@with-logic/elwood 0.1.0 → 0.1.1

package/dist/core/trust/allowlist.d.ts

@@ -0,0 +1,56 @@
+/**
+ * The allowlisted startup trust prompts and the affirmative option each one
+ * accepts, kept apart from the matching logic in `prompts.ts` so the wording
+ * table can grow without crowding it.
+ * Implements PRD §5.1/§5.4/§5.5 (C-CLAUDE-10, C-CLAUDE-14, C-CLAUDE-21, C-CODEX-15).
+ */
+/**
+ * The allowlist. Wording verified against claude 2.1.205–2.1.268 and codex-cli 0.142.5.
+ * `workspace`/`directory` trust are the folder-trust gates; `skill`, `plugin`,
+ * and `mcp` cover the CLI's first-run trust prompts for loading third-party
+ * skills, plugins, and MCP servers under a full-trust launch.
+ */
+export declare const trustPromptAllowlist: readonly [{
+    readonly id: "workspace_trust";
+    readonly agent: "claude";
+    readonly headerPattern: RegExp;
+    readonly accept: RegExp;
+    readonly answerPolicy: "autotrust";
+}, {
+    readonly id: "skill_trust";
+    readonly agent: "claude";
+    readonly headerPattern: RegExp;
+    readonly accept: RegExp;
+    readonly answerPolicy: "autotrust";
+}, {
+    readonly id: "plugin_trust";
+    readonly agent: "claude";
+    readonly headerPattern: RegExp;
+    readonly accept: RegExp;
+    readonly answerPolicy: "autotrust";
+}, {
+    readonly id: "mcp_trust";
+    readonly agent: "claude";
+    readonly headerPattern: RegExp;
+    readonly accept: RegExp;
+    readonly answerPolicy: "autotrust";
+}, {
+    readonly id: "bypass_permissions";
+    readonly agent: "claude";
+    readonly headerPattern: RegExp;
+    readonly accept: RegExp;
+    readonly answerPolicy: "autotrust";
+}, {
+    readonly id: "workspace_trust";
+    readonly agent: "codex";
+    readonly headerPattern: RegExp;
+    readonly accept: RegExp;
+    readonly answerPolicy: "autotrust";
+}, {
+    readonly id: "hook_trust";
+    readonly agent: "codex";
+    readonly headerPattern: RegExp;
+    readonly accept: RegExp;
+    readonly answerPolicy: "always";
+}];
+//# sourceMappingURL=allowlist.d.ts.map

package/dist/core/trust/allowlist.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"allowlist.d.ts","sourceRoot":"","sources":["../../../src/core/trust/allowlist.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAcH;;;;;GAKG;AAKH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgEc,CAAC"}

package/dist/core/{trust-prompts.js → trust/allowlist.js}

@@ -1,24 +1,20 @@
 /**
- * Allowlist of known adapter startup trust prompts and how to answer them.
- * Implements PRD §5.1 and §5.5 (C-CLAUDE-10, C-CODEX-11, C-CLAUDE-14, C-CODEX-15).
- *
- * This is an EXPLICIT allowlist, not an open-ended matcher: each entry names one
- * concrete prompt by its on-screen text and a fixed affirmative outcome. A new
- * CLI prompt is trusted only by adding a deliberate entry here — Elwood never
- * blanket-answers "any first-run confirmation", which would silently bypass a
- * future CLI security gate for third-party code or config.
+ * The allowlisted startup trust prompts and the affirmative option each one
+ * accepts, kept apart from the matching logic in `prompts.ts` so the wording
+ * table can grow without crowding it.
+ * Implements PRD §5.1/§5.4/§5.5 (C-CLAUDE-10, C-CLAUDE-14, C-CLAUDE-21, C-CODEX-15).
  */
-import { nonOptionText } from "./terminal-options.js";
-// Affirmative option shapes. Each rejects decline words so "No, ..." never matches.
+// Affirmative option shapes. Each rejects decline words so "No, ..." never
+// matches. Prompts with a SPECIFIC affirmative (MCP, hook trust, bypass
+// acceptance) get their own matcher so a nearby dialog's generic "Yes" cannot
+// be selected for them.
 const notDecline = "(?!.*\\b(no|without|not|quit|cancel|deny|don't)\\b)";
 const yesOption = new RegExp(`^${notDecline}.*\\b(yes|trust|continue|proceed)\\b`, "i");
 const useMcpOption = new RegExp(`^${notDecline}.*\\buse this(?:.*\\bMCP)? server`, "i");
-// Codex hook trust's real affirmative is "Trust all and continue" / "Trust
-// hooks" — matched specifically so a nearby unrelated dialog's generic "Yes,
-// continue" (e.g. a credential prompt) can never be selected for hook trust.
 const trustHooksOption = new RegExp(`^${notDecline}.*\\btrust\\b.*\\b(hooks?|all)\\b`, "i");
+const acceptOption = new RegExp(`^${notDecline}.*\\byes\\b.*\\baccept\\b`, "i");
 /**
- * The allowlist. Wording verified against claude 2.1.205–2.1.252 and codex-cli 0.142.5.
+ * The allowlist. Wording verified against claude 2.1.205–2.1.268 and codex-cli 0.142.5.
  * `workspace`/`directory` trust are the folder-trust gates; `skill`, `plugin`,
  * and `mcp` cover the CLI's first-run trust prompts for loading third-party
  * skills, plugins, and MCP servers under a full-trust launch.
@@ -61,6 +57,16 @@ export const trustPromptAllowlist = [
         accept: useMcpOption,
         answerPolicy: "autotrust",
     },
+    {
+        // Claude's one-time bypassPermissions disclaimer: "WARNING: Claude Code
+        // running in Bypass Permissions mode", "Yes, I accept" / "No, exit"
+        // (C-CLAUDE-21). "running in" keeps the live footer from matching.
+        id: "bypass_permissions",
+        agent: "claude",
+        headerPattern: /running in Bypass Permissions mode/i,
+        accept: acceptOption,
+        answerPolicy: "autotrust",
+    },
     {
         // Codex's directory-trust gate keeps the stable `workspace_trust` label
         // (PRD §5.4) even though its wording differs from Claude's.
@@ -82,27 +88,4 @@ export const trustPromptAllowlist = [
         answerPolicy: "always",
     },
 ];
-/**
- * True when `spec`'s HEADER wording appears in `header` — the frame's NON-option
- * text as produced by `nonOptionText`. This is the ONE shared, option-aware
- * recognizer: the responder, the cursor navigator, and the screen-fact blocking
- * rules all go through it (each computes `nonOptionText` once per frame and
- * tests every spec against that), so a numbered or cursor-selectable option whose
- * label merely contains a trust phrase is never recognized as a prompt. Matching
- * joined non-option lines also keeps wrapped headers matchable (§5.1).
- */
-export function trustHeaderMatches(header, spec) {
-    return spec.headerPattern.test(header);
-}
-/** `trustHeaderMatches` over a raw frame, for callers that test a single spec. */
-export function trustPromptHeaderVisible(frame, spec) {
-    return trustHeaderMatches(nonOptionText(frame), spec);
-}
-/** Specs for one agent that stay UNANSWERED under the effective policy (block on the human). */
-export function blockingTrustSpecs(agent, autotrust) {
-    return trustPromptAllowlist.filter(
-    // An `answerPolicy: "always"` prompt (hook trust) is auto-handled, so it must
-    // NOT be classified as human-blocking. Others block only when autotrust is off.
-    (spec) => spec.agent === agent && spec.answerPolicy !== "always" && !autotrust);
-}
-//# sourceMappingURL=trust-prompts.js.map
+//# sourceMappingURL=allowlist.js.map

package/dist/core/trust/allowlist.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"allowlist.js","sourceRoot":"","sources":["../../../src/core/trust/allowlist.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,2EAA2E;AAC3E,wEAAwE;AACxE,8EAA8E;AAC9E,wBAAwB;AACxB,MAAM,UAAU,GAAG,qDAAqD,CAAC;AACzE,MAAM,SAAS,GAAG,IAAI,MAAM,CAAC,IAAI,UAAU,sCAAsC,EAAE,GAAG,CAAC,CAAC;AACxF,MAAM,YAAY,GAAG,IAAI,MAAM,CAAC,IAAI,UAAU,mCAAmC,EAAE,GAAG,CAAC,CAAC;AACxF,MAAM,gBAAgB,GAAG,IAAI,MAAM,CAAC,IAAI,UAAU,mCAAmC,EAAE,GAAG,CAAC,CAAC;AAC5F,MAAM,YAAY,GAAG,IAAI,MAAM,CAAC,IAAI,UAAU,2BAA2B,EAAE,GAAG,CAAC,CAAC;AAEhF;;;;;GAKG;AACH,8EAA8E;AAC9E,gFAAgF;AAChF,4EAA4E;AAC5E,yDAAyD;AACzD,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC;QACE,2EAA2E;QAC3E,0EAA0E;QAC1E,EAAE,EAAE,iBAAiB;QACrB,KAAK,EAAE,QAAQ;QACf,aAAa,EAAE,4DAA4D;QAC3E,MAAM,EAAE,SAAS;QACjB,YAAY,EAAE,WAAW;KAC1B;IACD;QACE,EAAE,EAAE,aAAa;QACjB,KAAK,EAAE,QAAQ;QACf,aAAa,EAAE,0EAA0E;QACzF,MAAM,EAAE,SAAS;QACjB,YAAY,EAAE,WAAW;KAC1B;IACD;QACE,EAAE,EAAE,cAAc;QAClB,KAAK,EAAE,QAAQ;QACf,aAAa,EAAE,mEAAmE;QAClF,MAAM,EAAE,SAAS;QACjB,YAAY,EAAE,WAAW;KAC1B;IACD;QACE,2EAA2E;QAC3E,2EAA2E;QAC3E,0DAA0D;QAC1D,EAAE,EAAE,WAAW;QACf,KAAK,EAAE,QAAQ;QACf,aAAa,EAAE,4DAA4D;QAC3E,MAAM,EAAE,YAAY;QACpB,YAAY,EAAE,WAAW;KAC1B;IACD;QACE,wEAAwE;QACxE,oEAAoE;QACpE,mEAAmE;QACnE,EAAE,EAAE,oBAAoB;QACxB,KAAK,EAAE,QAAQ;QACf,aAAa,EAAE,qCAAqC;QACpD,MAAM,EAAE,YAAY;QACpB,YAAY,EAAE,WAAW;KAC1B;IACD;QACE,wEAAwE;QACxE,4DAA4D;QAC5D,EAAE,EAAE,iBAAiB;QACrB,KAAK,EAAE,OAAO;QACd,aAAa,EAAE,8CAA8C;QAC7D,MAAM,EAAE,SAAS;QACjB,YAAY,EAAE,WAAW;KAC1B;IACD,+EAA+E;IAC/E,iFAAiF;IACjF;QACE,EAAE,EAAE,YAAY;QAChB,KAAK,EAAE,OAAO;QACd,aAAa,EAAE,oBAAoB;QACnC,0EAA0E;QAC1E,2EAA2E;QAC3E,MAAM,EAAE,gBAAgB;QACxB,YAAY,EAAE,QAAQ;KACvB;CAC4C,CAAC"}

package/dist/core/trust/prompts.d.ts

@@ -9,6 +9,8 @@
  * future CLI security gate for third-party code or config.
  */
 import type { ElwoodAgentKind } from "../activity/index.ts";
+import { trustPromptAllowlist } from "./allowlist.ts";
+export { trustPromptAllowlist } from "./allowlist.ts";
 /**
  * The fields common to every allowlisted trust prompt. The prompt and its answer
  * are BOTH matched within the same current frame: `headerPattern` identifies the
@@ -35,6 +37,8 @@ type TrustPromptBase = {
  * under the caller's full-trust posture; `"always"` prompts are answered
  * regardless of it (Elwood's own hook bridge, never third-party code).
  */
+/** The Claude trust-prompt ids: folder trust plus the CLI's first-run skill/plugin/MCP gates. */
+type ClaudeTrustPromptId = "workspace_trust" | "skill_trust" | "plugin_trust" | "mcp_trust" | "bypass_permissions";
 export type TrustAnswerPolicy = "always" | "autotrust";
 /**
  * One allowlisted trust prompt, as an agent+id-DISCRIMINATED union so that (a) a
@@ -60,51 +64,6 @@ export type TrustPromptSpec = ({
     /** Answered regardless of `autotrust`: Elwood's own hook bridge (never third-party code). */
     readonly answerPolicy: "always";
 } & TrustPromptBase);
-/** The Claude trust-prompt ids: folder trust plus the CLI's first-run skill/plugin/MCP gates. */
-type ClaudeTrustPromptId = "workspace_trust" | "skill_trust" | "plugin_trust" | "mcp_trust";
-/**
- * The allowlist. Wording verified against claude 2.1.205–2.1.252 and codex-cli 0.142.5.
- * `workspace`/`directory` trust are the folder-trust gates; `skill`, `plugin`,
- * and `mcp` cover the CLI's first-run trust prompts for loading third-party
- * skills, plugins, and MCP servers under a full-trust launch.
- */
-export declare const trustPromptAllowlist: readonly [{
-    readonly id: "workspace_trust";
-    readonly agent: "claude";
-    readonly headerPattern: RegExp;
-    readonly accept: RegExp;
-    readonly answerPolicy: "autotrust";
-}, {
-    readonly id: "skill_trust";
-    readonly agent: "claude";
-    readonly headerPattern: RegExp;
-    readonly accept: RegExp;
-    readonly answerPolicy: "autotrust";
-}, {
-    readonly id: "plugin_trust";
-    readonly agent: "claude";
-    readonly headerPattern: RegExp;
-    readonly accept: RegExp;
-    readonly answerPolicy: "autotrust";
-}, {
-    readonly id: "mcp_trust";
-    readonly agent: "claude";
-    readonly headerPattern: RegExp;
-    readonly accept: RegExp;
-    readonly answerPolicy: "autotrust";
-}, {
-    readonly id: "workspace_trust";
-    readonly agent: "codex";
-    readonly headerPattern: RegExp;
-    readonly accept: RegExp;
-    readonly answerPolicy: "autotrust";
-}, {
-    readonly id: "hook_trust";
-    readonly agent: "codex";
-    readonly headerPattern: RegExp;
-    readonly accept: RegExp;
-    readonly answerPolicy: "always";
-}];
 /**
  * True when `spec`'s HEADER wording appears in `header` — the frame's NON-option
  * text as produced by `nonOptionText`. This is the ONE shared, option-aware
@@ -131,5 +90,4 @@ export type TrustPromptIdFor<A extends ElwoodAgentKind> = Extract<(typeof trustP
 }>["id"];
 /** Specs for one agent that stay UNANSWERED under the effective policy (block on the human). */
 export declare function blockingTrustSpecs(agent: ElwoodAgentKind, autotrust: boolean): readonly TrustPromptSpec[];
-export {};
 //# sourceMappingURL=prompts.d.ts.map

package/dist/core/trust/prompts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prompts.d.ts","sourceRoot":"","sources":["../../../src/core/trust/prompts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAG5D;;;;;;;;;GASG;AACH,KAAK,eAAe,GAAG;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,4FAA4F;IAC5F,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,WAAW,CAAC;AAEvD;;;;;;;;;GASG;AACH,MAAM,MAAM,eAAe,GACvB,CAAC;IACC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,QAAQ,CAAC,EAAE,EAAE,mBAAmB,CAAC;IACjC,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC;CACpC,GAAG,eAAe,CAAC,GACpB,CAAC;IACC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,EAAE,EAAE,iBAAiB,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC;CACpC,GAAG,eAAe,CAAC,GACpB,CAAC;IACC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,EAAE,EAAE,YAAY,CAAC;IAC1B,6FAA6F;IAC7F,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC;CACjC,GAAG,eAAe,CAAC,CAAC;AAEzB,iGAAiG;AACjG,KAAK,mBAAmB,GAAG,iBAAiB,GAAG,aAAa,GAAG,cAAc,GAAG,WAAW,CAAC;AAW5F;;;;;GAKG;AAKH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAsDc,CAAC;AAEhD;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,GAAG,OAAO,CAEjF;AAED,kFAAkF;AAClF,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,GAAG,OAAO,CAEtF;AAED;;;;;;GAMG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC;AAExE,sGAAsG;AACtG,MAAM,MAAM,gBAAgB,CAAC,CAAC,SAAS,eAAe,IAAI,OAAO,CAC/D,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,EACrC;IAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAA;CAAE,CACtB,CAAC,IAAI,CAAC,CAAC;AAER,gGAAgG;AAChG,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,eAAe,EACtB,SAAS,EAAE,OAAO,GACjB,SAAS,eAAe,EAAE,CAM5B"}
+{"version":3,"file":"prompts.d.ts","sourceRoot":"","sources":["../../../src/core/trust/prompts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAE5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAEtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAEtD;;;;;;;;;GASG;AACH,KAAK,eAAe,GAAG;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,4FAA4F;IAC5F,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF;;;;GAIG;AACH,iGAAiG;AACjG,KAAK,mBAAmB,GACpB,iBAAiB,GACjB,aAAa,GACb,cAAc,GACd,WAAW,GACX,oBAAoB,CAAC;AAEzB,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,WAAW,CAAC;AAEvD;;;;;;;;;GASG;AACH,MAAM,MAAM,eAAe,GACvB,CAAC;IACC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,QAAQ,CAAC,EAAE,EAAE,mBAAmB,CAAC;IACjC,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC;CACpC,GAAG,eAAe,CAAC,GACpB,CAAC;IACC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,EAAE,EAAE,iBAAiB,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC;CACpC,GAAG,eAAe,CAAC,GACpB,CAAC;IACC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,EAAE,EAAE,YAAY,CAAC;IAC1B,6FAA6F;IAC7F,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC;CACjC,GAAG,eAAe,CAAC,CAAC;AAEzB;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,GAAG,OAAO,CAEjF;AAED,kFAAkF;AAClF,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,GAAG,OAAO,CAEtF;AAED;;;;;;GAMG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC;AAExE,sGAAsG;AACtG,MAAM,MAAM,gBAAgB,CAAC,CAAC,SAAS,eAAe,IAAI,OAAO,CAC/D,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,EACrC;IAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAA;CAAE,CACtB,CAAC,IAAI,CAAC,CAAC;AAER,gGAAgG;AAChG,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,eAAe,EACtB,SAAS,EAAE,OAAO,GACjB,SAAS,eAAe,EAAE,CAM5B"}

package/dist/core/trust/prompts.js

@@ -9,79 +9,8 @@
  * future CLI security gate for third-party code or config.
  */
 import { nonOptionText } from "../terminal-options.js";
-// Affirmative option shapes. Each rejects decline words so "No, ..." never matches.
-const notDecline = "(?!.*\\b(no|without|not|quit|cancel|deny|don't)\\b)";
-const yesOption = new RegExp(`^${notDecline}.*\\b(yes|trust|continue|proceed)\\b`, "i");
-const useMcpOption = new RegExp(`^${notDecline}.*\\buse this(?:.*\\bMCP)? server`, "i");
-// Codex hook trust's real affirmative is "Trust all and continue" / "Trust
-// hooks" — matched specifically so a nearby unrelated dialog's generic "Yes,
-// continue" (e.g. a credential prompt) can never be selected for hook trust.
-const trustHooksOption = new RegExp(`^${notDecline}.*\\btrust\\b.*\\b(hooks?|all)\\b`, "i");
-/**
- * The allowlist. Wording verified against claude 2.1.205–2.1.252 and codex-cli 0.142.5.
- * `workspace`/`directory` trust are the folder-trust gates; `skill`, `plugin`,
- * and `mcp` cover the CLI's first-run trust prompts for loading third-party
- * skills, plugins, and MCP servers under a full-trust launch.
- */
-// Each `headerPattern` matches the prompt's QUESTION/HEADER wording — never a
-// phrase that lives only in an affirmative option — so recognition anchors on a
-// header line (matched via `trustHeaderMatches` over the frame's non-option
-// text), which a hostile option cannot spoof (PRD §5.1).
-export const trustPromptAllowlist = [
-    {
-        // Header renders as "Do you trust this folder?" or "Quick safety check: Is
-        // this a project you created or one you trust?" (claude 2.1.205/2.1.206).
-        id: "workspace_trust",
-        agent: "claude",
-        headerPattern: /do you trust this folder|project you .*\bor one you trust/i,
-        accept: yesOption,
-        answerPolicy: "autotrust",
-    },
-    {
-        id: "skill_trust",
-        agent: "claude",
-        headerPattern: /do you (?:want to )?(?:trust|load) (?:this|the) skill|load this skill\?/i,
-        accept: yesOption,
-        answerPolicy: "autotrust",
-    },
-    {
-        id: "plugin_trust",
-        agent: "claude",
-        headerPattern: /do you (?:want to )?trust (?:this|the) plugin|trust the plugin\?/i,
-        accept: yesOption,
-        answerPolicy: "autotrust",
-    },
-    {
-        // Header "New MCP server found in this project"; the affirmative option is
-        // "Use this MCP server" (no yes/trust/continue word), needing a per-prompt
-        // accept — the generic yes-matcher would leave it wedged.
-        id: "mcp_trust",
-        agent: "claude",
-        headerPattern: /New MCP server found|do you trust (?:this|the) MCP server/i,
-        accept: useMcpOption,
-        answerPolicy: "autotrust",
-    },
-    {
-        // Codex's directory-trust gate keeps the stable `workspace_trust` label
-        // (PRD §5.4) even though its wording differs from Claude's.
-        id: "workspace_trust",
-        agent: "codex",
-        headerPattern: /Do you trust the contents of this directory/i,
-        accept: yesOption,
-        answerPolicy: "autotrust",
-    },
-    // Hook trust is Elwood's own integration, required for the session to work, so
-    // it is always answered (not gated on autotrust) — see `answerPolicy: "always"`.
-    {
-        id: "hook_trust",
-        agent: "codex",
-        headerPattern: /Hooks need review/i,
-        // Specific to hook trust's own option ("Trust all and continue"), never a
-        // generic "Yes" that could belong to a different dialog in the same frame.
-        accept: trustHooksOption,
-        answerPolicy: "always",
-    },
-];
+import { trustPromptAllowlist } from "./allowlist.js";
+export { trustPromptAllowlist } from "./allowlist.js";
 /**
  * True when `spec`'s HEADER wording appears in `header` — the frame's NON-option
  * text as produced by `nonOptionText`. This is the ONE shared, option-aware

package/dist/core/trust/prompts.js.map

@@ -1 +1 @@
-{"version":3,"file":"prompts.js","sourceRoot":"","sources":["../../../src/core/trust/prompts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AA8DvD,oFAAoF;AACpF,MAAM,UAAU,GAAG,qDAAqD,CAAC;AACzE,MAAM,SAAS,GAAG,IAAI,MAAM,CAAC,IAAI,UAAU,sCAAsC,EAAE,GAAG,CAAC,CAAC;AACxF,MAAM,YAAY,GAAG,IAAI,MAAM,CAAC,IAAI,UAAU,mCAAmC,EAAE,GAAG,CAAC,CAAC;AACxF,2EAA2E;AAC3E,6EAA6E;AAC7E,6EAA6E;AAC7E,MAAM,gBAAgB,GAAG,IAAI,MAAM,CAAC,IAAI,UAAU,mCAAmC,EAAE,GAAG,CAAC,CAAC;AAE5F;;;;;GAKG;AACH,8EAA8E;AAC9E,gFAAgF;AAChF,4EAA4E;AAC5E,yDAAyD;AACzD,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC;QACE,2EAA2E;QAC3E,0EAA0E;QAC1E,EAAE,EAAE,iBAAiB;QACrB,KAAK,EAAE,QAAQ;QACf,aAAa,EAAE,4DAA4D;QAC3E,MAAM,EAAE,SAAS;QACjB,YAAY,EAAE,WAAW;KAC1B;IACD;QACE,EAAE,EAAE,aAAa;QACjB,KAAK,EAAE,QAAQ;QACf,aAAa,EAAE,0EAA0E;QACzF,MAAM,EAAE,SAAS;QACjB,YAAY,EAAE,WAAW;KAC1B;IACD;QACE,EAAE,EAAE,cAAc;QAClB,KAAK,EAAE,QAAQ;QACf,aAAa,EAAE,mEAAmE;QAClF,MAAM,EAAE,SAAS;QACjB,YAAY,EAAE,WAAW;KAC1B;IACD;QACE,2EAA2E;QAC3E,2EAA2E;QAC3E,0DAA0D;QAC1D,EAAE,EAAE,WAAW;QACf,KAAK,EAAE,QAAQ;QACf,aAAa,EAAE,4DAA4D;QAC3E,MAAM,EAAE,YAAY;QACpB,YAAY,EAAE,WAAW;KAC1B;IACD;QACE,wEAAwE;QACxE,4DAA4D;QAC5D,EAAE,EAAE,iBAAiB;QACrB,KAAK,EAAE,OAAO;QACd,aAAa,EAAE,8CAA8C;QAC7D,MAAM,EAAE,SAAS;QACjB,YAAY,EAAE,WAAW;KAC1B;IACD,+EAA+E;IAC/E,iFAAiF;IACjF;QACE,EAAE,EAAE,YAAY;QAChB,KAAK,EAAE,OAAO;QACd,aAAa,EAAE,oBAAoB;QACnC,0EAA0E;QAC1E,2EAA2E;QAC3E,MAAM,EAAE,gBAAgB;QACxB,YAAY,EAAE,QAAQ;KACvB;CAC4C,CAAC;AAEhD;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAc,EAAE,IAAqB;IACtE,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACzC,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,wBAAwB,CAAC,KAAa,EAAE,IAAqB;IAC3E,OAAO,kBAAkB,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;AACxD,CAAC;AAiBD,gGAAgG;AAChG,MAAM,UAAU,kBAAkB,CAChC,KAAsB,EACtB,SAAkB;IAElB,OAAO,oBAAoB,CAAC,MAAM;IAChC,8EAA8E;IAC9E,gFAAgF;IAChF,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,KAAK,IAAI,IAAI,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,SAAS,CAC/E,CAAC;AACJ,CAAC"}
+{"version":3,"file":"prompts.js","sourceRoot":"","sources":["../../../src/core/trust/prompts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAEtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAmEtD;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAc,EAAE,IAAqB;IACtE,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACzC,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,wBAAwB,CAAC,KAAa,EAAE,IAAqB;IAC3E,OAAO,kBAAkB,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;AACxD,CAAC;AAiBD,gGAAgG;AAChG,MAAM,UAAU,kBAAkB,CAChC,KAAsB,EACtB,SAAkB;IAElB,OAAO,oBAAoB,CAAC,MAAM;IAChC,8EAA8E;IAC9E,gFAAgF;IAChF,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,KAAK,IAAI,IAAI,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,SAAS,CAC/E,CAAC;AACJ,CAAC"}

package/dist/core/trust/responder.d.ts

@@ -45,4 +45,6 @@ export declare class TrustPromptResponder<A extends ElwoodAgentKind> {
     /** `frame` MUST be the CURRENT rendered screen, not an accumulated buffer. */
     handle(frame: string, write: (input: string) => TrustWriteResult, readFrame?: () => string): TrustPromptResult<A>;
 }
+/** Whether any allowlisted trust prompt for `agent` is showing its header in `text`. */
+export declare function trustPromptVisible(text: string, agent: ElwoodAgentKind): boolean;
 //# sourceMappingURL=responder.d.ts.map

package/dist/core/trust/responder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"responder.d.ts","sourceRoot":"","sources":["../../../src/core/trust/responder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAQ5D,OAAO,EACL,KAAK,gBAAgB,EAItB,MAAM,cAAc,CAAC;AAQtB,+EAA+E;AAC/E,MAAM,MAAM,qBAAqB,CAAC,CAAC,SAAS,eAAe,GAAG,eAAe,IAAI;IAC/E,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAEpD;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,CAAC,CAAC,SAAS,eAAe,GAAG,eAAe,IACrE;IACE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,qBAAqB,CAAC,CAAC,CAAC,CAAC;IAG9C,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;CACjC,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAA;CAAE,GACzE,SAAS,CAAC;AAEd,qBAAa,oBAAoB,CAAC,CAAC,SAAS,eAAe;IAGzD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAU;IACpC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA8B;IACpD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAkC;IAI1D,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAkC;gBAEtD,KAAK,EAAE,CAAC,EAAE,SAAS,UAAQ;IAKvC,8EAA8E;IAC9E,MAAM,CACJ,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,gBAAgB,EAC1C,SAAS,CAAC,EAAE,MAAM,MAAM,GACvB,iBAAiB,CAAC,CAAC,CAAC;CA0CxB"}
+{"version":3,"file":"responder.d.ts","sourceRoot":"","sources":["../../../src/core/trust/responder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAQ5D,OAAO,EACL,KAAK,gBAAgB,EAItB,MAAM,cAAc,CAAC;AAQtB,+EAA+E;AAC/E,MAAM,MAAM,qBAAqB,CAAC,CAAC,SAAS,eAAe,GAAG,eAAe,IAAI;IAC/E,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAEpD;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,CAAC,CAAC,SAAS,eAAe,GAAG,eAAe,IACrE;IACE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,qBAAqB,CAAC,CAAC,CAAC,CAAC;IAG9C,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;CACjC,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAA;CAAE,GACzE,SAAS,CAAC;AAEd,qBAAa,oBAAoB,CAAC,CAAC,SAAS,eAAe;IAGzD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAU;IACpC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA8B;IACpD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAkC;IAI1D,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAkC;gBAEtD,KAAK,EAAE,CAAC,EAAE,SAAS,UAAQ;IAKvC,8EAA8E;IAC9E,MAAM,CACJ,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,gBAAgB,EAC1C,SAAS,CAAC,EAAE,MAAM,MAAM,GACvB,iBAAiB,CAAC,CAAC,CAAC;CA0CxB;AAuDD,wFAAwF;AACxF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAIhF"}

package/dist/core/trust/responder.js

@@ -116,4 +116,8 @@ async function waitForCursorProgress(spec, priorOffset, readFrame) {
     }
     return "retry";
 }
+/** Whether any allowlisted trust prompt for `agent` is showing its header in `text`. */
+export function trustPromptVisible(text, agent) {
+    return trustPromptAllowlist.some((spec) => spec.agent === agent && trustPromptHeaderVisible(text, spec));
+}
 //# sourceMappingURL=responder.js.map

package/dist/core/trust/responder.js.map

@@ -1 +1 @@
-{"version":3,"file":"responder.js","sourceRoot":"","sources":["../../../src/core/trust/responder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACpC,OAAO,EACL,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAEL,kBAAkB,EAClB,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,cAAc,CAAC;AAKtB,MAAM,aAAa,GAAG,GAAG,CAAC;AAC1B,MAAM,yBAAyB,GAAG,KAAK,CAAC;AAgCxC,MAAM,OAAO,oBAAoB;IAC/B,6EAA6E;IAC7E,uEAAuE;IACtD,SAAS,CAAU;IACnB,KAAK,CAA8B;IACnC,OAAO,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC1D,yEAAyE;IACzE,6EAA6E;IAC7E,2DAA2D;IAC1C,eAAe,GAAG,IAAI,GAAG,EAAuB,CAAC;IAElE,YAAY,KAAQ,EAAE,SAAS,GAAG,KAAK;QACrC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,KAAK,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;IAC3E,CAAC;IAED,8EAA8E;IAC9E,MAAM,CACJ,KAAa,EACb,KAA0C,EAC1C,SAAwB;QAExB,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QACpC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,MAAM,EAAE,GAAG,IAAI,CAAC,EAAyB,CAAC;YAC1C,qEAAqE;YACrE,0EAA0E;YAC1E,sBAAsB;YACtB,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,YAAY,KAAK,QAAQ,CAAC;gBAAE,SAAS;YAClE,2EAA2E;YAC3E,2EAA2E;YAC3E,0EAA0E;YAC1E,mBAAmB;YACnB,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC;gBAAE,SAAS;YACxE,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;YACzC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;YAC9E,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,uEAAuE;gBACvE,gEAAgE;gBAChE,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;oBAAE,SAAS;gBAC3C,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC7B,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;YAChD,CAAC;YACD,+EAA+E;YAC/E,2EAA2E;YAC3E,6EAA6E;YAC7E,+EAA+E;YAC/E,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACrB,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;YAClC,MAAM,SAAS,GACb,MAAM,CAAC,KAAK,KAAK,QAAQ;gBACvB,CAAC,CAAC,SAAS,KAAK,SAAS;oBACvB,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;oBAClF,CAAC,CAAC,oBAAoB,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC;gBACvD,CAAC,CAAC,eAAe,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;YACvD,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBACjD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACxB,MAAM,KAAK,CAAC;YACd,CAAC,CAAC,CAAC;YACH,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC;QAC1E,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;CACF;AAED,kFAAkF;AAClF,KAAK,UAAU,eAAe,CAC5B,IAAuB,EACvB,KAA0C;IAE1C,KAAK,MAAM,GAAG,IAAI,IAAI;QAAE,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;AAC3C,CAAC;AAED,gGAAgG;AAChG,KAAK,UAAU,oBAAoB,CACjC,IAAsB,EACtB,aAAqB,EACrB,KAA0C,EAC1C,SAAuB;IAEvB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,yBAAyB,CAAC;IACxD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,IAAI,CAAC,wBAAwB,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1F,IAAI,MAAM,EAAE,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC/B,MAAM,KAAK,CAAC,aAAa,CAAC,CAAC;YAC3B,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC;QACrF,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;QACjB,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC7E,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO;IACrC,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,sCAAsC,aAAa,IAAI,CAAC,CAAC;AAC3E,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,IAAsB,EACtB,WAAmB,EACnB,SAAuB;IAEvB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,CAAC;IAC5C,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,MAAM,KAAK,CAAC,EAAE,CAAC,CAAC;QAChB,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;QAC1B,IAAI,CAAC,wBAAwB,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;YAC3C,IAAI,WAAW,KAAK,CAAC;gBAAE,OAAO,SAAS,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACzF,IAAI,MAAM,EAAE,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW;YAAE,OAAO,OAAO,CAAC;IAClF,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"responder.js","sourceRoot":"","sources":["../../../src/core/trust/responder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACpC,OAAO,EACL,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAEL,kBAAkB,EAClB,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,cAAc,CAAC;AAKtB,MAAM,aAAa,GAAG,GAAG,CAAC;AAC1B,MAAM,yBAAyB,GAAG,KAAK,CAAC;AAgCxC,MAAM,OAAO,oBAAoB;IAC/B,6EAA6E;IAC7E,uEAAuE;IACtD,SAAS,CAAU;IACnB,KAAK,CAA8B;IACnC,OAAO,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC1D,yEAAyE;IACzE,6EAA6E;IAC7E,2DAA2D;IAC1C,eAAe,GAAG,IAAI,GAAG,EAAuB,CAAC;IAElE,YAAY,KAAQ,EAAE,SAAS,GAAG,KAAK;QACrC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,KAAK,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;IAC3E,CAAC;IAED,8EAA8E;IAC9E,MAAM,CACJ,KAAa,EACb,KAA0C,EAC1C,SAAwB;QAExB,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QACpC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,MAAM,EAAE,GAAG,IAAI,CAAC,EAAyB,CAAC;YAC1C,qEAAqE;YACrE,0EAA0E;YAC1E,sBAAsB;YACtB,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,YAAY,KAAK,QAAQ,CAAC;gBAAE,SAAS;YAClE,2EAA2E;YAC3E,2EAA2E;YAC3E,0EAA0E;YAC1E,mBAAmB;YACnB,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC;gBAAE,SAAS;YACxE,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;YACzC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;YAC9E,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,uEAAuE;gBACvE,gEAAgE;gBAChE,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;oBAAE,SAAS;gBAC3C,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC7B,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;YAChD,CAAC;YACD,+EAA+E;YAC/E,2EAA2E;YAC3E,6EAA6E;YAC7E,+EAA+E;YAC/E,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACrB,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;YAClC,MAAM,SAAS,GACb,MAAM,CAAC,KAAK,KAAK,QAAQ;gBACvB,CAAC,CAAC,SAAS,KAAK,SAAS;oBACvB,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;oBAClF,CAAC,CAAC,oBAAoB,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC;gBACvD,CAAC,CAAC,eAAe,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;YACvD,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBACjD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACxB,MAAM,KAAK,CAAC;YACd,CAAC,CAAC,CAAC;YACH,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC;QAC1E,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;CACF;AAED,kFAAkF;AAClF,KAAK,UAAU,eAAe,CAC5B,IAAuB,EACvB,KAA0C;IAE1C,KAAK,MAAM,GAAG,IAAI,IAAI;QAAE,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;AAC3C,CAAC;AAED,gGAAgG;AAChG,KAAK,UAAU,oBAAoB,CACjC,IAAsB,EACtB,aAAqB,EACrB,KAA0C,EAC1C,SAAuB;IAEvB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,yBAAyB,CAAC;IACxD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,IAAI,CAAC,wBAAwB,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1F,IAAI,MAAM,EAAE,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC/B,MAAM,KAAK,CAAC,aAAa,CAAC,CAAC;YAC3B,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC;QACrF,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;QACjB,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC7E,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO;IACrC,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,sCAAsC,aAAa,IAAI,CAAC,CAAC;AAC3E,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,IAAsB,EACtB,WAAmB,EACnB,SAAuB;IAEvB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,CAAC;IAC5C,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,MAAM,KAAK,CAAC,EAAE,CAAC,CAAC;QAChB,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;QAC1B,IAAI,CAAC,wBAAwB,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;YAC3C,IAAI,WAAW,KAAK,CAAC;gBAAE,OAAO,SAAS,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACzF,IAAI,MAAM,EAAE,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW;YAAE,OAAO,OAAO,CAAC;IAClF,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,KAAsB;IACrE,OAAO,oBAAoB,CAAC,IAAI,CAC9B,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,KAAK,IAAI,wBAAwB,CAAC,IAAI,EAAE,IAAI,CAAC,CACvE,CAAC;AACJ,CAAC"}

package/dist/core/types.d.ts

@@ -42,6 +42,8 @@ export type StartClaudeOptions = {
     readonly disallowedTools?: readonly ClaudeToolRule[];
     readonly tools?: readonly ClaudeToolRule[];
     readonly settingsOverrides?: ClaudeSettingsOverrides;
+    /** Agent-neutral "never ask": expands to `permissionMode: "bypassPermissions"` (C-API-54). */
+    readonly highTrust?: boolean;
     readonly autoupdate?: boolean;
     readonly autotrust?: boolean;
     readonly hookTimeoutMs?: number;
@@ -58,6 +60,7 @@ export type ResumeClaudeOptions = {
     readonly allowedTools?: readonly ClaudeToolRule[];
     readonly disallowedTools?: readonly ClaudeToolRule[];
     readonly tools?: readonly ClaudeToolRule[];
+    readonly highTrust?: boolean;
     readonly autoupdate?: boolean;
     readonly autotrust?: boolean;
     readonly hookTimeoutMs?: number;

package/dist/core/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/core/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EACV,eAAe,EACf,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,EACpB,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAE9D,YAAY,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,CAAC;AAExD,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,wEAAwE;AACxE,MAAM,MAAM,oBAAoB,GAC5B,gBAAgB,GAChB,eAAe,GACf,iBAAiB,GACjB,uBAAuB,GACvB,qBAAqB,GACrB,kBAAkB,GAClB,uBAAuB,GACvB,yBAAyB,GACzB,iBAAiB,GACjB,gBAAgB,GAChB,gBAAgB,GAChB,oBAAoB,CAAC;AAEzB,+EAA+E;AAC/E,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IACnC,QAAQ,CAAC,EAAE,EAAE,mBAAmB,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,CAAC,MAAM,EAAE,mBAAmB,KAAK,OAAO,CAAC;AACnE,MAAM,MAAM,aAAa,GAAG,CAAC,KAAK,EAAE,mBAAmB,KAAK,OAAO,CAAC;AAEpE,MAAM,MAAM,oBAAoB,GAC5B,SAAS,GACT,aAAa,GACb,MAAM,GACN,MAAM,GACN,SAAS,GACT,mBAAmB,CAAC;AAExB,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC;AACpC,MAAM,MAAM,uBAAuB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAExE,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,kBAAkB,CAAC;IACpC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,eAAe,CAAC,EAAE,qBAAqB,CAAC;IACjD,QAAQ,CAAC,cAAc,CAAC,EAAE,oBAAoB,CAAC;IAC/C,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;IAClD,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;IACrD,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;IAC3C,QAAQ,CAAC,iBAAiB,CAAC,EAAE,uBAAuB,CAAC;IACrD,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;CACvC,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,kBAAkB,CAAC;IACpC,QAAQ,CAAC,WAAW,CAAC,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,eAAe,CAAC,EAAE,qBAAqB,CAAC;IACjD,QAAQ,CAAC,cAAc,CAAC,EAAE,oBAAoB,CAAC;IAC/C,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;IAClD,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;IACrD,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;IAC3C,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;CACvC,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,aAAa,EAAE,mBAAmB,GAAG,kBAAkB,GAAG,SAAS,CAAC;IAC7E,QAAQ,CAAC,QAAQ,EACb,SAAS,GACT,eAAe,GACf,eAAe,GACf,kBAAkB,GAClB,cAAc,CAAC;IACnB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEF,+EAA+E;AAC/E,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,CAAC,eAAe,EAAE;QAAE,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACtF,QAAQ,CAAC,eAAe,EAAE;QACxB,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;QACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF,QAAQ,CAAC,MAAM,EAAE;QACf,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;QACjC,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;KACtC,CAAC;IACF,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC;IACvC,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC;IACrC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG,MAAM,oBAAoB,CAAC;AAE/D,gGAAgG;AAChG,MAAM,MAAM,cAAc,GAAG,oBAAoB,GAAG;IAClD,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;CAChC,GAAG;IACF,QAAQ,EAAE,CAAC,IAAI,QAAQ,mBAAmB,EAAE,GAAG,CAAC,SAAS,QAAQ,MAAM,CAAC,EAAE,GACtE,CAAC,SAAS,mBAAmB,GAC3B,kBAAkB,CAAC,CAAC,CAAC,GACrB,KAAK,GACP,KAAK;CACV,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG,MAAM,cAAc,CAAC;AAEnD,MAAM,MAAM,kBAAkB,CAAC,CAAC,SAAS,eAAe,IAAI,CAC1D,KAAK,EAAE,cAAc,CAAC,CAAC,CAAC,KACrB,CAAC,SAAS,QAAQ,MAAM,CAAC,EAAE,GAC5B,CAAC,SAAS,mBAAmB,GAC3B,mBAAmB,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,GACxD,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC,GAC9C,IAAI,CAAC;AAET,kFAAkF;AAClF,MAAM,MAAM,cAAc,GAAG,cAAc,CAAC;AAC5C,mFAAmF;AACnF,MAAM,MAAM,eAAe,GAAG,eAAe,CAAC;AAC9C,sFAAsF;AACtF,MAAM,MAAM,kBAAkB,CAAC,CAAC,SAAS,eAAe,IAAI,kBAAkB,CAAC,CAAC,CAAC,CAAC;AAElF,MAAM,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/core/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EACV,eAAe,EACf,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,EACpB,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAE9D,YAAY,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,CAAC;AAExD,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,wEAAwE;AACxE,MAAM,MAAM,oBAAoB,GAC5B,gBAAgB,GAChB,eAAe,GACf,iBAAiB,GACjB,uBAAuB,GACvB,qBAAqB,GACrB,kBAAkB,GAClB,uBAAuB,GACvB,yBAAyB,GACzB,iBAAiB,GACjB,gBAAgB,GAChB,gBAAgB,GAChB,oBAAoB,CAAC;AAEzB,+EAA+E;AAC/E,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IACnC,QAAQ,CAAC,EAAE,EAAE,mBAAmB,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,CAAC,MAAM,EAAE,mBAAmB,KAAK,OAAO,CAAC;AACnE,MAAM,MAAM,aAAa,GAAG,CAAC,KAAK,EAAE,mBAAmB,KAAK,OAAO,CAAC;AAEpE,MAAM,MAAM,oBAAoB,GAC5B,SAAS,GACT,aAAa,GACb,MAAM,GACN,MAAM,GACN,SAAS,GACT,mBAAmB,CAAC;AAExB,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC;AACpC,MAAM,MAAM,uBAAuB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAExE,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,kBAAkB,CAAC;IACpC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,eAAe,CAAC,EAAE,qBAAqB,CAAC;IACjD,QAAQ,CAAC,cAAc,CAAC,EAAE,oBAAoB,CAAC;IAC/C,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;IAClD,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;IACrD,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;IAC3C,QAAQ,CAAC,iBAAiB,CAAC,EAAE,uBAAuB,CAAC;IACrD,8FAA8F;IAC9F,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;CACvC,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,kBAAkB,CAAC;IACpC,QAAQ,CAAC,WAAW,CAAC,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,eAAe,CAAC,EAAE,qBAAqB,CAAC;IACjD,QAAQ,CAAC,cAAc,CAAC,EAAE,oBAAoB,CAAC;IAC/C,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;IAClD,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;IACrD,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;IAC3C,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;CACvC,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,aAAa,EAAE,mBAAmB,GAAG,kBAAkB,GAAG,SAAS,CAAC;IAC7E,QAAQ,CAAC,QAAQ,EACb,SAAS,GACT,eAAe,GACf,eAAe,GACf,kBAAkB,GAClB,cAAc,CAAC;IACnB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEF,+EAA+E;AAC/E,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,CAAC,eAAe,EAAE;QAAE,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACtF,QAAQ,CAAC,eAAe,EAAE;QACxB,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;QACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF,QAAQ,CAAC,MAAM,EAAE;QACf,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;QACjC,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;KACtC,CAAC;IACF,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC;IACvC,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC;IACrC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG,MAAM,oBAAoB,CAAC;AAE/D,gGAAgG;AAChG,MAAM,MAAM,cAAc,GAAG,oBAAoB,GAAG;IAClD,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;CAChC,GAAG;IACF,QAAQ,EAAE,CAAC,IAAI,QAAQ,mBAAmB,EAAE,GAAG,CAAC,SAAS,QAAQ,MAAM,CAAC,EAAE,GACtE,CAAC,SAAS,mBAAmB,GAC3B,kBAAkB,CAAC,CAAC,CAAC,GACrB,KAAK,GACP,KAAK;CACV,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG,MAAM,cAAc,CAAC;AAEnD,MAAM,MAAM,kBAAkB,CAAC,CAAC,SAAS,eAAe,IAAI,CAC1D,KAAK,EAAE,cAAc,CAAC,CAAC,CAAC,KACrB,CAAC,SAAS,QAAQ,MAAM,CAAC,EAAE,GAC5B,CAAC,SAAS,mBAAmB,GAC3B,mBAAmB,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,GACxD,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC,GAC9C,IAAI,CAAC;AAET,kFAAkF;AAClF,MAAM,MAAM,cAAc,GAAG,cAAc,CAAC;AAC5C,mFAAmF;AACnF,MAAM,MAAM,eAAe,GAAG,eAAe,CAAC;AAC9C,sFAAsF;AACtF,MAAM,MAAM,kBAAkB,CAAC,CAAC,SAAS,eAAe,IAAI,kBAAkB,CAAC,CAAC,CAAC,CAAC;AAElF,MAAM,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC"}

package/dist/runtime/launch-arguments.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Flag/value launch-argument pairs shared by the adapters' shell commands and the
+ * foreground `elwood interactive` spawn, so one mapping serves both launch paths.
+ * Implements PRD §4.2 and §12A.9.
+ */
+/** One agent argument: a flag or bare word followed by its value. */
+export type LaunchArgument = readonly [flag: string, value: string];
+/** The argv form for a direct `spawn` (no shell, nothing quoted). */
+export declare function launchArgv(args: readonly LaunchArgument[]): readonly string[];
+/** The login-shell form: flags stay bare, every value is single-quoted. */
+export declare function launchShellWords(args: readonly LaunchArgument[]): readonly string[];
+//# sourceMappingURL=launch-arguments.d.ts.map

package/dist/runtime/launch-arguments.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"launch-arguments.d.ts","sourceRoot":"","sources":["../../src/runtime/launch-arguments.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,qEAAqE;AACrE,MAAM,MAAM,cAAc,GAAG,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AAEpE,qEAAqE;AACrE,wBAAgB,UAAU,CAAC,IAAI,EAAE,SAAS,cAAc,EAAE,GAAG,SAAS,MAAM,EAAE,CAE7E;AAED,2EAA2E;AAC3E,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,cAAc,EAAE,GAAG,SAAS,MAAM,EAAE,CAEnF"}

package/dist/runtime/launch-arguments.js

@@ -0,0 +1,15 @@
+/**
+ * Flag/value launch-argument pairs shared by the adapters' shell commands and the
+ * foreground `elwood interactive` spawn, so one mapping serves both launch paths.
+ * Implements PRD §4.2 and §12A.9.
+ */
+import { shellQuote } from "./shell.js";
+/** The argv form for a direct `spawn` (no shell, nothing quoted). */
+export function launchArgv(args) {
+    return args.flatMap((argument) => [argument[0], argument[1]]);
+}
+/** The login-shell form: flags stay bare, every value is single-quoted. */
+export function launchShellWords(args) {
+    return args.map((argument) => `${argument[0]} ${shellQuote(argument[1])}`);
+}
+//# sourceMappingURL=launch-arguments.js.map

package/dist/runtime/launch-arguments.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"launch-arguments.js","sourceRoot":"","sources":["../../src/runtime/launch-arguments.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAKxC,qEAAqE;AACrE,MAAM,UAAU,UAAU,CAAC,IAA+B;IACxD,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,gBAAgB,CAAC,IAA+B;IAC9D,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAC7E,CAAC"}

package/docs/cli-behavior.md

@@ -191,6 +191,46 @@ select a destructive-rider affirmative, and never answer a specific-affirmative
 prompt (e.g. hook trust) with a generic "Yes". `src/core/trust/responder.ts`,
 `src/core/trust/prompts.ts`, verified by `tests/e2e/trust-prompt-claude.e2e.ts`.
 
+### Bypass-permissions acceptance dialog (`--high-trust`)
+
+Claude Code carries a one-time disclaimer for bypass mode. Its wording, taken
+from the 2.1.268 binary (it is not in the public docs), is:
+
+```
+WARNING: Claude Code running in Bypass Permissions mode
+In Bypass Permissions mode, Claude Code will not ask for your approval before running potentially dangerous commands.
+By proceeding, you accept all responsibility for actions taken while running in Bypass Permissions mode.
+  Yes, I accept
+  No, exit
+```
+
+The acceptance is persisted in Claude's global config as
+`bypassPermissionsModeAccepted` (the binary describes it as "Whether the user has
+accepted the bypass permissions mode dialog"), and `--bg` refuses bypass mode
+until it has been accepted once interactively, so the dialog is at most
+once-per-machine. **Empirically, on 2.1.268 (Claude Max account, macOS) the
+dialog did NOT render at all** — neither through Elwood's `--permission-mode
+bypassPermissions` launch nor with a raw `--dangerously-skip-permissions`
+launch — and no `bypassPermissionsModeAccepted` key existed anywhere under
+`~/.claude*`; the session went straight to the composer with the persistent
+`⏵⏵ bypass permissions on (shift+tab to cycle)` footer. Whether it appears is
+therefore version/account-gated, and Elwood must be correct in BOTH states:
+
+- The dialog is an allowlisted trust prompt (`bypass_permissions`), answered
+  under `autotrust` by the same header-anchored, numbered-or-cursor machinery as
+  folder trust. The header pattern anchors on `running in Bypass Permissions
+  mode` so the always-present `bypass permissions on` footer can never match, and
+  the affirmative matcher is specific to `Yes, I accept` (never a generic yes).
+- When the dialog does not render, nothing is written and the session simply
+  reaches `ready`; `tests/e2e/high-trust.e2e.ts` asserts a `bypass_permissions`
+  `startup_prompt` exactly when the dialog was seen, and logs which case ran.
+- The folder-trust gate still renders first under bypass mode (see above), so a
+  fresh temp workspace answers `workspace_trust` and then, if shown, the
+  disclaimer.
+- `--dangerously-skip-permissions cannot be used with root/sudo privileges for
+  security reasons` is the CLI's own refusal; Elwood does not special-case it —
+  it surfaces as the ordinary start failure with the CLI's message.
+
 **Do not equate `autotrust` with “not blocking” until the write clears the real
 screen.** Trust rules are omitted from human-blocking classification under
 `autotrust`, because automation owns the gate. If option parsing drifts and writes
@@ -404,6 +444,54 @@ Verified manually in a real PTY with successful headed turns on Codex 0.153.4 an
 Claude 2.1.261, including terminal restoration and clean JSON terminal records.
 C-CLI-18/C-CODEX-12.
 
+## Interactive mode, session listing, and model listing
+
+`elwood interactive` is the one command that does NOT drive the interactive TUI
+through Elwood: it spawns `claude`/`codex` directly with inherited stdio and the
+adapters' shared launch-argument builders, so every dialog the headless path
+automates is the user's to answer. Verified in a real PTY on Claude 2.1.268 and
+Codex 0.153.4:
+
+- Codex shows its in-TUI update prompt first, then the directory-trust prompt
+  ("Do you trust the contents of this directory?"), before the `›` composer. A
+  PTY driver must answer both (Skip = `2`, Yes = `1`) before the composer
+  appears; answering `2` to the trust prompt ("No, quit") exits 0. Codex draws
+  words with cursor moves, so match dialog text with `\s*` between words. A
+  typed `/quit` + Enter did not end the idle Codex TUI within 10s; its idle
+  double Ctrl-C did (status 0), so the e2e driver quits Codex that way.
+- Claude in a fresh temp directory went straight to the `❯` composer here, and
+  `/exit` returned 0. The footer's "don't ask on" came from the user's own
+  `~/.claude/settings.json` `permissions.defaultMode`, not from Elwood: with no
+  configured posture Elwood passes no `--permission-mode` (source `built-in` is
+  omitted), which is exactly the direct-launch experience.
+- `elwood interactive <id>` after a headless `--keep` run reopened the prior
+  conversation (the kept prompt and answer were on screen) via
+  `claude --resume <conversation id>` in the stored workspace, and Claude
+  printed its own "Resume this session with: claude --resume …" on exit. The
+  Elwood record's `lastUsedAt` did not change, confirming no state writes.
+- A stored headless session carries `permissionMode: dontAsk`, so an interactive
+  resume of it runs Claude in don't-ask mode until `--claude-permission-mode`
+  overrides it (documented in the README).
+
+`elwood models` reuses the headless facade plus `CliLifecycle`, so timeout,
+SIGINT, blocked prompts, and teardown behave as for a run. Real Claude lists
+five rows in ~6s; real Codex six rows in ~5s. Two environment facts matter:
+
+- When Elwood itself runs nested inside a Claude Code session (`CLAUDECODE` and
+  `CLAUDE_CODE_*` set), claude >= 2.1.201 skips transcript persistence for the
+  nested instance; a headless run then fails `wait_timeout` ("transcript did not
+  catch up after ready") and floods `transcript_read_error (ENOENT)`. The e2e
+  helper strips those variables; do the same for manual smoke runs.
+- Even outside nesting, one `transcript_read_error (ENOENT)` warning appears at
+  Claude startup before the first turn creates the transcript file. It is
+  pre-existing run behavior, not specific to `models`.
+
+`elwood sessions` reports `live` from the presence of a `.sock` file in the
+session's stable socket home. A connect probe was rejected on purpose: the
+bridge treats any connection that closes without a frame as a malformed request
+and emits `hookError`/`activity` on the live owner, so presence is the only
+side-effect-free signal. C-CLI-21 through C-CLI-24.
+
 ## Testing against the real CLIs
 
 - `test:e2e` runs **serially** (`--test-concurrency=1`): Codex config-file

package/docs/cli-output.md

@@ -79,6 +79,66 @@ share `toolCallId` when the agent supplies one:
 JSONL warning records stay on stdout so the machine protocol remains ordered;
 text and JSON runs surface warnings on stderr.
 
+## Session and model listings
+
+`elwood sessions` and `elwood models` accept `--output text` (default) or
+`--output json`; JSONL is not a listing protocol. Both emit exactly one document
+in JSON mode, and `sessions` never starts an agent:
+
+```json
+{
+  "schemaVersion": 1,
+  "type": "sessions",
+  "stateDir": "/Users/me/.local/state/elwood",
+  "sessions": [
+    {
+      "id": "6f0c2c1e-3f1a-4d2b-9c6e-1f2a3b4c5d6e",
+      "agent": "codex",
+      "cwd": "/Users/me/project",
+      "createdAt": "2026-09-10T18:21:04.512Z",
+      "lastUsedAt": "2026-09-10T18:24:39.001Z",
+      "resumable": true,
+      "live": false
+    }
+  ]
+}
+```
+
+`live` means a launch's bridge socket file is present; it is a cheap presence
+check, so a force-killed owner can leave a stale "live" until the session is
+next started or torn down. An empty state directory yields an empty `sessions`
+array (text mode prints a notice on stderr and nothing on stdout). Unreadable
+records are skipped with one stderr warning each.
+
+`elwood models` starts the agent briefly to read its own model picker, then
+tears the session down:
+
+```json
+{
+  "schemaVersion": 1,
+  "type": "models",
+  "agent": "claude",
+  "models": [
+    { "id": "opus", "label": "Opus", "description": "…", "isCurrent": true, "isDefault": false, "raw": "…" },
+    { "id": "sonnet", "label": "Sonnet", "description": "…", "isCurrent": false, "isDefault": true, "raw": "…" }
+  ]
+}
+```
+
+Failures use the same `error` document and statuses as a run. Useful recipes:
+
+```sh
+id=$(elwood sessions --output json | jq -r '.sessions[0].id')
+elwood resume "$id" --output json "Summarize what we decided" | jq -er .response
+elwood models --agent codex --output json | jq -r '.models[] | select(.isDefault) | .id'
+```
+
+`elwood resume <id> [prompt...]` is exactly `elwood run --resume <id>`; the
+stored agent and workspace apply, and piped stdin composes with positional words
+the same way. `elwood interactive [id]` is not scriptable: it requires a terminal
+on stdin and stdout, hands the terminal to the agent's own TUI, writes no
+protocol to stdout, and exits with the agent's exit status.
+
 ## Exit codes
 
 | Status | Meaning |