAK,EAAE,gBAAgB,CAAC;IACxB;;qDAEiD;IACjD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,KAAK,EAAE,YAAY,CAAC;IACpB;;;;iEAI6D;IAC7D,IAAI,EAAE,YAAY,CAAC;IACnB;2CACuC;IACvC,kBAAkB,EAAE,OAAO,CAAC;IAC5B,6EAA6E;IAC7E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wEAAwE;IACxE,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB;qEACiE;IACjE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,gBAAgB,CAAC;IACzB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;2EACuE;IACvE,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B;kFAC8E;IAC9E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,UAAU,EAAE,CAAC;IACrB,8EAA8E;IAC9E,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,OAAO,EAAE,OAAO,CAAC;CAClB;AAqFD,wBAAsB,WAAW,CAC/B,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,iBAAiB,CAAC,CAsD5B;AA2JD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,iBAAiB,GAAG,MAAM,EAAE,CAsDrE"}

package/dist/agent-probe.js

@@ -1,7 +1,8 @@
 import { randomBytes } from "node:crypto";
 import { readFile, unlink } from "node:fs/promises";
 import { join, resolve } from "node:path";
-import { defaultAgentRunner, describeAgent, invokeAgent, resolveAgent, tail, } from "./agent-runner.js";
+import { defaultAgentRunner, describeAgent, recordAgentTranscript, resolveAgent, tail, } from "./agent-runner.js";
+import { buildPermitsContext, ROLE_POSTURE, } from "./permits.js";
 /**
  * What each seat actually needs. The implementer, author, and recovery
  * agents write the tree; the implementer and recovery agents also fix
@@ -10,7 +11,7 @@ import { defaultAgentRunner, describeAgent, invokeAgent, resolveAgent, tail, } f
  * posture, not a failure (codex exec ships read-only by default, which is
  * exactly right for those two seats and exactly wrong for recovery).
  */
-const WRITE_ROLES = new Set(["agent", "authorAgent", "recoveryAgent"]);
+const WRITE_ROLES = new Set(Object.keys(ROLE_POSTURE).filter((role) => ROLE_POSTURE[role] === "workspace"));
 const EXEC_ROLES = new Set(["agent", "recoveryAgent"]);
 /**
  * Output lines that explain a failed probe better than the verdict alone —
@@ -77,9 +78,12 @@ function configuredRoles(config) {
 export async function probeAgents(options) {
     const root = resolve(options.cwd);
     const agentRunner = options.agentRunner ?? defaultAgentRunner;
+    const permits = options.permits ?? (await buildPermitsContext({ config: options.config }));
     const log = options.log ?? ((line) => console.log(line));
-    // One probe per distinct invocation: roles that share an agent block
-    // would produce the identical spawn, and each spawn is a paid model call.
+    // One probe per distinct DERIVED invocation, not the raw config: two roles
+    // sharing an agent block can still derive different spawns once posture
+    // is per-role (a workspace seat and a read-only seat pointed at the same
+    // claude block), and each spawn is a paid model call.
     const distinct = new Map();
     const unconfigured = [];
     for (const { role, agent } of configuredRoles(options.config)) {
@@ -87,30 +91,53 @@ export async function probeAgents(options) {
             unconfigured.push(role);
             continue;
         }
-        const key = JSON.stringify([agent.command, agent.args, agent.promptMode]);
+        const derived = await permits.derive(role, agent);
+        const key = JSON.stringify([derived.agent.command, derived.agent.args, derived.agent.promptMode]);
         const entry = distinct.get(key);
         if (entry)
             entry.roles.push(role);
-        else
-            distinct.set(key, { agent, roles: [role] });
+        else {
+            distinct.set(key, {
+                agent: derived.agent,
+                roles: [role],
+                label: derived.label,
+                ...(derived.settingsPath === undefined ? {} : { settingsPath: derived.settingsPath }),
+            });
+        }
     }
     const firstVerify = Object.values(options.config.verify)[0];
     // `--help` keeps the probe cheap while still matching the same
     // `Bash(<command>:*)` prefix rule the real verify command needs — the
     // permission machinery is what is under test, not the suite.
     const execCommand = firstVerify === undefined ? undefined : `${firstVerify} --help`;
+    const programId = options.programId ?? "doctor";
     const probes = [];
-    for (const { agent, roles } of distinct.values()) {
-        log(`probing ${roles.join(", ")}: ${describeAgent(agent)}`);
-        probes.push(await probeOne(root, agent, roles, agentRunner, execCommand));
+    for (const { agent, roles, label, settingsPath } of distinct.values()) {
+        log(`probing ${roles.join(", ")}: ${describeAgent(agent)} [${label}]`);
+        const observe = { root, programId, label: `probe-${roles.join("-")}`, log };
+        probes.push(await probeOne(root, agent, roles, label, agentRunner, execCommand, settingsPath, observe));
     }
+    if (options.permits === undefined)
+        await permits.dispose?.();
     return {
         probes,
         unconfigured,
         healthy: probes.every((probe) => probe.healthy),
     };
 }
-async function probeOne(root, agent, roles, agentRunner, execCommand) {
+/** Spawns an already-derived agent config directly — `probeAgents` derives
+ *  once per role up front (to dedup on the derived invocation), so this
+ *  never re-derives. */
+function spawnDerived(runner, agent, prompt, cwd) {
+    return runner({ command: agent.command, args: agent.args, prompt, promptMode: agent.promptMode, cwd });
+}
+/** Loose match on the exec command a probe asked for against a transcript
+ *  entry — trimmed equality, tolerant of nothing else: the brief demands the
+ *  command run bare, so an honest agent's transcript entry is exact. */
+function sameCommand(a, b) {
+    return a.trim() === b.trim();
+}
+async function probeOne(root, agent, roles, label, agentRunner, execCommand, settingsPath, observe) {
     const nonce = randomBytes(4).toString("hex");
     const probeFile = `nightshift-probe-${nonce}.txt`;
     const token = `nightshift-probe-ok-${nonce}`;
@@ -119,21 +146,25 @@ async function probeOne(root, agent, roles, agentRunner, execCommand) {
     // probe's failure, never the doctor's crash.
     let invocation;
     try {
-        invocation = await invokeAgent(agentRunner, agent, brief, root);
+        invocation = await spawnDerived(agentRunner, agent, brief, root);
     }
     catch (error) {
         return {
             roles,
             agent,
+            label,
+            ...(settingsPath === undefined ? {} : { settingsPath }),
             exitCode: -1,
             write: "failed",
             exec: execCommand === undefined ? "skipped" : "failed",
+            execRunnerObserved: false,
             ...(execCommand === undefined ? {} : { execCommand }),
             claims: [],
             notes: [`the agent could not be spawned at all: ${error.message}`],
             healthy: false,
         };
     }
+    await recordAgentTranscript(observe, roles.join("+"), invocation);
     // The write verdict never trusts the reply: the file either landed with
     // the token or it did not.
     let write = "failed";
@@ -152,16 +183,32 @@ async function probeOne(root, agent, roles, agentRunner, execCommand) {
         claims.push(`WRITE: ${writeClaim}`);
     }
     let exec = "skipped";
+    const execRunnerObserved = execCommand !== undefined && invocation.transcript?.observed === true;
     if (execCommand !== undefined) {
-        const execClaim = claimLine(invocation.output, "EXEC");
-        if (execClaim !== undefined && /^(done|ok)\b/iu.test(execClaim)) {
-            exec = "ok";
+        if (invocation.transcript?.observed) {
+            // Runner-observed (WS-02): the transcript is what actually happened,
+            // not what the agent claims happened. Denied wins over ran, in the
+            // (should not occur) case a CLI reports both.
+            const denied = invocation.transcript.denials.some((denial) => sameCommand(denial.command, execCommand));
+            const ran = invocation.transcript.commands.some((command) => sameCommand(command.command, execCommand));
+            exec = !denied && ran ? "ok" : "failed";
+            if (exec === "failed") {
+                claims.push(denied
+                    ? `EXEC: (denied by the CLI's own permission check — see the transcript)`
+                    : "EXEC: (the transcript shows the command never ran)");
+            }
         }
         else {
-            exec = "failed";
-            claims.push(execClaim === undefined
-                ? "EXEC: (the reply never reported the exec step — the agent may have crashed before reaching it)"
-                : `EXEC: ${execClaim}`);
+            const execClaim = claimLine(invocation.output, "EXEC");
+            if (execClaim !== undefined && /^(done|ok)\b/iu.test(execClaim)) {
+                exec = "ok";
+            }
+            else {
+                exec = "failed";
+                claims.push(execClaim === undefined
+                    ? "EXEC: (the reply never reported the exec step — the agent may have crashed before reaching it)"
+                    : `EXEC: ${execClaim}`);
+            }
         }
     }
     // Notes restating a claim are noise: the signature scanner re-matches the
@@ -186,9 +233,12 @@ async function probeOne(root, agent, roles, agentRunner, execCommand) {
     return {
         roles,
         agent,
+        label,
+        ...(settingsPath === undefined ? {} : { settingsPath }),
         exitCode: invocation.exitCode,
         write,
         exec,
+        execRunnerObserved,
         ...(execCommand === undefined ? {} : { execCommand }),
         claims,
         notes,
@@ -206,6 +256,10 @@ export function renderProbeResult(result) {
         const writers = probe.roles.filter((role) => WRITE_ROLES.has(role));
         const execers = probe.roles.filter((role) => EXEC_ROLES.has(role));
         lines.push(`${probe.roles.join(", ")}: ${describeAgent(probe.agent)}`);
+        lines.push(probe.settingsPath === undefined
+            ? `  permissions: ${probe.label}`
+            : `  permissions: ${probe.label} — settings: ${probe.settingsPath}`);
+        const execSource = probe.execRunnerObserved ? "runner-observed" : "agent's report";
         if (probe.healthy) {
             const parts = [];
             if (probe.write === "ok")
@@ -213,7 +267,7 @@ export function renderProbeResult(result) {
             else
                 parts.push("reply-only seat (a read-only sandbox is its correct posture)");
             if (probe.exec === "ok") {
-                parts.push(`reports it can run \`${probe.execCommand ?? ""}\``);
+                parts.push(`can run \`${probe.execCommand ?? ""}\` (${execSource})`);
             }
             else if (probe.exec === "failed") {
                 parts.push("cannot run the gate (fine — this seat never fixes verify failures)");
@@ -228,10 +282,10 @@ export function renderProbeResult(result) {
             lines.push(`  write: FAILED — no probe file landed, and ${writers.join(", ")} must write the tree`);
         }
         if (probe.exec === "ok") {
-            lines.push(`  exec \`${probe.execCommand ?? ""}\`: ok (agent's report)`);
+            lines.push(`  exec \`${probe.execCommand ?? ""}\`: ok (${execSource})`);
         }
         else if (probe.exec === "failed" && execers.length > 0) {
-            lines.push(`  exec \`${probe.execCommand ?? ""}\`: FAILED — ${execers.join(", ")} ` +
+            lines.push(`  exec \`${probe.execCommand ?? ""}\`: FAILED (${execSource}) — ${execers.join(", ")} ` +
                 "must run the verify commands to fix failures with open eyes");
         }
         for (const claim of probe.claims)

package/dist/agent-probe.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent-probe.js","sourceRoot":"","sources":["../src/agent-probe.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,WAAW,EACX,YAAY,EACZ,IAAI,GAEL,MAAM,mBAAmB,CAAC;AAkD3B;;;;;;;GAOG;AACH,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,aAAa,EAAE,eAAe,CAAC,CAAC,CAAC;AACvE,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC,CAAC;AAEvD;;;GAGG;AACH,MAAM,qBAAqB,GACzB,oHAAoH,CAAC;AAEvH,SAAS,UAAU,CAAC,SAAiB,EAAE,KAAa,EAAE,WAAoB;IACxE,OAAO;QACL,0BAA0B;QAC1B,EAAE;QACF,+DAA+D;QAC/D,uDAAuD;QACvD,EAAE;QACF,0DAA0D,SAAS,IAAI;QACvE,2DAA2D,KAAK,EAAE;QAClE,GAAG,CAAC,WAAW,KAAK,SAAS;YAC3B,CAAC,CAAC;gBACE,0CAA0C,WAAW,EAAE;gBACvD,iEAAiE;gBACjE,4DAA4D;gBAC5D,kEAAkE;gBAClE,kEAAkE;gBAClE,sDAAsD;aACvD;YACH,CAAC,CAAC,EAAE,CAAC;QACP,EAAE;QACF,uDAAuD;QACvD,EAAE;QACF,6DAA6D;QAC7D,GAAG,CAAC,WAAW,KAAK,SAAS;YAC3B,CAAC,CAAC,CAAC,4DAA4D,CAAC;YAChE,CAAC,CAAC,EAAE,CAAC;QACP,EAAE;QACF,8CAA8C;KAC/C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,yEAAyE;AACzE,SAAS,SAAS,CAAC,MAAc,EAAE,KAAa;IAC9C,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,MAAM,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IACtD,OAAO,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9D,CAAC;AAED,SAAS,eAAe,CAAC,MAAc;IACrC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,OAAO,KAAK,EAAE,IAAI,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1D,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;AACnB,CAAC;AAED,8DAA8D;AAC9D,SAAS,eAAe,CACtB,MAAwB;IAExB,OAAO;QACL,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE;QAC9C,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,CAAC,WAAW,EAAE;QAClD,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE;QACpD,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,CAAC,aAAa,EAAE;QACtD,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,CAAC,aAAa,EAAE;KACvD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAA2B;IAE3B,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,kBAAkB,CAAC;IAC9D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAEjE,qEAAqE;IACrE,0EAA0E;IAC1E,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAmD,CAAC;IAC5E,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACxB,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;QAC1E,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,KAAK;YAAE,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;;YAC7B,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5D,+DAA+D;IAC/D,sEAAsE;IACtE,6DAA6D;IAC7D,MAAM,WAAW,GAAG,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,WAAW,SAAS,CAAC;IAEpF,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,KAAK,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;QACjD,GAAG,CAAC,WAAW,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC5D,MAAM,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;IAC5E,CAAC;IAED,OAAO;QACL,MAAM;QACN,YAAY;QACZ,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC;KAChD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,IAAY,EACZ,KAAkB,EAClB,KAAe,EACf,WAAwB,EACxB,WAA+B;IAE/B,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,oBAAoB,KAAK,MAAM,CAAC;IAClD,MAAM,KAAK,GAAG,uBAAuB,KAAK,EAAE,CAAC;IAC7C,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;IAExD,sEAAsE;IACtE,6CAA6C;IAC7C,IAAI,UAAmD,CAAC;IACxD,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,WAAW,CAAC,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IAClE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,KAAK;YACL,KAAK;YACL,QAAQ,EAAE,CAAC,CAAC;YACZ,KAAK,EAAE,QAAQ;YACf,IAAI,EAAE,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;YACtD,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;YACrD,MAAM,EAAE,EAAE;YACV,KAAK,EAAE,CAAC,0CAA2C,KAAe,CAAC,OAAO,EAAE,CAAC;YAC7E,OAAO,EAAE,KAAK;SACf,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,2BAA2B;IAC3B,IAAI,KAAK,GAAiB,QAAQ,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC;QAC9D,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,KAAK,GAAG,IAAI,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB;IACnB,CAAC;IACD,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAEpD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzD,IAAI,KAAK,KAAK,QAAQ,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QACnD,MAAM,CAAC,IAAI,CAAC,UAAU,UAAU,EAAE,CAAC,CAAC;IACtC,CAAC;IAED,IAAI,IAAI,GAAiB,SAAS,CAAC;IACnC,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,SAAS,GAAG,SAAS,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACvD,IAAI,SAAS,KAAK,SAAS,IAAI,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAChE,IAAI,GAAG,IAAI,CAAC;QACd,CAAC;aAAM,CAAC;YACN,IAAI,GAAG,QAAQ,CAAC;YAChB,MAAM,CAAC,IAAI,CACT,SAAS,KAAK,SAAS;gBACrB,CAAC,CAAC,gGAAgG;gBAClG,CAAC,CAAC,SAAS,SAAS,EAAE,CACzB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,wEAAwE;IACxE,uEAAuE;IACvE,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC,CAAC;IACnF,MAAM,KAAK,GAAG,eAAe,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CACrD,CAAC,IAAI,EAAE,EAAE,CACP,CAAC,aAAa,CAAC,IAAI,CACjB,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAC9D,CACJ,CAAC;IACF,IAAI,UAAU,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACxC,KAAK,CAAC,IAAI,CACR,0DAA0D,UAAU,CAAC,UAAU,GAAG,CACnF,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CACR,0BAA0B,UAAU,CAAC,QAAQ,KAAK,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,EAAE,CACxF,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,0EAA0E;IAC1E,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAClE,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAChE,MAAM,OAAO,GACX,UAAU,CAAC,QAAQ,KAAK,CAAC;QACzB,UAAU,CAAC,UAAU,KAAK,SAAS;QACnC,CAAC,CAAC,aAAa,IAAI,KAAK,KAAK,IAAI,CAAC;QAClC,CAAC,CAAC,YAAY,IAAI,IAAI,KAAK,QAAQ,CAAC,CAAC;IAEvC,OAAO;QACL,KAAK;QACL,KAAK;QACL,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,KAAK;QACL,IAAI;QACJ,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;QACrD,MAAM;QACN,KAAK;QACL,OAAO;KACR,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAyB;IACzD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QACpE,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QACnE,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAEvE,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI;gBAAE,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;;gBAC1D,KAAK,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAC;YAChF,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBACxB,KAAK,CAAC,IAAI,CAAC,wBAAwB,KAAK,CAAC,WAAW,IAAI,EAAE,IAAI,CAAC,CAAC;YAClE,CAAC;iBAAM,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACnC,KAAK,CAAC,IAAI,CAAC,oEAAoE,CAAC,CAAC;YACnF,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,UAAU,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACzC,SAAS;QACX,CAAC;QAED,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YACzB,KAAK,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;QAC1D,CAAC;aAAM,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,KAAK,CAAC,IAAI,CACR,+CAA+C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,sBAAsB,CACxF,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC,YAAY,KAAK,CAAC,WAAW,IAAI,EAAE,yBAAyB,CAAC,CAAC;QAC3E,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzD,KAAK,CAAC,IAAI,CACR,YAAY,KAAK,CAAC,WAAW,IAAI,EAAE,gBAAgB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;gBACtE,6DAA6D,CAChE,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM;YAAE,KAAK,CAAC,IAAI,CAAC,oBAAoB,KAAK,EAAE,CAAC,CAAC;QAC1E,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK;YAAE,KAAK,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACvC,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,qCAAqC,CAAC,CAAC;IAC3D,CAAC;IACD,KAAK,CAAC,IAAI,CACR,MAAM,CAAC,OAAO;QACZ,CAAC,CAAC,mDAAmD;QACrD,CAAC,CAAC,+GAA+G,CACpH,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"agent-probe.js","sourceRoot":"","sources":["../src/agent-probe.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,qBAAqB,EACrB,YAAY,EACZ,IAAI,GAGL,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,mBAAmB,EACnB,YAAY,GAIb,MAAM,cAAc,CAAC;AAmEtB;;;;;;;GAOG;AACH,MAAM,WAAW,GAAG,IAAI,GAAG,CACxB,MAAM,CAAC,IAAI,CAAC,YAAY,CAAiB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,WAAW,CAAC,CAChG,CAAC;AACF,MAAM,UAAU,GAAG,IAAI,GAAG,CAAS,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC,CAAC;AAE/D;;;GAGG;AACH,MAAM,qBAAqB,GACzB,oHAAoH,CAAC;AAEvH,SAAS,UAAU,CAAC,SAAiB,EAAE,KAAa,EAAE,WAAoB;IACxE,OAAO;QACL,0BAA0B;QAC1B,EAAE;QACF,+DAA+D;QAC/D,uDAAuD;QACvD,EAAE;QACF,0DAA0D,SAAS,IAAI;QACvE,2DAA2D,KAAK,EAAE;QAClE,GAAG,CAAC,WAAW,KAAK,SAAS;YAC3B,CAAC,CAAC;gBACE,0CAA0C,WAAW,EAAE;gBACvD,iEAAiE;gBACjE,4DAA4D;gBAC5D,kEAAkE;gBAClE,kEAAkE;gBAClE,sDAAsD;aACvD;YACH,CAAC,CAAC,EAAE,CAAC;QACP,EAAE;QACF,uDAAuD;QACvD,EAAE;QACF,6DAA6D;QAC7D,GAAG,CAAC,WAAW,KAAK,SAAS;YAC3B,CAAC,CAAC,CAAC,4DAA4D,CAAC;YAChE,CAAC,CAAC,EAAE,CAAC;QACP,EAAE;QACF,8CAA8C;KAC/C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,yEAAyE;AACzE,SAAS,SAAS,CAAC,MAAc,EAAE,KAAa;IAC9C,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,MAAM,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IACtD,OAAO,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9D,CAAC;AAED,SAAS,eAAe,CAAC,MAAc;IACrC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,OAAO,KAAK,EAAE,IAAI,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1D,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;AACnB,CAAC;AAED,8DAA8D;AAC9D,SAAS,eAAe,CACtB,MAAwB;IAExB,OAAO;QACL,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE;QAC9C,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,CAAC,WAAW,EAAE;QAClD,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE;QACpD,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,CAAC,aAAa,EAAE;QACtD,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,CAAC,aAAa,EAAE;KACvD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAA2B;IAE3B,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,kBAAkB,CAAC;IAC9D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,CAAC,MAAM,mBAAmB,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC3F,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAEjE,2EAA2E;IAC3E,wEAAwE;IACxE,yEAAyE;IACzE,sDAAsD;IACtD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAGrB,CAAC;IACJ,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACxB,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAClD,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;QAClG,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,KAAK;YAAE,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;aAC7B,CAAC;YACJ,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE;gBAChB,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,KAAK,EAAE,CAAC,IAAI,CAAC;gBACb,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,GAAG,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC;aACtF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5D,+DAA+D;IAC/D,sEAAsE;IACtE,6DAA6D;IAC7D,MAAM,WAAW,GAAG,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,WAAW,SAAS,CAAC;IAEpF,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,QAAQ,CAAC;IAChD,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,KAAK,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;QACtE,GAAG,CAAC,WAAW,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,aAAa,CAAC,KAAK,CAAC,KAAK,KAAK,GAAG,CAAC,CAAC;QACvE,MAAM,OAAO,GAAmB,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC;QAC5F,MAAM,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1G,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS;QAAE,MAAM,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;IAE7D,OAAO;QACL,MAAM;QACN,YAAY;QACZ,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC;KAChD,CAAC;AACJ,CAAC;AAED;;wBAEwB;AACxB,SAAS,YAAY,CACnB,MAAmB,EACnB,KAAkB,EAClB,MAAc,EACd,GAAW;IAEX,OAAO,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;AACzG,CAAC;AAED;;wEAEwE;AACxE,SAAS,WAAW,CAAC,CAAS,EAAE,CAAS;IACvC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;AAC/B,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,IAAY,EACZ,KAAkB,EAClB,KAAe,EACf,KAAuB,EACvB,WAAwB,EACxB,WAA+B,EAC/B,YAAgC,EAChC,OAAuB;IAEvB,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,oBAAoB,KAAK,MAAM,CAAC;IAClD,MAAM,KAAK,GAAG,uBAAuB,KAAK,EAAE,CAAC;IAC7C,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;IAExD,sEAAsE;IACtE,6CAA6C;IAC7C,IAAI,UAA4C,CAAC;IACjD,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,YAAY,CAAC,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACnE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,KAAK;YACL,KAAK;YACL,KAAK;YACL,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC;YACvD,QAAQ,EAAE,CAAC,CAAC;YACZ,KAAK,EAAE,QAAQ;YACf,IAAI,EAAE,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;YACtD,kBAAkB,EAAE,KAAK;YACzB,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;YACrD,MAAM,EAAE,EAAE;YACV,KAAK,EAAE,CAAC,0CAA2C,KAAe,CAAC,OAAO,EAAE,CAAC;YAC7E,OAAO,EAAE,KAAK;SACf,CAAC;IACJ,CAAC;IACD,MAAM,qBAAqB,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC,CAAC;IAElE,wEAAwE;IACxE,2BAA2B;IAC3B,IAAI,KAAK,GAAiB,QAAQ,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC;QAC9D,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,KAAK,GAAG,IAAI,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB;IACnB,CAAC;IACD,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAEpD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzD,IAAI,KAAK,KAAK,QAAQ,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QACnD,MAAM,CAAC,IAAI,CAAC,UAAU,UAAU,EAAE,CAAC,CAAC;IACtC,CAAC;IAED,IAAI,IAAI,GAAiB,SAAS,CAAC;IACnC,MAAM,kBAAkB,GAAG,WAAW,KAAK,SAAS,IAAI,UAAU,CAAC,UAAU,EAAE,QAAQ,KAAK,IAAI,CAAC;IACjG,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,UAAU,CAAC,UAAU,EAAE,QAAQ,EAAE,CAAC;YACpC,qEAAqE;YACrE,mEAAmE;YACnE,8CAA8C;YAC9C,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;YACxG,MAAM,GAAG,GAAG,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;YACxG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;YACxC,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtB,MAAM,CAAC,IAAI,CACT,MAAM;oBACJ,CAAC,CAAC,uEAAuE;oBACzE,CAAC,CAAC,oDAAoD,CACzD,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,SAAS,GAAG,SAAS,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YACvD,IAAI,SAAS,KAAK,SAAS,IAAI,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;gBAChE,IAAI,GAAG,IAAI,CAAC;YACd,CAAC;iBAAM,CAAC;gBACN,IAAI,GAAG,QAAQ,CAAC;gBAChB,MAAM,CAAC,IAAI,CACT,SAAS,KAAK,SAAS;oBACrB,CAAC,CAAC,gGAAgG;oBAClG,CAAC,CAAC,SAAS,SAAS,EAAE,CACzB,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,wEAAwE;IACxE,uEAAuE;IACvE,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC,CAAC;IACnF,MAAM,KAAK,GAAG,eAAe,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CACrD,CAAC,IAAI,EAAE,EAAE,CACP,CAAC,aAAa,CAAC,IAAI,CACjB,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAC9D,CACJ,CAAC;IACF,IAAI,UAAU,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACxC,KAAK,CAAC,IAAI,CACR,0DAA0D,UAAU,CAAC,UAAU,GAAG,CACnF,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CACR,0BAA0B,UAAU,CAAC,QAAQ,KAAK,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,EAAE,CACxF,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,0EAA0E;IAC1E,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAClE,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAChE,MAAM,OAAO,GACX,UAAU,CAAC,QAAQ,KAAK,CAAC;QACzB,UAAU,CAAC,UAAU,KAAK,SAAS;QACnC,CAAC,CAAC,aAAa,IAAI,KAAK,KAAK,IAAI,CAAC;QAClC,CAAC,CAAC,YAAY,IAAI,IAAI,KAAK,QAAQ,CAAC,CAAC;IAEvC,OAAO;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC;QACvD,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,KAAK;QACL,IAAI;QACJ,kBAAkB;QAClB,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;QACrD,MAAM;QACN,KAAK;QACL,OAAO;KACR,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAyB;IACzD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QACpE,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QACnE,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACvE,KAAK,CAAC,IAAI,CACR,KAAK,CAAC,YAAY,KAAK,SAAS;YAC9B,CAAC,CAAC,kBAAkB,KAAK,CAAC,KAAK,EAAE;YACjC,CAAC,CAAC,kBAAkB,KAAK,CAAC,KAAK,gBAAgB,KAAK,CAAC,YAAY,EAAE,CACtE,CAAC;QAEF,MAAM,UAAU,GAAG,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,gBAAgB,CAAC;QAEnF,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI;gBAAE,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;;gBAC1D,KAAK,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAC;YAChF,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBACxB,KAAK,CAAC,IAAI,CAAC,aAAa,KAAK,CAAC,WAAW,IAAI,EAAE,OAAO,UAAU,GAAG,CAAC,CAAC;YACvE,CAAC;iBAAM,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACnC,KAAK,CAAC,IAAI,CAAC,oEAAoE,CAAC,CAAC;YACnF,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,UAAU,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACzC,SAAS;QACX,CAAC;QAED,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YACzB,KAAK,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;QAC1D,CAAC;aAAM,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,KAAK,CAAC,IAAI,CACR,+CAA+C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,sBAAsB,CACxF,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC,YAAY,KAAK,CAAC,WAAW,IAAI,EAAE,WAAW,UAAU,GAAG,CAAC,CAAC;QAC1E,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzD,KAAK,CAAC,IAAI,CACR,YAAY,KAAK,CAAC,WAAW,IAAI,EAAE,eAAe,UAAU,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;gBACtF,6DAA6D,CAChE,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM;YAAE,KAAK,CAAC,IAAI,CAAC,oBAAoB,KAAK,EAAE,CAAC,CAAC;QAC1E,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK;YAAE,KAAK,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACvC,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,qCAAqC,CAAC,CAAC;IAC3D,CAAC;IACD,KAAK,CAAC,IAAI,CACR,MAAM,CAAC,OAAO;QACZ,CAAC,CAAC,mDAAmD;QACrD,CAAC,CAAC,+GAA+G,CACpH,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/agent-runner.d.ts

@@ -1,9 +1,43 @@
 import type { AgentConfig, NightshiftConfig } from "./config.js";
+import type { AgentRole, PermitsContext } from "./permits.js";
+/** A Bash command a Claude spawn actually ran, observed from its stream-json `tool_use` block. */
+export interface TranscriptCommand {
+    command: string;
+    description?: string;
+}
+/** A command the CLI itself refused, observed from its stream-json permission events. */
+export interface TranscriptDenial {
+    command: string;
+    reason: string;
+    tool?: string;
+}
+/**
+ * What the runner observed a Claude spawn do, demultiplexed from its
+ * `--output-format stream-json` NDJSON stream. `observed: false` marks a
+ * stream that could not be demultiplexed (an older CLI ignoring the flag, a
+ * crash before the first event) — the raw-text fallback, not a failure.
+ */
+export interface AgentTranscript {
+    observed: boolean;
+    commands: TranscriptCommand[];
+    denials: TranscriptDenial[];
+    /**
+     * True when a line *after* the first was valid enough to keep the stream
+     * classified as NDJSON, but itself failed to parse and was skipped
+     * (fail-open, per spec). A skipped line could have been a `tool_use` or a
+     * denial — there is no way to know which — so this is the transcript's own
+     * admission that `commands`/`denials` may be missing an entry, and it must
+     * never be silently blessed as fully authoritative alongside `observed: true`.
+     */
+    corrupted?: boolean;
+}
 export interface CommandResult {
     exitCode: number;
     output: string;
     /** Set when the prompt could not be fully delivered to the process stdin. */
     inputError?: string;
+    /** Present only for a Claude spawn whose args requested stream-json output. */
+    transcript?: AgentTranscript;
 }
 export interface AgentInvocation {
     command: string;
@@ -27,13 +61,67 @@ export declare function runProcess(command: string, args: string[], options: {
     input?: string;
     shell: boolean;
     onOutput?: (chunk: string) => void;
+    /**
+     * Stdout-only chunks, separate from `onOutput`'s combined stdout+stderr
+     * stream. The NDJSON demultiplexer feeds from this instead: Claude's
+     * structured stream-json events are only ever written to stdout, while
+     * stderr carries human-readable warnings and diagnostics that are not
+     * JSON at all. Feeding those into the same line parser as the NDJSON
+     * stream would corrupt or invalidate it depending on arrival order — a
+     * stderr line arriving before the first stdout event would look like an
+     * unparseable first line and force the whole spawn to the raw-text
+     * fallback even though stdout was itself well-formed NDJSON.
+     */
+    onStdout?: (chunk: string) => void;
     env?: NodeJS.ProcessEnv;
 }): Promise<CommandResult>;
+/**
+ * Demultiplexes a whole captured stream-json string in one call — what
+ * fixture-replay tests exercise. `undefined` means the input did not parse as
+ * NDJSON at all (the raw-text fallback applies).
+ */
+export declare function demultiplexClaudeStreamJson(raw: string): {
+    output: string;
+    transcript: AgentTranscript;
+} | undefined;
 export declare const defaultAgentRunner: AgentRunner;
 export declare const defaultVerifyRunner: VerifyRunner;
 export declare function tail(output: string, limit?: number): string;
-/** Spawns a configured agent role with a prompt; shared by every brief spawner. */
-export declare function invokeAgent(runner: AgentRunner, agent: AgentConfig, prompt: string, cwd: string): Promise<CommandResult>;
+/**
+ * Names where a spawn's transcript is written and how its path is logged —
+ * one home for both, shared by every `invokeAgent` call site, so the write
+ * and its log line are not duplicated across each spawning command.
+ */
+export interface TranscriptSink {
+    root: string;
+    programId: string;
+    /** Names the JSONL file, e.g. "ws-02-implementer" or "probe-agent". */
+    label: string;
+    log: (line: string) => void;
+}
+/**
+ * Writes a spawn's transcript as JSONL under `build-logs/<programId>/` and
+ * logs the path — the one place this happens, shared by `invokeAgent` and
+ * the doctor probe (`agent-probe.ts`, which spawns through an already-derived
+ * invocation and so cannot go through `invokeAgent` itself). A no-op when the
+ * result carries no transcript at all (a non-Claude spawn, an operator-
+ * configured or operator-`--output-format` role — never asked to be
+ * observed).
+ */
+export declare function recordAgentTranscript(observe: TranscriptSink, role: string, result: CommandResult): Promise<void>;
+/**
+ * Spawns a configured agent role with a prompt; shared by every brief
+ * spawner. `permits` derives the posture for this role/agent/host before the
+ * process ever starts — an operator-authored permission flag in `agent.args`
+ * is spawned untouched (WS-01 SC-05); everything else gets the flags
+ * `src/permits.ts` derives from the role's fixed posture and the run's
+ * containment.
+ *
+ * `observe`, when given, writes the spawn's transcript (if one was observed)
+ * as JSONL under `build-logs/<programId>/` and logs the path — the one place
+ * this happens, rather than duplicated across every spawning call site.
+ */
+export declare function invokeAgent(runner: AgentRunner, agent: AgentConfig, prompt: string, cwd: string, permits: PermitsContext, role: AgentRole, observe?: TranscriptSink): Promise<CommandResult>;
 /**
  * The implementer: the `agent` block, or the environment fallback for hosts
  * that have no config file yet.

package/dist/agent-runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-runner.d.ts","sourceRoot":"","sources":["../src/agent-runner.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEjE,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,6EAA6E;IAC7E,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,OAAO,GAAG,UAAU,CAAC;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;CACpC;AAED,MAAM,MAAM,WAAW,GAAG,CAAC,UAAU,EAAE,eAAe,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;AAClF,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;AAMpF;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,GAAE,MAAM,CAAC,UAAwB,GACpC,MAAM,CAAC,UAAU,CAQnB;AAED,wBAAgB,UAAU,CACxB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,EAAE;IACP,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,OAAO,CAAC;IACf,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IACnC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,GACA,OAAO,CAAC,aAAa,CAAC,CA4CxB;AAED,eAAO,MAAM,kBAAkB,EAAE,WAqB9B,CAAC;AAEJ,eAAO,MAAM,mBAAmB,EAAE,YACa,CAAC;AAEhD,wBAAgB,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,SAAO,GAAG,MAAM,CAEzD;AAED,mFAAmF;AACnF,wBAAsB,WAAW,CAC/B,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,WAAW,EAClB,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,aAAa,CAAC,CAQxB;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,gBAAgB,GAAG,WAAW,GAAG,SAAS,CAO9E;AAED,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,WAAW,CAAC;IACnB,4DAA4D;IAC5D,mBAAmB,EAAE,OAAO,CAAC;CAC9B;AAED,kEAAkE;AAClE,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,gBAAgB,GACvB,qBAAqB,GAAG,SAAS,CAOnC;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,WAAW,CAAC;IACnB,0DAA0D;IAC1D,mBAAmB,EAAE,OAAO,CAAC;CAC9B;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,gBAAgB,GACvB,mBAAmB,GAAG,SAAS,CAOjC;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,gBAAgB,GACvB,WAAW,GAAG,SAAS,CAEzB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,gBAAgB,GACvB,WAAW,GAAG,SAAS,CAOzB;AAED,2EAA2E;AAC3E,wBAAgB,aAAa,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CAExD"}
+{"version":3,"file":"agent-runner.d.ts","sourceRoot":"","sources":["../src/agent-runner.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE9D,kGAAkG;AAClG,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,yFAAyF;AACzF,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAC5B;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,6EAA6E;IAC7E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+EAA+E;IAC/E,UAAU,CAAC,EAAE,eAAe,CAAC;CAC9B;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,OAAO,GAAG,UAAU,CAAC;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;CACpC;AAED,MAAM,MAAM,WAAW,GAAG,CAAC,UAAU,EAAE,eAAe,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;AAClF,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;AAMpF;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,GAAE,MAAM,CAAC,UAAwB,GACpC,MAAM,CAAC,UAAU,CAQnB;AAED,wBAAgB,UAAU,CACxB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,EAAE;IACP,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,OAAO,CAAC;IACf,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IACnC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IACnC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,GACA,OAAO,CAAC,aAAa,CAAC,CA+CxB;AAwRD;;;;GAIG;AACH,wBAAgB,2BAA2B,CACzC,GAAG,EAAE,MAAM,GACV;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,eAAe,CAAA;CAAE,GAAG,SAAS,CAI7D;AAED,eAAO,MAAM,kBAAkB,EAAE,WAiDhC,CAAC;AAEF,eAAO,MAAM,mBAAmB,EAAE,YACa,CAAC;AAEhD,wBAAgB,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,SAAO,GAAG,MAAM,CAEzD;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,uEAAuE;IACvE,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AAqBD;;;;;;;;GAQG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,cAAc,EACvB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,IAAI,CAAC,CAef;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,WAAW,EAClB,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,cAAc,EACvB,IAAI,EAAE,SAAS,EACf,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,aAAa,CAAC,CAWxB;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,gBAAgB,GAAG,WAAW,GAAG,SAAS,CAO9E;AAED,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,WAAW,CAAC;IACnB,4DAA4D;IAC5D,mBAAmB,EAAE,OAAO,CAAC;CAC9B;AAED,kEAAkE;AAClE,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,gBAAgB,GACvB,qBAAqB,GAAG,SAAS,CAOnC;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,WAAW,CAAC;IACnB,0DAA0D;IAC1D,mBAAmB,EAAE,OAAO,CAAC;CAC9B;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,gBAAgB,GACvB,mBAAmB,GAAG,SAAS,CAOjC;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,gBAAgB,GACvB,WAAW,GAAG,SAAS,CAEzB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,gBAAgB,GACvB,WAAW,GAAG,SAAS,CAOzB;AAED,2EAA2E;AAC3E,wBAAgB,aAAa,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CAExD"}